WO2011134292A1 - Establishment method, system and device for communication keys among nodes - Google Patents

Abstract

An establishment method, system and device for communication keys among nodes are disclosed. The method comprises the following steps: 1) a transmission source node transmits a first key announcement packet to a switch equipment ; 2) the switch equipment transmits a second key announcement packet to a switch equipment ; 3) the switch equipment transmits a third key announcement packet to a destination node ; 4) the destination node transmits a third key announcement acknowledgement packet to the switch equipment ; 5) the switch equipment transmits a second key announcement acknowledgement packet to the switch equipment ; 6) the switch equipment transmits a first key announcement acknowledgement packet to the transmission source node ; 7) the transmission source node receives the first key announcement acknowledgement packet; wherein all of the first key announcement packet, the second key announcement packet and the third key announcement packet include a communication key between the transmission source node and the destination node . With such solution, keys among legal nodes of a local area network can be established and updated flexibly.

Description

 Method, system and device for establishing communication key between nodes

 This application claims to be submitted to the Chinese Patent Office on April 29, 2010, the application number is 201010159675.2, and the invention name is "a method and system for establishing a communication key between nodes," the priority of the Chinese patent application, the entire contents of which are The citations are incorporated herein by reference.

Technical field

 The present invention relates to the field of communication network applications, and in particular, to a method, system and device for establishing a communication key between nodes.

Background technique

 Wired LANs are generally broadcast networks. Data sent by one node can be received by other nodes. Each node on the network shares a channel, which brings great security risks to the network. As long as the attacker accesses the network for monitoring, it can capture all the packets on the network. The LAN of the existing national standard GB/T 15629.3 (corresponding to IEEE 802.3 or ISO/IEC 8802-3) does not provide a data privacy method, which makes it easy for an attacker to steal key information.

 In wired LANs, the IEEE implements link layer security by security enhancements to IEEE 802.3. IEEE 802.1AE provides a data encryption protocol for protecting Ethernet, and uses hop-by-hop encryption security measures to securely communicate data between network nodes. This security measure imposes a huge computational burden on the switching devices in the LAN, which is likely to cause an attacker to attack the switching device; and the delay of the data packet from the transmitting node to the destination node is also increased, and the network transmission is reduced. effectiveness.

 The topology of the wired LAN is more complicated, and the number of nodes involved is also relatively large. Therefore, the data communication in the network is relatively complicated, and the terminal and the switching device are collectively referred to as nodes. If static keys are assigned between LAN nodes to ensure secure communication between nodes, the process of allocation and updating is extremely complicated.

Summary of the invention

 In order to solve the above problems in the prior art, the embodiments of the present invention provide a method, a system, and a device for establishing an inter-node communication key, which are capable of flexibly establishing and updating keys between the legal nodes of the local area network.

 The technical solution of the present invention is: The present invention is a method for establishing a communication key between nodes, and the method includes the following steps:

1) the sending source node Ns^e sends the first key announcement packet to the switching device SW _FlKt ;

2) The switching device SW _FIRST sends a second key advertisement packet to the switching device SWL 3) The switching device SW _St sends a third key announcement packet to the destination node N _Destmatl . _n ;

4) Destination node N _Destmatl . _n sending a third key notification response packet to the switching device SW _St ;

5) The switching device SWj^ sends a second key notification response packet to the switching device SW _FlKt ;

6) The switching device SW _First sends a first key notification response packet to the sending source node _{First 8∞Γ∞} ;

 7) the sending source node Ns^e receives the first key notification response packet;

The first key advertisement packet, the second key advertisement packet, and the third key advertisement packet all include the source node N ce and the destination node N _Destmat1 . Communication key between _n

KEY _SD .

A system for establishing an inter-node communication key, the system for establishing an inter-node communication key includes transmitting a first key advertisement packet to a switching device SW _First , and receiving a first key advertisement response packet sent by the switching device SW _First Transmitting a source node _{∞Γ∞ 8∞Γ∞} ; receiving a first key advertisement packet sent by the source node Ns^ce, sending a second key advertisement packet to the switching device SWL _ast , and receiving a second key advertisement sent by the switching device SWL _ast Transmitting the packet, transmitting the first key advertisement response packet to the source node First _8∞Γ∞ , switching the device SW _First ; receiving the second key advertisement packet sent by the switching device SW _First , to the destination node N _Destmatl . _n sends a third key advertisement packet, and receives the destination node N _Destinatl . The third key advertisement response packet sent by _n , the switching device SWL _ast transmitting the second key advertisement response packet to the switching device SW _F1Kt ; the third key advertisement packet sent by the receiving switching device SW _Last, sent to the switching device SW _Last The third key announces the destination node N _{Destmatl of the} response packet. _The first key advertisement packet, the second key advertisement packet, and the third key advertisement packet all include the source node N s _{∞ rce} and the destination node N _Destinatl . Communication key KEY _D between _n .

 A device, the device is a terminal device or a switching device, and the device includes:

Key notification module, means for, when the transmission source node is _Ν υΓ∞, transmitting a first key notification packet to the first switching device _SW FlKt, the first key notification packet includes a transmission source node N _s The communication key between the _∞rce and the destination node ^^^ causes the first switching device SW _First and the second switching device SWj to send the communication key KEY D to the destination node N _Destinatl . _n-; a receiving module, means for, when the transmission source node is _Ν 8∞Γ∞, receiving a first key of first switch devices SW _First advertisement response packet sent, by the first key announcement response After the verification of the packet, the source node Nw and the destination node N _{Destmatl are sent} . _n Communication is performed using the communication key KEY D. The advantages of the present invention are: The source node ^ is sent. ^ and destination node N _Destinatl . The communication key between _n is temporarily generated by the sending source node Ns^ce, and is gradually advertised to the destination node N _Destinatl through the established secure connection channel. _n . The process of establishing and updating the shared key between nodes may be triggered by the sending source node _{∞Γ∞ 8∞Γ∞} . Through this method, the legitimate nodes of the local area network can flexibly establish and update the keys between them, and the administrator does not need to deploy a shared static key between the two nodes. DRAWINGS

 FIG. 1 is a schematic diagram of a process of establishing an inter-node communication key according to the present invention.

detailed description

The node N (Node) defined in the present invention refers to a physical layer device such as a user terminal STA (STAtion) and a switching device SW (SWitch) _{0 in a} local area network, which are not handled as nodes.

 It is assumed that a secure connection has been established between the adjacent switching device and the user terminal in the network through pre-distribution or other security mechanisms, ie, has a shared key; all switching devices are pre-distributed or otherwise securely between the two. The mechanism has established a secure connection, which already has a shared key.

To send the source node to the destination node N _Destmatl . The establishment of the communication key between _n is described as an example. The switching device SW _First refers to the source node N s _{∞ rce} to the destination node N _Destinatl . The first switching device through which the data packet of _n passes, and the switching device SWL _ast refers to the last switching device that passes through the source node N _s∞rce to the destination node N _DestmatlM ^ packet.

According to the above assumption, the source node Ns^ce has established a secure connection with the switching device SW _First , and the shared key is recorded as KEY _S and the destination node N _Destmatl . _n A secure connection has been established with the switching device SWi^, the shared key is recorded as KEY _D , the switching device SW _FLKT and the switching device SWJ ^ have established a secure connection, and the shared key is recorded as KEY _F .

Referring to FIG. 1 , a method for establishing an inter-node communication key provided by the present invention is a specific scheme for establishing a communication key between a source node N _s∞rce and a destination node N _Destmatira ^ as follows:

1) The sending source node Ns^e sends a key notification packet 1 to the switching device SW _First ;

The key announcement packet 1 includes:

 Its towel:

ID _Destinati . _n field: indicates the destination node N _Destinati . The identity of _n ;

E KEY D) field: represents the key information and data, Ν by a transmission source node and the exchange using its _ΥΓ∞ The key KEY _S between the device SW _FIRST and the KEY _S encrypted data; wherein KEY _S is a random number generated by the source node N _s∞rce as the destination node N _Destmatl . Communication key between _n ;

MIC1 field: Indicates the message integrity verification code, which is calculated by the source function Ns^ce using the key KEY _S between it and the switching device SW _FIRST to advertise the other fields outside the field in the packet 1 by the hash function. The hash value.

2) The switching device SW _FIRST sends a key notification packet 2 to the switching device SWL

After receiving the key advertisement packet 1 by the switching device SW _FIRST , the following processing is performed:

 2.1) Verify that the MIC1 is correct by using the key KEYs between it and the source node. If not, discard the packet; otherwise, execute 2.2);

2.2) Using the key KEYs decryption field between it and the source node Ν _8∞Γ∞ , the inter-node communication key KE Y _S _ _D can be obtained;

2.3) Construction Key Announcement Packet 2 is sent to the switching device SWL _ast

The key announcement packet 2 includes:

 Its towel:

ID _S field: indicates the identifier of the sending source node N _s ;

ID _DESTMATL . _n field: Indicates the destination node N _Destmatl identifier, which has the same value as the ID _DESTINATL in the received key announcement packet 1. The value of the _n field;

E ₂ (KEY _SD ): indicates key data data, which is decrypted by the switching device SW _FIRST using the key KEY _F _L between the switching device SWL _AST and the decrypted inter-node communication key KEY _s _j^p data;

MIC2 field: indicates a message integrity verification code, which is calculated by the switching device SW _FIRST using the key KEY _F _L between the switch and the switching device SWL _AST to advertise the other fields outside the field in the packet 2 by the hash function. Hash value.

3) The switching device SWj^ sends the key notification packet 3 to the destination node N _{Destmatl n} ;

After receiving the key advertisement packet 2, the switching device SWL _AST performs the following processing:

3.1) using a switching device which _SW FLKR ^ ¾] key KEY _F _L MIC2 to verify correct, if correct, the packet is discarded; otherwise, 3.2);

3.2) Using the key KEY _F between the switching device SW _{FIRST to} decrypt the E ₂ (KEY ^ _D ) field, the inter-node communication key KE Y _S _ _D can be obtained; 3.3) Constructing a key announcement packet 3 to be sent to the destination node N

 The key announcement packet 3 includes:

ID Source E ₃ (KEY _SD ) MIC3

 Its towel:

IDs^e field: indicates the identifier of the source node N _s∞rce , the value of which is the same as the value of the ID ce field in the received key announcement packet 2;

E ₃ (KEY _S _ _D ) field: indicates key data data, which is used by the switching device SWL _ast with the destination node N _Destmatl . The key KEY _D between _n is encrypted by the decrypted inter-node communication key KEY D;

MIC3 field: Indicates the message integrity verification code, which is used by the switching device SWj^ with the destination node N _Destmatl . The key KEY _D between _n advertises the hash value calculated by the hash function for the other fields outside the field in the packet 3.

4) destination node N _Destmatira ^ send key notification response packet 3 to switching device SW _St ;

Destination node N _Destmatl . _After receiving the key advertisement packet 3, the following processing is performed:

4.1) verifying whether the MIC3 is correct by using the key KEY _D with the switching device SW _Last , if not, discarding the packet; otherwise, executing 4.2);

4.2) Using the key KEY _D between the switching device SWj^ to decrypt the E ₃ (KEY^ _D ) field, the inter-node communication key KEY _S _ _D can be obtained, and the KEY _S _ _{D is} the destination node N _Destmatl . _n and the source node. Communication key between

4.3) The construction key notification response packet 3 is sent to the switching device SWL _ast .

 The key notification response packet 3 includes:

 ID Source MIC4

 Its towel:

IDs^e field: indicates the identifier of the source node N _s∞rce , the value of which is the same as the value of the ID ce field in the received key announcement packet 3;

MIC4 field: indicates the message integrity verification code, which is _calculated by the destination node N _Destmatira ^ with the key KEY _D between the switching device SW _St and the other fields outside the field in the response packet 3 of the key. Hash value.

5) The switching device SWL _ast sends a key notification response packet 2 to the switching device SW _FlKt ; After receiving the key notification response packet 3, the switching device SWL _ast performs the following processing:

 5.1) Compare the IDs^ce field with the IDs^ce field value in the previously sent key advertisement packet 3, if not, discard the packet; otherwise, execute 5.2);

5.2) Utilize with the destination node N _Destinatl . The key KEY _D between _n verifies whether the MIC3 is correct. If not, discard the packet; otherwise, execute 5.3);

5.3) The construction key notification response packet 2 is sent to the switching device SW _First .

 The temporary key agreement response packet includes:

 ID Source ID Destination MIC5

 Its towel:

IDs^e field: indicates the identifier of the source node N _s∞rce , the value of which is the same as the value of the ID ce field in the received key announcement packet 2;

ID _Destmatl . _n field: indicates the destination node N _Destmatl . The ID, whose value is the ID _{Destinatl in} packet 2, is the same as the received key. The value of the _n field;

 MIC5 field: Indicates the message integrity verification code, used by the switching device SWj ^ and the switching device

The key KEY _F between SW _{FlKt reports the} hash value calculated by the hash function for the other fields outside the field in the response packet 2 of the key.

6) The switching device SW _Flrst sends a key notification response packet 1 to the sending source node

_After receiving the key notification response packet 2, the switching device SW _FlKt performs the following processing:

6.1) Check the ID _s∞rce field in the group, ID _Destmatl . _n field is sent to the switching device before

Whether the corresponding field value in the key notification packet 2 of SWL _ast is consistent, if not, discard the packet; otherwise, perform 6.2);

6.2 between the key KEY _F) with switching equipment using SWj ^ _ _L MIC5 verify correct, if correct, the packet is discarded; otherwise, 6.3);

 6.3) Constructing a Key Announcement Response Packet 1 Sending to the source node Ns^^

 The key notification response packet 1 includes:

 ID Destination MIC6

 Its towel:

ID _Destmatl . _n field: indicates the destination node N _Destinatl . The ID, whose value is the same as the ID of the received key, is set to ID _{Destinatl in} Group 1. The value of the _n field; MIC6 field: indicates a message integrity verification code, which is calculated by the switching function by the switching device SW _First using the key KEY _S between the transmission source node Ns^ce and the other fields outside the field in the key notification response packet 1. The hash value.

 7) The sending source node Ns^ce receives the key notification response packet 1;

 After the source node Ns^ee receives the key advertisement response packet 1, it performs the following processing:

7.1) Check the ID _Destmatl in the _group . _{The n} field is associated with the ID _{Destinatl in} packet 1 that was previously sent to the switching device SW _First . Whether the value of the _n field is consistent, if not, discard the packet; otherwise, perform 7.2);

7.2) Verify that the MIC6 is correct by using the key KEY _S with the switching device SW _First . If not, discard the packet; otherwise, the source node Ns^ce and the destination node N _{Destinatl are completed} . The establishment process of the communication key KEY _S _ _D between _n , after which the source node N s _{∞ rce} and the destination node N _{Destmatl are transmitted} . The communication key KEY _S _! 3⁄4 line secret communication can be used between _n .

Send the source node. Need to target the node N _Destmatl . _n Establishing a communication key When performing the above implementation, the sending source node Ns^ce can also generate a value as an identifier of the communication key establishment process, and the identifier can be a clock, a sequence number or a random number, and Carrying in each message, correspondingly switching device SWj ^ After receiving the key notification response packet 3, it is necessary to verify whether the identity value in the packet is consistent with the identity value in the previously received key notification packet 2; Switching device SW _First After receiving the key notification response packet 2, it is required to verify whether the identity value in the packet is consistent with the identity value in the key notification packet 1 received before; the source node Ν _{8∞Γ∞ needs to} receive the key notification response packet 1 It is verified whether the identity value in the packet is consistent with the identity value in the key notification packet 1 previously sent.

When the specific implementation is implemented by using the foregoing solution, the source node Ν _8∞Γ∞ , the switching device SW _First, and the switching device SW _{Last may} also transmit the key advertisement packet 1, the key advertisement packet 2, and the key advertisement packet 3. Each of the two independently generates a value as an advertisement identifier carried in the foregoing packet, and the advertisement identifier may be a clock, a sequence number, or a random number, and accordingly, the switching device SWL _ast , the switching device SW _First, and the sending source node Nso^e receive the password. After the key notification response packet 3, the key advertisement response packet 2, and the key advertisement response packet 1, both need to verify whether the advertisement identifier value in the packet is consistent with the identifier value in the previously transmitted packet.

A system for establishing an inter-node communication key, the system for establishing a communication key between nodes includes transmitting a key notification packet to the switching device SW _First , and transmitting a key notification response packet 1 sent by the receiving switching device SW _F1Kt Node Ν _8∞Γ∞ ; receiving the key notification packet sent by the source node Ν _8∞Γ∞ Packet sent to the switching device SWL _ast key announcement 2, the device receiving the exchange key announcement response packet sent SWL _ast 2, SW _First switch device in response to a packet transmission source node transmits _N s∞rce key announcement; receiving switching device The key notification packet 2 sent by SW _First to the destination node N _Destmatl . _n sends a key announcement packet 3, and receives the destination node N _Destinatl . The key notification response packet sent by _n , the switching device SW _Last transmitting the key notification response packet 2 to the switching device SW _First ; receiving the key advertisement packet 3 sent by the switching device SWL _{ast, and} transmitting the key notification to the switching device SWL _ast Response destination node of group 3

Ni) estimation.

An apparatus, the apparatus may be a terminal device or switching device, the apparatus may comprise: a key announcement module, means for, when the transmission source node v _υΓ∞, transmitting a first key notification packet to the first switching The device SW _FlKt , the first key advertisement packet includes a communication key between the source node N _s∞rce and the destination node ^^^ to make the first switching device SW _First and the second switching device SWL _ast The communication key KEY D is sent to the destination node N _Destinatl . _n-; a receiving module, means for, when the transmission source node is _Ν 8∞Γ∞, receiving a first key of first switch devices SW _First advertisement response packet sent, by the first key announcement response After the verification of the packet, the source node Nw and the destination node N _{Destmatl are sent} . _n Communication is performed using the communication key KEY D.

 The device may further include:

An announcement response module is used when the device is a destination node N _Destmatl . _{When n} , the third key advertisement packet sent by the second switching device SW _{Last is} received, and the sending source node N _s∞rce and the destination node N _{Destmat1 in the} third key advertisement packet are _extracted . a communication key KEY _S _ _D between _n ; and constructing a third key advertisement response packet to be sent to the second switching device SW _Last , so that the second switching device SWj^ sends a second key notification response packet to the first exchange devices SW _first, a first switching device SW _first transmitting a first key announcement response packet to the transmission source node

 The device may further include:

The first notification module is configured to: when the device is the first switching device SW _F1Kt , receive the first key advertisement packet sent by the sending source node Ns^ce, and extract the sending source node in the first key advertisement packet Ν _{8∞ Γ∞} with the destination node N _Destmatl . The communication key KEY _S _ _D between _n , and constructs a second key advertisement packet sent to the second switching device SWL to transmit the source node Ν _8∞Γ∞ and the destination node N _Destinatl through the second key advertised packet. The communication key KEY _S _ _D between _n is sent to the second switching device S WL _AST to enable The second switching device SWL _ast sends the communication key KEY D to the destination node N _Destinatl . _n-; receiving a second switching device SWL _ast transmitting second key announcement response packet, and the configuration of the first key announcement response packet to the transmission source node Ν _{8 (Λ} ^

 The device may further include:

A second announcement module, when said second switching device is a device SWL _ast, receiving a first transmission switching device _SW FlKt second key notification packet, extracting the second key notification packet transmission source node _N s∞ _Rce and destination node N _Destmatl . A communication key KEY _S _ _D between _n and a third key announcement packet is constructed to be sent to the destination node N _Destmatl . _n ; The communication key between the source node and the destination node ^^^ _1∞1 will be sent through the third key announcement packet! ^ _丫 ^ is sent to the destination node N _Destmatl . _n ; Receive destination node N _Destmatl . _n transmitting the third key advertisement response packet, constructing the second key advertisement response packet to be sent to the first switching device SW _First ; so that the first switching device SW _First sends the first key advertisement response packet to the sending source node Ns^ ^

Claims

Rights request

1. A method for establishing a communication key between nodes, characterized in that: the method includes the following steps:

1) The sending source node Ns^e sends the first key announcement packet to the switching device SW _FlKt ;

2) The switching device SW _First sends the second key advertisement packet to the switching device SW _St ;

3) The switching device SWL _ast sends the third key advertisement packet to the destination node N _Destmatl . _n ;

4) Destination node N _Destmatl . _nSend the third key announcement response packet to the switching device SW _St ;

5) The switching device SWj^ sends the second key advertisement response packet to the switching device SW _FlKt ;

6) The switching device SW _FIRST sends the first key announcement response packet to the sending source node N _8∞Γ∞ ;

7) The sending source node Ns^e receives the first key announcement response packet;

The first key advertisement group, the second key advertisement group and the third key advertisement group all include the sending source node Ns^ce and the destination node N _Destmatl . communication key between _n

_KEYSD .

2. The method for establishing a communication key between nodes according to claim 1, characterized in that: in step 1), the first key notification packet includes ID _Destmatl . _n field, E KEY D) field and MIC1 field; among them:

ID _Destmatl . _n field: Indicates the destination node N _Destmatl . Identification of _n ;

E KEY D) field: represents the key material data, which is the data encrypted by the sending source node Ν _ΥΓ∞ using the key KEY _S between it and the switching device SW _FIRST ; where _{KEY S is} the data encrypted by the sending source node N The random number generated by _s∞rce is used as the destination node N _Destmatl . Communication key between _n ;

MIC1 field: Represents the message integrity verification code, which is calculated by the sending source node Ns^ce using the key KEY _S between it and the switching device SW _FIRST through a hash function for other fields in the first key announcement group except this field. hash value.

3. The method for establishing a communication key between nodes according to claim 2, characterized in that: in step 2), the switching device SW _FLKT sends the second key after receiving the first key announcement packet. Key advertisement packet is sent to the switching device SWL _ast ,

The switching device SW _FIRST sends the second key notification packet to the switching device SW _LAST , specifically including: 2.1) Using the key KEY _S between the switching device SW _FIRST and the sending source node to verify whether MIC1 is correct, if not , then discard the packet; otherwise, perform 2.2);

2.2) Use the key KEY _S between the switching device SW _{First and} the sending source node to decrypt the E KEY D) field to obtain the inter-node communication key KEY _{S_D} ;

2.3) Construct a second key notification packet and send it to the switching device SW _St. The second key notification packet includes: I _S field, ID _{Dest n} field, E ₂ (KEY _SD ) field and MIC2 field;

Its scarf:

ID ce field: Indicates the identification of the sending source node N _{s 6} ;

ID _Destmatl . _n field: Indicates the destination node N _Destmatl identification, and its value is the same as the ID _Destinatl in the received key advertisement group 1. The value of _n field;

E ₂ (KEY _SD ) field: represents the key material data, which is the encrypted data of the inter-node communication key KEY D obtained by decrypting the key KEY _F pair between the switching device SW _FlKt and the switching device SWj^;

MIC2 field: represents the message integrity verification code, which is calculated by the switching device SW _First using the key KEY _{F_L} between it and the switching device SWL _AST to use the hash function for other fields in the second key announcement group except this field. Hash value.

4. The method for establishing a communication key between nodes according to claim 3, characterized in that: in step 3), the switching device SWL _AST sends the third key after receiving the second key announcement packet. Key advertisement packet is sent to the destination node N _{Destmatl n} ,

The switching device SWj^ sends the third key advertisement packet to the destination node N _Destinatl . _n , specifically including:

3.1) Use the key KEY _F of the switching device SWj^ and the switching device _SWFlKr ^¾] to verify whether MIC2 is correct. If it is incorrect, discard the packet; otherwise, perform 3.2);

3.2) Use the key KEY _F of the switching device SWj^ and the switching device _SWFlKr ^¾] to decrypt the _E2 (KEY _{S_D )} field to obtain the inter-node communication key _{KEY S_D} ;

3.3) Construct a third key notification packet and send it to the destination node N _Destmatl . _n , the third key notification group includes: IDs^e field, _E3 (KEY^ _D ) field and MIC3 field; wherein:

IDs^e field: Indicates the sending source node. The identifier, whose value is the same as the value of the ID _ce field in the received second key advertisement packet;

E ₃ (KEY _{S_D )} field: Indicates key material data, which is used by the switching device SWL _ast with the destination node N _Destmatl . The key KEY _D between _n pairs is decrypted and the inter-node communication key KEY _{S_D} is the encrypted number _. data;

MIC3 field: Indicates the message integrity verification code, which is used by the switching device SWj ^ with the destination node N _Destmatl . The key KEY _D between _n pairs the hash value calculated by the hash function for other fields in the third key notification group except this field.

5. The method for establishing a communication key between nodes according to claim 4, characterized in that: the destination node N _Destinatl in step 4). _n After receiving the third key advertisement packet, send the third key advertisement response packet to the switching device SWL _ast ,

The destination node N _Destmatl . _nSend the third key announcement response packet to the switching device SW _St , specifically including:

4.1) Use the key KEY _D between the switching device SW _Last to verify whether MIC3 is correct. If it is incorrect, discard the packet; otherwise, perform 4.2);

4.2) Use the _key KEY _D between the switching device SWL _ast to decrypt the E ₃ (KEY _{S_D )} field to obtain the inter-node communication key _{KEY S_D} , which is _the destination node N _Destinatl . The communication key between _n and the sending source node Ns^e;

4.3) Construct a third key notification response packet and send it to the switching device SW _Last . The third key notification response packet includes: IDs^ce field and MIC4 field; wherein:

ID ce field: Indicates the identity of the sending source node N _{s 6} , and its value is the same as the value of the ID _ce field in the received third key announcement packet;

MIC4 field: represents the message integrity verification code, calculated by the destination node N _Destmatira ^ using the key KEY _D between the switching device S WL _ast and other fields other than this field in the third key announcement response packet through a hash function. hash value.

6. The inter-node communication key establishment method according to claim 5, characterized in that: in step 5), the switching device SWL _ast sends the second key announcement response packet after receiving the third key announcement response packet. Key announcement response packet is sent to the switching device SW _First ,

The switching device SWj sends a second key advertisement response packet to the switching device SW _First , specifically including:

5.1) Compare whether the ID _S field is consistent with the ID _S field value in the previously sent third key notification packet. If they are inconsistent, discard the packet; otherwise, perform 5.2);

5.2) Use and destination node N _Destinatl . The key KEY _D between _n verifies whether MIC3 is correct, if not If correct, discard the packet; otherwise, proceed to 5.3);

5.3) Construct a second key advertisement response packet and send it to the switching device SW _First . The second key advertisement response packet includes: ID _s∞rce field, ID _Destmatira ^ field and MIC5 field, where:

IDs^e field: Indicates the sending source node. The identifier, whose value is the same as the value of the ID _ce field in the received second key advertisement packet;

ID _Destmatl . _n field: Indicates the destination node N _Destinatl . _n identifier, whose value is the same as the ID _Destmatl in the received second key advertisement packet. The value of _n field;

MIC5 field: Indicates the message integrity verification code, which is calculated by the switching device SWj ^ using the key KEY _{F_L} between the switching device SW _FLKT and other fields other than this field in the second key announcement response packet through a hash function. Hash value.

7. The method for establishing a communication key between nodes according to claim 6, characterized in that: in step 6), the switching device SW _First sends the first key notification response packet after receiving the second key notification response packet.

The switching device SW _First sends a first key advertisement response

Specifically include:

6.1) Check the ID _s∞rce field and ID _Destmatl in the group. _n field is the same as before sent to the switching device

Whether the corresponding field values in the second key notification packet of SWL _ast are consistent, if not, discard the packet; otherwise, perform 6.2);

6.2) Use the key KEY _{F_L} between the switching device SWj^ to verify whether the MIC5 is correct. If it _is incorrect, discard the packet; otherwise, perform 6.3);

6.3) Construct the first key advertisement response

The first key advertisement response packet includes: ! ^EM^ field and MIC6 field, where:

ID _Destmatl . _n field: Indicates the destination node N _Destinatl . _n identifier, whose value is the same as the ID _Destmatl in the first key notification packet received. The value of _n field;

MIC6 field: represents the message integrity verification code. The switching device SW _First uses the key KEY _S between it and the sending source node Ns^e to calculate other fields other than this field in the first key announcement response packet through a hash function. The resulting hash value.

8. The method for establishing a communication key between nodes according to claim 7, characterized in that: the specific implementation of step 7) is:

7.1) Check the ID _Destmatl in the first key advertisement response packet. _{The n} field corresponds to the ID _Destmatl in the first key advertisement packet previously sent to the switching device SW _FlKt . Whether _{the n} field values are consistent, if not, discard the packet; otherwise, perform 7.2);

7.2) Use the key KEYs of the switching device SW _FlKr to verify whether the MIC6 is correct. If it is incorrect, discard the packet; otherwise, complete the sending of the source node _N8∞Γ∞ and the destination node N _Destinatl . The establishment process of _the communication key KEY _{S_D} between _n , after which the source node N _8∞Γ∞ and the destination node N _Destmatl are sent. The communication key KEY _{S_} ! ¾ is used to communicate secretly between _n .

9. A system for establishing a communication key between nodes, characterized in that: the system for establishing a communication key between nodes includes sending a first key announcement packet to the switching device SW _FlKt , and receiving the first key notification packet sent by the switching device SW _First . The source node of the key advertisement response packet

Receive the first key advertisement packet sent by the sending source node _N8∞Γ∞ , send the second key advertisement packet to the switching device SWi^, receive the second key notification response packet sent by the switching device SWL _ast , and send the second key notification packet to the sending source node N _s∞rce the switching device SW _First that sends the first key advertisement response packet; receives the second key advertisement packet sent by the switching device SW _First to the destination node N _Destmatl . _n sends the third key announcement packet and receives the destination node N _Destmatl . The third key advertisement response packet sent by _n , the switching device SW _Last that sends the second key advertisement response packet to the switching device SW _FlKt ; receiving the third key advertisement response packet sent by the switching device SWL _ast , and sending it to the switching device SWL _ast The destination node N _Destmatl of the third key advertisement response packet. _n ; wherein the first key announcement group, the second key announcement group and the third key announcement group all include the sending source node N _8∞Γ∞ and the destination node ^^^ _The communication key KEY _{S_D} between _1∞ .

10. A device, characterized in that the device is a terminal device or a switching device, and the device includes:

A key notification module, configured to send a first key notification packet to the first switching device SW _FlKt when the device is the sending source node N _υΓ∞ , and the first key notification packet contains the sending source node N _s The communication key between _∞rce and the destination node ^^^ is such that the first switching device SW _First and the second switching device SWj ^ send the communication key KEY D to the destination node N _Destinatl . _n ; a receiving module, configured to receive the first key announcement response packet sent by the first switching device SW _First when the device is the sending source node _N8∞1∞ , and respond to the first key announcement by After the verification of the packet, the source node Nw and the destination node N _Destmatl are sent. _n uses the communication key KEY D to communicate.

11. The device according to claim 10, characterized in that the device further includes: a notification response module, used when the device is the destination node N _DESTMATL . At time _n , receive the third key notification packet sent by the second switching device SW _LAST , and extract the sending source node N _S∞RCE and the destination node N _DESTMATL in the third key notification packet. The communication key KEY _{S_D} between _n ; and construct a third key notification response packet and send it to the second _switching device SW _Last , so that the second switching device SWj^ sends the second key notification response packet to the first switch The device SW _FIRST , the first switching device SW _FIRST sends the first key announcement response packet to the sending source node _N8 „

12. The device according to claim 10, characterized in that, the device further includes: a first notification module, configured to receive, when the device is the first switching device SW _FLKT , received by the sending source node Ns^ce. The first key notification packet is to extract the sending source node N _8∞Γ∞ and the destination node N _DESTMATL in the first key notification packet. The communication key KEY _{S_D} between _n , and construct _a second key advertisement packet and send it to the second switching device SWL. Through the second key advertisement packet, the source node N _8∞Γ∞ and the destination node ^^^ are sent The communication key KEY _{S_D} between them is sent to the second switching device SW _LAST , so that the second _switching device SWL _AST sends the communication key KEY D to the destination node _NDESTINATL . _n ; Receive the second key advertisement response packet sent by the second switching device SWL _AST , and construct the first key advertisement response packet and send it to the sending source node Ns^^

13. The device according to claim 10, characterized in that, the device further includes: a second notification module, configured to receive the message sent by the first switching device SW _FLKT when the device is the second switching device SWL _AST . In the second key announcement packet, extract the sending source node N _S∞RCE and the destination node N _DESTMATL in the second key announcement packet. The communication key KEY _{S_D} between _n is constructed and the third key announcement packet is sent to the destination _node N _DESTMATL . _n ; The communication key between the source node and the destination node ^^^ _1∞1 will be sent through the third key announcement packet! ^Y^ is sent to the destination node N _DESTMATL . _n ; Receive destination node N _DESTMATL . The third key announcement response packet sent by _n constructs a second key announcement response packet and sends it to the first switching device SW _FIRST ; so that the first switching device SW _FIRST sends the first key announcement response packet to the sending source node Ns^ ^