Key management methods, node, system and storage medium

Abstract

Provided in the present application are key management methods, a node, a system and a storage medium. A key management method comprises: sending a key configuration request to a second node by means of a key agent (110); receiving key configuration information issued by the second node, and synchronizing the key configuration information to a key database (120); and sending an encrypted message to a third node, the message carrying the key configuration information (130).

Description

Key management method, node, system and storage medium TECHNICAL FIELD

[0001] The present application relates to the technical field of wireless communication, for example, to a key management method, node, system and storage medium. BACKGROUND

[0002] With the deployment demand of large-scale high performance computing (HPC) and artificial intelligence (AI) / machine learning (ML), traditional point-to-point encryption protocols such as transport layer security (TLS) and internet protocol security (IPSec) have the problem of large-scale key session state maintenance, which leads to deployment difficulties. In order to reduce the storage capacity consumption problem caused by key state maintenance, the PSP security protocol is simplified on the basis of traditional IPSec and medium access control security (MACsec), mainly reflected in the use of key derivation function to derive security key on the receiving side. However, PSP cannot effectively cope with the sender state expansion problem of large-scale deployment.

[0003] The UEC transport layer security protocol (UET Security Protocol, USP) of the ultra ethernet transport (UET) security transmission protocol further simplifies the PSP, adopts the concept of security domain, realizes key security and source independence, and further realizes the support for scalability. However, there is no solution for centralized management of USP security keys. SUMMARY

[0004] The present application provides a key management method, node, system and storage medium.

[0005] The present application provides a key management method, node, system and storage medium.

[0006] The embodiment of the present application further provides a key management method, applied to a second node, comprising: receiving a key configuration request sent by a first node through a key proxy; according to the key configuration request, issuing key configuration information to the first node, wherein the key configuration information is synchronized to a key database by the first node and is carried in an encrypted message sent by the first node to a third node.

[0007] The embodiment of the present application further provides a first node, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the key management method applied to the first node when executing the program.

[0008] The embodiment of the present application further provides a second node, comprising: a memory and one or more processors; the memory is configured to store one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the key management method applied to the second node.

[0009] The embodiment of the present application further provides a key management system, comprising the first node and the second node.

[0010] The embodiment of the present application further provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the program is executed by a processor to implement the key management method. BRIEF DESCRIPTION OF DRAWINGS

[0011] Fig. 1 is a flow chart of a key management method according to an embodiment;

[0012] Fig. 2 is a flow chart of another key management method according to an embodiment;

[0013] Fig. 3 is a schematic diagram of a key management process according to an embodiment;

[0014] Fig. 4 is a schematic diagram of a key application process in a P2P mode according to an embodiment;

[0015] Fig. 5 is a schematic diagram of a key scheduling update process in a P2P mode according to an embodiment;

[0016] Fig. 6 is a schematic diagram of a key update process when a security domain member leaves in a P2P mode according to an embodiment;

[0017] Fig. 7 is a schematic diagram of a key application process in a C / S mode according to an embodiment;

[0018] Fig. 8 is a schematic diagram of a key update process in a C / S mode according to an embodiment;

[0019] FIG. 9 is a structural diagram of a key management device according to an embodiment;

[0020] FIG. 10 is a structural diagram of another key management device according to an embodiment;

[0021] FIG. 11 is a structural diagram of a first node according to an embodiment;

[0022] FIG. 12 is a structural diagram of a second node according to an embodiment;

[0023] FIG. 13 is a structural diagram of a key management system according to an embodiment. DETAILED DESCRIPTION

[0024] The present application will be described below in conjunction with the accompanying drawings and embodiments. The embodiments in the present application and the features in the embodiments can be combined with each other arbitrarily without conflict.

[0025] Ultra-Ethernet Transport (UET) is a new transport protocol designed to handle the most challenging application scales, reliably deliver packets, provide secure data transfer, and avoid network congestion. By leveraging semantics and reliability technologies in HPC to address the shortcomings of RDMA over Converged Ethernet version 2 (RoCEv2), UET achieves extreme scale and provides effective packet congestion management.

[0026] UET can be divided into three sub-layers according to functions:

[0027] The UET semantic sublayer (SES) defines a series of operations such as sending, receiving, writing, and reading. The semantic layer provides optional message ordering and various optional initiator or target completion notifications. Its goal is to provide high-performance, highly scalable operations to support specialized AI and full-featured HPC deployments. The semantic layer is responsible for connecting user-level software APIs and the packet delivery sublayer (PDS). UET allows the sending end to call Libfabric to implement its operations.

[0028] The UET packet delivery sublayer PDS supports reliability and congestion management functions. The PDS is responsible for providing reliable packet delivery, including packet ordering and selective retransmission. Congestion management functions include transmission rate control and adaptive path selection.

[0029] The UET Transport Security Sublayer (TSS), i.e., USP, provides encryption and authentication for all data payloads and most transport header options. An extensible key management scheme is adopted, without the need to maintain the security state of each key peer, simplifying the storage consumption of traditional peer-to-peer protocol (P2P) key management, and realizing the scale management requirements.

[0030] The three sub-layers of UET work together to support network extreme scale, reliable delivery of messages, secure data processing, and avoid network congestion.

[0031] Regarding the key centralized management mechanism, the traditional mechanism of TLS and IPsec uses the P2P mode key distribution processing, but the processing mechanism here is based on the establishment of a secure connection between points. For centralized management mechanisms such as controllers, quantum encryption technology can be used, and a quantum encryption proxy server can be used to modify the original IPsec traditional key to a quantum key, but for key distribution, the traditional key distribution of IKE is still used.

[0032] The present application provides a method and mechanism for implementing key management in a UEC network, which does not rely on end-to-end key connection key management mechanisms, and provides a solution for centralized key management. This key mechanism supports both P2P and C / S modes.

[0033] FIG. 1 is a flowchart of a key management method provided by an embodiment, which can be applied to a first node, which can be a message sending end or a key configuration end. As shown in FIG. 1, the method provided by the embodiment includes:

[0034] In 110, a key configuration request is sent to a second node through a key proxy.

[0035] In 120, key configuration information issued by the second node is received, and the key configuration information is synchronized to a key database.

[0036] In 130, an encrypted message is sent to a third node, and the message carries the key configuration information.

[0037] In an embodiment, the key configuration information includes at least one of the following: a security domain identifier, a security source identifier, and security identifier association information.

[0038] In an embodiment, the method further includes generating a key based on a set key algorithm and a key generation strategy through the key database, and encrypting and authenticating the message.

[0039] In an embodiment, the method further comprises: obtaining a service resource identifier and a service instance identifier in a service initialization process, and determining a security domain associated with the service resource identifier and the service instance identifier; configuring a key algorithm and a key mode through a key proxy; the key mode comprises at least one of the following: a peer-to-peer mode, a client / server mode.

[0040] In the embodiment, the key configuration is issued after the completion of the service initialization process, the service resource ID and the service instance ID of a user are obtained by using an initialization service, and the user security domain is bound. On this basis, the service, the resource and the security domain can be associated, and the safe and effective forwarding of the message can be realized, wherein the service can refer to a service instance, the resource can refer to a bottom queue resource, and the security domain can refer to a trusted domain in which the service message is transmitted.

[0041] In an embodiment, before the encrypted message is sent to the third node, the method further comprises: associating a service transmission channel through a semantic sublayer; encapsulating the message through a packet delivery sublayer; taking the service application layer information as a payload of the message; and encrypting the message through a security sublayer.

[0042] In an embodiment, the method further comprises: in a case where a key update condition is met or a security domain member leaves the security domain, reporting a key state notification through the key database; the key state notification comprises transmission and reception statistical information of the message in a specified key state.

[0043] In an embodiment, the method further comprises: in a case where the key update instruction of the second node is received, updating the key configuration information; sending the key update instruction to the key database, the key update instruction being used to instruct the key database to update the key; and receiving a first confirmation message sent by the key database in a case where the key update is completed.

[0044] In an embodiment, the method further comprises: in a case where the domain leaving request of the security domain member is received, sending a domain leaving request to the second node; in a case where the leaving instruction of the second node is received, updating the local service service instance, the service allocation resource identifier, and the security identifier associated information; and sending a second confirmation message to the second node.

[0045] In an embodiment, the method further comprises: issuing a key deletion instruction to the key database, the key deletion instruction being used to instruct the key database to delete the key; and receiving a third confirmation message sent by the key database in a case where the key deletion is completed.

[0046] FIG. 2 is a flowchart of a key management method provided by an embodiment, which can be applied to a second node, which can be a key management entity. As shown in FIG. 2, the method provided by the embodiment includes 210 and 220.

[0047] In 210, a key configuration request sent by a first node through a key proxy is received.

[0048] In 220, key configuration information is issued to the first node according to the key configuration request, the key configuration information is synchronized to a key database by the first node, and is carried in an encrypted message sent by the first node to a third node.

[0049] In an embodiment, the key configuration information includes at least one of the following: a security domain identifier, a security source identifier, and security association number information.

[0050] In an embodiment, the method further includes: receiving a key state notification reported by the first node through the key database; the key state notification includes transmission and reception statistics information of a message in a specified key state; and sending a key update instruction to the first node in a case where the key state notification satisfies a key update condition.

[0051] In an embodiment, the method further includes: receiving a first confirmation message sent by the first node in a case where the key update is completed.

[0052] In an embodiment, the method further includes: in a case where the key mode is a peer-to-peer mode, sending a key update instruction to all security domain members; and in a case where the key mode is a client / server mode, sending a key update instruction to a security domain member that satisfies a key update condition.

[0053] In an embodiment, the method further includes: receiving a domain departure request of the first node; sending a departure instruction to the first node, the departure instruction being used to instruct the first node to update local service instance, association information of a service allocation resource identifier, and a security identifier; and receiving a second confirmation message of the first node.

[0054] In an embodiment, the method further includes: receiving a third confirmation message sent by the first node in a case where the key deletion is completed by the key database.

[0055] FIG. 3 is a schematic diagram of a key management process according to an embodiment. As shown in FIG. 3, the key management process adopts a centralized key management mechanism architecture. When a user applies for a service, the user can apply for information of a security key (such as a security-related parameter) associated with the service through a key agent function of a first node (a sending end). The key agent applies for information such as a security domain and a security identifier corresponding to the user service to a second node (a key management, i.e., a key management entity). The key management returns corresponding security-related parameters. The key agent synchronizes the security information related to the user service to a key database. The key database parses the security-related parameters such as the security domain and the security identifier information issued by the key management, encrypts information of the security key using a key algorithm, performs message authentication after the encryption is completed, and sends the message to a third node (a receiving end). The channel between the sending end and the receiving end can be a virtual extended local area network (VXLAN) or other tunnels. The receiving end receives the message, performs message decryption according to the security-related parameters such as the security domain and the security identifier carried in the message, and sends the message to a destination user after the decryption and authentication are passed.

[0056] Based on the security implementation of the UEC, the embodiment of the present application proposes a key management method applicable to P2P end-to-end and C / S mode, adopts a centralized key management architecture, and involves key application, key update, and key deletion processes.

[0057] The process of key application of a communication node (i.e., the sending end or the receiving end in FIG. 3, which can also be referred to as a network node) is mainly as follows:

[0058] 1) After receiving a service initialization requirement, the key agent performs default security configuration of a service instance, including a key algorithm and a key mode (such as a P2P or C / S mode).

[0059] 2) The key agent sends a key configuration request to the key management entity through a specific security channel between the key agent and the key management entity. The key management entity issues information such as a security domain identifier, a security source identifier, and a security association number corresponding to the service application.

[0060] 3) The key agent creates a service instance of the service, and binds the service to a resource identifier and the security domain identifier.

[0061] 4) The key agent sends the key configuration parameters sent by the key management entity to the key database through a privileged channel, and completes encryption and authentication of the message using a specific key algorithm and a key generation strategy.

[0062] The communication node needs to perform key update when reaching the upper limit of key schedule update or a security domain member leaves the security domain, and the process of key update mainly includes the following steps:

[0063] 1) The key database reports the key state notification to the key agent through a privileged channel. The key state notification mainly includes the statistics of the transmission and reception of service packets in this key state.

[0064] 2) The key management entity checks the key state notification reported by the security domain member, and if the packet transmission and reception statistics of a security domain member device in the corresponding security key state reaches the threshold value, it indicates that the device needs to perform key update. Further, the key management can perform different processing according to different key modes:

[0065] If the working mode between the security domain members is P2P, the key management entity notifies all members in the security domain to perform key update, and the key update is completed by the key management entity issuing new keys. After receiving the new keys, the member devices in the security domain complete the key update within a certain time. When performing key update, a key update mechanism is needed to notify the members of the key update and ensure that the key update is completed within a certain period of time; if the working mode between the security domain members is C / S, the key management entity only issues key update processing instructions to the client whose key state reaches the update threshold in the security domain, and the key configuration of other client members is not affected.

[0066] 3) The key management entity receives the key update instruction, updates the binding relationship between the local service instance, the service allocation resource identifier, and the security domain identifier. And notifies the key update instruction to the key database through the privileged channel. The key database completes the key update and returns the confirmation mechanism to the key agent and the key management entity.

[0067] When leaving the security domain, the communication node needs to perform key deletion and key update, and the process of key deletion and key update mainly includes the following steps:

[0068] 1) The security domain member sends a domain leaving request to the key agent, and the key agent sends the request to the key management entity.

[0069] 2) After receiving the request, the key management entity issues a key member leaving instruction. After receiving the instruction, the key agent updates the binding relationship between the local service instance, the service allocation resource identifier, and the security domain identifier, and issues a command to the key database for processing.

[0070] 3) After the key database completes the key deletion, it returns the confirmation mechanism to the key agent and the key management entity.

[0071] 4) The key management entity issues a new key instruction to other members of the security domain and requires the key update to be completed within a certain time. If the security domain mode is C / S mode, this operation is not involved.

[0072] The key management method of the present application is exemplarily described below through some embodiments.

[0073] Embodiment One

[0074] In this embodiment, as shown in FIG. 4, the key application process in P2P mode mainly includes:

[0075] One, the first node (the sending end) carries the service requirement to the key proxy function to apply for providing the security service.

[0076] Two, after receiving the request of the sending end, the key proxy realizes the initialization configuration of the user service through the privileged channel. The configuration here mainly refers to the security related parameter configuration, such as the security default parameter encryption algorithm, etc.

[0077] Three, the key proxy applies for the security initialization configuration to the second node (the key management entity), including the security parameter security domain identifier, the security source identifier, and the security association number information. The key management entity (which can also be called the security domain management entity) can be in the form of a controller or a third party management entity.

[0078] Four, the key management entity issues the corresponding security parameter security domain identifier, security source identifier, and security association number information to the key proxy, and the key proxy establishes the association between the user service application and the service task, the network resource identifier, and the security domain identifier.

[0079] Five, the key proxy constructs the business task through the privileged channel, transmits the related business information to the node transmission layer, and transmits the applied security parameter configuration information to the key database. In the UEC business scenario, the message reaches the semantic sublayer to perform the business transmission channel association; after the message reaches the packet delivery sublayer, the business message is encapsulated, and the business application layer information is transmitted as the message payload to the security sublayer.

[0080] Six, after receiving the message from the packet delivery sublayer, the security sublayer searches the security domain identifier and the security association number information. If it is found that the information does not match, the incoming message is discarded, and an error message is returned; if it is found that the information matches successfully, the security function processing is realized, such as the key encryption algorithm and the encryption mode information, to realize the authentication and encryption processing of the application layer and the transmission layer encapsulated message.

[0081] Seven, the security sublayer forwards the encrypted and authenticated message to the third node (the receiving end).

[0082] In this embodiment, the key update of P2P mode can involve two cases: (1) key schedule update, the upper limit of schedule update refers to that the number of messages sent and received by a security domain member in a certain key state reaches the threshold of updating the key, and then the key update is needed; (2) security domain member leaves update. Considering that the members in the domain are aware of the key information, there can be an attack risk after leaving, and therefore, in the case of a security domain member leaving, the key management entity needs to uniformly update the keys of the entire security domain.

[0083] As shown in FIG. 5, the key schedule update process of P2P mode mainly includes:

[0084] One, the sending end reports the key state notification. The key state notification refers to the message sending and receiving statistics in this key state. If the message sending and receiving statistics of a security domain member device in this security key state reaches the threshold, it means that the member device needs to update the key. The key database of the sending end reports the key state notification to the key agent through a privileged channel.

[0085] Two, the key agent reports the key state notification of the sending end to the key management through the interface channel between the key management. After receiving the key state notification, the key management performs message sending and receiving statistics verification, and if the verification value reaches the upper limit of the schedule, it uniformly issues a new key to all member devices in the security domain.

[0086] Three, the key management issues a key state update request to all member devices in the security domain. After the key state update, the key agent function needs to update the key information: the binding relationship of SDI, AN and service resources.

[0087] The member device security database needs to update its key configuration.

[0088] Four, after all member devices in the security domain update the key configuration, they reply to the key change completion notification, report the key state notification to the key agent through a privileged channel, and the key agent reports the key state change completion notification to the key management through the interface channel between the key management.

[0089] As shown in FIG. 6, the key update process of the security domain member leaving of P2P mode mainly includes:

[0090] One, the sending end member device sends a leaving security notification request. And through the channel between the key management, it sends the notification to the key management.

[0091] Two, the key management sends a reply to remove this security domain member, and the sending end key agent updates the binding relationship between the task resources and the security domain. The sending end member device removes the security domain, and replies to the removal completion notification.

[0092] Three, the key management entity sends key state update notification to other members in the domain, uniform key parameter update. The key agent completes the binding relationship between the resource and the security domain, the security database completes the update of the key configuration parameters. And after completing the key update, reply confirmation information to the key management.

[0093] Embodiment two

[0094] In this embodiment, as shown in Figure 7, the key application process of C / S mode mainly includes:

[0095] One, the first node (client) carries the business demand to the key agent, and applies to provide security service.

[0096] Two, the key agent function realizes the initialization configuration of the user service through the privileged channel after receiving the client request. The configuration here mainly refers to the security related parameter configuration, such as: security default encryption algorithm, etc.

[0097] Three, the key agent function applies for security initialization configuration to the second node (key management entity), including security parameter security domain identifier, security source identifier, and association number information. Here, the key management needs to know the client information for C-S operation mode.

[0098] Four, the key management entity issues the corresponding security parameter security domain identifier, security source identifier, and association number information to the key agent. And the key agent establishes the association between the user service business application and the service task, the network resource identifier, and the security domain identifier.

[0099] Five, through the key agent privileged channel, the business task is constructed, the business information is transmitted to the node transmission layer, and the security parameter configuration information applied is transmitted to the key database. In the UEC business scenario, the message reaches the semantic sublayer to associate the business transmission channel; after the message reaches the packet delivery sublayer, the business message is encapsulated, and the business application layer information is transmitted as the message payload to the security sublayer.

[0100] Six, the security sublayer receives the message from the packet delivery sublayer, retrieves the security domain identifier and the association number information, and if the information is found to be mismatched, the incoming message is discarded, and an error message is returned. If the information is found to be matched successfully, the security function processing is implemented, such as key encryption algorithm, C / S encryption mode, etc. security policy, to realize the authentication and encryption processing of the application layer and the transmission layer encapsulated message.

[0101] Seven, the security sublayer forwards the encrypted and authenticated message to the third node (server). The server will query the security domain key database, obtain the corresponding key and encryption parameter according to the security domain identifier and the association number information, and verify and decrypt the data packet.

[0102] In the client-server encryption mode, the client and the server need to consider the mode of key derivation, and the keys generated by different modes of key derivation are different. The configuration of the key derivation is sent to the key agent by the key management, and the key agent sends the key database processing to the client and the server.

[0103] After the server receives the encrypted message from the client, key verification is needed. If it is found that the information of the incoming message does not match the pre-prepared security parameters, that is, the corresponding entry cannot be found in the security domain key database, or the association number is invalid, the data packet will be discarded, and the corresponding error counter will be recorded. If it is found that the information matches successfully, the security authentication is passed and the message decryption processing is performed, and the incoming message statistical record is updated.

[0104] As shown in FIG. 8, the key update process of the C / S mode mainly includes:

[0105] First, the key management entity completes the configuration of the key information to the server end.

[0106] Second, the client device regularly reports its client key state, and the client key state refers to the message transmission and reception statistics in this key state. If the message transmission and reception statistics of a client device reach the threshold in this security key state, it means that the device needs to update the key.

[0107] Third, the server end device checks the client key state, and if the threshold is reached, the server issues a key update notification to the client device. The key update notification only applies to this client device and has no effect on the key state of other client devices in the security domain.

[0108] Fourth, if the client device leaves the original security domain, the server end issues a security domain member removal notification to the client device, which has no effect on other client devices in the domain.

[0109] The centralized key management architecture and implementation mechanism provided by the embodiments of the present application adopts a security domain concept, and realizes the joining or leaving of a security domain member, key parameter distribution, and key update processing through key management, key proxy, and key database functions, and supports point-to-point (P2P) and client / server (C / S) two-mode key management. The key management includes key application, key update, and key deletion. The key application mechanism adopts an initialization service to bind a user service resource and a user security domain binding policy, realizes key management-key proxy-key database key configuration, and realizes encryption processing on a user service message through a key algorithm and an encryption policy application. The key update mechanism is realized based on key state statistics (transmission and reception service message statistics in a corresponding key state), and in order to maintain key effectiveness, a unified key update instruction can be safely managed and issued to all security domain members, and after a security domain member completes new key configuration, key update of all domain members is completed within a certain time. The key proxy needs to change a service instance of this security domain member, and the binding relationship between a service resource identifier and a security domain identifier is different from the point-to-point mode. In the client / server mode, the key update is issued to the client member by the server. The key deletion mechanism is triggered based on a security domain member leaving operation. In the point-to-point mode, key update of other domain members needs to be performed after the security domain member key is deleted. In the client / server mode, the key update operation is not needed.

[0110] The embodiments of the present application further provide a key management device. FIG. 9 is a structural schematic diagram of a key management device provided by an embodiment. As shown in FIG. 9, the key management device includes: a request module 310, configured to send a key configuration request to a second node through a key proxy; a receiving module 320, configured to receive key configuration information issued by the second node, and synchronize the key configuration information to a key database; and a sending module 330, configured to send an encrypted message to a third node, wherein the message carries the key configuration information.

[0111] In an embodiment, the key configuration information includes at least one of the following: a security domain identifier, a security source identifier, and security identifier association information.

[0112] In an embodiment, the device further includes an encryption module, configured to generate a key based on a set key algorithm and a key generation strategy through the key database, and encrypt and authenticate the message.

[0113] In an embodiment, the apparatus further comprises: an initialization module configured to obtain a service resource identifier and a service instance identifier in a service initialization process, and determine a security domain associated with the service resource identifier and the service instance identifier; and a configuration module configured to configure a key algorithm and a key mode by a key proxy, wherein the key mode comprises at least one of: a peer-to-peer mode, and a client / server mode.

[0114] In an embodiment, before sending the encrypted message to the third node, the apparatus further comprises: a processing module configured to: associate a service transmission channel by a semantic sublayer; encapsulate the message by a packet delivery sublayer; take service application layer information as a payload of the message; and encrypt the message by a security sublayer.

[0115] In an embodiment, the apparatus further comprises: a reporting module configured to report a key state notification to the key database when a key update condition is met or a security domain member leaves the security domain, wherein the key state notification comprises transmission and reception statistics information of the message in a specified key state.

[0116] In an embodiment, the apparatus further comprises: an updating module configured to update the key configuration information when a key update instruction of the second node is received; an instruction sending module configured to send the key update instruction to the key database, wherein the key update instruction is used to instruct the key database to update a key; and a first confirmation module configured to receive a first confirmation message sent by the key database when the key update is completed.

[0117] In an embodiment, the apparatus further comprises: a leaving request module configured to send a domain leaving request to the second node when a domain leaving request of a security domain member is received; an updating module configured to update local service service instance, service allocation resource identifier, and security identifier association information when a leaving instruction of the second node is received; and a second confirmation module configured to send a second confirmation message to the second node.

[0118] In an embodiment, the apparatus further comprises: a deleting module configured to send a key deletion instruction to the key database, wherein the key deletion instruction is used to instruct the key database to delete a key; and a third confirmation module configured to receive a third confirmation message sent by the key database when the key deletion is completed.

[0119] The key management apparatus of the embodiment belongs to the same concept as the key management method of the above-mentioned embodiments, and the technical details not described in detail in the embodiment can be referred to any of the above-mentioned embodiments, and the embodiment has the same effect as performing the key management method.

[0120] The embodiment of the present application further provides a key management device. Fig. 10 is a structural schematic diagram of a key management device according to an embodiment. As shown in Fig. 10, the key management device comprises: a receiving module 410 configured to receive a key configuration request sent by a first node through a key proxy; and an issuing module 420 configured to issue key configuration information to the first node according to the key configuration request, wherein the key configuration information is synchronized to a key database by the first node and is carried in an encrypted message sent by the first node to a third node.

[0121] In an embodiment, the key configuration information comprises at least one of the following: a security domain identifier, a security source identifier, and security association number information.

[0122] In an embodiment, the device further comprises: a notification receiving module configured to receive a key state notification reported by the first node through the key database; the key state notification comprises transmission and reception statistical information of a message in a specified key state; and an updating module configured to send a key updating instruction to the first node if the key state notification meets a key updating condition.

[0123] In an embodiment, the device further comprises: a first confirmation module configured to receive a first confirmation message sent by the first node if the key updating is completed.

[0124] In an embodiment, the device further comprises: an updating module configured to send a key updating instruction to all security domain members if the key mode is a peer-to-peer mode, and to send a key updating instruction to the security domain members meeting the key updating condition if the key mode is a client / server mode.

[0125] In an embodiment, the device further comprises: a request receiving module configured to receive a domain departure request of the first node; an instruction sending module configured to send a departure instruction to the first node, wherein the departure instruction is used to instruct the first node to update a local service instance, a service allocation resource identifier, and security identifier association information; and a second confirmation module configured to receive a second confirmation message of the first node.

[0126] In an embodiment, the device further comprises: a third confirmation module configured to receive a third confirmation message sent by the first node if the key database completes the key deletion.

[0127] The key management device provided by the embodiment belongs to the same concept as the key management method provided by the above-mentioned embodiments, and the technical details not described in the embodiment can be referred to any of the above-mentioned embodiments, and the embodiment has the same effect as performing the key management method.

[0128] The embodiment of the present application further provides a first node. Fig. 11 is a schematic diagram of a hardware structure of a first node according to an embodiment. As shown in Fig. 11, the first node provided by the present application comprises a processor 510 and a memory 520. The processor 510 in the first node can be one or more, and Fig. 11 takes one processor 510 as an example. The memory 520 is configured to store one or more programs. The one or more programs are executed by the one or more processors 510, so that the one or more processors 510 implement the key management method according to the embodiments of the present application.

[0129] The first node further comprises a communication device 530, an input device 540 and an output device 550.

[0130] The processor 510, the memory 520, the communication device 530, the input device 540 and the output device 550 in the first node can be connected through a bus or other means, and Fig. 11 takes the connection through the bus as an example.

[0131] The input device 540 can be used to receive input digital or character information, and generate key signal input related to user settings and function control of the first node. The output device 550 can include a display device such as a display screen.

[0132] The communication device 530 can include a receiver and a transmitter. The communication device 530 is configured to perform information receiving and transmitting communication under the control of the processor 510.

[0133] The memory 520 as a kind of computer readable storage medium can be configured to store software programs, computer executable programs and modules, such as program instructions / modules (for example, the request module 310, the receiving module 320 and the sending module 330 in the key management device) of the key management method according to the embodiments of the present application. The memory 520 can include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required by at least one function; the data storage area can store data created according to the use of the first node and the like. In addition, the memory 520 can include a high-speed random access memory, and can also include a non-volatile memory, for example, at least one magnetic disk storage device, a flash memory device or other non-volatile solid-state memory device. In some examples, the memory 520 can further include a memory remotely arranged with respect to the processor 510, and these remote memories can be connected to the first node through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0134] The second node provided by the embodiments of the present application includes a processor 610 and a memory 620. The processor 610 in the second node can be one or more, and one processor 610 is taken as an example in FIG. 12. The memory 620 is configured to store one or more programs. The one or more programs are executed by the one or more processors 610, so that the one or more processors 610 implement the key management method as described in the embodiments of the present application.

[0135] The second node further includes a communication device 630, an input device 640 and an output device 650.

[0136] The processor 610, the memory 620, the communication device 630, the input device 640 and the output device 650 in the second node can be connected through a bus or other means, and the connection through the bus is taken as an example in FIG. 12.

[0137] The input device 640 can be used to receive input digital or character information, and generate key signal input related to user settings and function control of the second node. The output device 650 can include a display device such as a display screen.

[0138] The communication device 630 can include a receiver and a transmitter. The communication device 630 is configured to perform information receiving and transmitting communication under the control of the processor 610.

[0139] The memory 620 as a kind of computer readable storage medium can be configured to store software programs, computer executable programs and modules, such as program instructions / modules (for example, the receiving module 410 and the issuing module 420 in the key management device) corresponding to the key management method described in the embodiments of the present application. The memory 620 can include a program storage area and a data storage area. The program storage area can store an operating system and application programs required by at least one function; the data storage area can store data created according to the use of the second node, and the like. In addition, the memory 620 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state memory device. In some examples, the memory 620 can further include a memory remotely arranged with respect to the processor 610, and these remote memories can be connected to the second node through a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0140] The embodiments of the present application further provide a key management system, as shown in FIG. 13, which includes the first node 10 and the second node 20 as described in any of the above embodiments.

[0141] The embodiment of the present application further provides a storage medium, which stores a computer program. The computer program is executed by a processor to implement the key management method in any of the embodiments of the present application. The method is applied to a first node, and includes: sending a key configuration request to a second node through a key agent; receiving key configuration information issued by the second node, and synchronizing the key configuration information to a key database; and sending an encrypted message to a third node, the message carrying the key configuration information. Alternatively, the method is applied to the second node, and includes: receiving a key configuration request sent by the first node through the key agent; issuing key configuration information to the first node according to the key configuration request, the key configuration information being synchronized to a key database by the first node and carried in an encrypted message sent by the first node to the third node.

[0142] The embodiment of the present application further provides a computer program product, which includes computer programs / instructions. The computer programs / instructions are executed by a processor to implement the key management method in any of the embodiments of the present application.

[0143] The computer storage medium of the embodiment of the present application can adopt any combination of one or more computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium may, for example, be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples (non-exhaustive list) of the computer readable storage medium include: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read only memory (EPROM), a flash memory, a fiber optic device, a portable CD-ROM, an optical storage device, a magnetic storage device, or any suitable combination of the above. The computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, device or apparatus.

[0144] A computer readable signal medium can include a propagated data signal with computer executable code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal can take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium can be any computer readable medium that can be involved in

[0145] The code can be transmitted in any form, including, but not limited to, radio frequency (RF) signals, digital signals, light, sound, or other media. The media can take a variety of forms, including, but not limited to, wire, cable, fiber optics, and / or wireless media. The computer program code can be implemented in any of a variety of programming languages, including, but not limited to, C, C++, Java, and / or Visual Basic, among others.

[0146] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0147] The embodiments of the present application also provide a computer program product, including computer program / instructions, which, when executed by a processor, implement the video encoding method according to any of the above embodiments.

[0148] The above description is merely illustrative of the application, and not in limitation of the application's scope since modifications can be made by those skilled in the art, now or in the future, without departing from the scope of the application.

[0149] Those skilled in the art will appreciate that the term user terminal encompasses any suitable type of wireless user device, such as a mobile phone, a portable data processing portable network browser or a vehicle mounted mobile station.

[0150] In general, the various embodiments of the application can be implemented in hardware or special purpose circuits, software, logic or any combination thereof. For example, some aspects can be implemented in hardware, while other aspects can be implemented in software that can be executed by a controller, microprocessor or other computing device, although the application is not limited thereto. The various embodiments of the application can be realized in hardware, or a combination of hardware and software, or software.

[0151] Embodiments of the application can be implemented by computer program instructions on a mobile device's data processor, for example in the processor entity, or by hardware, or by a combination of software and hardware. Computer program instructions can be in assemblies, Instruction Set Architecture (ISA), machine, machine-related, microcode, firmware, state setting data, or source code or object code written in any combination of one or more programming languages to be ultimately mapped to machine language.

[0152] Any block diagrams of logical flows of the application can represent program operations, or a logical flow of operations, or a combination of program operations and logical flows of operations. Computer program instructions can be stored on a memory. The memory can be of any suitable type and can be implemented using any suitable data storage technology, such as, but not limited to, a random access memory (RAM), a read-only memory (ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. The computer readable media can include non-transitory storage media. The data processor can be of any suitable type and can be implemented using any suitable combination of hardware and software. The data processor can be, for example, a general purpose computer, a microprocessor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or any combination thereof.

Claims

1. A key management method applied to a first node, comprising: sending, by a key agent, a key configuration request to a second node; receiving key configuration information issued by the second node and synchronizing the key configuration information to a key database; sending an encrypted message to a third node, the message carrying the key configuration information.

2. The method of claim 1, wherein, The key configuration information comprises at least one of the following: a security domain identifier, a security source identifier, and security identifier association information. 3.The method of claim 1, further comprising: generating, by the key database, a key based on a set key algorithm and a key generation strategy, and encrypting and authenticating the message. 4.The method of claim 1, further comprising: obtaining a service resource identifier and a service instance identifier in a service initialization process, and determining a security domain associated with the service resource identifier and the service instance identifier; configuring, by the key agent, a key algorithm and a key mode; the key mode comprises at least one of the following: a peer-to-peer mode, a client / server mode. 5.The method of claim 1, before sending the encrypted message to the third node, further comprising: performing service transmission channel association by a semantic sublayer; performing message encapsulation by a packet delivery sublayer; taking service application layer information as a payload of the message; encrypting the message by a security sublayer. 6.The method of claim 1, further comprising: reporting, by the key database, a key state notification in a case that a key update condition is met or a security domain member leaves the security domain; the key state notification comprises transmission and reception statistics information of the message in a specified key state. 7.The method of claim 1, further comprising: updating the key configuration information in a case that a key update instruction of the second node is received; sending the key update instruction to the key database, the key update instruction being used to instruct the key database to update a key; receiving a first confirmation message sent by the key database in a case that the key update is completed. 8.The method of claim 1, further comprising: sending a domain leave request to the second node in a case that a domain leave request of a security domain member is received; updating association information between a local service service instance and a service allocation resource identifier and association information between the local service service instance and a security identifier in a case that a leave instruction of the second node is received; sending a second confirmation message to the second node. 9.The method of claim 8, further comprising: issuing a key deletion instruction to the key database, the key deletion instruction being used to instruct the key database to delete a key; receiving a third confirmation message sent by the key database in a case that the key deletion is completed. 10.A key management method applied to a second node, comprising: receiving a key configuration request sent by a first node through a key agent; According to the key configuration request, key configuration information is issued to the first node, the key configuration information is synchronized to a key database by the first node, and is carried in an encrypted message sent by the first node to a third node.

11. The method of claim 10, wherein, The key configuration information includes at least one of the following: a security domain identifier, a security source identifier, and security association number information.

12. The method of claim 10, further comprising: receiving a key state notification reported by the first node through the key database; the key state notification including transmission and reception statistics of messages in a specified key state; in a case where the key state notification meets a key update condition, sending a key update instruction to the first node.

13. The method of claim 12, further comprising: receiving a first acknowledgement message sent by the first node in a case where the key update is completed.

14. The method of claim 10, further comprising: in a case where the key mode is a peer-to-peer mode, sending a key update instruction to all security domain members; in a case where the key mode is a client / server mode, sending a key update instruction to security domain members that meet a key update condition.

15. The method of claim 10, further comprising: receiving a domain departure request of the first node; sending a departure instruction to the first node, the departure instruction being used to instruct the first node to update association information between a local service instance and a service allocation resource identifier and association information between the local service instance and a security identifier; receiving a second acknowledgement message of the first node.

16. The method of claim 15, further comprising: receiving a third acknowledgement message sent by the first node in a case where the key database completes key deletion.

17. A first node, comprising: a memory, and at least one processor; the memory is configured to store at least one program; when the at least one program is executed by the at least one processor, the at least one processor implements the key management method of any one of claims 1-9.

18. A second node, comprising: a memory, and at least one processor; the memory is configured to store at least one program; when the at least one program is executed by the at least one processor, the at least one processor implements the key management method of any one of claims 10-16.

19. A key management system comprising: the first node of claim 17 and the second node of claim 18.

20. A computer readable storage medium storing a computer program, the program being executed by a processor to implement the key management method of any one of claims 1-16.

Images