CN115484038A

CN115484038A - Data processing method and equipment thereof

Info

Publication number: CN115484038A
Application number: CN202110604350.9A
Authority: CN
Inventors: 江伟玉; 张道德; 刘冰洋; 杨飞
Original assignee: Huawei Technologies Co Ltd
Current assignee: Huawei Technologies Co Ltd
Priority date: 2021-05-31
Filing date: 2021-05-31
Publication date: 2022-12-16

Abstract

The embodiment of the application discloses a data processing method and equipment thereof, which are used for data transmission. The method in the embodiment of the application comprises the following steps: the method comprises the steps of sending a first data packet to a first network device, wherein the first data packet carries key negotiation information, the key negotiation information is used for establishing a session key, the session key is used for carrying out safe communication between the first terminal device and a target device, receiving a second data packet sent by the first network device, the second data packet comprises a first key parameter, the first key parameter is generated by the first network device according to a first target parameter and a second target parameter, the first target parameter is obtained by the first network device according to a key negotiation function, the second target parameter is obtained by the second network device according to the key negotiation function, the first key parameter is used for generating a session key, and the session key is generated according to the first key parameter. In the embodiment of the application, the session key is generated according to the first key parameter, so that the security of data transmission is improved.

Description

Data processing method and equipment thereof

Technical Field

The embodiment of the application relates to the technical field of computers, in particular to a data processing method and data processing equipment.

Background

To secure end-to-end communications, a secure authenticatable key exchange protocol is typically required to negotiate session keys to provide confidentiality and integrity for the communication data.

Under a symmetric key-based key agreement and sharing mechanism, a trusted authority server is usually required to participate in real time to assist the communication peers in establishing a secure and trusted session key. For example, before the client communicates with the opposite-end client, a secure channel is established with the authoritative server, and a session key request is sent to the authoritative server. The authoritative server sends a session key to the client and the opposite-end client, and the client and the opposite-end client communicate according to the session key.

In the process, when the client and the opposite-end client communicate each time, the authoritative server is required to send the session key, and if the authoritative server is broken by a third party, the third party can acquire the session key in real time, so that the communication security is influenced.

Disclosure of Invention

The embodiment of the application provides a data processing method and equipment thereof, which are used for data transmission. The first terminal device carries the key negotiation information in the first data packet and generates the session key according to the first key parameter sent by the first network device, so that the situation that the authoritative server directly sends the session key is avoided, and the safety of data transmission is improved.

A first aspect of the application provides a data processing method.

The method comprises the steps that a first terminal device sends a first data packet to a first network device, the first data packet carries key negotiation information, the key negotiation information is used for establishing a session key, the session key is used for safe communication between the first terminal device and a target device, the first terminal device receives a second data packet sent by the first network device, the second data packet comprises a first key parameter, the first key parameter is generated by the first network device according to a first target parameter and a second target parameter, the first target parameter is obtained by the first network device according to a key negotiation function, the second target parameter is obtained by the second target device according to the key negotiation function, the first key parameter is used for generating a session key, and the first terminal device generates the session key according to the first key parameter.

In the embodiment of the application, the first terminal device generates the session key according to the first key parameter sent by the first network device by carrying the key negotiation information in the first data packet, so that the authoritative server is prevented from directly sending the session key, and the security of data transmission is improved.

Based on the implementation manner of the first aspect of the present application, in one possible implementation manner,

the first terminal device generates a first random number, where the first random number is used to generate a session key, the first random number is carried in a first data packet, the second data packet further includes a second random number, the second random number is used to generate a session key, the second random number is generated by a target device, and the generating of the session key by the first terminal device according to the first key parameter specifically includes: the first terminal equipment generates a session key according to the first random number, the second random number and the first key parameter.

In the embodiment of the application, the first terminal device generates the session key according to the first random number generated by the first terminal device, the second random number generated by the target device, and the first key parameter, and since parameters generated by a plurality of devices are needed for generating the session key, it is difficult for an illegal third party to break one of the devices to generate the session key, thereby further ensuring the security of data transmission.

the first terminal device encrypts the first random number according to a symmetric encryption algorithm to obtain a first encrypted random number, the first encrypted random number is carried in a first data packet, the second random number is a random number encrypted by the target device according to the symmetric encryption algorithm, and the generation of the session key by the first terminal device according to the first random number, the second random number and the first key parameter specifically includes: the first terminal equipment decrypts the second random number according to a symmetric decryption algorithm to obtain a second decrypted random number, the symmetric decryption algorithm corresponds to the symmetric encryption algorithm, and the first terminal equipment generates a session key according to the first random number, the second decrypted random number and the first key parameter.

In the embodiment of the application, the first random number and the second random number are encrypted and decrypted through a symmetric encryption algorithm, so that the calculation load of the terminal equipment can be reduced compared with that of an asymmetric algorithm, and in addition, the security of data transmission can be further ensured through the encryption and decryption of the first random number and the second random number.

the first terminal device obtains first identity information and second identity information, the first identity information is used for identifying the first terminal device, the second identity information is used for identifying the target device, the first terminal device obtains first key information according to the first identity information and the second identity information, the first terminal device encrypts the first random number according to a symmetric encryption algorithm, and obtaining the first encrypted random number specifically comprises: the first terminal device encrypts the first random number according to the first key information and the symmetric encryption algorithm to obtain a first encrypted random number, and the first terminal device decrypts the second random number according to the symmetric decryption algorithm to obtain a second decrypted random number specifically includes: and the first terminal equipment decrypts the second random number according to the symmetric decryption algorithm and the first key information to obtain a second decrypted random number.

In the embodiment of the application, the first key information is obtained through the first identity information of the first terminal device and the second identity information of the target device, and the first random number and the second random number are encrypted and decrypted according to the first key information, so that the security of data transmission is improved.

Based on the implementation manner of the first aspect of the present application, in a possible implementation manner, the first identity information includes a first identity and a first validity period parameter, the first identity is used to identify the first terminal device, the first validity period parameter is used to indicate expiration time of the first identity information, the second identity information includes a second identity and a second validity period parameter, the second identity is used to identify the target device, the second validity period parameter is used to indicate expiration time of the second identity information, and the obtaining, by the first terminal device, the first key information according to the first identity information and the second identity information includes: and the first terminal equipment judges whether the second validity period parameter exceeds the preset failure time, and if not, the first terminal equipment obtains first key information according to the first identity information and the second identity information.

In the embodiment of the application, whether the first key information needs to be generated is determined by judging whether the second validity period exceeds the preset expiration time, so that the validity time of the first identity information or the second identity information is reduced, and the security of the first key information is further ensured.

Based on the implementation manner of the first aspect of the present application, in a possible implementation manner, the first terminal device obtains a first collaborative encryption key, where the first key parameter is encrypted by the first network device according to the first collaborative encryption key, and the method further includes: the first terminal device decrypts the first key parameter according to the first collaborative encryption key to obtain a first key plaintext parameter, and the generating, by the first terminal device, the session key according to the first key parameter specifically includes: and the first terminal equipment generates a session key according to the first key plaintext parameters.

In the embodiment of the application, the first key parameter is encrypted and decrypted according to the first cooperative encryption key, so that the security of data transmission is improved.

the first terminal device acquiring the first collaborative encryption key includes: the method comprises the steps that a first terminal device receives a collaborative encryption key seed parameter sent by a second network device, wherein the collaborative encryption key seed parameter is generated by the second network device, and the first terminal device obtains a first collaborative encryption key according to the collaborative encryption key seed parameter.

In the embodiment of the application, the collaborative encryption key seed parameter is sent by a trusted second network device, and the first collaborative encryption key is generated according to the collaborative encryption key seed parameter, so that the security of the first collaborative encryption key is improved.

Based on the implementation manner of the first aspect of the present application, in a possible implementation manner, the second data packet further includes first authentication information, where the first authentication information is generated by the target device according to the first random number and the first key parameter, and the generating, by the first terminal device, the session key according to the first key parameter specifically includes: and the first terminal equipment judges whether the first authentication information is tampered, and if not, the first terminal equipment generates a session key according to the first key parameter.

In the embodiment of the application, whether the session key is generated is determined by judging whether the first authentication information is tampered, so that the security of the session key is further ensured.

the step of judging whether the first authentication information is tampered by the first terminal device specifically includes: the first terminal device calculates to obtain first key information according to the first identity information, the second identity information and a key derivation function, calculates to obtain second authentication information according to the first key information, the first random number, the first target parameter and the second target parameter, judges whether the first authentication information and the second authentication information are the same or not by the first terminal device, and if yes, the first terminal device determines that the first authentication information is not tampered.

In the embodiment of the application, the second authentication information calculated according to the first key information, the first random number, the first target parameter and the second target parameter is compared with the first authentication information, and if the first authentication information and the first authentication information are the same, it is determined that the first authentication information is not tampered, so that the reliability of judging the first authentication information is improved.

Based on the implementation manner of the first aspect of the present application, in a possible implementation manner, the first terminal device performs calculation according to the target key parameter, the second random number, the first target parameter, and the second target parameter to obtain third authentication information, where the third authentication information is used for session key authentication of the target device, and the first terminal device sends the third authentication information to the first network device.

In the embodiment of the application, the peer device can also verify by sending the third authentication information, so as to generate the session key for communication, thereby further ensuring the security of data transmission.

Based on the implementation manner of the first aspect of the present application, in a possible implementation manner, after the first terminal device generates the session key according to the first key parameter, the method further includes: and the first terminal equipment updates the first collaborative encryption key to obtain a second collaborative encryption key, the second collaborative encryption key is used for decrypting a second key parameter, the second key parameter is received by the first terminal equipment after receiving the first key parameter, and the second key parameter is used for establishing a second session key between the first terminal equipment and other equipment or target equipment.

In the embodiment of the application, the forward security of data transmission is ensured by updating the first cooperative encryption key.

Based on the implementation manner of the first aspect of the present application, in a possible implementation manner, the updating, by the first terminal device, the first cooperative encryption key to obtain the second cooperative encryption key includes: and the first terminal equipment calculates the first collaborative encryption key according to the safe one-way function to obtain a second collaborative encryption key.

In the embodiment of the application, the first cooperative encryption key is updated through a secure one-way function, so that the forward security of data transmission is further ensured.

Based on the implementation manner of the first aspect of the present application, in a possible implementation manner, the key agreement information is carried in a packet header of the first data packet.

In the embodiment of the application, the key negotiation information is carried in the message header of the first data packet, so that the resource overhead of bandwidth is reduced.

Based on the implementation manner of the first aspect of the present application, in a possible implementation manner, the first data packet further carries first service data, and the first service data is generated for the first terminal device.

In the embodiment of the application, the information for generating the session key is carried along with the path in the data packet for transmitting the first service data, so that the transmission resource overhead is reduced.

Based on the implementation manner of the first aspect of the present application, in a possible implementation manner, the first key parameter and the second random number are carried in a packet header of a second data packet, and the second data packet further carries second service data, where the second service data is generated for a target device.

In the embodiment of the application, the information for generating the session key is carried along with the channel in the data packet for transmitting the second service data, so that the transmission resource overhead is reduced.

A second aspect of the present application provides a data processing method.

The method comprises the steps that first network equipment receives a first data packet sent by first terminal equipment, the first data packet carries key negotiation information, the key negotiation information is used for establishing a session key, the session key is used for safe communication between the first terminal equipment and target equipment, the first network equipment adds a first target parameter to the first data packet to obtain a third data packet, the first target parameter is obtained by the first network equipment according to a key negotiation function, the first network equipment sends the third data packet to the target equipment, the first network equipment receives a fourth data packet sent by the target equipment, the second data packet comprises a second target parameter, the second target parameter is obtained by the target equipment according to the key negotiation function, the first network equipment obtains a first key parameter according to the first target parameter and the second target parameter, the first key parameter is used for generating a session key, the first network equipment sends the second data packet to the first terminal equipment, and the second data packet carries the first key parameter.

In the embodiment of the application, the first data packet carries the key negotiation information, and the session key is generated according to the first key parameter sent by the first network device, so that the situation that an authoritative server directly sends the session key is avoided, and the security of data transmission is improved.

Based on the implementation manner of the second aspect of the present application, in a possible implementation manner, the first data packet further includes a first random number, where the first random number is used to generate a session key, the second data packet further includes a second random number, the second random number is generated by the target device, and the second random number is carried in the fourth data packet.

In the embodiment of the application, the session key is generated according to the first random number generated by the first terminal device, the second random number generated by the target device and the first key parameter, and since the generation of the session key needs parameters generated by a plurality of devices, it is difficult for an illegal third party to break one of the devices to generate the session key, thereby further ensuring the security of data transmission.

Based on the implementation manner of the second aspect of the present application, in a possible implementation manner, the first random number is a first encrypted random number, the first encrypted random number is obtained by encrypting the first random number by the first terminal device according to a symmetric encryption algorithm, and the second random number is a random number encrypted by the target device according to the symmetric encryption algorithm.

In the embodiment of the application, the first random number and the second random number are encrypted and decrypted through a symmetric encryption algorithm, so that the calculation load of the terminal equipment can be reduced compared with an asymmetric algorithm, and in addition, the security of data transmission can be further ensured through the encryption and decryption of the first random number and the second random number.

Based on the implementation manner of the second aspect of the present application, in a possible implementation manner, the first encrypted random number is obtained by the first terminal device according to the first key information and a symmetric encryption algorithm, the first key information is obtained by the first terminal device according to the first identity information and the second identity information, the first identity information is used for identifying the first terminal device, and the second identity information is used for identifying the target device.

Based on the implementation manner of the second aspect of the present application, in a possible implementation manner, the first identity information includes a first identity identifier and a first validity period parameter, the first identity identifier is used for identifying the first terminal device, the first validity period parameter is used for indicating a time to failure of the first identity information, the second identity information includes a second identity identifier and a second validity period parameter, the second identity identifier is used for identifying the target device, and the second validity period parameter is used for indicating a time to failure of the second identity information.

In the embodiment of the application, the second validity period parameter is carried in the second identity information, so that the validity time of the first identity information or the second identity information is reduced, and the security of the first key information is further ensured.

Based on the implementation manner of the second aspect of the present application, in a possible implementation manner, the first network device obtains the first collaborative encryption key, and the first network device encrypts the first key parameter according to the first collaborative encryption key, where the encrypted first key parameter is carried in the second data packet.

Based on the embodiment of the second aspect of the present application, in a possible implementation manner, the obtaining, by the first network device, the first cooperative encryption key specifically includes: the method comprises the steps that a first network device receives a collaborative encryption key seed parameter sent by a second network device, wherein the collaborative encryption key seed parameter is generated by the second network device, and the first network device obtains a first collaborative encryption key according to the collaborative encryption key seed parameter.

In the embodiment of the application, the collaborative encryption key seed parameter is sent by a trusted second network device, and the first collaborative encryption key is obtained according to the collaborative encryption key seed parameter, so that the security of the first collaborative encryption key is improved.

Based on the implementation manner of the second aspect of the present application, in a possible implementation manner, the second data packet further includes first authentication information, where the first authentication information is generated by the target device according to the first random number and the first key parameter, and the first authentication information is used by the first terminal device to determine whether to generate the session key.

Based on the implementation manner of the second aspect of the present application, in one possible implementation manner, the method further includes: the first network device receives third authentication information sent by the first terminal device, the third authentication information is obtained by the first terminal device through calculation according to a target key parameter, a second random number, a first target parameter and a second target parameter, the target key parameter is obtained by the first terminal device through calculation according to first identity information, second identity information and a key derivation function, the third authentication information is used for authenticating a session key by the target device, and the first network device sends the third authentication information to the target device.

In the embodiment of the application, the peer device can also verify by sending the third authentication information, so as to generate a session key for communication, thereby further ensuring the security of data transmission.

Based on the implementation manner of the second aspect of the present application, in a possible implementation manner, after the first network device receives the third authentication information sent by the first terminal device, the method further includes: the first network device updates the first collaborative encryption key to obtain a second collaborative encryption key, the second collaborative encryption key is used for encrypting a second key parameter, the second key parameter is received by the first network device after receiving the first key parameter, and the second key parameter is used for the first terminal device to communicate with other devices.

In a possible implementation manner, based on the implementation manner of the second aspect of the present application, the updating, by the first network device, the first collaborative encryption key includes: and the first network equipment calculates the first collaborative encryption key according to the safe one-way function to obtain a second collaborative encryption key.

Based on the implementation manner of the second aspect of the present application, in a possible implementation manner, the key agreement information is carried in a packet header of the first data packet.

Based on the implementation manner of the second aspect of the present application, in a possible implementation manner, the first data packet further carries first service data, and the first service data is generated for the first terminal device.

Based on the implementation manner of the second aspect of the present application, in a possible implementation manner, the first key parameter and the second random number are carried in a packet header of a second data packet, and the second data packet further carries second service data, where the second service data is generated for the target device.

A third aspect of the present application provides a terminal device.

A terminal device, comprising:

a sending unit, configured to send a first data packet to a first network device, where the first data packet carries key negotiation information, the key negotiation information is used to establish a session key, and the session key is used for secure communication between a first terminal device and a target device;

a receiving unit, configured to receive a second data packet sent by a first network device, where the second data packet includes a first key parameter, the first key parameter is generated by the first network device according to a first target parameter and a second target parameter, the first target parameter is obtained by the first network device according to a key agreement function, the second target parameter is obtained by the second network device according to the key agreement function, and the first key parameter is used to generate a session key;

and the generating unit is used for generating the session key according to the first key parameter.

Alternatively,

the generation unit is further configured to generate a first random number, where the first random number is used to generate a session key, and the first random number is carried in a first data packet;

the second data packet further includes a second random number, the second random number being used to generate the session key, the second random number being generated by the destination device,

the generation unit is specifically configured to generate a session key according to the first random number, the second random number, and the first key parameter.

Optionally, the terminal device further includes:

the processing unit is used for encrypting the first random number according to a symmetric encryption algorithm to obtain a first encrypted random number, and the first encrypted random number is carried in a first data packet;

the second random number is a random number encrypted by the target device according to a symmetric encryption algorithm,

the processing unit is specifically used for decrypting the second random number according to a symmetric decryption algorithm to obtain a second decrypted random number, and the symmetric decryption algorithm corresponds to the symmetric encryption algorithm;

the generation unit is further configured to generate a session key based on the first random number, the second decrypted random number, and the first key parameter.

Optionally, the terminal device further includes:

an acquisition unit configured to acquire first identity information and second identity information, the first identity information being used to identify a first terminal device, the second identity information being used to identify a target device;

the processing unit is further used for obtaining first key information according to the first identity information and the second identity information;

the processing unit is specifically configured to encrypt the first random number according to the first key information and a symmetric encryption algorithm to obtain a first encrypted random number;

the processing unit is specifically configured to decrypt the second random number according to the symmetric decryption algorithm and the first key information to obtain a second decrypted random number.

Optionally, the first identity information includes a first identity identifier for identifying the first terminal device and a first validity parameter for indicating expiration time of the first identity information, the second identity information includes a second identity identifier for identifying the target device and a second validity parameter for indicating expiration time of the second identity information,

the processing unit is specifically used for judging whether the second validity period parameter exceeds a preset failure time;

if not, the processing unit obtains first key information according to the first identity information and the second identity information.

Alternatively, the first and second liquid crystal display panels may be,

the obtaining unit is further configured to obtain a first collaborative encryption key;

the processing unit is further configured to decrypt the first key parameter according to the first collaborative encryption key to obtain a first key plaintext parameter;

the generating unit is specifically configured to generate a session key according to the first key plaintext parameter.

Optionally, the receiving unit is further configured to receive a collaborative encryption key seed parameter sent by a second network device, where the collaborative encryption key seed parameter is generated by the second network device;

the processing unit is further configured to obtain the first collaborative encryption key according to the collaborative encryption key seed parameter.

Optionally, the second data packet further includes first authentication information, where the first authentication information is generated by the target device according to the first random number and the first key parameter, and the processing unit is further configured to determine whether the first authentication information is tampered;

if not, the generating unit is specifically configured to generate the session key according to the first key parameter.

Alternatively, the first and second liquid crystal display panels may be,

the processing unit is specifically configured to calculate to obtain first key information according to the first identity information, the second identity information, and a key derivation function;

the processing unit is further used for calculating according to the first key information, the first random number, the first target parameter and the second target parameter to obtain second authentication information;

the processing unit is further used for judging whether the first authentication information and the second authentication information are the same;

if yes, the processing unit is specifically configured to determine that the first authentication information is not tampered.

Alternatively,

the processing unit is further used for calculating according to the target key parameter, the second random number, the first target parameter and the second target parameter to obtain third authentication information, and the third authentication information is used for session key authentication of the target equipment;

the sending unit is further configured to send third authentication information to the first network device.

Optionally, the terminal device further includes:

and the updating unit is used for updating the first collaborative encryption key to obtain a second collaborative encryption key, the second collaborative encryption key is used for decrypting a second key parameter, the second key parameter is received by the first terminal device after receiving the first key parameter, and the second key parameter is used for establishing a second session key between the first terminal device and other devices or target devices.

Optionally, the processing unit is further configured to calculate the first collaborative encryption key according to a secure one-way function, so as to obtain a second collaborative encryption key.

Optionally, the key agreement information is carried in a packet header of the first data packet.

Optionally, the first data packet further carries first service data, and the first service data is generated by the terminal device.

Optionally, the first key parameter and the second random number are carried in a packet header of a second data packet, and the second data packet also carries second service data, where the second service data is generated by the target device.

The steps executed by the terminal device in the third aspect of the present application are similar to the steps executed by the first terminal device in the first aspect of the present application, and are not described herein again.

A fourth aspect of the present application provides a network device.

A network device, comprising:

the device comprises a receiving unit and a sending unit, wherein the receiving unit is used for receiving a first data packet sent by first terminal equipment, the first data packet carries key negotiation information, the key negotiation information is used for establishing a session key, and the session key is used for carrying out safe communication between the first terminal equipment and target equipment;

the adding unit is used for adding a first target parameter into the first data packet to obtain a third data packet, wherein the first target parameter is obtained by the first network equipment according to a key negotiation function;

a sending unit, configured to send a third data packet to the target device;

the receiving unit is further configured to receive a fourth data packet sent by the target device, where the second data packet includes a second target parameter, and the second target parameter is obtained by the target device according to a key negotiation function;

the processing unit is used for obtaining a first key parameter according to the first target parameter and the second target parameter, and the first key parameter is used for generating a session key;

the sending unit is further configured to send a second data packet to the first terminal device, where the second data packet carries the first key parameter.

Optionally, the first data packet further includes a first random number, where the first random number is used to generate a session key, and the second data packet further includes a second random number, where the second random number is generated by the target device and is carried in the fourth data packet.

Optionally, the first random number is a first encrypted random number, the first encrypted random number is obtained by encrypting the first random number by the first terminal device according to a symmetric encryption algorithm, and the second random number is a random number encrypted by the target device according to the symmetric encryption algorithm.

Optionally, the first encrypted random number is obtained by the first terminal device according to first key information and a symmetric encryption algorithm, the first key information is obtained by the first terminal device according to first identity information and second identity information, the first identity information is used for identifying the first terminal device, and the second identity information is used for identifying the target device.

Optionally, the first identity information includes a first identity identifier and a first validity period parameter, the first identity identifier is used for identifying the first terminal device, the first validity period parameter is used for indicating expiration time of the first identity information, the second identity information includes a second identity identifier and a second validity period parameter, the second identity identifier is used for identifying the target device, and the second validity period parameter is used for indicating expiration time of the second identity information.

Optionally, the network device further includes:

an acquisition unit configured to acquire a first collaborative encryption key;

the processing unit is further configured to encrypt the first key parameter according to the first collaborative encryption key, where the encrypted first key parameter is carried in the second data packet.

Optionally, the second data packet further includes first authentication information, where the first authentication information is generated by the target device according to the first random number and the first key parameter, and the first authentication information is used by the first terminal device to determine whether to generate the session key.

Alternatively,

the receiving unit is further configured to receive third authentication information sent by the first terminal device, where the third authentication information is obtained by the first terminal device through calculation according to a target key parameter, the second random number, the first target parameter, and the second target parameter, the target key parameter is obtained by the first terminal device through calculation according to the first identity information, the second identity information, and a key derivation function, and the third authentication information is used for authenticating a session key by the target device;

the sending unit is further configured to send third authentication information to the target device.

Optionally, the network device further includes:

and the updating unit is configured to update the first cooperative encryption key to obtain a second cooperative encryption key, where the second cooperative encryption key is used to encrypt a second key parameter, the second key parameter is received by the first network device after receiving the first key parameter, and the second key parameter is used for the first terminal device to communicate with another device.

Optionally, the key negotiation information is carried in a packet header of the first data packet.

Optionally, the first data packet further carries first service data, and the first service data is generated for the first terminal device.

The steps executed by the network device in the fourth aspect of the present application are similar to the steps executed by the network device in the second aspect of the present application, and details are not repeated here.

A fifth aspect of the present application provides a terminal device, including:

the terminal device comprises a processor and a memory, the memory having stored therein a computer program, the processor executing the computer program stored in the memory to cause the terminal device to perform the method according to the first aspect of the present application.

A sixth aspect of the present application provides a network device, comprising:

the network device comprises a processor and a memory, the memory having stored therein a computer program, the processor executing the computer program stored in the memory to cause the network device to perform the method according to the embodiment of the second aspect of the present application.

A seventh aspect of the present application provides a readable storage medium storing instructions that, when executed, cause a method as in an embodiment of the first or second aspect of the present application to be implemented.

An eighth aspect of the present application provides a computer program product which, when executed on a computer, causes the computer to perform a method as embodied in the first or second aspect of the present application.

According to the technical scheme, the embodiment of the application has the following advantages:

Drawings

FIG. 1 is a diagram of a prior art system architecture provided by an embodiment of the present application;

FIG. 2 is a diagram of another prior art system architecture provided by an embodiment of the present application;

FIG. 3 is a system architecture diagram of a data processing method according to an embodiment of the present application;

fig. 4 is a schematic flowchart of a data processing method according to an embodiment of the present application;

fig. 5a is another schematic flow chart of a data processing method according to an embodiment of the present application;

fig. 5b is another schematic flow chart of a data processing method according to an embodiment of the present application;

fig. 6 is another schematic flow chart of a data processing method according to an embodiment of the present application;

fig. 7 is a schematic structural diagram of a terminal device according to an embodiment of the present application;

fig. 8 is another schematic structural diagram of a terminal device according to an embodiment of the present application;

fig. 9 is a schematic structural diagram of a network device according to an embodiment of the present application;

fig. 10 is a schematic structural diagram of a network device according to an embodiment of the present application;

fig. 11 is another schematic structural diagram of a terminal device according to an embodiment of the present application;

fig. 12 is another schematic structural diagram of a network device according to an embodiment of the present application.

Detailed Description

The embodiment of the application provides a data processing method which is used for data transmission. In the embodiment of the application, the first terminal device generates the session key according to the first key parameter sent by the first network device by carrying the key negotiation information in the first data packet, so that the authoritative server is prevented from directly sending the session key, and the security of data transmission is improved.

In order to better understand a data processing method disclosed in the embodiments of the present application, a network transmission framework to which the embodiments of the present application are applicable is first described below.

Please refer to fig. 1, which is a diagram illustrating a prior art system architecture according to an embodiment of the present application.

To secure end-to-end communications, a secure authenticatable key exchange protocol is typically required to negotiate dynamic session keys to provide confidentiality and integrity for communication data (e.g., application layer data).

The certifiable key exchange protocol needs to be attacked by a man-in-the-middle or an illegal third party, and the fact that the man-in-the-middle or the illegal third party on a communication link cannot damage the key exchange process is guaranteed. Such as preventing a man-in-the-middle or an illegal third party from obtaining a session key for communication or impersonating either party of the two parties to communication from communicating with the other party. In a scenario where sensitive data needs to be transmitted, in order to prevent a security problem caused by the leakage of a subsequent communication key, a Diffie-hellman protocol is generally required to be used in end-to-end communication to ensure the forward security of the communication key.

As shown in fig. 1, in the scenario where a client communicates with a server, in order to ensure that the client communicates with a legitimate server, identity authentication generally needs to be performed. For example, using a long-term identity credential shared by the client and the server, such as using the client's long-term identity credential<ID _i ，IDK _I >Long-term identity credentials for servers<ID _R ，IDK _R >Performing identity authentication to preventIdentity is fake. Meanwhile, a key related to identity authentication needs to be used for signing a parameter for negotiating the session key, so as to prevent a man-in-the-middle or a third party from tampering data or unpacking the session key parameter. In this process, the key parameters that the two communicating parties interact with are typically based on diffie-hellman to provide forward security. So-called forward security, that is, the leakage of the long-term key does not cause the leakage of the session key of the previous communication, or the leakage of the subsequent session key does not affect the leakage of the session key in the previous communication process, so that the session key usually has temporality, and different session keys are used in different time periods or different data streams.

However, in future scenarios of massive IoT access, and in cases where IoT needs to transmit sensitive data, existing authenticatable key exchange protocols have difficulty to compromise the security and performance requirements of resource-constrained IoT devices. First, most existing authenticatable key exchanges use asymmetric encryption mechanisms, such as digital certificate mechanisms to perform identity authentication, and asymmetric Diffie-hellman mechanisms to use forward security, while asymmetric cryptographic mechanisms are computationally and transport expensive and are not suitable for battery, computing power, or bandwidth-limited IoT devices. In addition, in the case that the opposite end of IoT communication changes dynamically and is difficult to determine in advance, if the existing symmetric key mechanism is adopted to secure the key exchange, there are the problems of inflexibility and inextensibility of pre-configuring the shared key, and it is difficult to provide forward security.

An authenticated key exchange protocol based on asymmetric cryptography is typically based on a digital certificate mechanism. In the client-server communication mode, the server needs a digital certificate issued by an authority device, and the client needs to have a root certificate capable of verifying the validity of the digital certificate. Since both have a common trust anchor (i.e., authority device), the terminal device and the server may perform one-way authentication or two-way authentication. In some scenarios, such as open web access, one-way authentication is typically performed, and the client needs to verify the legitimacy of the server identity. For example, it is necessary to determine whether the server is a legitimate server. In some scenarios, such as an enterprise network scenario, mutual authentication may be required, and the server also needs to verify whether the client is a valid client.

In case of two-way authentication, the client needs to send its own digital certificate CertC and generate the previous authentication information using the client private key. The server also needs to verify the certificate certc of the client, verify the authentication information according to the public key in the certificate certc, and calculate a new session key after the verification is passed. However, due to the adoption of an asymmetric cryptographic mechanism, a client needs to verify a plurality of certificates and verify signatures, but the verification of a digital certificate not only brings large transmission overhead, for example, a single x.509 certificate is at least 500B, but a certificate chain can reach several KB, but also brings large calculation overhead, for example, the average length of the certificate chain is 2-3 levels, multiple times of signature verification and one time of D-H key calculation are needed, asymmetric calculation overhead is thousands to tens of thousands times greater than that of symmetric calculation overhead, and large chip cost is also brought, for example, the asymmetric cryptographic algorithm implementation accounts for 60% of the whole security algorithm code.

Therefore, it is not applicable to IoT devices with limited resources, such as in a scenario with limited bandwidth, the transmission of digital certificate may cause delay of unpacking fragmentation, multi-packet transmission, and the like.

A key agreement and sharing mechanism based on a symmetric key, one mode depends on configuring a same shared key at both communication sides in advance, and the mechanism has no flexible expandability. Yet another approach, as shown in fig. 2, requires real-time participation of a trusted authority server (e.g., a key distribution center KDC) to assist the two communicating ends in establishing a secure trusted session key.

As shown in fig. 2, each client has a shared secret key with the authoritative server KDC, so that the client and the KDC can mutually authenticate and establish a secure channel. Similarly, each business server and the authoritative server KDC also trust each other, and trust can be established between the key distribution center and the servers based on digital certificates or a shared key mechanism.

However, this scheme requires an authoritative KDC to be online in real time, and two parties in real communication cannot communicate independently from the KDC, that is, each time the client communicates with the authoritative server, the KDC needs to distribute the shared key in real time. The security of communication completely depends on the security of the KDC, when the KDC is broken, the security mechanism is broken, and the permission of the KDC is too large to monitor all communication. In addition, the scheme has no forward security, and if the shared key of the client and the key distribution center is leaked, an attacker can decrypt and obtain all session keys.

Based on the above problem, embodiments of the present application provide a data transmission method, which is used to solve the above problem.

Please refer to fig. 3, which is a schematic diagram of an architecture of a data transmission system according to an embodiment of the present disclosure.

The data transmission system comprises a target network device 301, a first terminal device 302, a first network device 303, a second network device 304 and a second terminal device 305. The target network device 301 establishes connections with the first terminal device 302, the first network device 303, the second network device 304, and the second terminal device 305, respectively. It is understood that the connection between the target network device 301 and the first terminal device 302, the first network device 303, the second network device 304, and the second terminal device 305 may be a wired connection or a wireless connection, which is not limited herein. In practical applications, there may also be other numbers of network devices or terminal devices, for example, the first network device 303 and the second network device 304 may be replaced by one network device, which is not limited herein.

If the connection is through a wired network, the connection is generally in the form of a fiber network, it can be understood that the connection can also be through other wired networks, for example, through an ADSL connection, a wired broadband connection, and the like, which is not limited herein. If the connection is through a wireless network, the connection may be through a WLAN connection (i.e. wi-fi connection), it is understood that the connection may also be through other wireless network connections, for example, a bluetooth connection, an infrared connection, a data network connection, and the like, where the data network connection may also include GPRS or EDGE and CDMA of 2G, WCDMA or CDMA of 3G, and data network connection of TD-LTE, FDD-LTE, 5G, 6G, and the like of 4G, and a specific connection manner is not limited herein.

The first terminal device 302 and/or the second terminal device 305 in this embodiment may be a device having a wireless transceiving function, or may be a device that only supports wired transmission, which is not limited herein. For example, the first terminal device 302 and/or the second terminal device 305 may be a mobile phone (mobile phone), a tablet (Pad), a desktop computer, a notebook computer, a Virtual Reality (VR) terminal device, an Augmented Reality (AR) terminal device, a wireless terminal in industrial control (industrial control), a vehicle-mounted terminal device, a terminal in self driving (self driving), a terminal in remote medical (remote medical), a terminal in smart grid (smart grid), a terminal in transportation security (transportation security), a terminal in city (smart city), a terminal in smart home (smart home), a wearable terminal device, and the like.

In this embodiment, the first network device 303, the target network device 301, and the second network device 304 may be devices having a wireless transceiving function, or may be devices that only support wired transmission, which is not limited herein. For example, the first network device 303, the target network device 301, and the second network device 304 may be network devices such as a router, a switch, a server, or a desktop computer with a computing function, which is not limited herein.

The data transmission system provided by the embodiment of the application can be a communication scene of an enterprise network, a campus network or an industrial internet, namely, two communication parties and network equipment belong to the same security domain for common management. Under the data transmission system, the target network device 301 is responsible for distributing the relevant identity keys to the first terminal device 302, the second terminal device 305, the first network device 303 and the second network device 304 under the data transmission system.

The following describes a data processing method in an embodiment of the present application with reference to a data transmission system framework of fig. 3.

In this embodiment, there are multiple method embodiments, where the multiple method embodiments may be implemented as one embodiment, or may be implemented separately, for example, the step of the terminal device acquiring the first identity information may be implemented separately, or may be implemented together in the step of the terminal device generating the session key, and this is not limited herein. Next, a plurality of embodiments of the present application will be described, respectively.

Please refer to fig. 4, which is a flowchart illustrating a data processing method according to an embodiment of the present disclosure.

1. First identity information is obtained.

In step 401, the target network device generates first identity information.

When the terminal device accesses the network or needs to communicate with other devices, the target network device allocates first identity information to the terminal device and a first network device for forwarding a data packet of the terminal device, wherein the first identity information is used for identifying the terminal device. The target network device generates the first identity information before assigning the first identity information to the terminal device and to the first network device.

In a possible implementation manner, the first network device may be a first-hop network device or a gateway device connected to the terminal device, and in an actual application process, the first network device may also be all network devices or gateway devices used for forwarding a terminal device data packet, or only a few of the network devices or gateway devices, which is not limited here.

Specifically, in one possible implementation, the target network device randomly selects a binary t-degree polynomial, where the binary t-degree polynomial satisfies f (x, y) = f (y, x). The target network device calculates the first identity information from the binary t-th order polynomial. Specifically, the first identity information includes a first identity identifier and a first validity period parameter, and the first identity identifier is allocated to the terminal device by the target network device and is used for identifying the terminal device. The first validity period parameter is allocated to the terminal device by the target network device, and the first validity period parameter is used for indicating the expiration time of the first identity information. It should be noted that the first validity parameter may be a time stamp, such as 2021, 6/month 1, indicating that the first identity information is valid before the time stamp. Alternatively, the first validity parameter may be a counter, such as a counter of 500 seconds or 500 times, after 500 seconds or 500 times of data transmission, the first identity information is invalidated. In practical application, the first validity period parameter may be represented by other means, for example, it may be a revocation list, where two communication parties maintain a revocation list together, the revocation list includes different numbers, each time two communication parties perform communication once, the two communication parties revoke a common number in the revocation list, and after the number in the revocation list is revoked, it indicates that the first identity information is invalid. Specifically, the expression form of the first validity period parameter is not limited herein.

In particular, in one possible implementation, the target network device calculates a first identity key based on the first identity identifier of the terminal device, the first validity period parameter, and the bivariate polynomial, the first identity key being used for encrypting data of the communication subsequently used by the terminal device in the communication. For example, the target network device is according to K _I ＝f(ID _I | the first validity parameter, y), where f () is a bivariate polynomial and y is the unknown y, K in the bivariate polynomial _I Is a first identity key, ID _I Is a first identity. Wherein the content of the first and second substances,

in a possible implementation manner, the target network device further generates a first cooperative encryption key, where the first cooperative encryption key is used for subsequent encryption by the terminal device. Specifically, the target network device may randomly generate a random number as a cooperative encryption key seed parameter, where the cooperative encryption key seed parameter is the first cooperative encryption key, or the target network device may further perform hash calculation on the cooperative encryption key seed parameter m times to obtain the first cooperative encryption key, for example, HS _IM ＝Hash ^M (HS _I ) Wherein, HI _I For encrypting key seeds cooperativelyA subparameter, hash () is a secure one-way Hash function, expressed in HI _I As input, a first collaborative encryption key HS is obtained after M times of identical hash calculations _IM . The method for specifically obtaining the first collaborative encryption key is not limited here, and for example, the first collaborative encryption key may be generated according to a secure one-way hash function by using a collaborative encryption key seed parameter and another parameter.

In step 402, the target network device sends first identity information to the terminal device.

After the target network device generates the first identity information, the target network device sends the first identity information to the terminal device.

Specifically, in a possible implementation manner, the target network device may first establish a secure data transmission channel with the terminal device, for example, establish a connection with the terminal device in the form of an encrypted data transmission channel or a dedicated optical fiber line, and then transmit the first identity information through the secure data transmission channel.

Alternatively, in a possible implementation manner, the target network device may also send the first identity information to the terminal device in an out-of-band manner, for example, the first identity information may be copied from the target network device through a USB removable memory, and the first identity information may be copied to the terminal device through the USB removable memory. Or, a data line may be used to connect the terminal device and the target network device, and the first identity information is directly transmitted through the data line directly connecting the terminal device and the target network device, where the specific transmission mode for the target network device and the terminal device to transmit the first identity information is not limited here.

It can be understood that, after the target network device generates the first collaborative encryption key, the target network device may transmit the first collaborative encryption key along the path when transmitting the first identity information, that is, the first identity information and the first collaborative encryption key are transmitted to the terminal device in a data packet manner, so that transmission resource overhead caused by respective transmission can be saved in a data packet along the path. However, in an actual application process, the target network device may also send the first identity information and the first cooperative encryption key respectively, which is not limited herein. It should be noted that, when the target network device sends the first collaborative encryption key, only the collaborative encryption key seed parameter may be sent, and then the terminal device calculates the first collaborative encryption key according to the secure one-way function, and may directly send the first collaborative encryption key, which is not limited herein.

In step 403, the target network device sends the first identity information to the first network device.

After the target network device has generated the first identity information, the target network device sends the first identity information to the first network device.

Specifically, in a possible implementation manner, when the terminal device accesses the target network device through the first network device, the target network device sends the first identity information to the first network device, so that transmission resource overhead of separately sending the first identity information to the first network device can be saved.

Specifically, in a possible implementation manner, the target network device may first establish a secure data transmission channel with the first network device, for example, establish a connection with the first network device in the form of an encrypted data transmission channel or a dedicated optical fiber line, and then transmit the first identity information through the secure data transmission channel.

Alternatively, in a possible implementation manner, the target network device may also send the first identity information to the first network device in an out-of-band manner, for example, the first identity information may be copied from the target network device through the USB removable memory, and the first identity information may be copied to the first network device through the USB removable memory. Or, a data line may be used to connect the first network device and the target network device, and the first identity information is directly transmitted through the data line directly connected to the first network device and the target network device, where a specific transmission mode for the target network device and the first network device to transmit the first identity information is not limited here.

It can be understood that, after the target network device generates the first cooperative encryption key, the target network device may transmit the first cooperative encryption key along with the path when transmitting the first identity information, that is, the first identity information and the first cooperative encryption key are transmitted to the first network device in a data packet manner, so that transmission resource overhead caused by respective transmission may be saved by a data packet along with the path transmission manner. However, in an actual application process, the target network device may also send the first identity information and the first cooperative encryption key respectively, which is not limited herein. It should be noted that, when the target network device sends the first collaborative encryption key, only the collaborative encryption key seed parameter may be sent, and then the first network device calculates the first collaborative encryption key according to the secure one-way function, and may directly send the first collaborative encryption key, which is not limited herein.

It should be noted that, the process of the target network device sending the first identity information to the terminal device, and the process of the target network device sending the first identity information to the first network device may be independent processes, or may be executed by different network devices, that is, the first identity information and/or the first cooperative encryption key may be sent to the terminal device and the first network device through different network devices, which is not limited herein.

It can be understood that the step of sending the identity information to the other terminal device and the corresponding network device by the target network device is similar to the step of sending the identity information to the terminal device and the first network device by the target network device in this embodiment, and details are not described here.

Based on the embodiment shown in fig. 4, the following describes a process of establishing a session key between the first terminal device and the second terminal device in detail.

Please refer to fig. 5a and 5b, which are schematic flow charts of a data processing method according to an embodiment of the present application.

In step 501, a first terminal device generates a first random number.

In order for the first terminal device to establish secure communication with the second terminal device, a session key is required between the first terminal device and the second terminal device to ensure the security of the communication. Therefore, the first terminal device generates a first random number, which is used for generating the session key, first. For example, the first terminal device generates a random number RandC, which may be a natural number or a constant, and is not limited herein.

In step 502, the first terminal device obtains first identity information and second identity information.

The first terminal equipment acquires first identity information and second identity information, wherein the first identity information is used for identifying the first terminal equipment, and the second identity information is used for identifying the second terminal equipment.

Specifically, the first terminal device may obtain the first identity information and the second identity information from a specified target network device or a specified management server, that is, the target network device or the management server sends the first identity information and the second identity information to the first terminal device. In a possible implementation manner, the first terminal device may send an identity request to the target network device, and the target network device sends the first identity information and the second identity information to the first terminal device. Or, in a possible implementation manner, the target network device configures the first identity information to the first terminal device in advance, and when the first terminal device needs to communicate with the second terminal device, the target network device sends the second identity information of the second terminal device to the first terminal device.

In a possible implementation manner, when transmitting the service data or the system message to the first terminal device, the target network device transmits the first identity information and/or the second identity information along the path, so that transmission resource overhead caused by separately transmitting the first identity information or the second identity information can be saved. For example, when the target network device sends a service data packet to the first terminal device, the target network device may put the first identity information and the second identity information in the header of the data packet for transmission.

In step 503, the first terminal device obtains first key information according to the first identity information and the second identity information.

After the first terminal device acquires the first identity information and the second identity information, the first terminal device acquires first key information according to the first identity information and the second identity information.

Specifically, in a possible implementation manner, the first terminal device receives a first identity key sent by the target network device, and calculates to obtain first key information according to the first identity key, the second identity, the second validity period parameter, and a bivariate polynomial algorithm. The manner of obtaining the first identity key is similar to that of obtaining the first identity key in step 401 in the embodiment shown in fig. 4, and details are not described herein again. For example, the first terminal device is based on SK _I-R ＝F(SK _I ，ID _R | R) calculates first key information, where SK _I-R Representing first key information, SK _I Denotes a first identity key, ID _R Representing a second identity, R representing a second validity parameter, F () being a binary polynomial algorithm.

In a possible implementation manner, the first terminal device does not receive the first identity key from the target network device, and obtains the first key information according to the first identity identifier, the first validity period parameter, the second identity identifier, the second validity period parameter, and the bivariate polynomial algorithm in the first identity information. For example, SK _I-R ＝f(ID _I ||I，ID _R R), where SK _I-R Indicating first key information, ID _I Denotes a first identity, I denotes a first validity period parameter, ID _R Representing a second identity, R a second validity period parameter, and F () a bivariate polynomial algorithm. It is to be understood that, in an actual application process, the first key information may also be calculated in other manners, for example, the first key information may be calculated only according to the first identity and the second identity, which is not limited herein.

In a possible implementation manner, the first terminal device determines whether the second validity period parameter exceeds a preset expiration time, and if so, it indicates that the second identity information is outdated information, and does not calculate the first key information. If the first identity information does not exceed the second identity information, the second identity information is effective information, and the first secret key information is obtained through calculation according to the first identity information and the second identity information.

In step 504, the first terminal device encrypts the first random number according to the first key information and the symmetric encryption algorithm, so as to obtain a first encrypted random number.

After the first terminal device obtains the first key information, the first terminal device encrypts the first random number according to the first key information and a symmetric encryption algorithm to obtain a first encrypted random number.

Specifically, in a possible implementation manner, the first terminal device performs calculation according to the first key information to obtain a first encryption key, for example, CK = KDF (SK) _I-R ) Where CK represents the first encryption key, KDF () is a calculation function, SK _I-R Indicating the first key information. After obtaining the first encryption key, the first random number is encrypted according to a function ECK (RandC). Where RandC represents a first random number and ECK () represents a secure symmetric encryption algorithm, which may be, for example, the AES-128 algorithm. The specific symmetric encryption algorithm is not limited herein.

In step 505, the first terminal device sends a first data packet to the first network device.

After obtaining the first encrypted random number, the first terminal device sends a first data packet to the first network device, where the first data packet carries key agreement information, the key agreement information is used to establish a session key, and the key agreement information includes the first encrypted random number. In a possible implementation manner, the key negotiation information is carried in a message header of the first data packet.

In particular, in a possible implementation manner, the first data packet may be a data packet that is used by the first terminal device to request to establish the session key with the second terminal device, and may be, for example, an AKE request data packet that is used to request to establish the session key with the second terminal device.

Or, in a possible implementation manner, the first data packet may be a data packet in which the first terminal device and the second terminal device transmit service data, where the data packet of the service data carries key negotiation information along with a path, and the key negotiation information may include information such as a first encrypted random number, first identity information, and second identity information, and further, the key negotiation information may also be used to instruct the first terminal device and the second terminal device to establish a session key, for example, the key negotiation information carries an indicator L, where the indicator L is used to instruct the first terminal device and the second terminal device to establish a session key.

In step 506, the first network device adds the first target parameter to the first packet to obtain a third packet.

After the first network device receives a data packet sent by the first terminal device, the first network device adds a first target parameter to the first data packet to obtain a third data packet, wherein the first target parameter is obtained by the first network device according to a key negotiation function.

Specifically, the first network device generates a random number a, and calculates a first target parameter g according to the random number a ^a . Wherein, in one possible implementation, g ^a Is calculated according to a secret key negotiation function Diffie-Hellman algorithm. It will be appreciated that, in practical applications, g ^a The key agreement function may also be obtained according to other key agreement functions, which are not limited herein.

The first network device adds the first target parameter to the first data packet after obtaining the first target parameter. For example, the first target parameter may be added to a preamble portion of the first packet or a payload portion of the first packet, which is not limited herein.

In step 507, the first network device sends a third data packet to the second network device.

After the first network device obtains the third data packet, the first network device sends the third data packet to the second network device.

In step 508, the second network device performs calculation according to the first target parameter and the second target parameter to obtain a first key parameter.

After the second network device receives the third data packet, the second network device analyzes the third data packet, obtains a first target parameter from the third data packet, and performs calculation according to the first target parameter and a second target parameter to obtain a first key parameter, wherein the second target parameter is obtained by the second network device according to a key negotiation function, and the first key parameter is used for generating a session key.

Specifically, the second network device generates a random number b and calculates a second target parameter g according to the random number b ^b . Wherein, in one possible implementation, g ^b Is calculated according to a secret key negotiation function Diffie-Hellman algorithm. It will be appreciated that, in practice, g ^b The key agreement function may also be obtained according to other key agreement functions, which are not limited herein.

After the second network device obtains the second target parameter through calculation, the second network device calculates the first key parameter according to the first target parameter and the second target parameter. For example, according to the formula TSK = H (g) ^ab ) Calculating to obtain a first key parameter, wherein TSK is the first key parameter, g ^ab H () may be a secure one-way function, which is the product of a first target argument and a second target argument.

In step 509, the second network device encrypts the first key parameter according to the third hash parameter.

After the second network device obtains the first key parameter, in a possible implementation manner, the second network device encrypts the first key parameter according to the third hash parameter.

There are various ways for the second network device to obtain the third hash parameter. For example, the second network device may directly obtain the third hash parameter from the target network device, where a generation manner of the third hash parameter is similar to that of the first cooperative encryption key in step 401 in the embodiment shown in fig. 4, and details are not described here again. Or, the second network device may further obtain a second collaborative encryption key seed parameter from the target network device, and the second network deviceObtaining a third hash parameter, e.g. HS, after m times of hash calculation according to the second collaborative encryption key seed parameter _RM ＝Hash ^M (HS _R ) Wherein, HI _R For the second cooperative encryption key seed parameter, hash () is a secure one-way Hash function, expressed in HI _R As input, a third hash parameter HS is obtained after performing M times of the same hash calculation _RM . The method for specifically obtaining the third hash parameter is not limited here, and for example, the third hash parameter may be generated according to a secure one-way hash function through the second collaborative encryption key seed parameter and another parameter.

After the second network device obtains the third hash parameter, the second network device encrypts the first key parameter according to the third hash parameter. In particular, in one possible implementation, the second network device may be according to the formula [ TSK]＝E _DK1 (TSK) encrypting the first key parameter, wherein [ TSK]Denotes the first key argument after encryption, DK1 denotes the third hash argument, TSK denotes the first key argument before encryption, and E () denotes a symmetric encryption algorithm, e.g., AES-128.

In step 510, the second network device sends a fifth data packet to the second terminal device.

After the second network device obtains the encrypted first key parameter, the second network device sends a fifth data packet carrying the encrypted first key parameter to the second terminal device.

After encrypting the first key parameter, the second network device forms a fifth data packet according to the encrypted first key parameter, the first encrypted random number, the first identity information, the second identity information, the first target parameter, and the second target parameter. It can be understood that the fifth data packet may be regenerated by the second network device, or the fifth data packet may be obtained by adding the encrypted first key parameter and the second target parameter to the third data packet on the basis of the original third data packet, where a specific manner of obtaining the fifth data packet is not limited herein.

In step 511, the second terminal device decrypts the first encrypted random number according to the first identity information and the second identity information, so as to obtain the first random number.

After the second terminal device receives the fifth data packet sent by the second network device, the second terminal device analyzes the fifth data packet, and decrypts the first encrypted random number according to the first identity information and the second identity information to obtain the first random number.

Specifically, the second terminal device obtains first key information according to the first identity information and the second identity information, and decrypts the first encrypted random number according to the first key information to obtain the first random number.

In a possible implementation manner, the second terminal device receives a second identity key sent by the target network device, and calculates to obtain the first key information according to the second identity key, the second identity identifier, the second validity period parameter, and the binary polynomial algorithm. The second identity key is obtained in a similar manner to the first identity key in step 401 in the embodiment shown in fig. 4, and details thereof are not repeated here. For example, the first terminal device is based on SK _I-R ＝F(SK _R ，ID _I I) calculates first key information, wherein SK _I-R Representing first key information, SK _R Representing a second identity key, ID _I Representing a first identity, I a first validity parameter, and F () a bivariate polynomial algorithm.

In a possible implementation manner, the second terminal device does not receive the second identity key from the target network device, and obtains the first key information according to the first identity identifier, the first validity period parameter, the second identity identifier, the second validity period parameter, and the bivariate polynomial algorithm in the first identity information. For example, SK _I-R ＝f(ID _I ||I，ID _R R), where SK _I-R Indicating first key information, ID _I Denotes a first identity, I denotes a first validity parameter, ID _R Representing a second identity, R a second validity period parameter, and F () a bivariate polynomial algorithm. It is understood that, in the practical application process, the first key information can also be calculated by other waysFor example, the first key information may be calculated only from the first identity and the second identity, and is not limited herein.

In a possible implementation manner, the second terminal device determines whether the first validity period parameter exceeds a preset expiration time, and if so, the first identity information is an expired information, and the first key information is not calculated. If the first identity information does not exceed the second identity information, the first identity information is indicated to be effective information, and the first key information is obtained through calculation according to the first identity information and the second identity information.

After the first key information is obtained, the second terminal device decrypts the first encrypted random number according to the first key information to obtain the first random number. For example, the second terminal device follows the algorithm RandC = D _ck ([RandC]) Decrypting the first encrypted random number, wherein RandC represents the first random number, [ RandC]Represents a first encrypted random number, CK represents first key information, and D () represents a decryption algorithm of a symmetric cipher, i.e., the decryption algorithm corresponds to an encryption algorithm that encrypts the first random number.

In step 512, the second terminal device decrypts the first key parameter according to the third hash parameter.

And after the second terminal equipment acquires the fifth data packet, the second terminal equipment decrypts the first key parameter according to the third hash parameter.

Specifically, there are various ways for the second terminal device to obtain the third hash parameter. For example, the second terminal device may directly obtain the third hash parameter from the target network device, where a generation manner of the third hash parameter is similar to that of the first cooperative encryption key in step 401 in the embodiment shown in fig. 4, and details are not described here again. Or the second terminal device may further obtain a second cooperative encryption key seed parameter from the target network device, and the second terminal device performs hash calculation for m times according to the second cooperative encryption key seed parameter to obtain a third hash parameter, for example, HS _RM ＝Hash ^M (HS _R ) Wherein, HI _R For the second cooperative encryption key seed parameter, hash () is secureOne-way hash function, expressed in HI _R As input, a third hash parameter HS is obtained after performing M times of the same hash calculation _RM . The method for specifically obtaining the third hash parameter is not limited here, and for example, the third hash parameter may be generated according to a secure one-way hash function by using the second cooperative encryption key seed parameter and another parameter.

And after the second terminal equipment acquires the third hash parameter, the second terminal equipment decrypts the first key parameter according to the third hash parameter. For example, the second terminal device follows the algorithm TSK = D _DKn ([TSK]) Where TSK represents the decrypted first key parameter, [ TSK]Representing the encrypted first key argument, DKn representing the third hash argument, D () being a symmetric decryption algorithm, i.e. the decryption algorithm corresponding to the encryption algorithm encrypting the first key argument.

In step 513, the second terminal device generates first authentication information according to the first random number and the first key parameter.

After the second terminal device obtains the first random number and the first key parameter, the second terminal device generates first authentication information according to the first random number and the first key parameter.

In particular, in one possible implementation, the second terminal device is configured to use the algorithm AuthR = HMAC _AK (g ^a ，g ^b RandC) obtaining first authentication information, where AuthR denotes the first authentication information, AK denotes first key information, g ^a And g ^b Represents a first key parameter, randC represents a first random number, and HMAC () represents a secure hash algorithm, such as SHA-256 algorithm, or CMAC algorithm, which is not limited herein.

The first authentication information is used for the first terminal device to verify the security of the transmitted data packet, for example, when the first terminal device receives the data packet sent by the second terminal device, the first authentication information is verified, and if the first authentication information fails to verify, it indicates that the content in the data packet may be tampered. If the verification is passed, the content in the data packet can be safely received.

The second terminal equipment returns to the rootAnd encrypting the first random number and the second random number according to the first key information to obtain a first encrypted random number and a second encrypted random number. In a possible implementation manner, the second terminal device may encrypt the first random number and the second random number simultaneously according to the first key information, so as to obtain an encrypted value. For example, the second terminal device may be according to algorithm E _ck (RandC, randS) simultaneously encrypting the first random number and the second random number, wherein RandC denotes the first random number, randS denotes the second random number, ck denotes first key information, and E () denotes a secure encryption algorithm.

In a possible implementation manner, the second terminal device may further encrypt the first random number and the second random number respectively to obtain the first encrypted random number and the second encrypted random number.

In step 514, the second terminal device sends a fifth data packet to the second network device.

And after obtaining the first authentication information, the first encrypted random number and the second encrypted random number, the second terminal device generates a fifth data packet according to the first authentication information, the first encrypted random number and the second encrypted random number.

Specifically, in a possible implementation manner, the fifth data packet may further include a first target parameter, a second target parameter, first identity information, and second identity information.

In a possible implementation manner, the first data packet may be a data packet that is used by the second terminal device exclusively for responding to the session key establishment sent by the first terminal device, and may be, for example, an AKE response data packet that is used for establishing a session key with the first terminal device.

In a possible implementation manner, the fifth data packet may be a data packet in which the second terminal device and the first terminal device transmit service data, and the data packet of the service data carries the first authentication information, the first encrypted random number, and the second encrypted random number along with the path, and further, the data packet may further include the first target parameter, the second target parameter, the first identity information, and the second identity information. The information carried by the associated path may be placed in a header or payload portion of the packet, or other fields of the packet, which is not limited herein.

In step 515, the second network device sends a fifth data packet to the first network device.

After the second network device receives the fifth data packet, the second network device directly forwards the fifth data packet to the first network device.

In step 516, the first network device performs calculation according to the first target parameter and the second target parameter to obtain a first key parameter.

After the first network device receives a fifth data packet sent by the second network device, the first network device obtains a second target parameter in the fifth data packet, and calculates according to the first target parameter and the second target parameter to obtain a first key parameter.

Specifically, in a possible implementation manner, the first network device verifies the first target parameter carried in the fifth data packet, that is, compares the first target parameter with the first target parameter in the local cache of the first network device, and if the first target parameter is the same as the first target parameter, it indicates that the first target parameter in the fifth data packet is not tampered. And if the verification is passed, the first network equipment calculates according to the first target parameter and the second target parameter to obtain a first key parameter.

In particular, in one possible implementation, the first network device is according to the formula TSK = H (g) ^ab ) Calculating to obtain a first key parameter, wherein TSK is the first key parameter, g ^ab H () may be a secure one-way function, which is the product of a first target argument and a second target argument.

In step 517, the first network device encrypts the first key parameter according to the first collaborative encryption key.

After the first network device obtains the first key parameter, the first network device encrypts the first key parameter according to the first collaborative encryption key.

In particular, in one possible implementation, the first network device may be according to the formula [ TSK]＝E _DKm (TSK) encrypts the first key parameter, wherein [ TSK]Denotes a first key argument after encryption, DKm denotes a first cooperative encryption key, TSK denotes a first key argument before encryption, and E () denotes a symmetric encryption algorithm, e.g., AES-128.

In step 518, the first network device sends a second data packet to the first terminal device.

And after the first network equipment encrypts the first key parameter, the first network equipment adds the encrypted first key parameter to the fifth data packet to obtain a second data packet. The first network device sends the second data packet to the first terminal device.

In step 519, the first terminal device decrypts the second random number according to the symmetric decryption algorithm and the first key information.

And after the first terminal equipment receives the second data packet, the first terminal equipment decrypts the second random number according to the first key information and the symmetric decryption algorithm.

Specifically, in a possible implementation manner, the second terminal device uses an algorithm (RandC, rands) = D _ck ([RandC，RandS]) Decrypting the first encrypted random number and the second random number, where RandC represents the first random number, randS represents the second random number after decryption, [ RandC, rands]Represents a first encrypted random number and a second random number, CK represents first key information, and D () represents a decryption algorithm of a symmetric cipher, i.e., the decryption algorithm corresponds to an encryption algorithm that encrypts the first random number and the second random number.

After the first random number and the decrypted second random number are obtained through decryption, the first terminal device verifies whether the first random number is the same as the first random number in the local cache or not, and if yes, the first random number and the second random number are not tampered in the transmission process.

In step 520, the first terminal device determines whether the first authentication information is tampered.

After the first terminal device acquires the second data packet, the first terminal device acquires the first authentication information and judges whether the first authentication information is tampered.

Specifically, in a possible implementation manner, the first terminal device performs the algorithm AuthR = HMAC _AK (g ^a ，g ^b RandC), where AuthR denotes second authentication information, AK denotes first key information, g) verifies first authentication information ^a And g ^b Represents a first key parameter, randC represents a first random number, and HMAC () represents a secure hash algorithm, such as SHA-256 algorithm, CMAC algorithm, etc., which is not limited herein. If the second authentication information calculated by the first terminal device according to the formula is the same as the received first authentication information, it indicates that the first authentication information is not tampered in the transmission process, and if the calculated second authentication information is different from the received first authentication information, it indicates that the first authentication information is tampered in the transmission process.

In step 521, the first terminal device generates a session key according to the first key parameter, the first random number, and the second random number.

And if the first authentication information is not tampered, the first terminal equipment generates a session key according to the first key parameter, the first random number and the second random number.

Specifically, in a possible implementation manner, the first terminal device generates a session key according to an algorithm SessionKey = F (TSK, randC, randS). Wherein SessionKey represents a session key, TSK represents a first key parameter, randC represents a first random number, randS represents a second random number, and F () represents a secure algorithm.

In step 522, the first terminal device performs calculation according to the first key information, the second random number, the first target parameter, and the second target parameter to obtain third authentication information.

After receiving the second data packet, the first terminal device calculates according to the first key information, the second random number, the first target parameter and the second target parameter to obtain third authentication information, and the third authentication information is used for session key authentication of the target device.

Specifically, in one possible implementation, the first terminal device performs authentication according to the algorithm AuthI＝HMAC _AK (g ^a ，g ^b RandS) to obtain third authentication information, where AuthI denotes the third authentication information, AK denotes the first key information, g ^a And g ^b Represents a first key parameter, randS represents a second random number, and HMAC () represents a secure hash algorithm, such as SHA-256 algorithm, or CMAC algorithm, which is not limited herein.

The third authentication information is used for the second terminal device to verify the security of the transmitted data packet, for example, when the second terminal device receives the data packet sent by the first terminal device, the third authentication information is verified, and if the third authentication information fails to be verified, it indicates that the content in the data packet may be tampered. If the verification is passed, the content in the data packet can be safely received.

In step 523, the first terminal device updates the first cooperative encryption key to obtain a second cooperative encryption key.

After the first terminal device calculates the session key, the first terminal device updates the first collaborative encryption key to obtain a second collaborative encryption key.

In particular, in one possible implementation, the first terminal device is based on the algorithm HS _IM2 ＝Hash(HS _IM ) A second collaborative encryption key is computed. Wherein, HS _IM2 Indicating a second cooperative encryption key, HS _IM Representing a first cooperative encryption key, and Hash () representing a secure one-way function. The second collaborative encryption key is used for decrypting a second key parameter, the second key parameter is received by the first terminal device after receiving the first key parameter, and the second key parameter is used for establishing a second session key for the first terminal device and other devices or target devices.

And after the first terminal equipment updates the second cooperative encryption key, deleting the first cooperative encryption key and the use trace of the first cooperative encryption key.

In step 524, the first terminal device sends a sixth data packet to the first network device.

After the first terminal device obtains the third authentication information, the first terminal device generates a sixth data packet according to the third authentication information, and sends the sixth data packet to the first network device.

In a possible implementation manner, the sixth data packet may be a data packet that is used by the first terminal device exclusively for confirming the session key with the second terminal device, and may be, for example, a key confirmation message that is used to request confirmation of the session key with the second terminal device.

Or, in a possible implementation manner, the sixth data packet may be a data packet in which the first terminal device and the second terminal device transmit service data, where a key confirmation message is carried in the data packet of the service data, and the third authentication information in the key confirmation message may be carried in a preamble or other fields of the data packet, which is not limited here.

In step 525, the first network device updates the first collaborative encryption key to obtain a second collaborative encryption key.

After the first network device receives the sixth data packet, the first network device updates the first collaborative encryption key to obtain a second collaborative encryption key.

In particular, in a possible implementation, the first network device is based on the algorithm HS _IM2 ＝Hash(HS _IM ) A second collaborative encryption key is computed. Among them, HS _IM2 Indicating a second cooperative encryption key, HS _IM Representing a first cooperative encryption key, and Hash () representing a secure one-way function.

After the first network device updates the second cooperative encryption key, the first network device deletes the first cooperative encryption key and a use trace of the first cooperative encryption key.

In step 526, the first network device sends a sixth data packet to the second network device.

After the first network device receives the sixth data packet, the first network device forwards the sixth data packet to the second network device.

It should be noted that the first network device may separately send the sixth data packet to the second network device, or may carry the third authentication information in the sixth data packet in other service data packets, and transmit the third authentication information to the second network device, so that transmission resource overhead caused by separately sending the sixth data packet may be saved.

In step 527, the second network device updates the third hash parameter to obtain a fourth hash parameter.

After the second network device receives the sixth data packet, the second network device updates the third hash parameter to obtain a fourth hash parameter, the fourth hash parameter is used for decrypting the second key parameter, and the second key parameter is used for establishing a second session key for the second time between the second terminal device and other devices or the target device.

And after the first network equipment updates the fourth hash parameter, deleting the third hash parameter and the use trace of the third hash parameter.

In step 528, the second network device sends a sixth data packet to the second terminal device.

After the second network device receives the sixth data packet, the second network device forwards the sixth data packet to the second terminal device.

In step 529, the second terminal device determines whether the third authentication information is tampered.

After the second terminal device receives the sixth data packet, the second terminal device obtains the third authentication information, and determines whether the second authentication information is tampered.

In particular, in one possible implementation, the second terminal device uses the algorithm AuthI = HMAC _AK (g ^a ，g ^b RandS), where AuthI denotes the third authentication information, AK denotes the first key information, g) verifies the third authentication information ^a And g ^b Represents a first key parameter, randS represents a second random number, and HMAC () represents a secure hash algorithm, such as SHA-256 algorithm, CMAC algorithm, etc., which is not limited herein. If the authentication information calculated by the first terminal device according to the formula is the same as the received third authentication information, it indicates that the third authentication information is not tampered in the transmission process, and if the authentication information is countedAnd if the calculated authentication information is different from the received third authentication information, the third authentication information is falsified in the transmission process.

In step 530, the second terminal device generates a session key based on the first key parameter, the first random number, and the second random number.

And if the third authentication information is not tampered, the second terminal equipment generates a session key according to the first key parameter, the first random number and the second random number.

After the session key is obtained by both the first terminal device and the second terminal device, the communication between the first terminal device and the second terminal device may then be based on the session key. It should be noted that the session key may be used for once data stream application of the first terminal device and the second terminal device, that is, one data stream performs once session key authentication process, and one session key corresponds to one data stream communication. Alternatively, in a possible implementation manner, the session key is replaced by the first terminal device and the second terminal device at intervals, that is, one session key corresponds to a period of time.

In this embodiment, one session key is communicated with two same devices, and if the two devices communicate with each other, the one session key is re-authenticated according to the procedure of generating authentication by the session key in this embodiment.

In this embodiment of the application, steps 501, 504, 511, 513, 519, 520, and 522 are optional steps, that is, the first terminal device and the second terminal device may generate the session key only according to the first key parameter.

In the embodiment of the application, when the first terminal device communicates with the second terminal device, the target network device only needs to send the first identity information and the second identity information, and the target network device does not need to send the session key used for communication, so that the communication safety is improved. And the session key generated according to the first target parameter, the second target parameter, the first identity information and the second identity information has higher safety. In addition, in the embodiment, one-to-one pairing session key does not need to be configured in advance, forward security can be realized only by using a symmetric cryptographic algorithm, and the security of communication data can be effectively improved by forward security guarantee in a scene that IoT needs to transmit very sensitive data. Due to the fact that under the condition that the IoT is deployed outdoors and data is sensitive, the confidentiality of communication data can be effectively guaranteed through the forward security.

In the embodiment of the application, the first terminal device and the second terminal device generate first key information which is paired one by one based on the binary polynomial and the first identity information. The first network device and the second network device encrypt the first target parameter and the second target parameter used for generating the session key based on the first collaborative encryption key and the third hash parameter, and the first collaborative encryption key and the third hash parameter are deleted when being used up and are updated to a new value, thereby providing the interactive forward security between the first terminal device and the first network device, and between the second terminal device and the second network device. And the first terminal equipment generates first key information with the first identity identification or the second identity identification based on the binary polynomial, and the first key information can be used for encrypting and authenticating information between the first terminal equipment and the second terminal equipment without presetting a shared key in advance or transmitting a certificate, so that the method is flexible and extensible, and has high efficiency and low cost. And the first key parameter is encrypted by using the dynamically changed hash parameter, so that the forward security is guaranteed.

In this embodiment, when the first terminal device and the second terminal device perform communication, forwarding the data packet and exchanging session key information between the first terminal device and the second terminal device may also be performed only by one network device. As described in detail below.

Please refer to fig. 6, which is a schematic flow chart illustrating a data processing method according to an embodiment of the present application.

In step 601, the identity authentication server sends the first identity key and the second identity key to the terminal device, the first access point, and the service server.

In the IoT device (terminal device) and server (service server) scenario of the campus network, the identity keys of all terminal devices in the campus network are managed by a unified identity authentication server. When the terminal device accesses the network, the authentication process is executed first, and the identity authentication server sends a first identity key of the terminal device and a second identity key of the service server to the terminal device, the service server and a first access point, wherein the first access point is used for message routing between the terminal device and the service server.

Specifically, the identity authentication server generates a first identity key and a second identity key according to identifiers corresponding to the terminal device and the service server and system parameters. For example, first identity key = f (ID) _I ||ETS _I Y), where f () is a bivariate polynomial

y is an unknown number y, ID in a bivariate polynomial _I Being an identifier of the terminal device, ETS _I Indicating the expiry time of the first identity key. Similarly, second identity key = f (ID) _R ||ETS _R Y), where f () is a bivariate polynomial

y is an unknown number y, ID in a bivariate polynomial _R Being an identifier of a service server, ETS _R Indicating the expiry time of the second identity key.

The main model for the communication between the terminal device and the service server can be implemented based on the IP layer protocol. The first access point is responsible for auxiliary computation, and only processes network layer (IP layer) information without analyzing application layer data. The service server side has larger computing power and can execute the calculation of the asymmetric key.

The identity authentication server obtains the first identity authentication server in calculationAfter the identity key and the second identity key, the identity authentication server sends the first identity key and the second identity key to the terminal device, the first access point and the service server respectively. Specifically, the identifier of the terminal device and the identifier of the service server, as well as the expiration time of the corresponding first identity key and the expiration time of the corresponding second identity key, may also be included. Furthermore, a hash parameter HS can be included _I 。

In step 602, the terminal device sends an authentication request packet to the first access network.

Before accessing the service server, the terminal device performs an authenticatable key exchange procedure. Specifically, the terminal device sends an authentication request packet to the first access network.

Specifically, the network layer header of the authentication request packet sets Flag =01, which is used to indicate that the packet is an authentication request packet. And includes a session identifier sessionID, a terminal device identifier ID in an application layer packet _I The expiry time of the first identity key of the terminal device and an encrypted random number. The random number is generated by the terminal device and is encrypted according to the encryption key CK. The encryption key CK is calculated according to the AES128 algorithm. For example, CK = F ₁ (K _I-R )，K _I-R ＝F ₂ (SK _I ，ID _R ，ETS _R )＝f(ID _I ||ETS _I ，ID _R ||ETS _R ) Wherein F is ₁ Representing a secure key derivation function, F ₂ A univariate polynomial algorithm is represented.

After the terminal device generates the authentication request data packet, the terminal device sends the authentication request data packet to the first access point.

In step 603, the first access point adds g to the authentication request packet ^a 。

After receiving the authentication request data packet, the first access point adds a parameter g to the authentication request data packet ^a . Specifically, the first access node generates a random number a, and negotiates a function diff with a key according to the random number aE-hellman algorithm calculates to obtain g ^a . And mixing g ^a Added at the network layer header.

In step 604, the first access point sends an authentication request packet to the service server.

The first access node adds g ^a Then, the first access network point sends the added g to the service server ^a The authentication request packet.

After the service server receives the data packet, the network layer of the service server will g ^a Up to the application layer. Application layer inspection ETS _I If not, the data packet is discarded. If so, the CK value is calculated according to a formula. For example, CK = F ₁ (K _I-R )，K _I-R ＝F ₂ (SK _I ，ID _R ，ETS _R )＝f(ID _I ||ETS _I ，ID _R ||ETS _R ) Wherein F is ₁ Representing a secure key derivation function, F ₂ A univariate polynomial algorithm is represented.

After the business server obtains the CK, the business server generates a random number Randr, and encrypts RandI and Randr by using the CK to obtain [ RandI, randr] ^CK . Next, AK was recalculated, with AK = F1 (K) _I-R Authentication ") and calculates a first authentication message AuthR from AK. For example, authR = HMAC (AK, g) ^a ||g ^b | RandI), where HMAC () may be the SHA256 algorithm.

In step 605, the service server sends an authentication response packet to the first access network.

After obtaining the first authentication message, the service server sends an authentication response data packet to the first access network, wherein the authentication response data packet contains Session ID and ID ^R ，[RandI，RandR] ^CK ，AuthR，g ^a ，g ^b ，Flag＝10。

In step 606, the first access point calculates [ g ] ^a ]And added to the authentication response packet.

After receiving the authentication response data packet, the first access point carries out the authentication response data packetAnd (6) checking. Specifically, whether the data packet is an authentication response data packet is judged according to the Flag identifier. And check g ^a Whether to sum locally stored g ^a And (5) the consistency is achieved. If they are consistent, according to g ^a And g ^b Generate g ^ab And using hash parameters HS _I Encryption g ^ab To obtain [ g ] ^ab ] ^DK Wherein DK is a Hash parameter HS _I . In the presence of a catalyst to obtain [ g ^ab ] ^DK Then, [ g ] is mixed ^ab ] ^DK Adds a network layer header to the authentication response packet and updates the HS _I ＝Hash(HS _I )。

In step 607, the first access point sends an authentication response packet to the terminal device.

The first access point sends an add to the terminal device ^ab ] ^DK The authentication response packet of (1).

In step 608, the terminal device calculates a session key from the authentication response packet.

And after the terminal equipment receives the authentication response data packet, the terminal equipment calculates the session key according to the authentication response data packet.

Specifically, after the terminal device receives the authentication response packet, the network layer of the terminal device first decrypts [ g ] using the hash parameter HIS ^ab ] ^DK To obtain g ^ab . Further, g is ^ab 、g ^a And g ^b Up-handed to the application layer, update HS _I ＝Hash(HS _I )。

Application layer uses CK to decrypt [ RandI, randR ]] ^CK RandI and RandR are obtained. Further, whether the RandI is consistent with the RandI generated when the request is sent is verified. If the two are consistent, the verification is continuously performed. The first authentication information AtuhR is verified using AK. In particular, according to AuthR = HMAC (AK, g) ^a ||g ^b | RandI), where HMAC () may be the SHA256 algorithm. If the calculated AuthR is the same as the first authentication message, the verification is passed.

After the verification is passed, the second authentication information AuthI is calculated using AK, specifically, authI = HMAC (AK, g) ^a ||g ^b | RandR). Further, calculateSession key SessionKey. Specifically, sessionKey = KDF (RandI, randR, g) ^ab )。

After the terminal equipment obtains the session key, the HS is updated _I ＝Hash(HS _I )。

In step 609, the terminal device sends the target data packet to the first access network.

After the terminal equipment obtains the session key, the terminal equipment sends a target data packet to the first access network point, wherein the target data packet carries the Session ID and the ID _I Authi, etc.

In step 610, the first access point sends the destination data packet to the service server.

After the first access network point receives the target data packet, the first access network point forwards the target data packet to the service server and updates the HS _I ＝Hash(HS _I ). After the service server receives the target data packet, the service server verifies Authi by AK. Specifically, authI = HMAC (AK, g) ^a ||g ^b | RandR), if the calculated AuthI is the same as the received second authentication information AuthI, the authentication is passed. Further, a session key SessionKey is calculated. Specifically, sessionKey = KDF (RandI, randR, g) ^ab )。

After obtaining the session key, the service server updates the HS _I ＝Hash(HS _I ). And the service server performs secure communication with the terminal equipment according to the session key.

In the embodiment of the application, the terminal equipment IoT can flexibly access a plurality of different servers or other IoTs without configuring one-to-one pairing session keys in advance, the forward security is realized by using a lightweight pure symmetric cryptographic algorithm, and the communication data security can be effectively improved by ensuring the forward security in the scene that the IoT needs to transmit sensitive data. Due to the fact that under the conditions that IoT equipment is deployed outdoors and data are sensitive, forward security is provided, confidentiality of communication data can be effectively guaranteed.

In the above, the data processing method in the embodiment of the present application is described, and in the following, the terminal device and the network device in the embodiment of the present application are described, please refer to fig. 7, which is a schematic structural diagram of the terminal device provided in the present application.

A terminal device, comprising:

a sending unit 701, configured to send a first data packet to a first network device, where the first data packet carries key agreement information, the key agreement information is used to establish a session key, and the session key is used for secure communication between a first terminal device and a target device;

a receiving unit 702, configured to receive a second data packet sent by a first network device, where the second data packet includes a first key parameter, the first key parameter is generated by the first network device according to a first target parameter and a second target parameter, the first target parameter is obtained by the first network device according to a key agreement function, the second target parameter is obtained by the second network device according to the key agreement function, and the first key parameter is used to generate a session key;

a generating unit 703 is configured to generate a session key according to the first key parameter.

In this embodiment, the steps executed by each unit of the terminal device are similar to the operations executed by the first terminal device and the terminal device in fig. 4, fig. 5a, fig. 5b, and fig. 6, and detailed descriptions thereof are omitted here.

Please refer to fig. 8, which is a schematic structural diagram of another terminal device provided in the present application.

A terminal device, comprising:

a sending unit 801, configured to send a first data packet to a first network device, where the first data packet carries key negotiation information, the key negotiation information is used to establish a session key, and the session key is used for secure communication between a first terminal device and a target device;

a receiving unit 802, configured to receive a second data packet sent by a first network device, where the second data packet includes a first key parameter, the first key parameter is generated by the first network device according to a first target parameter and a second target parameter, the first target parameter is obtained by the first network device according to a key agreement function, the second target parameter is obtained by the second network device according to the key agreement function, and the first key parameter is used to generate a session key;

a generating unit 803, configured to generate a session key according to the first key parameter.

Alternatively, the first and second liquid crystal display panels may be,

the generating unit 803 is further configured to generate a first random number, where the first random number is used to generate a session key, and the first random number is carried in the first data packet;

the generating unit 803 is specifically configured to generate a session key according to the first random number, the second random number, and the first key parameter.

Optionally, the terminal device further includes:

the processing unit 804 is configured to encrypt the first random number according to a symmetric encryption algorithm to obtain a first encrypted random number, where the first encrypted random number is carried in a first data packet;

the processing unit 804 is specifically configured to decrypt the second random number according to a symmetric decryption algorithm to obtain a second decrypted random number, where the symmetric decryption algorithm corresponds to the symmetric encryption algorithm;

the generating unit 803 is further configured to generate a session key according to the first random number, the second decryption random number, and the first key parameter.

Optionally, the terminal device further includes:

an obtaining unit 805 configured to obtain first identity information and second identity information, where the first identity information is used to identify a first terminal device, and the second identity information is used to identify a target device;

the processing unit 804 is further configured to obtain first key information according to the first identity information and the second identity information;

the processing unit 804 is specifically configured to encrypt the first random number according to the first key information and a symmetric encryption algorithm to obtain a first encrypted random number;

the processing unit 804 is specifically configured to decrypt the second random number according to the symmetric decryption algorithm and the first key information, so as to obtain a second decrypted random number.

the processing unit 804 is specifically configured to determine whether the second validity period parameter exceeds a preset expiration time;

if not, the processing unit 804 obtains the first key information according to the first identity information and the second identity information.

Alternatively, the first and second liquid crystal display panels may be,

the obtaining unit 805 is further configured to obtain a first collaborative encryption key;

the generating unit 803 is specifically configured to generate a session key according to the first key plaintext parameter.

Optionally, the receiving unit 802 is further configured to receive a collaborative encryption key seed parameter sent by a second network device, where the collaborative encryption key seed parameter is generated by the second network device;

the processing unit 804 is further configured to obtain the first collaborative encryption key according to the collaborative encryption key seed parameter.

Optionally, the second data packet further includes first authentication information, where the first authentication information is generated by the target device according to the first random number and the first key parameter, and the processing unit 804 is further configured to determine whether the first authentication information is tampered;

if not, the generating unit 803 is specifically configured to generate the session key according to the first key parameter.

Alternatively,

the processing unit 804 is specifically configured to calculate to obtain first key information according to the first identity information, the second identity information, and a key derivation function;

the processing unit 804 is further configured to calculate according to the first key information, the first random number, the first target parameter, and the second target parameter to obtain second authentication information;

the processing unit 804 is further configured to determine whether the first authentication information and the second authentication information are the same;

if so, the processing unit 804 is specifically configured to determine that the first authentication information has not been tampered.

Alternatively,

the processing unit 804 is further configured to calculate to obtain third authentication information according to the target key parameter, the second random number, the first target parameter, and the second target parameter, where the third authentication information is used for performing session key authentication on the target device;

the sending unit 801 is further configured to send third authentication information to the first network device.

Optionally, the terminal device further includes:

an updating unit 806, configured to update the first cooperative encryption key to obtain a second cooperative encryption key, where the second cooperative encryption key is used to decrypt a second key parameter, the second key parameter is received by the first terminal device after receiving the first key parameter, and the second key parameter is used for the first terminal device to establish a second session key with another device or the target device.

Optionally, the processing unit 804 is further configured to calculate the first cooperative encryption key according to a secure one-way function, so as to obtain a second cooperative encryption key.

In this embodiment, steps executed by each unit of the terminal device are similar to operations executed by the first terminal device and the terminal device in fig. 4, fig. 5a, fig. 5b, and fig. 6, and details are not repeated here.

Please refer to fig. 9, which is a schematic structural diagram of a network device according to an embodiment of the present application.

A network device, comprising:

a receiving unit 901, configured to receive a first data packet sent by a first terminal device, where the first data packet carries key negotiation information, the key negotiation information is used to establish a session key, and the session key is used for secure communication between the first terminal device and a target device;

an adding unit 902, configured to add a first target parameter to the first data packet to obtain a third data packet, where the first target parameter is obtained by the first network device according to a key agreement function;

a sending unit 903, configured to send the third data packet to the target device;

the receiving unit 901 is further configured to receive a fourth data packet sent by the target device, where the second data packet includes a second target parameter, and the second target parameter is obtained by the target device according to a key agreement function;

a processing unit 904, configured to obtain a first key parameter according to the first target parameter and the second target parameter, where the first key parameter is used to generate a session key;

the sending unit 903 is further configured to send a second data packet to the first terminal device, where the second data packet carries the first key parameter.

In this embodiment, the steps executed by each unit of the network device are similar to the operations executed by the first network device and the first access point in fig. 4, fig. 5a, fig. 5b, and fig. 6, and detailed description thereof is omitted here.

Please refer to fig. 10, which is a schematic structural diagram of a network device according to an embodiment of the present application.

A network device, comprising:

a receiving unit 1001, configured to receive a first data packet sent by a first terminal device, where the first data packet carries key negotiation information, the key negotiation information is used to establish a session key, and the session key is used for secure communication between the first terminal device and a target device;

an adding unit 1002, configured to add a first target parameter to the first data packet to obtain a third data packet, where the first target parameter is obtained by the first network device according to a key agreement function;

a sending unit 1003, configured to send the third data packet to the target device;

the receiving unit 1001 is further configured to receive a fourth data packet sent by the target device, where the second data packet includes a second target parameter, and the second target parameter is obtained by the target device according to the key agreement function;

a processing unit 1004, configured to obtain a first key parameter according to the first target parameter and the second target parameter, where the first key parameter is used to generate a session key;

the sending unit 1003 is further configured to send a second data packet to the first terminal device, where the second data packet carries the first key parameter.

Optionally, the first data packet further includes a first random number, where the first random number is used to generate a session key, and the second data packet further includes a second random number, where the second random number is generated by the target device, and the second random number is carried in the fourth data packet.

Optionally, the first random number is a first encrypted random number, the first encrypted random number is obtained by encrypting, by the first terminal device, the first random number according to a symmetric encryption algorithm, and the second random number is a random number encrypted by the target device according to the symmetric encryption algorithm.

Optionally, the network device further includes:

an obtaining unit 1005 configured to obtain a first collaborative encryption key;

the processing unit 1004 is further configured to encrypt the first key parameter according to the first collaborative encryption key, where the encrypted first key parameter is carried in the second data packet.

Optionally, the receiving unit 1001 is further configured to receive a collaborative encryption key seed parameter sent by a second network device, where the collaborative encryption key seed parameter is generated by the second network device;

the processing unit 1004 is further configured to obtain the first collaborative encryption key according to the collaborative encryption key seed parameter.

Alternatively,

the receiving unit 1001 is further configured to receive third authentication information sent by the first terminal device, where the third authentication information is obtained by the first terminal device through calculation according to a target key parameter, the second random number, the first target parameter, and the second target parameter, the target key parameter is obtained by the first terminal device through calculation according to the first identity information, the second identity information, and the key derivation function, and the third authentication information is used for authenticating a session key by the target device;

the sending unit 1003 is further configured to send third authentication information to the target device.

Optionally, the network device further includes:

an updating unit 1006, configured to update the first collaborative encryption key to obtain a second collaborative encryption key, where the second collaborative encryption key is used to encrypt a second key parameter, the second key parameter is received by the first network device after receiving the first key parameter, and the second key parameter is used for the first terminal device to communicate with other devices.

Optionally, the processing unit 1004 is further configured to calculate the first collaborative encryption key according to a secure one-way function, so as to obtain a second collaborative encryption key.

In this embodiment, the steps executed by each unit of the network device are similar to the operations executed by the first network device and the first access point in fig. 4, fig. 5a, fig. 5b, and fig. 6, and details are not repeated here.

Please refer to fig. 11, which is a schematic structural diagram of a terminal device in an embodiment of the present application.

The processor 1101 is connected to the memory 1102 and the interface 1104, the bus 1105 is connected to the processor 1101, the memory 1102 and the interface 1104 respectively, the interface 1104 is used for receiving or sending data, and the processor 1101 is a single-core or multi-core central processing unit, or a specific integrated circuit, or one or more integrated circuits configured to implement the embodiments of the present invention. The memory 1102 may be a Random Access Memory (RAM), or may be a non-volatile memory (non-volatile memory), such as at least one hard disk memory. The memory 1102 is used to store computer-executable instructions. Specifically, the computer-executable instructions may include a program 1103.

In this embodiment, when the processor 1101 calls the program 1103, the terminal device in fig. 11 may be configured to execute the operations executed by the terminal device and the first terminal device in the embodiments shown in fig. 4, fig. 5a, fig. 5b, and fig. 6, which are not described herein again.

Fig. 12 is a schematic structural diagram of a network device according to an embodiment of the present application.

The processor 1201 is connected to the memory 1202 and the interface 1204, the bus 1205 is connected to the processor 1201, the memory 1202 and the interface 1204, respectively, the interface 1204 is used for receiving or sending data, and the processor 1201 is a single-core or multi-core central processing unit, or a specific integrated circuit, or one or more integrated circuits configured to implement the embodiments of the present invention. The memory 1202 may be a Random Access Memory (RAM), or may be a non-volatile memory (non-volatile memory), such as at least one hard disk memory. The memory 1202 is used to store computer-executable instructions. Specifically, the program 1203 may be included in computer-executable instructions.

In this embodiment, when the processor 1201 invokes the program 1203, the network device in fig. 12 may perform the operations performed by the first network device and the first access point in the embodiments shown in fig. 4, fig. 5a, fig. 5b, and fig. 6, which are not described herein again.

It should be understood that the processor mentioned in the terminal device or the network device or the storage system in the above embodiments of the present application, or the processor provided in the above embodiments of the present application, may be a Central Processing Unit (CPU), or may be other general-purpose processor, a Digital Signal Processor (DSP), an application-specific integrated circuit (ASIC), an off-the-shelf programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, or the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

It should also be understood that the number of processors in the terminal device or the network device in the above embodiments in this application may be one or multiple, and may be adjusted according to an actual application scenario, and this is merely an exemplary illustration and is not limited. The number of the memories in the embodiment of the present application may be one or multiple, and may be adjusted according to an actual application scenario, and this is merely an exemplary illustration and is not limited.

It should be further noted that, when the terminal device or the network device includes a processor (or a processing unit) and a memory, the processor in this application may be integrated with the memory, or the processor and the memory are connected through an interface, and may be adjusted according to an actual application scenario, and is not limited.

The present invention further provides a computer program or a computer program product including the computer program, where when the computer program is executed on a computer, the computer will implement the method flow of any one of the above method embodiments with a terminal device or a network device.

The embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, where the computer program, when executed by a computer, implements the method flows related to the terminal device or the network device in any of the above method embodiments.

In the various embodiments of fig. 3-4 described above, all or part of the implementation may be in software, hardware, firmware, or any combination thereof. When implemented in software, may be implemented in whole or in part in the form of a computer program product.

The computer program product includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described in accordance with the embodiments of the application to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can store or a data storage device, such as a server, a data center, etc., that is integrated with one or more available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid State Disk (SSD)), among others.

The terms "first," "second," and the like in the description and in the claims of the present application and in the above-described drawings are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the terms so used are interchangeable under appropriate circumstances and are merely descriptive of the various embodiments of the application and how objects of the same nature can be distinguished. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of elements is not necessarily limited to those elements, but may include other elements not expressly listed or inherent to such process, method, article, or apparatus.

The names of the messages/frames/information, modules or units, etc. provided in the embodiments of the present application are only examples, and other names may be used as long as the roles of the messages/frames/information, modules or units, etc. are the same.

The terminology used in the embodiments of the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used in the embodiments of the present application, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that in the description of the present application, unless otherwise indicated, "/" indicates a relationship where the objects associated before and after are an "or", e.g., a/B may indicate a or B; in the present application, "and/or" is only an association relationship describing an association object, and means that there may be three relationships, for example, a and/or B, and may mean: a exists alone, A and B exist simultaneously, and B exists alone, wherein A and B can be singular or plural.

The words "if" or "if" as used herein may be interpreted as "at \8230; \8230whenor" when 8230; \8230, when or "in response to a determination" or "in response to a detection", depending on the context. Similarly, the phrases "if determined" or "if detected (a stated condition or event)" may be interpreted as "when determined" or "in response to a determination" or "when detected (a stated condition or event)" or "in response to a detection (a stated condition or event)", depending on the context.

The above embodiments are only used for illustrating the technical solutions of the present application, and not for limiting the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and the modifications or the substitutions do not make the essence of the corresponding technical solutions depart from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of data processing, comprising:

a first terminal device sends a first data packet to a first network device, wherein the first data packet carries key negotiation information, the key negotiation information is used for establishing a session key, and the session key is used for performing secure communication between the first terminal device and the target device;

the first terminal device receives a second data packet sent by the first network device, where the second data packet includes a first key parameter, the first key parameter is generated by the first network device according to a first target parameter and a second target parameter, the first target parameter is obtained by the first network device according to a key agreement function, the second target parameter is obtained by the second network device according to the key agreement function, and the first key parameter is used to generate the session key;

and the first terminal equipment generates the session key according to the first key parameter.

2. The method of claim 1, further comprising:

the first terminal equipment generates a first random number, the first random number is used for generating the session key, and the first random number is carried in the first data packet;

the second data packet further includes a second random number, where the second random number is used to generate the session key, and the generating, by the first terminal device according to the first key parameter, the session key specifically includes:

and the first terminal equipment generates the session key according to the first random number, the second random number and the first key parameter.

3. The method of claim 2, further comprising:

the first terminal equipment encrypts the first random number according to a symmetric encryption algorithm to obtain a first encrypted random number, wherein the first encrypted random number is carried in the first data packet;

the generating, by the first terminal device, the session key according to the first random number, the second random number, and the first key parameter specifically includes:

the first terminal equipment decrypts the second random number according to a symmetric decryption algorithm to obtain a second decrypted random number, wherein the symmetric decryption algorithm corresponds to the symmetric encryption algorithm;

the first terminal device generates the session key based on the first random number, the second decrypted random number, and the first key parameter.

4. The method of claim 3, further comprising:

the first terminal equipment acquires first identity information and second identity information, wherein the first identity information is used for identifying the first terminal equipment, and the second identity information is used for identifying the target equipment;

the first terminal equipment obtains first key information according to the first identity information and the second identity information;

the encrypting the first random number by the first terminal device according to a symmetric encryption algorithm to obtain a first encrypted random number specifically includes:

the first terminal equipment encrypts the first random number according to the first key information and the symmetric encryption algorithm to obtain a first encrypted random number;

the decrypting, by the first terminal device, the second random number according to the symmetric decryption algorithm to obtain the second decrypted random number specifically includes:

and the first terminal equipment decrypts the second random number according to the symmetric decryption algorithm and the first key information to obtain a second decrypted random number.

5. The method of claim 4, wherein the first identity information includes a first identity identifier and a first validity parameter, the first identity identifier is used for identifying the first terminal device, the first validity parameter is used for indicating expiration time of the first identity information, the second identity information includes a second identity identifier and a second validity parameter, the second identity identifier is used for identifying the target device, the second validity parameter is used for indicating expiration time of the second identity information, and the obtaining, by the first terminal device, first key information according to the first identity information and the second identity information includes:

the first terminal equipment judges whether the second validity period parameter exceeds a preset failure time or not;

and if the first identity information does not exceed the second identity information, the first terminal equipment obtains first key information according to the first identity information and the second identity information.

6. The method according to any one of claims 1 to 5, further comprising:

the first terminal equipment acquires a first collaborative encryption key;

the first key parameter is encrypted by the first network device according to the first collaborative encryption key, and the method further includes:

the first terminal equipment decrypts the first key parameter according to the first collaborative encryption key to obtain a first key plaintext parameter;

the generating, by the first terminal device, the session key according to the first key parameter specifically includes:

and the first terminal equipment generates the session key according to the first key plaintext parameters.

7. The method of claim 6, wherein the first terminal device obtaining the first collaborative encryption key comprises:

the first terminal device receives a collaborative encryption key seed parameter sent by a second network device, wherein the collaborative encryption key seed parameter is generated by the second network device;

and the first terminal equipment obtains the first collaborative encryption key according to the collaborative encryption key seed parameter.

8. The method according to any one of claims 2 to 7, wherein the second data packet further includes first authentication information, the first authentication information is generated by the target device according to the first random number and the first key parameter, and the generating, by the first terminal device, the session key according to the first key parameter specifically includes:

the first terminal equipment judges whether the first authentication information is tampered or not;

and if not, the first terminal equipment generates the session key according to the first key parameter.

9. The method according to claim 8, wherein the determining, by the first terminal device, whether the first authentication information is tampered specifically includes:

the first terminal equipment calculates to obtain first key information according to the first identity information, the second identity information and a key derivation function;

the first terminal device calculates according to the first key information, the first random number, the first target parameter and the second target parameter to obtain second authentication information;

the first terminal equipment judges whether the first authentication information and the second authentication information are the same;

if so, the first terminal device determines that the first authentication information is not tampered.

10. The method of claim 9, further comprising:

the first terminal device calculates according to the target key parameter, the second random number, the first target parameter and the second target parameter to obtain third authentication information, and the third authentication information is used for the target device to perform the session key authentication;

and the first terminal equipment sends the third authentication information to the first network equipment.

11. The method according to any of claims 6 to 10, wherein after the first terminal device generates the session key according to the first key parameter, the method further comprises:

and the first terminal equipment updates the first collaborative encryption key to obtain a second collaborative encryption key, the second collaborative encryption key is used for decrypting a second key parameter, the second key parameter is received by the first terminal equipment after receiving the first key parameter, and the second key parameter is used for establishing a second session key between the first terminal equipment and other equipment or the target equipment.

12. The method according to claim 11, wherein the first terminal device updates the first cooperative encryption key to obtain a second cooperative encryption key comprises:

and the first terminal equipment calculates the first collaborative encryption key according to a safe one-way function to obtain a second collaborative encryption key.

13. The method according to any one of claims 1 to 12, wherein the key agreement information is carried in a packet header of the first packet.

14. The method of claim 13, wherein the first data packet further carries first service data, and the first service data is generated by the first terminal device.

15. The method according to claim 2, wherein the first key parameter and the second random number are carried in a packet header of the second data packet, and the second data packet further carries second service data, and the second service data is generated by the target device.

16. A data processing method, comprising:

a first network device receives a first data packet sent by a first terminal device, wherein the first data packet carries key negotiation information, the key negotiation information is used for establishing a session key, and the session key is used for performing secure communication between the first terminal device and a target device;

the first network equipment adds a first target parameter to the first data packet to obtain a third data packet, wherein the first target parameter is obtained by the first network equipment according to a key negotiation function;

the first network device sends the third data packet to the target device;

the first network device receives a fourth data packet sent by the target device, wherein the second data packet comprises a second target parameter, and the second target parameter is obtained by the target device according to the key negotiation function;

the first network equipment obtains a first key parameter according to the first target parameter and the second target parameter, wherein the first key parameter is used for generating the session key;

and the first network equipment sends a second data packet to the first terminal equipment, wherein the second data packet carries the first key parameter.

17. The method of claim 16, wherein the first packet further includes a first random number, the first random number is used to generate the session key, and wherein the second packet further includes a second random number, the second random number is generated by the target device, and the second random number is carried in the fourth packet.

18. The method according to claim 17, wherein the first random number is a first encrypted random number, the first encrypted random number is obtained by encrypting the first random number by the first terminal device according to a symmetric encryption algorithm, and the second random number is a random number encrypted by the target device according to the symmetric encryption algorithm.

19. The method of claim 18, wherein the first encrypted random number is obtained by the first terminal device according to first key information and the symmetric encryption algorithm, wherein the first key information is obtained by the first terminal device according to first identity information and second identity information, wherein the first identity information is used for identifying the first terminal device, and wherein the second identity information is used for identifying the target device.

20. The method of claim 19, wherein the first identity information comprises a first identity identifier and a first validity parameter, wherein the first identity identifier is used for identifying the first terminal device, wherein the first validity parameter is used for indicating a time to failure of the first identity information, wherein the second identity information comprises a second identity identifier and a second validity parameter, wherein the second identity identifier is used for identifying the target device, and wherein the second validity parameter is used for indicating a time to failure of the second identity information.

21. The method of any one of claims 16 to 20, further comprising:

the first network equipment acquires a first collaborative encryption key;

and the first network equipment encrypts the first key parameter according to the first cooperative encryption key, wherein the encrypted first key parameter is carried in the second data packet.

22. The method of claim 21, wherein the obtaining, by the first network device, the first collaborative encryption key specifically comprises:

the first network equipment receives a collaborative encryption key seed parameter sent by second network equipment, wherein the collaborative encryption key seed parameter is generated by the second network equipment;

and the first network equipment obtains the first collaborative encryption key according to the collaborative encryption key seed parameter.

23. The method according to claims 17 to 22, wherein the second data packet further includes first authentication information, the first authentication information is generated by the target device according to the first random number and the first key parameter, and the first authentication information is used by the first terminal device to determine whether to generate the session key.

24. The method of claim 23, further comprising:

the first network device receives third authentication information sent by the first terminal device, where the third authentication information is obtained by the first terminal device through calculation according to a target key parameter, the second random number, the first target parameter, and the second target parameter, the target key parameter is obtained by the first terminal device through calculation according to the first identity information, the second identity information, and a key derivation function, and the third authentication information is used by the target device to authenticate the session key;

and the first network equipment sends the third authentication information to the target equipment.

25. The method of claim 24, wherein after the first network device receives the third authentication information sent by the first terminal device, the method further comprises:

and the first network device updates the first cooperative encryption key to obtain a second cooperative encryption key, where the second cooperative encryption key is used to encrypt a second key parameter, the second key parameter is received by the first network device after receiving the first key parameter, and the second key parameter is used for the first terminal device to communicate with other devices.

26. The method of claim 25, wherein the first network device updating the first collaborative encryption key comprises:

and the first network equipment calculates the first collaborative encryption key according to a safe one-way function to obtain a second collaborative encryption key.

27. The method according to any one of claims 16 to 26, wherein the key agreement information is carried in a header of the first packet.

28. The method of claim 27, wherein the first data packet further carries first service data, and wherein the first service data is generated by the first terminal device.

29. The method according to claim 17, wherein the first key parameter and the second random number are carried in a packet header of the second data packet, and the second data packet further carries second service data, and the second service data is generated by the target device.

30. A terminal device, comprising:

a sending unit, configured to send a first data packet to a first network device, where the first data packet carries key agreement information, the key agreement information is used to establish a session key, and the session key is used for secure communication between the first terminal device and the target device;

a receiving unit, configured to receive a second data packet sent by the first network device, where the second data packet includes a first key parameter, the first key parameter is generated by the first network device according to a first target parameter and a second target parameter, the first target parameter is obtained by the first network device according to a key agreement function, the second target parameter is obtained by the second target device according to the key agreement function, and the first key parameter is used to generate the session key;

31. The terminal device of claim 30,

the generation unit is further configured to generate a first random number, where the first random number is used to generate the session key, and the first random number is carried in the first data packet;

the second data packet further includes a second random number used for generating the session key, the second random number being generated by the target device,

the generating unit is specifically configured to generate the session key according to the first random number, the second random number, and the first key parameter.

32. The terminal device of claim 31, wherein the terminal device further comprises:

the processing unit is used for encrypting the first random number according to a symmetric encryption algorithm to obtain a first encrypted random number, and the first encrypted random number is carried in the first data packet;

the second random number is a random number encrypted by the target device according to the symmetric encryption algorithm,

the processing unit is specifically configured to decrypt the second random number according to a symmetric decryption algorithm to obtain a second decrypted random number, where the symmetric decryption algorithm corresponds to the symmetric encryption algorithm;

the generation unit is further configured to generate the session key according to the first random number, the second decrypted random number, and the first key parameter.

33. The terminal device of claim 32, wherein the terminal device further comprises:

an obtaining unit, configured to obtain first identity information and second identity information, where the first identity information is used to identify the first terminal device, and the second identity information is used to identify the target device;

the processing unit is further configured to obtain first key information according to the first identity information and the second identity information;

the processing unit is specifically configured to encrypt the first random number according to the first key information and the symmetric encryption algorithm to obtain a first encrypted random number;

34. The terminal device of claim 33, wherein the first identity information comprises a first identity ID and a first validity period parameter, the first identity ID is used for identifying the first terminal device, the first validity period parameter is used for indicating a time of failure of the first identity information, the second identity information comprises a second identity ID and a second validity period parameter, the second identity ID is used for identifying the target device, the second validity period parameter is used for indicating a time of failure of the second identity information,

the processing unit is specifically configured to determine whether the second validity period parameter exceeds a preset expiration time;

and if the first identity information does not exceed the second identity information, the processing unit obtains first key information according to the first identity information and the second identity information.

35. The terminal device according to any of claims 30 to 34,

the first key parameter is encrypted by the first network device according to the first collaborative encryption key, and the processing unit is further configured to decrypt the first key parameter according to the first collaborative encryption key to obtain a first key plaintext parameter;

the generating unit is specifically configured to generate the session key according to the first key plaintext parameter.

36. The terminal device according to claim 35, wherein the receiving unit is further configured to receive a collaborative encryption key seed parameter sent by a second network device, where the collaborative encryption key seed parameter is generated by the second network device;

37. The terminal device according to any one of claims 31 to 36, wherein the second packet further includes first authentication information, the first authentication information being generated by the target device according to the first random number and the first key parameter, and the processing unit is further configured to determine whether the first authentication information is tampered;

38. The terminal device of claim 37,

the processing unit is further configured to calculate according to the first key information, the first random number, the first target parameter, and the second target parameter to obtain second authentication information;

the processing unit is further configured to determine whether the first authentication information and the second authentication information are the same;

if so, the processing unit is specifically configured to determine that the first authentication information is not tampered.

39. The terminal device of claim 38,

the processing unit is further configured to calculate according to the target key parameter, the second random number, the first target parameter, and the second target parameter to obtain third authentication information, where the third authentication information is used for the target device to perform the session key authentication;

the sending unit is further configured to send the third authentication information to the first network device.

40. The terminal device according to any of claims 35 to 39, wherein the terminal device further comprises:

an updating unit, configured to update the first collaborative encryption key to obtain a second collaborative encryption key, where the second collaborative encryption key is used to decrypt a second key parameter, the second key parameter is received by the first terminal device after receiving the first key parameter, and the second key parameter is used for establishing a second session key between the first terminal device and another device or the target device.

41. The terminal device according to claim 40, wherein the processing unit is further configured to calculate the first collaborative encryption key according to a secure one-way function to obtain a second collaborative encryption key.

42. The terminal device according to any one of claims 30 to 41, wherein the key agreement information is carried in a packet header of the first data packet.

43. The terminal device of claim 42, wherein the first data packet further carries first service data, and the first service data is generated by the terminal device.

44. The terminal device according to claim 31, wherein the first key parameter and the second random number are carried in a packet header of the second data packet, and the second data packet further carries second service data, and the second service data is generated by the target device.

45. A network device, comprising:

a receiving unit, configured to receive a first data packet sent by a first terminal device, where the first data packet carries key negotiation information, the key negotiation information is used to establish a session key, and the session key is used for secure communication between the first terminal device and the target device;

an adding unit, configured to add a first target parameter to the first data packet to obtain a third data packet, where the first target parameter is obtained by the first network device according to a key agreement function;

a sending unit, configured to send the third data packet to the target device;

the receiving unit is further configured to receive a fourth data packet sent by the target device, where the second data packet includes a second target parameter, and the second target parameter is obtained by the target device according to the key agreement function;

a processing unit, configured to obtain a first key parameter according to the first target parameter and the second target parameter, where the first key parameter is used to generate the session key;

46. The network device of claim 45, wherein the first packet further includes a first random number, and wherein the first random number is used to generate the session key, and wherein the second packet further includes a second random number, and wherein the second random number is generated by the target device and is carried in the fourth packet.

47. The network device according to claim 46, wherein the first random number is a first encrypted random number, the first encrypted random number is obtained by encrypting the first random number by the first terminal device according to a symmetric encryption algorithm, and the second random number is a random number encrypted by the target device according to the symmetric encryption algorithm.

48. The network device of claim 47, wherein the first encrypted random number is obtained by the first terminal device according to first key information and the symmetric encryption algorithm, wherein the first key information is obtained by the first terminal device according to first identity information and second identity information, wherein the first identity information is used for identifying the first terminal device, and wherein the second identity information is used for identifying the target device.

49. The network device of claim 48, wherein the first identity information comprises a first identity identifier and a first validity parameter, the first identity identifier is used for identifying the first terminal device, the first validity parameter is used for indicating a time to failure of the first identity information, the second identity information comprises a second identity identifier and a second validity parameter, the second identity identifier is used for identifying the target device, and the second validity parameter is used for indicating a time to failure of the second identity information.

50. The network device of any one of claims 45 to 49, wherein the network device further comprises:

an obtaining unit configured to obtain a first collaborative encryption key;

51. The network device of claim 50, wherein the receiving unit is further configured to receive a collaborative encryption key seed parameter sent by a second network device, and the collaborative encryption key seed parameter is generated by the second network device;

52. The network device according to claims 46 to 51, wherein the second packet further comprises first authentication information, the first authentication information is generated by the target device according to the first random number and the first key parameter, and the first authentication information is used by the first terminal device to determine whether to generate the session key.

53. The network device of claim 52,

the receiving unit is further configured to receive third authentication information sent by the first terminal device, where the third authentication information is obtained by the first terminal device through calculation according to a target key parameter, the second random number, the first target parameter, and the second target parameter, the target key parameter is obtained by the first terminal device through calculation according to the first identity information, the second identity information, and a key derivation function, and the third authentication information is used for the target device to authenticate the session key;

the sending unit is further configured to send the third authentication information to the target device.

54. The network device of claim 53, wherein the network device further comprises:

an updating unit, configured to update the first collaborative encryption key to obtain a second collaborative encryption key, where the second collaborative encryption key is used to encrypt a second key parameter, the second key parameter is received by the first network device after receiving the first key parameter, and the second key parameter is used for the first terminal device to communicate with other devices.

55. The network device of claim 54, wherein the processing unit is further configured to compute the first collaborative encryption key according to a secure one-way function to obtain a second collaborative encryption key.

56. The network device according to any of claims 45 to 55, wherein the key agreement information is carried in a header of the first packet.

57. The network device of claim 56, wherein the first data packet further carries first service data, and wherein the first service data is generated by the first terminal device.

58. The network device according to claim 56, wherein the first key parameter and the second random number are carried in a packet header of the second data packet, and the second data packet further carries second service data, and the second service data is generated by the target device.

59. A network device, characterized in that the network device comprises a processor and a memory, in which a computer program is stored, the processor executing the computer program stored in the memory to cause the network device to perform the method according to any of claims 16-29.

60. A terminal device, characterized in that the network device comprises a processor and a memory, in which a computer program is stored, the processor executing the computer program stored in the memory to cause the network device to perform the method according to any of claims 1-15.

61. A readable storage medium storing instructions that, when executed, cause the method of any of claims 1-29 to be implemented.