WO2009103214A1

WO2009103214A1 - A network authentication communication method and a mesh network system

Info

Publication number: WO2009103214A1
Application number: PCT/CN2008/073615
Authority: WO
Inventors: 樊唱东; 莫良耀; 冯丹凤; 张慧敏; 张炜
Original assignee: 华为技术有限公司
Priority date: 2008-02-20
Filing date: 2008-12-19
Publication date: 2009-08-27
Also published as: CN101516090B; CN101516090A

Abstract

A network authentication communication method and a mesh network system, in which the method includes: the network equipment computes and records the secondary key and the corresponding key identification according to the key credential information and the equipment identification of the network equipment; the Radio Frequency (RF) module in the network equipment establishes a security association with the Mesh Key Distributor (MKD) according to the key identification. The system includes a MKD and network equipments. By applying the invention, because of dividing the computing process of the key hierarchy renewedly, the computing process of the secondary key only associates with the equipment identification, rather than being bound with each RF module of the equipment. Therefore, it is not required to repeat the initial authentication process by every RF module, and a security association can be established between the network equipment which has multiple RF modules and the other network equipment only through one time initial authentication. The repeat authentication is avoided, and the efficiency of the authentication is enhanced.

Description

Network authentication communication method and mesh network system

The present invention relates to a network authentication communication method and a mesh network system, and more particularly to a method for authenticating a network device in a wireless mesh network and establishing a key for secure communication between devices, and a network capable of implementing the method Network system. Background technique

Mesh network (also known as Mesh network) is a new type of wireless network technology. Each node in a mesh network can send and receive signals, and each node can directly communicate with one or more peer nodes. . Each network node is connected in a wireless multi-hop manner through neighboring other network nodes, which can greatly increase the coverage of the wireless system. FIG. 1 is a schematic diagram of a network topology structure of an existing mesh network. Among them, the mesh network includes four logical network devices. They are Terminal (Station, abbreviated as STA), Mesh Point (MP), Mesh Access Point (MAP), and Mesh Point with a Portal. , referred to as: MPP). In order to prevent the access of illegal devices and communication eavesdropping, a secure access authentication and private communication mechanism is constructed.

In the mesh network, the 802.Hi standard for access authentication and communication security between STAs and APs provides a mature solution, so mutual authentication and communication security between nodes in MAP, MP, and MPP in mesh networks. It is an urgent problem to be solved in a mesh network. The main idea of the existing wireless mesh network security framework in 802. lis is to divide the devices of the entire wireless mesh network according to the main logical functions of the device, as shown in Figure 2, which is a logical function partition structure of the existing wireless mesh network. schematic diagram. Among them, MAP can be seen as The function of the MP logical node is added on the basis of the 802.11AP (Access Point); the MPP can be regarded as the function of adding the MP logical node on the basis of the portal. Therefore, the security of wireless mesh networks is rooted in mutual authentication and secure communication between MP logical nodes. Specifically, a logical node called a mesh key distributor (Mesh Key Distributor, MKD) is added to the wireless mesh network to authenticate each node and provide the mesh device in the mesh network. The master key that communicates with each other.

The security mechanism when MKD authenticates network devices mainly includes three parts: key level, initial authentication and security association after authentication. Figure 3A shows a mesh key hierarchy diagram of an existing wireless mesh network. MSK indicates the main session key (Main Session Key), PSK indicates the pre-shared key, ΡΜΚ indicates the pairwise master key (Pairwise Master Key), and MKDK indicates the mesh key distribution key ( Mesh Key Distribution Key), PTK stands for Pairwise Transient Key, PMK-MKD stands for Mesh Key Distributor PMK shared with MKD, and PMK-MA stands for PMK shared with MA (Mesh Authent icator PMK ) , and MPTK-KD represent Mesh PTK for Key Distribution for key distribution. Figure 3B shows a flow chart of initial authentication of an existing MP node. Figure 3C shows the security association flow chart after the existing two MP nodes are authenticated.

The existing security mechanism is bound to the MAC address of the radio that the device is requesting authentication when performing the authentication establishment key hierarchy. When the MP device has multiple radios, each radio has an independent media access control (Media Access). Controlling, referred to as: MAC) address. At this time, the above security mechanism will have the following problems:

1. Duplicate authentication of network devices.

Since the existing process of authenticating a network device is assigned with a key, a key hierarchy is established by authentication. However, each key level is bound to the MAC address of the radio module. In some cases, in order to increase the system capacity, one network device may be connected to multiple radio modules, and several radio modules work on different channels at the same time. If a network device, such as an MP device, a MAP device, or an MPP device, has multiple RF modules, each RF module establishes security with the RF module of other network devices. When fully associated, it is necessary to establish their respective key levels through authentication. Therefore, a network device having multiple radio frequency modules needs to perform multiple authentications when performing authentication based on an existing security mechanism.

2. Duplicate authentication when the network device is securely associated with the MKD node.

In the existing security mechanism, when the network device is associated with the MKD node, the MKD indexes the MKDK through the MAC address obtained in the handshake message with the MP device. Therefore, the index of the MKDK is also one-to-one corresponding to each RF module in the network device. . If the network device has multiple radio modules, you need to re-authenticate the security association between each radio and the MKD node and establish a different MKDK. Therefore, for multi-radio devices, multiple authentications are required when performing security association with MKD.

In addition, in the above-mentioned repeated multiple authentication process, when each radio frequency module is repeatedly authenticated, the access server (Acces s Server, hereinafter referred to as AS) may cause confusion of authentication behavior, thereby causing charging. pickle. Summary of the invention

A method for supporting network devices with multiple radio modules to use the security mechanism for authentication and key management, so that the network device only needs one initial authentication, that is, a security association with other network devices and MKD nodes.

An embodiment of the present invention provides a network authentication communication method, including: the network device calculates and records a secondary key and a corresponding key identifier according to the key credential information and the device identifier of the network device;

The radio frequency module in the network device establishes a security association with the mesh key distribution node MKD according to the key identifier.

An embodiment of the present invention provides a mesh network system including an MKD and a network device, where The MKD includes:

a first distribution module, configured to calculate and record the secondary keys MKDK and PMK-MKD and corresponding key identifiers MKDKName and PMK-MKDName according to the key credential information and the device identifier of the network device;

a second distribution module, configured to establish a security association with the network device according to the secondary key obtained by the first distribution module and the corresponding key identifier;

The network device includes:

a first device module, configured to calculate and record secondary keys MKDK and PMK-MKD and corresponding key identifiers MKDKName and PMK-MKDName according to the key credential information and the device identifier of the network device;

And a plurality of radio frequency modules, configured to establish a security association with the MKD according to the secondary key obtained by the first device module and the corresponding key identifier.

One embodiment of the present invention provides a method for providing a key and a key identification for a multi-radio network device in a mesh network, including:

The mesh key distribution node obtains the key credential information and the identifier of the multi-radio network device; and calculates the second-level key and the corresponding key identifier according to the key credential information and the identifier of the multi-radio network device.

An embodiment of the present invention provides a mesh key distribution node device, including: a module for obtaining key credential information; and

And a module for calculating a secondary key and a corresponding key identifier according to the key credential information and the identifier of the multi-radio network device.

Due to the re-division of the key hierarchy calculation process, the calculation process of the secondary key It only associates with the device ID and is not bound to each RF module in the device. Therefore, it is not necessary for each RF module to perform repeated initial authentication processes, so that network devices with multiple RF modules can communicate with other networks only after one initial authentication. The device establishes a security association. This eliminates duplicate certification and improves the efficiency of authentication.

BRIEF DESCRIPTION OF DRAWINGS FIG. 1 is a schematic diagram of a network topology structure of an existing mesh network; FIG. 2 is a schematic diagram of a logical function division structure of an existing wireless mesh network; FIG. 3A is a mesh key hierarchy of an existing wireless mesh network. FIG. 3B is a flowchart of initial authentication of an existing MP node; FIG. 3C is a flowchart of security association after initial authentication of two existing MP nodes; FIG. ⁴ is a network according to Embodiment 1 of the network authentication communication method of the present invention; Figure 5 is a signaling diagram of the network authentication communication method according to Embodiment 1 of the network authentication communication method of the present invention; Figure 6 is a key hierarchy of the network authentication communication method embodiment 1 of the present invention; FIG. 7 is a schematic diagram of a frame format of a multi-hop behavior frame according to Embodiment 1 of the network authentication communication method of the present invention; FIG. 8 is a flowchart of a four-step handshake process according to Embodiment 1 of the network authentication communication method of the present invention; 8 is a signaling diagram of the four-step handshake process according to Embodiment 1 of the network authentication communication method of the present invention; FIG. 9 is a flowchart of Embodiment 2 of the network authentication communication method of the present invention; FIG. 10 is a mesh network system of the present invention; Schematic.

detailed description

The first thing to note is that the mesh network includes: network devices such as MP, MAP, and ΜΡΡ. Its The MP is used to support the routing function of the mesh network interconnection, and can obtain the same wireless coverage with low transmission power through wireless multi-hop communication; the MAP has the function of the MP and the function of the AP in the traditional WLAN, It provides relay/gateway functions, supports mesh network interconnection, and provides access functions for user terminals. In addition to security functions, MPP can also implement bandwidth management to implement Layer 2 and Layer 3 conversion. For the convenience of description and expression, in the following embodiments of the present invention, only the MP is taken as an example. For other network devices such as MAP and MPP, the principles are the same and will not be described again.

Method embodiment 1

This embodiment provides a network authentication communication method, as shown in FIG. 4, including:

Step 101: The authentication server (Authenticating Server, AS for short) performs initial authentication on the MP, and returns the key credential information after the authentication is passed. The specific process can be completed by using steps 3-1 to 3-9 in the flow shown in Figure 5 of the signaling. Including the following steps:

3-1) The MP acts as the Supplicant to access the mesh network, and finds an MP node that has been authenticated as a Mesh Authenticator (MA) in the neighboring MP, and initiates an authentication request.

3-2) The MA issues an Extensible Authentication Protocol (EAP) packet (EAP-Packet) to query the identity of the newly accessed MP;

3-3) MP responds to the identity of the MA (EAP_Response Identity);

3-4) The MA node encapsulates the identity information of the MP in an action frame format and forwards it to the yang;

3-5) MKD encapsulates the identity information of the MP and sends it to the AS by using the remote authentication dialing user service (Remote Authentication Dial In User Service, Radius) / Diameter protocol;

3-6) The AS selects a pre-registered authentication protocol according to the identity information of the MP, and performs mutual authentication with the MP;

3-7) After the authentication is completed, the AS returns the response information based on the authentication result. If it fails, return a failure message (EAP-Failure); if successful, return a success message (EAP-Success) and return Key certificate information after authentication, such as MSK.

3-8) MKD encapsulates the authentication result into a behavior frame and sends it to the MA;

3-9) The MA forwards the authentication result to the newly accessed MP.

Step 102: The MKD and the MP calculate and record the secondary key PMK-MKD, MKDK, and the key identifiers PMK-MKDName and MKDKName ₀ for uniquely identifying the secondary key according to the MSK obtained in the initial authentication process.

The specific calculation method can be performed by using the following key derivation formula:

MKDKName=Truncate-128 (SHA-256 ( "MKD Key Name" | |MeshIDlength | | MeshlDl | NASIDlength | |MKD-NAS-ID| | MKDD-IDI |Dev_ID| |MPTKANonce) ) where "M" indicates field connection MKDD-ID indicates the MAC address of the MKD; MPTKANonce is the random number generated at the time of initial authentication. The network identifier MeshID of the mesh network, the NAS identifier MKD-NAS-ID of the mesh key distribution node (MKD), the domain identifier MKDD-ID of the mesh key distribution node, and the SP-ID of the multi-radio device identifier are connected. And using the key credential information for random hash processing, the generated partial stream lengths are taken as the secondary keys PMK-MKD and MKDK, respectively, and the relevant fields for calculating the secondary key, such as Mesh-ID, MKD, are used. -NAS-ID, MKDD-ID, SP-ID, etc. for hash processing, taking part of the fixed length as the key identifier PMK-MKDName bound to the secondary key And MKDKName, which identify the secondary keys PMK-MKD and MKDK, respectively.

The "Dev_ID" field used in this embodiment is used to identify a network device MP. Specifically, the user name (User_Name) in the device authentication information, the primary MAC address identifier of the MP, or the initial authentication in the MP may be used. MAC address identifier of the radio module. The MP sends the user name to the AS in the initial authentication process, so that the AS obtains the user name of the MP. The primary MAC address is obtained by the AS from the information exchanged with the MP. If the primary MAC address identifier is selected, the MP needs to be obtained. The MP uses the radio module with the primary MAC address identifier for authentication during initial authentication.

It should be noted that when the MKD and the MP calculate the secondary key and the corresponding key identifier, in addition to the MSK obtained from the initial authentication process, the pre-shared PSK may be used instead of the above key derivation formula. The MSK in the calculation is performed. Among them, PSK is the key credential information shared by MP and MKD in advance, so there is no need to pass the initial authentication process.

By using the device identification field, at the time of authentication, regardless of which RF module interface the MP is authenticated, the secondary key PMK-MKD and MKDK generated by the authentication and the corresponding key identifiers PMK-MKDName and MKDKName are only related to the device information of the MP. Associated with, regardless of the MAC address of each RF module. The secondary key is stored and managed by the device management layer of the MP, and each of the internal RF modules of the MP shares the authenticated secondary key information. Figure 6 shows the corresponding key hierarchy. The PMK-MKD and MKDK calculated by MSK or PSK belong to the device management layer. The device management layer generates and stores PMK-MKD and MKDK, and the device management layer completes the authentication. Key certificate management; PMK-MA, PTK and MPTK-KD calculated by PMK and MKDK belong to the RF management layer, and the RF management layer generates and stores the respective PMK-MA, PTK and MPTK-KD, and the RF management layer is used to manage each RF session level key.

At this point, the new node MP completes the network access authentication of the mesh network, and the two secondary keys PMK-MKD and MKDK in the key hierarchy are established between the MP and the MKD. Step 103: Each radio frequency module in the MP establishes a security association with another device and the MKD. The generated session key information PMK-MA, PTK, MPTK-KD, etc. after the establishment of the security association is independently maintained by each radio frequency module. Specifically, establishing a security association with other devices is consistent with the existing solution, and the following steps are mainly included in FIG. 3C:

2-1) to 2-2), the MP node uses the peer link open (Peer link open) frame to inform the other party that the existing PMK-MA can be used for the session connection, and the upper layer key PMK corresponding to the key. The key identifier of the MKD is PMK-MKDName; then the two parties negotiate which PMK-MA to use according to the key agreement rule in the 11 s draft;

2-3) If the two parties decide to use PMK-MA1 of MP1 and MP2 does not have PMK-MA 1, the key request can be initiated through the secure tunnel established with MKD to obtain the request. Session master key PMK-MA1 for MP 1 communication;

2-4), the MKD obtains the corresponding key PMK-MKD according to the PMK-MKDName provided in the key request of the MP2, and generates PMK-MA1 according to the MAC address of the radio frequency module communicated by the two parties, and responds by the key. The message is returned to MP2;

2-5) to 2-6), MP1 and MP2 confirm the negotiated PMK-MA key and establish a secure link. Thereafter, a security association can be established through an associated process. In addition, when the MP establishes a security association with the MKD, the four-step handshake process as described below can be employed.

Here, the frame format that can be used in the four-step handshake process is first described. In the four-step handshake process of establishing a security association, a multihop action frame can be used for transmission, and its frame format is as shown in FIG. 7. Because in practical applications, MKD can be simultaneously included with MP. Multiple network devices communicate, so a key identification field is added to the Key Holder Security element to indicate the MKDK's key identifier MKDKName. The key identifier MKDKName in the key identifier field is used to find the MKDK corresponding to a certain network device. The mesh identifier Me sh ID in the multi-hop behavior frame represents an identifier of a mesh network.

The flowchart of the four-step handshake process is as shown in FIG. 8A. The signaling diagram is as shown in FIG. 8B, and includes: Step 110: The MP sets the handshake sequence "HandShakeSequence" field in the first handshake message to 1; in the "MA-ID" In the field, fill in the MAC address of the RF module that wants to establish a security association with the MKD in the MP; fill in the MAC address of the MKD in the "MKD-ID" field; fill in the random number generated by the MP in the "MANonce" field; The identifier of the generated MKDK key is MKDKName.

Step 111: After receiving the first handshake message, the MKD generates a random number in the "MKDNonce" field, and obtains a secondary key MKDK corresponding to the MP according to the key identifier MKDKName index, according to MA-Nonce, MKD-Nonce. , MA-ID, MKD-ID, etc. calculate the session key information MPTK-KD, and calculate the MIC code, set "HandShakeSequence" to 2 in the second handshake message, fill in MA-Nonce, MKD-Nonce, MA-ID , MKD-ID, MKDKName, Message Integrity Check (MIC) and other information, and sent to the MP.

Step 112: After receiving the second handshake message, the MP checks the consistency of the MKDKName, the MA-ID, the MKD-ID, and the MA-Nonce. If the MKD-Nonce is generated, the MPTK-KD is calculated according to the MKD-Nonce generated by the MKD. Checking, verifying correctly, returning the third handshake message, including MA-Nonce, MKD-Nonce, MA-ID, MKD-ID, MKDK-Name, MIC, etc., to MKD;

Step 113: The MKD also performs a session parameter consistency check and a MIC check on the third handshake message. After the verification is passed, the fourth handshake message is sent to confirm the third handshake message.

Method embodiment 2 This embodiment provides another network authentication communication method. As shown in FIG. 9, the method includes the following steps: Step 201: When the AS performs initial authentication on the MP, the MP sends the MAC address of all the radio frequency modules as the identity information to the MKD. .

Step 202: The itMKD associates the received itMAC address with the i-device identifier of the i^MP. Step 203: The MKD and the MP calculate and record the secondary key and the corresponding key identifier according to the obtained MSK. Specifically, the user name of the MP, the primary MAC address identifier of the MP, or the MAC address identifier of the radio module that is initially authenticated in the MP may be used as the Dev_ID field in the key derivation formula. See step 102 for a specific key derivation formula.

Step 204: After completing the calculation of the secondary key, a security association is also established. Specifically, the MP establishes a security association with other MPs, and the specific process is consistent with the prior art. For details, refer to FIG. 3C and related descriptions, and details are not described herein again. In addition, when each radio module in the MP establishes a security association with the MKD, the four-step handshake process as described in step 105 can still be used. The difference is that, in this embodiment, the key identifier MKDKName is not required to be indexed in the multi-hop behavior frame to index the secondary key MKDK, but the MAC address associated with the MP in the MKD and the device identifier of the MP are Find the MKDK corresponding to the MP, and then establish a security association with the radio module in the MKDK according to the MKDK.

System embodiment

This embodiment provides a mesh network system capable of implementing the foregoing method. As shown in FIG. 10, the network device 20 includes an MKD 10 and a network device 20, where the network device 20 may be MP, MAP or MPP. Its working principle is as follows:

The first distribution module 11 in the MKD 10 and the first device module 21 in the network device 20 calculate and record the secondary keys MKDK and PMK-MKD and corresponding keys according to the key credential information and the device identification of the network device 20. Identifies MKDKName and PMK-MKDName. Among them, each of the MKD1 and the network device 20 can be used. The PSK shared first is calculated. Alternatively, as shown in Fig. 10, the AS 30 may be further provided. Before the second level key is calculated, the first authentication module 31 in the AS 30 performs initial authentication on the network device 20. In the authentication process, the network device 20 and the AS 30 respectively generate corresponding MSKs; and the second authentication module 32 The MSK generated after the first authentication module 31 of the AS 30 is authenticated is sent to the MKD 10 as key credential information. The first distribution module 11 in the MKD 10 and the first device module 21 in the network device 20 are further calculated according to the respective MSK and the device identification of the network device 20. Thereby two secondary keys PMK-MKD and MKDK in the key hierarchy between the network device 20 and the MKD 10 are established. For a specific key derivation formula, refer to method embodiment 1.

After completing the calculation of the secondary key, a security association is also established. Specifically, the network device 20 is required to establish a security association with other network devices, and the specific process is consistent with the prior art. For details, refer to FIG. 3C and related descriptions, and details are not described herein. In addition, the network device 20 is also required to be established with the MKD10. The security association is as follows:

The second distribution module 12 in the MKD 10 establishes a security association with the network device 20 according to the secondary key obtained by the first distribution module 11 and the corresponding key identifier. Correspondingly, the network device 20 is further provided with multiple radio frequencies. The module, as shown in FIG. 10, is represented by the radio frequency module 22. The radio frequency module 22 is configured to establish a security association with the MKD 10 according to the secondary key obtained by the first device module 21 and the corresponding key identifier. For the process of establishing a security association, refer to the four-step handshake process described in the method embodiment 1, and details are not described herein again.

With the foregoing embodiments of the present invention, the calculation process of the key hierarchy is re-divided, so that the calculation process of the secondary key is only related to the device identification, and is not bound to each radio module in the device, so Each RF module performs a repeated initial authentication process, so that the network device with multiple RF modules can establish a security association with other network devices after an initial authentication. This eliminates duplicate certification and improves the efficiency of authentication.

Claims

Rights request

A network authentication communication method, characterized in that:

The network device calculates and records the second-level key and the corresponding key identifier according to the key credential information and the device identifier of the network device;

2. The network authentication communication method according to claim 1, wherein the calculating, by the network device, the secondary key and the corresponding key identifier according to the key credential information and the device identifier comprises:

The network device performs initial authentication with the authentication server AS, and returns to the primary session key MSK after the authentication is passed;

The network device calculates the secondary key and the corresponding key identifier according to the MSK and the device identifier.

The network authentication communication method according to claim 1, wherein the calculating, by the network device, the secondary key and the corresponding key identifier according to the key credential information and the device identifier comprises: the network The device calculates the secondary key and the corresponding key identifier according to the pre-shared key PSK and the device identifier.

4. The network authentication communication method according to claim 1, wherein said secondary key comprises a mesh key distribution key MKDK and a pairwise master key PMK-MKD shared with the mesh key distribution node MKD. The key identifier of the MKDK is a mesh key distribution key identifier MKDKName, and the key identifier of the PMK-MKD is a pairwise master key identifier PMK-MKDName shared with the MKD.

The network authentication communication method according to claim 4, wherein the establishing, by the radio frequency module in the network device, the security association with the MKD according to the key identifier comprises:

Transmitting, by the network device, the MK training ame generated by the network device to the yang;

The MKD obtains the MKDK generated by the MKD according to the MKDKName index;

The network device establishes a security association with the MKD according to the MKDK.

The network authentication communication method according to claim 5, wherein the network device sends the MKDKName generated by the network device to the MKD, and the MKDKName is carried in the first handshake message and sent to the MKD;

The first handshake message is a multi-hop behavior frame, and the MKDKName is carried in a key identifier field in the multi-hop behavior frame.

7. The network authentication communication method according to claim 2, wherein the calculating and recording the secondary key and the corresponding key identifier further comprises:

The network device sends the MAC address of all its radio frequency modules as identity information to the

MKD;

The MKD saves the received MAC address in association with the device identifier of the network device.

The network authentication communication method according to claim 7, wherein the establishing, by the radio frequency module in the network device, the security association with the MKD according to the key identifier comprises:

The MKD searches for an MKDK corresponding to the network device according to the MAC address associated with the MKD and the device identifier of the network device;

The MKD establishes a security association with the radio frequency module according to the found MKDK.

The network authentication communication method according to any one of claims 1 to 8, wherein the device identifier comprises: a user name of the network device, a primary media access control layer MAC address identifier, or an initial through the network device. MAC address identifier of the certified RF module.

10. The method according to claim 1, further comprising: the mesh key distribution node calculating and recording the secondary key and the corresponding key according to the key credential information and the device identifier of the network device Logo.

A mesh network system, comprising: an MKD and a network device, wherein the MKD includes:

a first distribution module, configured to calculate and record the secondary key MKDK and PMK-MKD and the corresponding key identifier MKDKName according to the key credential information and the device identifier of the network device PMK-MKDName ;

The network device includes:

12. The mesh network system according to claim 1, further comprising an AS, wherein the AS comprises:

a first authentication module, configured to perform initial authentication on the network device;

The second authentication module is configured to send the MSK generated after the first authentication module is authenticated as the key credential information to the MKD.

The mesh network system according to claim 1 or 12, wherein the network device is a mesh node MP, a mesh access node MAP or a mesh node MPP with an entry.

A method for providing a key and a key identifier for a multi-radio network device in a mesh network, the method comprising:

The method according to claim 14, wherein the calculating the secondary key and the corresponding key identification process according to the key credential information and the identifier of the network device in the mesh network is:

Connect the network identifier, the network access server identifier of the mesh key distribution node, the domain identifier of the mesh key distribution node, and the multi-radio device identifier, and use the key credential information to perform Machine hash processing.

16. The method according to claim 14, wherein the identifier of the multi-radio network device is only:

Use the user name in the device authentication information or the primary MAC address of the mesh node MP or the MAC address of the radio module that is initially authenticated in the MP.

The method according to claim 14, wherein the calculating the secondary key and the corresponding key identification process according to the key credential information and the identifier of the multi-radio network device further comprises:

The secondary key and the corresponding key identifier are saved.

18. A mesh key distribution node device, characterized in that the device comprises: a module for obtaining key voucher information;

19. The device according to claim 18, wherein the device further comprises: means for saving the secondary key and a corresponding key identifier.