WO2018090967A1 - 基于eoc网络的数据安全传输方法及系统 - Google Patents

基于eoc网络的数据安全传输方法及系统 Download PDF

Info

Publication number
WO2018090967A1
WO2018090967A1 PCT/CN2017/111579 CN2017111579W WO2018090967A1 WO 2018090967 A1 WO2018090967 A1 WO 2018090967A1 CN 2017111579 W CN2017111579 W CN 2017111579W WO 2018090967 A1 WO2018090967 A1 WO 2018090967A1
Authority
WO
WIPO (PCT)
Prior art keywords
key
coaxial cable
data
network unit
hierarchical
Prior art date
Application number
PCT/CN2017/111579
Other languages
English (en)
French (fr)
Inventor
张神力
Original Assignee
深圳创维数字技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳创维数字技术有限公司 filed Critical 深圳创维数字技术有限公司
Publication of WO2018090967A1 publication Critical patent/WO2018090967A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Definitions

  • the present disclosure relates to the field of communication network technologies, for example, to a data security transmission method and system based on an EOC network.
  • the two-way network access technology of Ethernet over cable (EOC) network is the most widely used in China.
  • the EOC is an access technology based on the cable protocol of the cable television coaxial cable network.
  • EOC network EOC head end equipment Coaxial Cable Line Terminal (CLT) and EOC terminal equipment Coaxial Cable Network Unit (CNU) data communication security obtained through CNU registration
  • the Network Encryption Key (NEK) ensures that the NEK encrypts and decrypts the network communication data, and during the CNU online period, the NEK will not change, and the new NEK will be allocated only when the network is re-online next time.
  • the present disclosure provides a data security transmission method and system based on EOC network, which can solve the problem that the data encryption performance is easily cracked and the data security is poor in the EOC communication data transmission process in the related art. technical problem.
  • a data security transmission method based on EOC network comprising the steps of:
  • the coaxial cable network unit sends a registration message to the coaxial cable line terminal and registers it:
  • the coaxial cable line terminal generates a hierarchical key and sends a key request message including the hierarchical key to the coaxial cable network unit;
  • the coaxial cable network unit After receiving the key request message, the coaxial cable network unit sends a key response message to the coaxial cable line terminal, where the key response message includes a hierarchical key effective state;
  • the data is encrypted or decrypted according to the hierarchical key, and the encrypted data is transmitted on the coaxial cable network unit and the coaxial cable line terminal.
  • the EOC network-based data security transmission method wherein the coaxial cable network unit sends a registration registration message to a coaxial cable line terminal and performs registration:
  • the coaxial cable line terminal allocates a network communication encrypted network encryption key for the coaxial cable network unit during the registration process, the network encryption key is a primary key, and acquires a terminal device identifier of the coaxial cable network unit .
  • the EOC network-based data security transmission method wherein the hierarchical key includes a primary key, a secondary key, and a tertiary key, and the key request message further includes: a terminal device identifier, a MAC The address, the encryption key usage time, the secondary key encryption algorithm identifier, and the third-level key encryption algorithm identifier.
  • the EOC network-based data security transmission method wherein the coaxial cable line terminal generates a hierarchical key, and sends a key request message including the hierarchical key to the coaxial cable network unit, including:
  • the second-level key is used to encrypt the random number A by using the primary key encryption algorithm to obtain the secondary key.
  • the random number A is used to encrypt the random number B by using the three-level key encryption algorithm to obtain the third-level key. ;
  • the coaxial cable line terminal sends the terminal device identifier, the MAC address, the encryption key usage time, the primary key, the secondary key, the secondary key encryption algorithm, the third level key, and the third level to the coaxial cable network unit. Key encryption algorithm.
  • the EOC network-based data security transmission method wherein the data is encrypted or decrypted according to a hierarchical key, and the encrypted data is performed between a coaxial cable network unit and a coaxial cable line terminal.
  • the transmission includes:
  • the coaxial cable line terminal sends communication data to the coaxial cable network unit
  • the data is encrypted according to the random number B to generate encrypted data, and the encrypted data is sent to the coaxial cable network unit;
  • the coaxial cable network unit After receiving the encrypted data and the primary key, the secondary key, and the third-level key, the coaxial cable network unit decrypts the secondary key by using the primary key to obtain a random number A, and the random number A is three-level secret.
  • the key is decrypted to obtain a random number B, and the random number B decrypts the encrypted data to obtain the decrypted data.
  • the communication data is encrypted or decrypted according to the hierarchical key, and the encrypted data is transmitted.
  • a data security transmission method based on an Ethernet coaxial cable EOC network, applied to a coaxial cable line terminal comprising:
  • the communication data is encrypted or decrypted according to the hierarchical key, and the encrypted data is transmitted.
  • a data security transmission device based on an Ethernet coaxial cable EOC network which is disposed in a coaxial cable network unit, and includes:
  • the first registration registration module is configured to send a registration registration message to the coaxial cable line terminal and register the registration;
  • the receiving and transmitting module is configured to receive a key request message including a hierarchical key sent by the coaxial cable line terminal, and send a key response message to the coaxial cable line terminal, where the key response message includes a hierarchical key effective state ;
  • the first data transmission module is configured to encrypt or decrypt the communication data according to the hierarchical key, and transmit the encrypted data.
  • a data security transmission device based on an Ethernet coaxial cable EOC network which is disposed at a coaxial cable line terminal, and includes:
  • a second registration registration module configured to receive a registration message sent by the coaxial cable network unit and register the coaxial cable network unit
  • a hierarchical key generation module configured to generate a hierarchical key, and send a key request message including the hierarchical key to the coaxial cable network unit;
  • the second data transmission module is configured to encrypt or decrypt the communication data according to the hierarchical key, and transmit the encrypted data.
  • a data security transmission system based on EOC network comprising:
  • the registration module is configured to send a registration registration message to the coaxial cable line terminal and register the registration;
  • a hierarchical key generation module configured to generate a hierarchical key for the coaxial cable line terminal, and send a key request message including the hierarchical key to the coaxial cable network unit;
  • the key response module is configured to send a key response message to the coaxial cable line terminal after receiving the key request message, where the key response message includes a hierarchical key effective state;
  • the data transmission module is configured to encrypt or decrypt the data according to the hierarchical key, and transmit the encrypted data between the coaxial cable network unit and the coaxial cable line terminal.
  • the EOC network-based data security transmission system wherein the registration module includes:
  • a data distribution unit configured to allocate, by the coaxial cable line terminal, a network encryption key for encrypting data communication for the coaxial cable network unit during the registration process, the network encryption key being a primary key, and acquiring a coaxial cable network
  • the terminal device identifier of the unit configured to allocate, by the coaxial cable line terminal, a network encryption key for encrypting data communication for the coaxial cable network unit during the registration process, the network encryption key being a primary key, and acquiring a coaxial cable network
  • the terminal device identifier of the unit configured to allocate, by the coaxial cable line terminal, a network encryption key for encrypting data communication for the coaxial cable network unit during the registration process, the network encryption key being a primary key, and acquiring a coaxial cable network
  • the terminal device identifier of the unit configured to allocate, by the coaxial cable line terminal, a network encryption key for encrypting data communication for the coaxial cable network unit during the registration process, the network encryption key being a primary key, and acquiring a
  • the EOC network-based data security transmission system wherein the hierarchical key includes a primary key, a secondary key, and a tertiary key, and the key request message further includes: a terminal device identifier, a MAC The address, the encryption key usage time, the secondary key encryption algorithm identifier, and the third-level key encryption algorithm identifier.
  • the EOC network-based data security transmission system wherein the hierarchical key generation module includes:
  • the hierarchical key generation unit is configured to encrypt the random number A by using an encryption algorithm identified by the secondary key encryption algorithm using a primary key to obtain a secondary key, and use the random number A to encrypt the third level key.
  • the encryption algorithm identified by the algorithm encrypts the random number B to obtain a three-level key;
  • the encryption parameter sending unit is configured to send the terminal device identifier, the MAC address, the encryption key usage time, the primary key, the secondary key, the secondary key encryption algorithm, to the coaxial cable network unit, Three-level key, three-level key encryption algorithm.
  • the EOC network-based data security transmission system wherein the data transmission module includes:
  • Data encryption and transmission unit set to send the coaxial cable line terminal to the coaxial cable network unit
  • the data is encrypted according to the random number B to generate encrypted data, and the encrypted data is sent to the coaxial cable network unit;
  • the data receiving and decrypting unit is configured to: after receiving the encrypted data and the primary key, the secondary key, and the third-level key, the coaxial cable network unit decrypts the secondary key by using the primary key to obtain the random number A.
  • the random number A decrypts the third-level key to obtain the random number B
  • the random number B decrypts the encrypted data to obtain the decrypted data.
  • a computer readable storage medium storing computer executable instructions for performing the above method.
  • a data secure transmission device comprising one or more processors, a memory and one or more programs, the one or more programs being stored in a memory, when executed by one or more processors, performing the above method.
  • a computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions that, when executed by a computer, cause the computer to execute Any of the above methods.
  • the present disclosure provides a data security transmission method and system based on EOC network.
  • the present disclosure adopts multi-layer encryption in data transmission to realize more secure transmission of data in an EOC network and ensure data communication security.
  • FIG. 1 is a flowchart of a data security transmission method based on an EOC network according to an embodiment of the present invention.
  • FIG. 2 is a schematic flow chart of step 100 in FIG. 1.
  • FIG. 3 is a schematic flow chart of step 200 in FIG. 1.
  • FIG. 4 is a schematic flow chart of the step 400 in FIG. 1.
  • FIG. 5 is a flowchart of another method for data security transmission of an EOC network according to an embodiment of the present invention.
  • FIG. 6 is a flowchart of another method for data security transmission of an EOC network according to an embodiment of the present invention.
  • FIG. 7 is a functional block diagram of a data security transmission system based on an EOC network according to an embodiment of the present invention.
  • FIG. 8 is a functional block diagram of a registration system of a data security transmission system based on an EOC network according to an embodiment of the present invention.
  • FIG. 9 is a functional block diagram of a hierarchical key generation module of a data security transmission system based on an EOC network according to an embodiment of the present invention.
  • FIG. 10 is a functional block diagram of a data transmission module of a data security transmission system based on an EOC network according to an embodiment of the present invention.
  • FIG. 11 is a schematic structural diagram of hardware of a data security transmission device according to an embodiment of the present invention.
  • This embodiment provides a data security transmission method based on an EOC network. As shown in FIG. 1, the method includes the following steps.
  • step 100 the coaxial cable network unit transmits a registration message to the coaxial cable line terminal and registers it.
  • step 200 the coaxial cable line terminal generates a hierarchical key and transmits a key request message to the coaxial cable network unit.
  • step 300 the coaxial cable network unit sends a key response message to the coaxial cable line terminal after receiving the key request message, and the key response message includes a hierarchical key effective state.
  • step 400 the data is encrypted or decrypted according to a hierarchical key, and the encrypted data is transmitted between the coaxial cable network unit and the coaxial cable line terminal.
  • the coaxial cable network unit is an EOC terminal device, referred to as CNU
  • the coaxial cable line terminal is an EOC head end device, which is denoted as CLT.
  • the CNU sends a message to the CLT and completes the registration.
  • the registration is to report the information about the coaxial cable network unit CNU to the coaxial cable line terminal CLT, and the related information includes the MAC address.
  • the CLT generates a hierarchical key for late encryption and sends a key request message containing the hierarchical key to the CNU.
  • the hierarchical key includes a primary key, a secondary key, and a third-level key
  • the key request message further includes: a terminal device identifier, a MAC address, an encryption key usage time, a secondary key encryption algorithm identifier, and Three-level key encryption algorithm identification.
  • the secondary key encryption algorithm identifier is used to identify the secondary key encryption algorithm
  • the third-level key encryption algorithm identifier is used to identify the third-level key encryption algorithm.
  • the CNU coaxial cable network unit, EOC terminal device
  • the CLT coaxial cable line terminal, EOC head end device
  • the key response message including the hierarchical secret Key activation status
  • the key response message further includes: a Terminal Equipment Identifier (TEI), a MAC address
  • TEI Terminal Equipment Identifier
  • CNU EOC terminal device
  • the TEI is obtained by the CNU to the CLT registration
  • the MAC address is the MAC address of the CNU
  • the key status refers to the key valid state, and the normal is effective
  • the hierarchical key is valid refers to the hierarchical key formality. It works, that is, the data communication between the CLT and the CNU is encrypted or decrypted by a hierarchical key.
  • step 400 during the communication between the CNU and the CLT, data encryption and decryption are performed using a hierarchical key to implement data security in the data transmission process.
  • step 100 can include the following steps.
  • step 101 the coaxial cable network unit transmits a registration message to the coaxial cable line terminal and registers it.
  • the coaxial cable line terminal is a coaxial cable network unit during registration
  • a data encryption encrypted network encryption key is assigned and the terminal device identifier of the coaxial cable network unit is obtained.
  • the CNU coaxial cable network unit, EOC terminal device
  • the CLT coaxial cable line terminal, EOC head end device
  • the CLT allocates a NEK to the CNU.
  • the NEK is used in the related art for data communication encryption between the CLT and the CNU, and does not change during normal communication between the CNU and the CLT; in the solution of this embodiment, the NEK is the first layer of the hierarchical key. The key is replaced periodically. The period is generally given by the time limit in the key request message; the replacement means that the CNU re-registers with the CLT to obtain the NEK.
  • step 200 may include the following steps.
  • step 201 the random number A is encrypted by using a primary key encryption algorithm using a primary key encryption algorithm to obtain a secondary key, and the random number B is encrypted by using the random number A using a three-level key encryption algorithm. Get a three-level key.
  • the coaxial cable line terminal sends the terminal device identifier, the MAC address, the encryption key usage time, the primary key, the secondary key, the secondary key encryption algorithm identifier, and the third to the coaxial cable network unit.
  • Level key, level 3 key encryption algorithm identifier is the terminal device identifier, the MAC address, the encryption key usage time, the primary key, the secondary key, the secondary key encryption algorithm identifier, and the third to the coaxial cable network unit.
  • the CLT coaxial cable line terminal, EOC head end device
  • the key request message includes the following content: TEI (terminal device) Identifier), MAC address, time limit, NEK (network encryption key), secondary key, secondary key encryption algorithm identification, third-level key, three-level key encryption algorithm identification;
  • the TEI terminal device
  • the identifier is used to uniquely identify an EOC terminal device (CNU) in an EOC network; the TEI is obtained by the CNU to the CLT registration; the MAC address is the MAC address of the CNU; the time limit is The encryption key used for communication between CLT and CNU The length of time is recommended to be 15-20 seconds; the encryption is implemented by using a hierarchical key; in this embodiment, the key data of the hierarchical key is determined by NEK (network encryption key), secondary key, and second The level key encryption algorithm, the third level key, and the third level key encryption algorithm are jointly
  • the hierarchical key refers to encrypting the random number A by using a primary key (NEK) using an encryption algorithm identified by a secondary key encryption algorithm to obtain a secondary key, using the random number A
  • the encryption algorithm identified by the three-level key encryption algorithm encrypts the random number B to obtain a three-level key; the random number B is used for encryption and decryption of data communication between the CLT and the CNU.
  • the encryption process of the hierarchical key is: encrypting the data to be communicated between the CLT and the CNU using the random number B, encrypting the random number B using the random number A, and encrypting the random number A using the NEK (network encryption key) .
  • the secondary key encryption algorithm and the third-level key encryption algorithm are different encryption and decryption algorithms according to different values.
  • the encryption and decryption algorithm includes: AES, DES, 3DES, and RSA; the random number A and the random number B are randomly generated by the CLT when sending a key request message to the CNU; the random number A and the random number B are in the CLT Both CNU and CNU are encrypted and transmitted.
  • step 400 may include the following steps.
  • step 401 when the coaxial cable line terminal transmits communication data to the coaxial cable network unit, the encrypted data is generated by encrypting the communication data according to the random number B, and the encrypted data is transmitted to the coaxial cable network unit.
  • the coaxial cable network unit decrypts the secondary key by using the primary key to obtain the random number A, and uses random The number A decrypts the third-level key to obtain the random number B, and the encrypted communication data is decrypted by the random number B to obtain the decrypted communication data.
  • the communication data is encrypted or decrypted by the hierarchical key between the CLT and the CNU; the communication The data is divided into communication data that the CLT sends to the CNU and communication data that the CNU sends to the CLT.
  • the communication data is the communication data sent by the CLT to the CNU
  • the communication data is encrypted on the CLT: the random number B encrypts the communication data, the random number A encrypts the random number B; the NEK encrypts the random number A; the encryption The subsequent random number B (three-level key), the encrypted random number A (secondary key), and the NEK jointly formed the hierarchical key have been sent to the receiving end CNU through the key request message in step 102; at the receiving end CNU decrypts the communication data: NEK decrypts the secondary key (encrypted random number A) to obtain random number A, and random number A decrypts the third-level key (encrypted random number B) to obtain random number B.
  • the random number B decrypts the encrypted communication data to obtain the decrypted communication data.
  • the communication data is communication data sent by the CNU to the CLT
  • the communication data is encrypted by the CNU through the hierarchical key: NEK decrypts the secondary key (encrypted random number A) to obtain a random number A, a random number A decrypts the third-level key (encrypted random number B) to obtain a random number B.
  • the random number B encrypts the communication data, and sends the encrypted data to the CLT;
  • the CLT decrypts the CNU through the hierarchical key: NEK decrypts the secondary key (encrypted random number A) to obtain the random number A, and the random number A decrypts the third-level key (encrypted random number B) to obtain the random number B, and the random number B pairs the communication data. Decrypt, and obtain the decrypted communication data.
  • FIG. 5 is a flowchart of another method for data security transmission of an EOC network according to the embodiment. The method is applied to a side of a coaxial cable network unit. As shown in FIG. 5, the method includes the following steps.
  • step 510 a registration message is sent to the coaxial cable line terminal and registered.
  • step 520 a key request message including a hierarchical key sent by the coaxial cable line terminal is received, and a key response message is sent to the coaxial cable line terminal, the key response message including a hierarchical key effective state.
  • step 530 the communication data is encrypted or decrypted according to the hierarchical key, and The encrypted data is transmitted.
  • FIG. 6 is a flowchart of another method for data security transmission of an EOC network according to the embodiment. The method is applied to a terminal end of a coaxial cable line. As shown in FIG. 6, the method includes the following steps.
  • step 610 a registration message sent by the coaxial cable network unit is received and the coaxial cable network unit is registered.
  • step 620 a hierarchical key is generated and a key request message containing the hierarchical key is sent to the coaxial cable network unit.
  • step 630 the communication data is encrypted or decrypted according to the hierarchical key, and the encrypted data is transmitted.
  • This embodiment also provides a data security transmission system based on an EOC network. As shown in FIG. 7, the system includes the following modules.
  • the registration module 100 is configured to send a registration message to the coaxial cable line terminal and register the registration.
  • the hierarchical key generation module 200 is configured to generate a hierarchical key for the coaxial cable line terminal and send a key request message to the coaxial cable network unit.
  • the key response module 300 is configured to send a key response message to the coaxial cable line terminal after the coaxial cable network unit receives the key request message, where the key response message includes a hierarchical key effective state.
  • the data transmission module 400 is configured to encrypt or decrypt the data according to the hierarchical key, and transmit the encrypted data between the coaxial cable network unit and the coaxial cable line terminal.
  • the registration module 100 may include the following units.
  • the registration unit 101 is configured to transmit a registration message to the coaxial cable line terminal and register the registration.
  • the data distribution unit 102 is configured to be a coaxial cable terminal during the registration process for the coaxial cable
  • the network element assigns a network communication encrypted network encryption key and obtains a terminal device identifier of the coaxial cable network unit.
  • the EOC network-based data security transmission system wherein the key request message includes: a terminal device identifier, a MAC address, an encryption key usage time, a primary key, a secondary key, and a secondary key. Encryption algorithm, three-level key, three-level key encryption algorithm.
  • the hierarchical key generation module 200 may include the following units.
  • the encryption parameter sending unit 201 is configured to send the terminal device identifier, the MAC address, the encryption key usage time, the primary key, the secondary key, and the secondary key encryption algorithm to the coaxial cable network unit. , three-level key, three-level key encryption algorithm.
  • the hierarchical key generation unit 202 is configured to encrypt the random number A by using an encryption algorithm identified by the secondary key encryption algorithm using a primary key to obtain a secondary key, and use the random number A to adopt a third-level key.
  • the encryption algorithm identified by the encryption algorithm encrypts the random number B to obtain a three-level key.
  • the data transmission module 400 may include the following units.
  • the data encryption and transmission unit 401 is configured to, when the coaxial cable line terminal transmits communication data to the coaxial cable network unit, encrypt the communication data according to the random number B to generate encrypted data, and transmit the encrypted data to the coaxial cable network unit.
  • the data receiving and decrypting unit 402 is configured to: after receiving the encrypted data and the primary key, the secondary key, and the third-level key, the coaxial cable network unit decrypts the secondary key by using the primary key to obtain a random number. A.
  • the third-level key is decrypted by the random number A to obtain the random number B, and the encrypted communication data is decrypted by the random number B to obtain the decrypted communication data.
  • the present embodiment provides a data security transmission method and system based on EOC network, which adopts multi-layer encryption in data transmission to realize more secure transmission of data in an EOC network and ensure data communication security.
  • the embodiment further provides a computer readable storage medium storing computer executable instructions for performing the above method.
  • FIG. 11 is a schematic diagram showing the hardware structure of a data secure transmission device according to the present embodiment. As shown in FIG. 11, the device includes: one or more processors 910 and a memory 920. One processor 910 is taken as an example in FIG.
  • the device may also include an input device 930 and an output device 940.
  • the processor 910, the memory 920, the input device 930, and the output device 940 in the device may be connected by a bus or other means, and the connection through the bus is taken as an example in FIG.
  • Input device 930 can receive input numeric or character information
  • output device 940 can include a display device such as a display screen.
  • the memory 920 is a computer readable storage medium that can be used to store software programs, computer executable programs, and modules.
  • the processor 910 performs various functional applications and data processing by executing software programs, instructions, and modules stored in the memory 920 to implement any of the above-described embodiments.
  • the memory 920 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data created according to usage of the device, and the like.
  • the memory may include volatile memory such as random access memory (RAM), and may also include non-volatile memory such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid state storage device.
  • Memory 920 can be a non-transitory computer storage medium or a transitory computer storage medium.
  • the non-transitory computer storage medium such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid state storage device.
  • memory 920 can optionally include memory remotely located relative to processor 910, which can be connected to the data secure transmission device over a network.
  • networks may include the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • the implementation of all or part of the processes in the foregoing embodiment may be performed by a computer program executing related hardware, and the program may be stored in a non-transitory computer readable storage medium, and the program may include, when executed, A flow of an embodiment of the method, wherein the non-transitory computer readable storage medium is a magnetic disk, an optical disk, a read only memory (ROM), or a random access memory (RAM).
  • the non-transitory computer readable storage medium is a magnetic disk, an optical disk, a read only memory (ROM), or a random access memory (RAM).
  • the present disclosure provides a data security transmission method and system based on EOC network.
  • the present disclosure adopts multi-layer encryption in data transmission to realize more secure transmission of data in an EOC network and ensure data communication security.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Small-Scale Networks (AREA)

Abstract

一种基于EOC网络的数据安全传输方法及系统，其中，所述方法包括：同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并进行注册登记；同轴电缆线路终端生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息；同轴电缆网络单元接收到密钥请求消息后向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态；根据层级密钥对所述数据进行加密或者解密，并将加密后的数据在同轴电缆网络单元和同轴电缆线路终端之间进行传输。

Description

基于EOC网络的数据安全传输方法及系统 技术领域
本公开涉及通信网络技术领域，例如涉及一种基于EOC网络的数据安全传输方法及系统。
背景技术
随着国内广电三网融合的普及，网络接入技术在国内广电的应用也越来越普遍，以太网同轴电缆(Ethernet Over Cable，EOC)网络双向网接入技术就是国内广电目前应用最为广泛的网络技术技术之一。其中EOC是基于有线电视同轴电缆网使用以太网协议的接入技术。
EOC网络中EOC头端设备同轴电缆线路终端(Coaxial Cable Line Terminal，CLT)和EOC终端设备同轴电缆网络单元(Coaxial Cable Network Unit，CNU)间数据通信的安全性通过CNU注册登记获取到的网络加密密钥(Network Encryption Key，NEK)来保证，NEK对网络通信数据进行加解密，并且在CNU在线期间，NEK不会改变，只有下次重新上线，才会分配新的NEK。
由于NEK在CNU在线期间，不会改变，因此会给黑客破解以足够的时间，一旦黑客想要破解EOC通信数据，那么EOC数据通信安全性得不到保证。
发明内容
本公开提供一种基于EOC网络的数据安全传输方法及系统，可以解决相关技术中EOC通信数据传输过程中，数据加密性差容易被破解，数据安全性差的 技术问题。
一种基于EOC网络的数据安全传输方法，其中，方法包括步骤：
同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并进行注册登记：
同轴电缆线路终端生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息；
同轴电缆网络单元接收到密钥请求消息后向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态；
根据层级密钥对所述数据进行加密或者解密，并将加密后的数据在同轴电缆网络单元和同轴电缆线路终端进行传输。
所述的基于EOC网络的数据安全传输方法，其中，所述同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并进行注册登记包括：
同轴电缆线路终端在注册登记过程中为同轴电缆网络单元分配数据通信加密的网络加密密钥，所述网络加密密钥为一级密钥，并获取同轴电缆网络单元的终端设备标识符。
所述的基于EOC网络的数据安全传输方法，其中，所述层级密钥包括一级密钥、二级密钥和三级密钥，所述密钥请求消息还包括：终端设备标识符、MAC地址、加密密钥使用时间、二级密钥加密算法标识、和三级密钥加密算法标识。
所述的基于EOC网络的数据安全传输方法，其中，所述同轴电缆线路终端生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息包括：
使用一级密钥采用二级密钥加密算法对随机数A进行加密，得到二级密钥，使用所述随机数A采用三级密钥加密算法对随机数B进行加密，得到三级密钥；
同轴电缆线路终端向同轴电缆网络单元发送终端设备标识符、MAC地址、加密密钥使用时间、一级密钥、二级密钥、二级密钥加密算法、三级密钥、三级密钥加密算法。
所述的基于EOC网络的数据安全传输方法，其中，所述根据层级密钥对所述数据进行加密或者解密，并将加密后的数据在同轴电缆网络单元和同轴电缆线路终端之间进行传输包括：
当同轴电缆线路终端向同轴电缆网络单元发送通信数据时，根据随机数B给数据加密生成加密数据，将加密数据发送至同轴电缆网络单元；
同轴电缆网络单元接收到加密数据和一级密钥、二级密钥、三级密钥后，利用一级密钥对二级密钥进行解密得到随机数A，随机数A对三级密钥进行解密得到随机数B，随机数B对加密数据进行解密，得到解密后的数据。
一种基于以太网同轴电缆EOC网络的数据安全传输方法，应用于同轴电缆网络单元，包括：
向同轴电缆线路终端发送注册登记消息并进行注册登记；
接收同轴电缆线路终端发送的包含层级密钥的密钥请求消息，并向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态；
根据所述层级密钥对通信数据进行加密或者解密，并将加密后的数据进行传输。
一种基于以太网同轴电缆EOC网络的数据安全传输方法，应用于同轴电缆线路终端，包括：
接收同轴电缆网络单元发送的注册登记消息并对同轴电缆网络单元进行注册登记；
生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求 消息；
根据所述层级密钥对通信数据进行加密或者解密，并将加密后的数据进行传输。
一种基于以太网同轴电缆EOC网络的数据安全传输装置，设置于同轴电缆网络单元，包括：
第一注册登记模块，设置为向同轴电缆线路终端发送注册登记消息并进行注册登记；
接收和发送模块，设置为接收同轴电缆线路终端发送的包含层级密钥的密钥请求消息，并向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态；
第一数据传输模块，设置为根据所述层级密钥对通信数据进行加密或者解密，并将加密后的数据进行传输。
一种基于以太网同轴电缆EOC网络的数据安全传输装置，设置于同轴电缆线路终端，包括：
第二注册登记模块，设置为接收同轴电缆网络单元发送的注册登记消息并对同轴电缆网络单元进行注册登记；
层级密钥生成模块，设置为生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息；
第二数据传输模块，设置为根据所述层级密钥对通信数据进行加密或者解密，并将加密后的数据进行传输。
一种基于EOC网络的数据安全传输系统，包括：
注册登记模块，设置为同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并进行注册登记；
层级密钥生成模块，设置为同轴电缆线路终端生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息；
密钥响应模块，设置为同轴电缆网络单元接收到密钥请求消息后向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态；
数据传输模块，设置为根据层级密钥对所述数据进行加密或者解密，并将加密后的数据在同轴电缆网络单元和同轴电缆线路终端之间进行传输。
所述的基于EOC网络的数据安全传输系统，其中，所述注册登记模块包括：
数据分配单元，设置为同轴电缆线路终端在注册登记过程中为同轴电缆网络单元分配数据通信加密的网络加密密钥，所述网络加密密钥为一级密钥，并获取同轴电缆网络单元的终端设备标识符。
所述的基于EOC网络的数据安全传输系统，其中，所述层级密钥包括一级密钥、二级密钥和三级密钥，所述密钥请求消息还包括：终端设备标识符、MAC地址、加密密钥使用时间、二级密钥加密算法标识和三级密钥加密算法标识。
所述的基于EOC网络的数据安全传输系统，其中，所述层级密钥生成模块包括：
层级密钥生成单元，设置为使用一级密钥采用二级密钥加密算法所标识的加密算法对随机数A进行加密，得到二级密钥，使用所述随机数A采用三级密钥加密算法所标识的加密算法对随机数B进行加密，得到三级密钥；
加密参数发送单元，设置为同轴电缆线路终端向同轴电缆网络单元发送终端设备标识符、MAC地址、加密密钥使用时间、一级密钥、二级密钥、二级密钥加密算法、三级密钥、三级密钥加密算法。
所述的基于EOC网络的数据安全传输系统，其中，所述数据传输模块包括：
数据加密及发送单元，设置为当同轴电缆线路终端向同轴电缆网络单元发 送通信数据时，根据随机数B给数据加密生成加密数据，将加密数据发送至同轴电缆网络单元；
数据接收与解密单元，设置为同轴电缆网络单元接收到加密数据和一级密钥、二级密钥、三级密钥后，利用一级密钥对二级密钥进行解密得到随机数A，随机数A对三级密钥进行解密得到随机数B，随机数B对加密数据进行解密，得到解密后的数据。
一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述方法。
一种数据安全传输设备，该设备包括一个或多个处理器、存储器以及一个或多个程序，所述一个或多个程序存储在存储器中，当被一个或多个处理器执行时，执行上述方法。
一种计算机程序产品，所述计算机程序产品包括存储在非暂态计算机可读存储介质上的计算机程序，所述计算机程序包括程序指令，当所述程序指令被计算机执行时，使所述计算机执行上述任意一种方法。
本公开提供了一种基于EOC网络的数据安全传输方法及系统，本公开在数据传输中采用多层加密，实现EOC网络中数据更加安全的传输，保证数据通信的安全性。
附图说明
图1为本实施例的一种基于EOC网络的数据安全传输方法的流程图。
图2为图1中的步骤100的流程示意图。
图3为图1中的步骤200的流程示意图。
图4为图1中的步骤400的流程示意图。
图5为本实施例的另一种EOC网络的数据安全传输方法的流程图
图6为本实施例的另一种EOC网络的数据安全传输方法的流程图。
图7为本实施例的一种基于EOC网络的数据安全传输系统的功能原理框图。
图8为本实施例的一种基于EOC网络的数据安全传输系统的注册登记模块的功能原理框图。
图9为本实施例的一种基于EOC网络的数据安全传输系统的层级密钥生成模块的功能原理框图。
图10为本实施例的一种基于EOC网络的数据安全传输系统的数据传输模块的功能原理框图。
图11为本实施例的一种数据安全传输设备的硬件结构示意图。
具体实施方式
以下对本公开进行说明。本实施例提供了一种基于EOC网络的数据安全传输方法，如图1所示，方法包括以下步骤。
在步骤100中，同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并进行注册登记。
在步骤200中，同轴电缆线路终端生成层级密钥，并向同轴电缆网络单元发送密钥请求消息。
在步骤300中，同轴电缆网络单元接收到密钥请求消息后向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态。
在步骤400中，根据层级密钥对所述数据进行加密或者解密，并将加密后的数据在同轴电缆网络单元和同轴电缆线路终端之间进行传输。
其中，步骤100中同轴电缆网络单元为EOC的终端设备，简称CNU，同轴电缆线路终端为EOC的头端设备，记为CLT。CNU向CLT发送消息并完成注册登记。注册登记是将同轴电缆网络单元CNU的相关信息上报给同轴电缆线路终端CLT，所述相关信息包括MAC地址。
在步骤200中，CLT生成后期加密用的层级密钥，并向CNU发送包含层级密钥的密钥请求消息，。所述层级密钥包括一级密钥、二级密钥和三级密钥，密钥请求消息还包括：终端设备标识符、MAC地址、加密密钥使用时间、二级密钥加密算法标识和三级密钥加密算法标识。其中，二级密钥加密算法标识用于标识二级密钥加密算法；三级密钥加密算法标识用于标识三级密钥加密算法。
步骤300中CNU(同轴电缆网络单元，EOC终端设备)接收到密钥请求并向CLT(同轴电缆线路终端，EOC头端设备)发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态；所述密钥响应消息还包含以下内容：终端设备标识符(Terminal Equipment Identifier，TEI)、MAC地址；所述TEI用于在一个EOC网络中唯一标识一个EOC终端设备(CNU)；所述TEI由CNU向CLT注册登记获取得到；所述MAC地址为所述CNU的MAC地址；密钥状态是指密钥生效状态，正常为生效；所述层级密钥生效是指层级密钥正式发挥作用，也就是CLT和CNU间的数据通信通过层级密钥来加密或者解密。
步骤400中，CNU与CLT通信过程中，数据加密和解密都采用层级密钥进行，以实现数据传输过程的数据的安全性。
如图2所示，步骤100可以包括以下步骤。
在步骤101中，同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并注册登记。
在步骤102中，同轴电缆线路终端在注册登记过程中为同轴电缆网络单元 分配数据通信加密的网络加密密钥，并获取同轴电缆网络单元的终端设备标识符。
其中，CNU(同轴电缆网络单元，EOC终端设备)向CLT(同轴电缆线路终端，EOC头端设备)发送消息并完成注册登记；所述注册登记过程，所述CLT会给CNU分配一个NEK；所述NEK在相关技术中用于CLT和CNU间的数据通信加密，并且在CNU和CLT正常通信期间都不会改变；在本实施例的方案中，所述NEK为层级密钥的首层密钥，并且会周期性的更换。所述周期一般是由密钥请求消息中的时间限制给定；所述更换是指CNU重新向CLT注册登记，获取NEK。
可选地，如图3所示，步骤200可以包括以下步骤。
在步骤201中，使用一级密钥采用二级密钥加密算法对随机数A进行加密，得到二级密钥，使用所述随机数A采用三级密钥加密算法对随机数B进行加密，得到三级密钥。
在步骤202中，同轴电缆线路终端向同轴电缆网络单元发送终端设备标识符、MAC地址、加密密钥使用时间、一级密钥、二级密钥、二级密钥加密算法标识、三级密钥、三级密钥加密算法标识。
其中，所述CLT(同轴电缆线路终端，EOC头端设备)向CNU(同轴电缆网络单元，EOC终端设备)发送密钥请求消息；所述密钥请求消息包含以下内容：TEI(终端设备标识符)、MAC地址、时间限制、NEK(网络加密密钥)、二级密钥、二级密钥加密算法标识、三级密钥、三级密钥加密算法标识；所述TEI(终端设备标识符)用于在一个EOC网络中唯一标识一个EOC终端设备(CNU)；所述TEI由CNU向CLT注册登记获取得到；所述MAC地址为所述CNU的MAC地址；所述时间限制是指CLT和CNU间通信所用的加密密钥使 用时间长度，建议为15-20秒；所述加密是通过层级密钥实现的；在本实施例中，所述层级密钥关键数据由NEK(网络加密密钥)、二级密钥、二级密钥加密算法、三级密钥、三级密钥加密算法共同构成；所述NEK(网络加密密钥)为初始密钥，又称为一级密钥，需要和注册登记获取得到的NEK保持一致；所述层级密钥是指使用一级密钥(NEK)采用二级密钥加密算法所标识的加密算法对随机数A进行加密，得到二级密钥，使用所述随机数A采用三级密钥加密算法所标识的加密算法对随机数B进行加密，得到三级密钥；所述随机数B用于CLT及CNU间数据通信的加密和解密。
层级密钥的加密过程为：使用随机数B对要在CLT及CNU间通信的数据进行加密，使用随机数A对随机数B进行加密，使用NEK(网络加密密钥)对随机数A进行加密。所述二级密钥加密算法及三级密钥加密算法是根据不同的取值标识不同的加解密算法。所述加解密算法包含：AES、DES、3DES、RSA；所述随机数A及随机数B是由CLT在给CNU发送密钥请求消息时随机产生；所述随机数A及随机数B在CLT和CNU通信过程中都是加密传输的。
可选地，如图4所示，步骤400可以包括以下步骤。
在步骤401中，当同轴电缆线路终端向同轴电缆网络单元发送通信数据时，根据随机数B给通信数据加密生成加密数据，将加密数据发送至同轴电缆网络单元。
在步骤402中，同轴电缆网络单元接收到加密数据和一级密钥、二级密钥、三级密钥后，利用一级密钥对二级密钥进行解密得到随机数A，利用随机数A对三级密钥进行解密得到随机数B，利用随机数B对加密的通信数据进行解密，得到解密后的通信数据。
其中，所述CLT和CNU间通过层级密钥加密或者解密通信数据；所述通信 数据分为CLT发送给CNU的通信数据和CNU发给CLT的通信数据。
当所述通信数据为CLT发送给CNU的通信数据时，在CLT上对通信数据做加密处理：随机数B给通信数据加密，随机数A给随机数B加密；NEK给随机数A加密；加密后的随机数B(三级密钥)、加密后的随机数A(二级密钥)及NEK共同构成的层级密钥在步骤102已经通过密钥请求消息发送给接收端CNU；在接收端CNU对通信数据做解密处理：NEK对二级密钥(加密后的随机数A)进行解密得到随机数A，随机数A对三级密钥(加密后的随机数B)进行解密得到随机数B，随机数B对加密的通信数据进行解密，得到解密后的通信数据。
当所述通信数据为CNU发送给CLT的通信数据时，在CNU通过层级密钥对通信数据进行加密：NEK对二级密钥(加密后的随机数A)进行解密得到随机数A，随机数A对三级密钥(加密后的随机数B)进行解密得到随机数B，随机数B对通信数据加密，并将加密后的数据发送给CLT；在CLT通过层级密钥对CNU进行解密：NEK对二级密钥(加密后的随机数A)进行解密得到随机数A，随机数A对三级密钥(加密后的随机数B)进行解密得到随机数B，随机数B对通信数据解密，得到解密后的通信数据。
图5是本实施例的另一种EOC网络的数据安全传输方法的流程图，该方法应用于同轴电缆网络单元侧，如图5所示，所述方法包括以下步骤。
在步骤510中，向同轴电缆线路终端发送注册登记消息并进行注册登记。
在步骤520中，接收同轴电缆线路终端发送的包含层级密钥的密钥请求消息，并向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态。
在步骤530中，根据所述层级密钥对通信数据进行加密或者解密，并将加 密后的数据进行传输。
图6是本实施例的另一种EOC网络的数据安全传输方法的流程图，该方法应用于同轴电缆线路终端侧，如图6所示，所述方法包括以下步骤。
在步骤610中，接收同轴电缆网络单元发送的注册登记消息并对同轴电缆网络单元进行注册登记。
在步骤620中，生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息。
在步骤630中，根据所述层级密钥对通信数据进行加密或者解密，并将加密后的数据进行传输。
本实施例还提供了一种基于EOC网络的数据安全传输系统，如图7所示，系统包括以下模块。
注册登记模块100，设置为同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并进行注册登记。
层级密钥生成模块200，设置为同轴电缆线路终端生成层级密钥，并向同轴电缆网络单元发送密钥请求消息。
密钥响应模块300，设置为同轴电缆网络单元接收到密钥请求消息后向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态。
数据传输模块400，设置为根据层级密钥对所述数据进行加密或者解密，并将加密后的数据在同轴电缆网络单元和同轴电缆线路终端之间进行传输。
可选地，如图8所示，其中，注册登记模块100可以包括以下单元。
注册单元101，设置为同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并注册登记。
数据分配单元102，设置为同轴电缆线路终端在注册登记过程中为同轴电缆 网络单元分配数据通信加密的网络加密密钥，并获取同轴电缆网络单元的终端设备标识符。
所述的基于EOC网络的数据安全传输系统，其中，所述密钥请求消息包括：终端设备标识符、MAC地址、加密密钥使用时间、一级密钥、二级密钥、二级密钥加密算法、三级密钥、三级密钥加密算法。
可选地，如图9所示，其中，层级密钥生成模块200可以包括以下单元。
加密参数发送单元201，设置为同轴电缆线路终端向同轴电缆网络单元发送终端设备标识符、MAC地址、加密密钥使用时间、一级密钥、二级密钥、二级密钥加密算法、三级密钥、三级密钥加密算法。
层级密钥生成单元202，设置为使用一级密钥采用二级密钥加密算法所标识的加密算法对随机数A进行加密，得到二级密钥，使用所述随机数A采用三级密钥加密算法所标识的加密算法对随机数B进行加密，得到三级密钥。
可选地，如图10所示，其中，数据传输模块400可以包括以下单元。
数据加密及发送单元401，设置为当同轴电缆线路终端向同轴电缆网络单元发送通信数据时，根据随机数B给通信数据加密生成加密数据，将加密数据发送至同轴电缆网络单元。
数据接收与解密单元402，设置为同轴电缆网络单元接收到加密数据和一级密钥、二级密钥、三级密钥后，利用一级密钥对二级密钥进行解密得到随机数A，利用随机数A对三级密钥进行解密得到随机数B，利用随机数B对加密的通信数据进行解密，得到解密后的通信数据。
综上所述，本实施例提供了一种基于EOC网络的数据安全传输方法及系统，在数据传输中采用多层加密，实现EOC网络中数据更加安全的传输，保证数据通信的安全性。
本实施例还提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述方法。
图11是根据本实施例的一种数据安全传输设备的硬件结构示意图，如图11所示，该设备包括：一个或多个处理器910和存储器920。图11中以一个处理器910为例。
所述设备还可以包括：输入装置930和输出装置940。
所述设备中的处理器910、存储器920、输入装置930和输出装置940可以通过总线或者其他方式连接，图11中以通过总线连接为例。
输入装置930可以接收输入的数字或字符信息，输出装置940可以包括显示屏等显示设备。
存储器920作为一种计算机可读存储介质，可用于存储软件程序、计算机可执行程序以及模块。处理器910通过运行存储在存储器920中的软件程序、指令以及模块，从而执行多种功能应用以及数据处理，以实现上述实施例中的任意一种方法。
存储器920可以包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需要的应用程序；存储数据区可存储根据设备的使用所创建的数据等。此外，存储器可以包括随机存取存储器(Random Access Memory，RAM)等易失性存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件或者其他非暂态固态存储器件。
存储器920可以是非暂态计算机存储介质或暂态计算机存储介质。该非暂态计算机存储介质，例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。在一些实施例中，存储器920可选包括相对于处理器910远程设置的存储器，这些远程存储器可以通过网络连接至该数据安全传输设备。上 述网络的实例可以包括互联网、企业内部网、局域网、移动通信网及其组合。
实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来执行相关的硬件来完成的，该程序可存储于一个非暂态计算机可读存储介质中，该程序在执行时，可包括如上述方法的实施例的流程，其中，该非暂态计算机可读存储介质可以为磁碟、光盘、只读存储记忆体(ROM)或随机存储记忆体(RAM)等。
工业实用性
本公开提供了一种基于EOC网络的数据安全传输方法及系统，本公开在数据传输中采用多层加密，实现EOC网络中数据更加安全的传输，保证数据通信的安全性。

Claims (20)

  1. 一种基于以太网同轴电缆EOC网络的数据安全传输方法，包括：
    同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并进行注册登记；
    同轴电缆线路终端生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息；
    同轴电缆网络单元接收到密钥请求消息后向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态；
    根据层级密钥对所述数据进行加密或者解密，并将加密后的数据在同轴电缆网络单元和同轴电缆线路终端之间进行传输。
  2. 根据权利要求1所述的方法，其中，所述同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并进行注册登记包括：
    同轴电缆线路终端在注册登记过程中为同轴电缆网络单元分配数据通信加密的网络加密密钥，所述网络加密密钥为一级密钥，并获取同轴电缆网络单元的终端设备标识符。
  3. 根据权利要求2所述的方法，其中，所述层级密钥包括一级密钥、二级密钥和三级密钥，所述密钥请求消息还包括：终端设备标识符、MAC地址、加密密钥使用时间、二级密钥加密算法标识和三级密钥加密算法标识。
  4. 根据权利要求3所述的方法，其中，所述同轴电缆线路终端生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息包括：
    使用一级密钥采用二级密钥加密算法对随机数A进行加密，得到二级密钥，使用所述随机数A采用三级密钥加密算法对随机数B进行加密，得到三级密钥；
    同轴电缆线路终端向同轴电缆网络单元发送终端设备标识符、MAC地址、加密密钥使用时间、一级密钥、二级密钥、二级密钥加密算法、三级密钥、三 级密钥加密算法。
  5. 根据权利要求4所述的方法，其中，所述根据层级密钥对所述数据进行加密或者解密，并将加密后的数据在同轴电缆网络单元和同轴电缆线路终端之间进行传输包括：
    当同轴电缆线路终端向同轴电缆网络单元发送通信数据时，根据随机数B给数据加密生成加密数据，将加密数据发送至同轴电缆网络单元；
    同轴电缆网络单元接收到加密数据和一级密钥、二级密钥、三级密钥后，利用一级密钥对二级密钥进行解密得到随机数A，随机数A对三级密钥进行解密得到随机数B，随机数B对加密数据进行解密，得到解密后的数据。
  6. 一种基于以太网同轴电缆EOC网络的数据安全传输方法，应用于同轴电缆网络单元，包括：
    向同轴电缆线路终端发送注册登记消息并进行注册登记；
    接收同轴电缆线路终端发送的包含层级密钥的密钥请求消息，并向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态；
    根据所述层级密钥对通信数据进行加密或者解密，并将加密后的数据进行传输。
  7. 根据权利要求6所述的方法，其中，所述向同轴电缆线路终端发送注册登记消息并进行注册登记包括：
    向同轴电缆线路终端发送注册登记消息并进行注册登记；
    在注册登记过程中接收同轴电缆线路终端分配的数据通信加密的网络加密密钥，所述网络加密密钥为一级密钥。
  8. 根据权利要求7所述的方法，其中，所述根据层级密钥对通信数据进行加密或者解密，并将加密后的数据进行传输包括：
    接收同轴电缆线路终端发送的加密数据，利用一级密钥对二级密钥进行解密得到随机数A，随机数A对三级密钥进行解密得到随机数B，随机数B对加密的通信数据进行解密，得到解密后的通信数据。
  9. 一种基于以太网同轴电缆EOC网络的数据安全传输方法，应用于同轴电缆线路终端，包括：
    接收同轴电缆网络单元发送的注册登记消息并对同轴电缆网络单元进行注册登记；
    生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息；
    根据所述层级密钥对通信数据进行加密或者解密，并将加密后的数据进行传输。
  10. 根据权利要求9所述的方法，其中，所述接收同轴电缆网络单元发送的注册登记消息并对同轴电缆网络单元进行注册登记包括：
    接收同轴电缆网络单元发送的注册登记消息并对同轴电缆网络单元进行注册登记；
    在注册登记过程中为同轴电缆网络单元分配数据通信加密的网络加密密钥，所述网络加密密钥为一级密钥，并获取同轴电缆网络单元的终端设备标识符。
  11. 根据权利要求10所述的方法，其中，所述密钥请求消息包括：终端设备标识符、MAC地址、加密密钥使用时间、一级密钥、二级密钥、二级密钥加密算法、三级密钥、三级密钥加密算法，其中，所述一级密钥、二级密钥和三级密钥为所述层级密钥。
  12. 根据权利要求11所述的方法，其中，所述根据所述层级密钥对通信数 据进行加密或者解密，并将加密后的数据进行传输，包括：
    根据随机数B对通信数据加密生成加密数据，并将所述加密数据发送给同轴电缆网络单元。
  13. 一种基于以太网同轴电缆EOC网络的数据安全传输装置，设置于同轴电缆网络单元，包括：
    第一注册登记模块，设置为向同轴电缆线路终端发送注册登记消息并进行注册登记；
    接收和发送模块，设置为接收同轴电缆线路终端发送的包含层级密钥的密钥请求消息，并向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态；
    第一数据传输模块，设置为根据所述层级密钥对通信数据进行加密或者解密，并将加密后的数据进行传输。
  14. 一种基于以太网同轴电缆EOC网络的数据安全传输装置，设置于同轴电缆线路终端，包括：
    第二注册登记模块，设置为接收同轴电缆网络单元发送的注册登记消息并对同轴电缆网络单元进行注册登记；
    层级密钥生成模块，设置为生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息；
    第二数据传输模块，设置为根据所述层级密钥对通信数据进行加密或者解密，并将加密后的数据进行传输。
  15. 一种基于EOC网络的数据安全传输系统，包括：
    注册登记模块，设置为同轴电缆网络单元向同轴电缆线路终端发送注册登记消息并进行注册登记；
    层级密钥生成模块，设置为同轴电缆线路终端生成层级密钥，并向同轴电缆网络单元发送包含所述层级密钥的密钥请求消息；
    密钥响应模块，设置为同轴电缆网络单元接收到密钥请求消息后向同轴电缆线路终端发送密钥响应消息，所述密钥响应消息包括层级密钥生效状态；
    数据传输模块，设置为根据层级密钥对所述数据进行加密或者解密，并将加密后的数据在同轴电缆网络单元和同轴电缆线路终端之间进行传输。
  16. 根据权利要求15所述的系统，其中，所述注册登记模块包括：
    数据分配单元，设置为同轴电缆线路终端在注册登记过程中为同轴电缆网络单元分配数据通信加密的网络加密密钥，所述网络加密密钥为一级密钥，并获取同轴电缆网络单元的终端设备标识符。
  17. 根据权利要求16所述的系统，其中，所述层级密钥包括一级密钥、二级密钥和三级密钥，所述密钥请求消息还包括：终端设备标识符、MAC地址、加密密钥使用时间、二级密钥加密算法标识和三级密钥加密算法标识。
  18. 根据权利要求17所述的系统，其中，所述层级密钥生成模块包括：
    层级密钥生成单元，设置为使用一级密钥采用二级密钥加密算法所标识的加密算法对随机数A进行加密，得到二级密钥，使用所述随机数A采用三级密钥加密算法所标识的加密算法对随机数B进行加密，得到三级密钥；
    加密参数发送单元，设置为同轴电缆线路终端向同轴电缆网络单元发送终端设备标识符、MAC地址、加密密钥使用时间、一级密钥、二级密钥、二级密钥加密算法、三级密钥、三级密钥加密算法。
  19. 根据权利要求18所述的系统，其中，所述数据传输模块包括：
    数据加密及发送单元，设置为当同轴电缆线路终端向同轴电缆网络单元发送通信数据时，根据随机数B给数据加密生成加密数据，将加密数据发送至同 轴电缆网络单元；
    数据接收与解密单元，设置为同轴电缆网络单元接收到加密数据和一级密钥、二级密钥、三级密钥后，利用一级密钥对二级密钥进行解密得到随机数A，利用随机数A对三级密钥进行解密得到随机数B，随机数B对加密数据进行解密，得到解密后的数据。
  20. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-12任一项的方法。
PCT/CN2017/111579 2016-11-17 2017-11-17 基于eoc网络的数据安全传输方法及系统 WO2018090967A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611012336.5 2016-11-17
CN201611012336.5A CN106534123B (zh) 2016-11-17 2016-11-17 一种基于eoc网络的数据安全传输方法及系统

Publications (1)

Publication Number Publication Date
WO2018090967A1 true WO2018090967A1 (zh) 2018-05-24

Family

ID=58353397

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/111579 WO2018090967A1 (zh) 2016-11-17 2017-11-17 基于eoc网络的数据安全传输方法及系统

Country Status (2)

Country Link
CN (1) CN106534123B (zh)
WO (1) WO2018090967A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110620649A (zh) * 2019-06-20 2019-12-27 南京铁道职业技术学院 铁道供电系统及其方法
CN112685351A (zh) * 2020-12-31 2021-04-20 深圳安捷丽新技术有限公司 一种pcie转usb协议的桥接芯片及其运行方法
CN116226886A (zh) * 2023-03-22 2023-06-06 中国移动通信集团广东有限公司 一种软件信息系统的信息安全管理方法及系统

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112364323A (zh) * 2020-11-16 2021-02-12 深圳安捷丽新技术有限公司 一种基于用户虹膜识别的高安全存储访问方法和装置
CN112364324A (zh) * 2020-11-16 2021-02-12 深圳安捷丽新技术有限公司 一种基于声纹识别的高安全等级数据访问方法和装置
CN112347446A (zh) * 2020-11-16 2021-02-09 深圳安捷丽新技术有限公司 一种基于用户人脸识别的多安全等级存储访问方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101056171A (zh) * 2006-06-20 2007-10-17 华为技术有限公司 一种加密通信方法和装置
CN101827079A (zh) * 2010-01-27 2010-09-08 南京大学 抗阻塞攻击的终端连接建立方法和终端访问认证系统
CN102857479A (zh) * 2011-06-30 2013-01-02 北京新媒传信科技有限公司 网络通讯的加密方法和系统
CN103609061A (zh) * 2012-06-21 2014-02-26 华为技术有限公司 安全认证的方法、装置和系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100505631C (zh) * 2007-06-14 2009-06-24 中兴通讯股份有限公司 Gpon系统中的组播处理方法
CN101127716B (zh) * 2007-09-30 2011-01-19 杭州华三通信技术有限公司 一种eoc系统中cnu的注册方法及其eoc系统
CN101998188A (zh) * 2009-08-27 2011-03-30 中兴通讯股份有限公司 无源光网络的加密/解密方法及系统
CN101888293A (zh) * 2010-07-20 2010-11-17 中国电信股份有限公司 一种用于以太网无源光网络的搅动方法和设备
US9270651B2 (en) * 2013-04-05 2016-02-23 Futurewei Technologies, Inc. Authentication and initial key exchange in ethernet passive optical network over coaxial network
US9178881B2 (en) * 2013-10-09 2015-11-03 Microsoft Technology Licensing, Llc Proof of device genuineness

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101056171A (zh) * 2006-06-20 2007-10-17 华为技术有限公司 一种加密通信方法和装置
CN101827079A (zh) * 2010-01-27 2010-09-08 南京大学 抗阻塞攻击的终端连接建立方法和终端访问认证系统
CN102857479A (zh) * 2011-06-30 2013-01-02 北京新媒传信科技有限公司 网络通讯的加密方法和系统
CN103609061A (zh) * 2012-06-21 2014-02-26 华为技术有限公司 安全认证的方法、装置和系统

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110620649A (zh) * 2019-06-20 2019-12-27 南京铁道职业技术学院 铁道供电系统及其方法
CN112685351A (zh) * 2020-12-31 2021-04-20 深圳安捷丽新技术有限公司 一种pcie转usb协议的桥接芯片及其运行方法
CN112685351B (zh) * 2020-12-31 2022-05-24 深圳安捷丽新技术有限公司 一种pcie转usb协议的桥接芯片及其运行方法
CN116226886A (zh) * 2023-03-22 2023-06-06 中国移动通信集团广东有限公司 一种软件信息系统的信息安全管理方法及系统
CN116226886B (zh) * 2023-03-22 2024-02-09 中国移动通信集团广东有限公司 一种软件信息系统的信息安全管理方法及系统

Also Published As

Publication number Publication date
CN106534123A (zh) 2017-03-22
CN106534123B (zh) 2019-08-06

Similar Documents

Publication Publication Date Title
WO2018090967A1 (zh) 基于eoc网络的数据安全传输方法及系统
US11316677B2 (en) Quantum key distribution node apparatus and method for quantum key distribution thereof
TWI641258B (zh) Data transmission method, device and system
EP3609121B1 (en) Method and device for managing digital certificate
CN111030996B (zh) 一种访问资源的方法及装置
JP5390844B2 (ja) 鍵配布システム、鍵配布方法
JP7292263B2 (ja) デジタル証明書を管理するための方法および装置
CA2753000C (en) Key derivation for secure communications
CN108111497B (zh) 摄像机与服务器相互认证方法和装置
JP2008113172A (ja) コンテンツ送信装置、コンテンツ受信装置及びコンテンツ暗号化方法
KR101608815B1 (ko) 폐쇄형 네트워크에서 암복호화 서비스 제공 시스템 및 방법
US20190268145A1 (en) Systems and Methods for Authenticating Communications Using a Single Message Exchange and Symmetric Key
KR20150079489A (ko) 실시간 통신 방법 및 시스템
WO2023160420A1 (zh) 群组消息加密方法、装置、设备和存储介质
WO2023231817A1 (zh) 数据处理方法、装置、计算机设备及存储介质
CN111080299A (zh) 一种交易信息的防抵赖方法及客户端、服务器
CN106789963B (zh) 非对称白盒密码加密方法和装置及设备
JP7208383B2 (ja) ビデオデータ伝送システム、方法および装置
KR101880999B1 (ko) 사물 인터넷 네트워크의 엔드 투 엔드 데이터 암호화 시스템 및 방법
CN106972928B (zh) 一种堡垒机私钥管理方法、装置及系统
WO2018054144A1 (zh) 对称密钥动态生成方法、装置、设备及系统
CN114124572A (zh) 基于单向网络的数据传输方法、装置、设备和介质
CN112437436B (zh) 一种身份认证方法及装置
US20140108804A1 (en) System and method for verifying the authenticity of an electronic device
CN111431846B (zh) 数据传输的方法、装置和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17871001

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17871001

Country of ref document: EP

Kind code of ref document: A1