WO2018219351A1 - 认证方法、设备以及系统 - Google Patents

认证方法、设备以及系统 Download PDF

Info

Publication number
WO2018219351A1
WO2018219351A1 PCT/CN2018/089627 CN2018089627W WO2018219351A1 WO 2018219351 A1 WO2018219351 A1 WO 2018219351A1 CN 2018089627 W CN2018089627 W CN 2018089627W WO 2018219351 A1 WO2018219351 A1 WO 2018219351A1
Authority
WO
WIPO (PCT)
Prior art keywords
destination
node
source
master node
slave
Prior art date
Application number
PCT/CN2018/089627
Other languages
English (en)
French (fr)
Inventor
王东晖
笪斌
李金明
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2018219351A1 publication Critical patent/WO2018219351A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/44—Program or device authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/45—Structures or tools for the administration of authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/74—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information operating in dual or compartmented mode, i.e. at least one secure mode

Definitions

  • the present invention relates to the field of communications, and in particular, to an authentication method, device, and system.
  • IOT Internet of Things
  • the power storage capacity of IoT devices is generally weak, and data communication through the Internet often consumes a large amount of power of IoT devices, affecting the service life of IoT devices.
  • the battery is usually small and cannot support IoT devices for data communication for a long time.
  • the embodiments of the present application provide an authentication method, device, and system, which reduce the source slave node and the destination slave node to participate in the identity authentication process, thereby reducing resource consumption of the source slave node and/or the destination slave node.
  • an authentication method is provided, which is applied to a communication system, where the communication system includes a source trusted domain and a destination trusted domain, and the source trusted domain includes a source master node and a source slave node, and the destination may be The domain includes a destination node and a destination slave node, the source slave node is a slave node of the source master node, and the destination slave node is a slave node of the destination master node, and the method includes the following steps:
  • the source master node When the access node needs to access the destination slave node in the destination trusted domain, the source master node sends an identity query request to the identity management system, where the access node is the source master node or the source From the node, the identity query request is used to instruct the identity management system to query the identity of the destination slave node;
  • the source master node receives the identity query result returned by the identity management system, where the identity query result is used to indicate that the attribute of the destination slave node is a slave node, and the master node corresponding to the destination slave node is The destination master node;
  • the source master node sends a location query request to the identity and location mapping management device, where the location query request is used to instruct the identity and location mapping management device to query the location of the destination master node;
  • the source master node receives the location query result returned by the identity and location mapping management device, where the location query result includes a global location address of the destination master node;
  • the source master node Receiving, by the source master node, a first verification result sent by the destination primary node, where the first verification result is a result obtained by verifying, by the target primary node, the first destination signature message, where A verification result is used to indicate that the destination slave node passes the identity authentication of the access node.
  • an authentication method is provided, which is applied to a communication system, where the communication system includes a source trusted domain and a destination trusted domain, and the source trusted domain includes a source master node and a source slave node, and the destination may be The domain includes a destination node and a destination slave node, the source slave node is a slave node of the source master node, and the destination slave node is a slave node of the destination master node, and the method includes the following steps:
  • the destination master node receives the first destination signature message sent by the source master node;
  • the destination primary node sends a first verification result to the source primary node, where the first verification result is a result obtained by verifying the first destination signature message, and the first verification result is used to indicate the purpose.
  • the slave node passes the identity authentication of the source slave node.
  • the first aspect and the second aspect describe a method for authenticating an authentication method provided by an embodiment of the present invention from a source primary node side and a destination primary node side respectively.
  • the source slave node and/or the destination slave node are reduced in participation identity.
  • the authentication process which reduces the resource consumption of the source slave node and/or the destination slave node.
  • the source slave node when the access node is the source slave node, the source slave node sends the original data packet to the source master node.
  • the source master node receives the original data packet sent by the source slave node.
  • the original data packet includes the source slave node identifier, a local location address of the source slave node, a destination slave node identifier, and a global location address of the destination master node.
  • the source master node replaces the local locating address of the source slave node in the original data packet with the global locating address of the source master node, thereby obtaining an intermediate data packet.
  • the source master node sends the intermediate data packet to the destination master node.
  • the destination master node receives the intermediate data packet sent by the source master node.
  • the destination master node replaces the global positioning address of the destination master node in the intermediate data packet with the local positioning address of the destination slave node, thereby obtaining a destination data packet.
  • the destination master node sends the destination data packet to the destination slave node.
  • the destination receives the destination data packet sent by the destination master node from a node.
  • the manner in which the source master node obtains the first destination signature message includes at least the following two types:
  • the source slave node signs the first message using the source slave node private key to obtain the first original signature message.
  • the source slave node sends the first original signature message to the source master node.
  • the source master node receives the first original signature message sent by the source slave node.
  • the source master node uses the source master node private key to sign the first original signature message to obtain the first destination signature message. It can be understood that in a complicated communication environment, a dual authentication method can be adopted, thereby improving communication security.
  • the source slave node sends the first message to the source master node.
  • the source master node receives the first message sent by the source slave node.
  • the source master node uses the source master node private key to sign the first message to obtain the first destination signature message. It can be understood that in the scenario where the communication environment is relatively short-answered, a single authentication mode can be adopted, thereby reducing the complexity of authentication and reducing resource consumption.
  • the source master node when the access node is the source master node, the source master node sends the original data packet to the destination master node.
  • the destination master node receives the original data packet sent by the source master node.
  • the original data packet includes the source primary node identifier, a global positioning address of the source primary node, a destination secondary node identifier, and a global positioning address of the destination primary node.
  • the destination master node replaces the global positioning address of the destination master node in the original data packet with the local positioning address of the destination slave node, thereby obtaining a destination data packet.
  • the destination master node sends the destination data packet to the destination slave node, and correspondingly, the destination slave node receives the destination data packet sent by the destination master node.
  • the source master node when the access node is the source master node, signs the first message by using a source master node private key to obtain The first destination signature message.
  • the source master node is a node having strong endurance capability in the source trusted domain; and the source slave node is a battery life in the source trusted domain.
  • the node with weak capability; the destination master node is a node with strong endurance capability in the destination trusted domain; and the destination slave node is a node with weak endurance capability in the destination trusted domain.
  • the source master node and the destination master node mainly participate in the process of identity authentication, and need to consume more resources.
  • the source slave node and the destination slave node are less involved in the identity authentication process, and do not need to consume a lot of resources, so, it can be selected.
  • the node with strong endurance capability selects the node with weak endurance as the source master node and the destination master node.
  • the destination master node sends a second destination signature message to the source master node.
  • the source master node receives the second destination signature message sent by the destination master node.
  • the source master node verifies the second destination signature message to obtain a second verification result.
  • the source master node sends the second verification result to the destination master node.
  • the destination master node receives the second verification result sent by the source master node.
  • the second verification result is used to indicate that the access node passes the identity authentication of the destination slave node. It can be understood that, in this embodiment, the access node and the destination slave node perform identity authentication with each other, which ensures that the identity of the access node and the destination slave node are all trusted, and the security of the communication is improved.
  • the first destination signature message and the second destination signature message are both identity-based signature messages.
  • the method before the destination master node sends the second destination signature message to the source master node, the method includes:
  • the destination sends a second message from the node to the destination master node.
  • the destination master node receives the second message sent by the destination slave node.
  • the destination master node signs the second message by using the destination master node private key to obtain the second destination signature message.
  • a third aspect provides a terminal device, which is applied to a communication system, where the communication system includes a source trusted domain and a destination trusted domain, where the source trusted domain includes a source master node and a source slave node, and the destination may be The source domain includes a destination master node and a destination slave node, the source slave node is a slave node of the source master node, the destination slave node is a slave node of the destination master node, and the terminal device is the source master a node, the terminal device includes a sending unit and a receiving unit,
  • the sending unit is configured to send an identity query request to the identity management system, where the access node is the source master node or the a source slave node, the identity query request is used to instruct the identity management system to query an identity of the destination slave node;
  • the receiving unit is configured to receive an identity query result returned by the identity management system, where the identity query result is used to indicate that the attribute of the destination slave node is a slave node, and the master node corresponding to the destination slave node The primary node for the purpose;
  • the sending unit is configured to send a location query request to the identity and location mapping management device, where the location query request is used to indicate that the identity and location mapping management device queries the location of the destination primary node;
  • the receiving unit is configured to receive a location query result returned by the identity and location mapping management device, where the location query result includes a global positioning address of the destination primary node;
  • the sending unit is configured to send a first destination signature message to the destination primary node according to the global positioning address of the destination primary node;
  • the receiving unit is configured to receive a first verification result sent by the destination master node, where the first verification result is a result obtained by verifying, by the target master node, the first destination signature message, The first verification result is used to indicate that the destination slave node passes the identity authentication of the access node.
  • the terminal device when the access node is the source slave node, the terminal device further includes a processing unit,
  • the receiving unit is configured to receive an original data packet sent by the source slave node, where the original data packet includes the source slave node identifier, a local location address of the source slave node, a destination slave node identifier, and the The global positioning address of the destination primary node;
  • the processing unit is configured to replace the local locating address of the source slave node in the original data packet with a global locating address of the source master node, thereby obtaining an intermediate data packet;
  • the sending unit is configured to send the intermediate data packet to the destination primary node, so that the destination primary node replaces the global positioning address of the destination primary node in the intermediate data packet with the destination The local location address of the node, thereby obtaining the destination data packet, and sending the destination data packet to the destination slave node.
  • the receiving unit is configured to receive a first original signature message sent by the source slave node, where the first original signature message is a source slave node using a source slave node private key pair The first message is signed;
  • the processing unit is configured to use the source master node private key to sign the first original signature message to obtain the first destination signature message.
  • the receiving unit when the access node is the source slave node, the receiving unit is configured to receive the first message sent by the source slave node;
  • the processing unit is configured to use the source master node private key to sign the first message to obtain the first destination signature message.
  • the sending unit when the access node is the source master node, the sending unit is configured to send an original data packet to the destination master node, where the original data packet includes the source a primary node identifier, a global locating address of the source master node, a destination slave node identifier, and a global locating address of the destination master node, such that the destination master node selects the destination master node in the original data packet
  • the global positioning address is replaced with the local positioning address of the destination slave node, thereby obtaining the destination data packet, and transmitting the destination data packet to the destination slave node.
  • the terminal device when the access node is the source master node, the terminal device further includes a processing unit, where the processing unit is configured to sign the first message by using a source master node private key, to Obtaining the first destination signature message.
  • the source master node is a node with strong endurance capability in the source trusted domain; the source slave node is a node with weak endurance capability in the source trusted domain; The node is a node with strong endurance capability in the trusted domain of the destination; the destination slave node is a node with weak endurance capability in the destination trusted domain.
  • the receiving unit is configured to receive a second destination signature message sent by the destination master node
  • the sending unit is configured to send a second verification result to the destination master node, where the second verification result is a result obtained by the source master node verifying the second destination signature message, and the second The verification result is used to indicate that the access node passes the identity authentication of the destination slave node.
  • the first destination signature message and the second destination signature message are both identity-based signature messages.
  • a fourth aspect provides a terminal device, which is applied to a communication system, where the communication system includes a source trusted domain and a destination trusted domain, where the source trusted domain includes a source master node and a source slave node, and the destination may be The source domain includes a destination master node and a destination slave node, the source slave node is a slave node of the source master node, the destination slave node is a slave node of the destination master node, and the terminal device is the target master a node, the terminal device includes a receiving unit and a sending unit,
  • the receiving unit is configured to receive the first destination signature message sent by the source master node;
  • the sending unit is configured to send a first verification result to the source primary node, where the first verification result is a result obtained by verifying the first destination signature message, where the first verification result is used to indicate the The destination slave node passes the identity authentication of the source slave node.
  • the terminal device when the access node is the source slave node, the terminal device further includes a processing unit,
  • the receiving unit is configured to receive an intermediate data packet sent by the source primary node, where the intermediate data packet is that the source primary node replaces a local positioning address of a source slave node in the original data packet with a source primary node.
  • the original data packet includes the source slave node identifier, a local location address of the source slave node, a destination slave node identifier, and a global location address of the destination master node;
  • the processing unit is configured to replace a global positioning address of the destination master node in the intermediate data packet with a local positioning address of the destination slave node, thereby obtaining a destination data packet;
  • the sending unit is configured to send the destination data packet to the destination slave node.
  • the terminal device when the access node is the source master node, the terminal device further includes a processing unit,
  • the receiving unit is configured to receive an original data packet sent by the source primary node, where the original data packet includes the source primary node identifier, a global positioning address of the source primary node, a destination secondary node identifier, and the The global positioning address of the destination primary node;
  • the processing unit is configured to replace a global positioning address of the destination primary node in the original data packet with a local positioning address of the destination secondary node, thereby obtaining a destination data packet;
  • the sending unit is configured to send the destination data packet to the destination slave node.
  • the source master node is a node with strong endurance capability in the source trusted domain; the source slave node is a node with weak endurance capability in the source trusted domain; The node is a node with strong endurance capability in the trusted domain of the destination; the destination slave node is a node with weak endurance capability in the destination trusted domain.
  • the sending unit is configured to send a second destination signature message to the source master node
  • the receiving unit is configured to receive a second verification result sent by the source master node, where the second verification result is a result obtained by the source master node verifying the second destination signature message, where the The second verification result is used to indicate that the access node passes the identity authentication of the destination slave node.
  • the first destination signature message and the second destination signature message are both identity-based signature messages.
  • the terminal device further includes a processing unit, where the receiving unit is configured to receive the second message sent by the destination slave node;
  • the processing unit is configured to use the destination master node private key to sign the second message to obtain the second destination signature message.
  • a terminal device comprising a memory and a processor, a transmitter and a receiver coupled to the memory, wherein: the transmitter is configured to transmit data to the outside, and the receiver is configured to receive an external transmission
  • the memory for storing the implementation code of the method of any one of the first aspects, the processor for executing the program code stored in the memory, that is, the method of any one of the first aspect .
  • a terminal device comprising: a memory and a processor, a transmitter and a receiver coupled to the memory, wherein: the transmitter is configured to transmit data to the outside, and the receiver is configured to Receiving externally transmitted data, the memory for storing implementation code of the method of any one of the second aspect, the processor for executing program code stored in the memory, that is, performing any one of the second aspects Said method.
  • a computer readable storage medium storing a computer program, the computer program being executed by a processor to implement the method of any of the first aspects.
  • a computer readable storage medium storing a computer program, the computer program being executed by a processor to implement the method of any one of the second aspects.
  • a ninth aspect is a communication system, where the communication system includes a source trusted domain and a destination trusted domain, the source trusted domain includes a source primary node and a source secondary node, and the destination trusted domain includes a destination primary node and a destination slave node, the source slave node being a slave node of the source master node, the destination slave node being a slave node of the destination master node, wherein the source master node is configured to perform any one of the first aspects The method, the destination master node is configured to perform the method of any one of the second aspects.
  • FIG. 1 is a schematic diagram of a communication system according to an embodiment of the present application.
  • FIG. 2 is a process interaction diagram of identity authentication between a source master node and a destination master node in the prior art
  • FIG. 3 is a process interaction diagram of identity authentication between a source primary node and a destination primary node in the prior art
  • FIG. 4 is a schematic diagram of a comparison between an IPv6 protocol architecture and an ION protocol architecture
  • FIG. 5 is an interaction diagram of an authentication method based on an ION protocol architecture according to an embodiment of the present application.
  • FIG. 6 is a process interaction diagram of a first mode for verifying a source slave node from a node in the implementation of the present application
  • FIG. 7 is a process interaction diagram of a second mode for verifying a source slave node from a node in the implementation of the present application.
  • FIG. 8 is a schematic diagram of data packets for data communication between a source slave node and the destination slave node in the implementation of the present application;
  • FIG. 9 is a process interaction diagram of a second mode in which a source slave node authenticates a destination slave node in the implementation of the present application.
  • FIG. 10 is an interaction diagram of another authentication method based on an ION protocol architecture according to an embodiment of the present application.
  • FIG. 11 is a process interaction diagram of a specific implementation manner in which a destination node performs verification on a source master node in the implementation of the present application;
  • FIG. 12 is a process interaction diagram of a specific implementation manner in which a source master node performs verification on a destination slave node in the implementation of the present application;
  • FIG. 13 is a schematic diagram of data packets for data communication between a source master node and a destination slave node in the implementation of the present application.
  • FIG. 14 is a schematic structural diagram of a device according to an embodiment of the present disclosure.
  • FIG. 15 is a schematic structural diagram of a source master node and a destination master node and a communication system formed by the two embodiments provided by the embodiments of the present application.
  • the trusted domain is first introduced.
  • the characteristics of the trusted domain are: in the same trusted domain, the nodes trust each other, that is, in the same trusted domain, the nodes can access each other without mutual authentication.
  • the trusted domain may be established according to the social relationship of the node, wherein the social relationship may be a belonging relationship, for example, a personal notebook, a refrigerator, a television, an electric meter, and a water meter are nodes belonging to the same user, and may constitute a trusted area.
  • the social relationship may be a relationship between objects in the same region. For example, temperature sensing, humidity sensors, smoke sensors, and fire fighting equipment belong to the same warehouse area and may constitute a trusted domain.
  • the social relationship may be a co-work relationship, for example, the flow rate sensor, the water level sensor, and the irrigation device operate as an irrigation system and may constitute a trusted domain. Since the nodes in the trusted domain can determine the mutual identity according to the social relationship, the establishment of the trusted domain can unify the scattered and fragmented nodes into an organic whole, thereby improving management efficiency and reducing management. the cost of. It is to be understood that the social relationship is not limited to the relationship of the above-mentioned objects, the relationship between the objects in the same region, and the relationship between the objects in the same place. In the actual application, the social relationship may be other relationships, which are not specifically limited herein.
  • the node in the trusted domain is a logical entity, and may be any one of a terminal device, a user equipment, and an Internet of Things (IoT) device. Or a combination of multiple.
  • the terminal device may be a desktop computer, a notebook computer, a tablet computer (PAD), or the like.
  • the user device can be a smart phone, a smart watch, smart glasses, and the like.
  • IoT devices can be sensors, electricity meters, water meters, and the like. It should be understood that the above examples are for illustrative purposes only and should not be construed as limiting.
  • FIG. 1 is a schematic diagram of a communication system according to an embodiment of the present application. As shown in FIG. 1, at least a source trusted domain and a destination trusted domain exist in the communication system.
  • the source trusted domain includes a source master node and a source slave node, wherein the source slave node is a node under the jurisdiction of the source master node.
  • the source master node is a node with strong endurance capability in the source trusted domain
  • the source slave node is a node with weak endurance capability in the source trusted domain. That is, the source master node is a node that can be externally connected to the power source, or a chargeable node with a relatively large amount of remaining power; the source slave node is a node that cannot be charged, or a chargeable node that has less remaining power.
  • the source master node may be a desktop device, a laptop computer, a tablet computer, or the like, which may be externally connected to the power supply terminal, or the source master node may be a rechargeable mobile phone, smart watch or smart glasses, etc. with a remaining battery capacity exceeding 80%.
  • the source slave node can be a smart water meter set in a dark corner of a tall building, and a non-rechargeable IoT device such as a smart meter, or the source slave node can be a smart phone, smart watch or smart glasses with less than 20% remaining power. Rechargeable user equipment. It can be understood that the identity of the source master node and the source slave node can be changed. For example, when the power of the source master node drops to 20%, the source master node can become the source slave node, and the source and slave nodes are fully charged to 100%. When the source slave node can become the source master node.
  • the destination trusted domain includes a destination master node and a destination slave node, wherein the destination slave node is a node under the jurisdiction of the destination master node.
  • the destination master node is the node with strong endurance capability in the destination trusted domain
  • the destination slave node is the node with weak endurance capability in the destination trusted domain. That is, the destination master node is a node that can be externally connected to the power source, or a chargeable node with a relatively large amount of remaining power; the destination slave node is a node that cannot be charged, or a chargeable node that has less remaining power.
  • the destination master node may be a desktop computer, a notebook computer, a tablet computer, or the like, which may be externally connected to the power supply terminal, or the destination master node may be a rechargeable mobile phone, smart watch or smart glasses, etc. with a remaining battery capacity exceeding 80%.
  • the destination slave node can be a smart water meter set in a dark corner of a tall building, and a non-rechargeable IoT device such as a smart meter, or the destination node can be a smart phone, smart watch or smart glasses with less than 20% remaining power. Rechargeable user equipment. It can be understood that the identity of the destination master node and the destination slave node can be changed. For example, when the power of the destination master node falls to 20%, the destination master node can become the destination slave node, and the power of the destination slave node is filled to 100%. When the destination slave node can become the destination master node.
  • the source master nodes can be connected through an IP (internet protocol) network, and the source slave nodes are connected to their corresponding source master nodes; in the destination trusted domain, the destination master nodes can pass through The IP network is connected, and the destination slave node is connected to its corresponding destination master node; between the source trusted domain and the destination trusted domain, at least one source master node and at least one destination master node are connected through the IP network.
  • IP internet protocol
  • the prior art proposes an authentication method between a source primary node and a destination primary node based on an IPv6 protocol architecture.
  • the method includes two steps, wherein the first link is: the identity authentication of the source master node and the destination master node by the gateway.
  • the second link is: identity authentication between the source primary node and the destination primary node.
  • the source master node sends a first authentication request to the first gateway, where the first gateway is the gateway to which the source master node belongs.
  • the first gateway After receiving the first authentication request, the first gateway sends the first random number and the first authentication key to the source master node, where the first random number is a random number generated by the first gateway, and the first authentication key The order is randomly selected by the first gateway.
  • the source master node receives the first random number sent by the first gateway and the first authentication key order.
  • the source master node searches for the corresponding authentication key stored in itself according to the first authentication key order, and calculates a first response value hash (RM1, AK1) by using a hash function, where the hash function is the gateway and the source master node in advance.
  • the agreed function RM1 is the first random number
  • AK1 is the authentication key corresponding to the first authentication key stored at the source master node.
  • the source master sends the first response value to the first gateway.
  • the first gateway receives the first response value sent by the source master node.
  • the first gateway searches for the corresponding authentication key stored in itself according to the first authentication key order, and calculates a second response value hash1 (RM1, AK2) using the hash1 function.
  • the hash1 function is a function pre-agreed by the first gateway and the source master node
  • RM1 is a first random number
  • AK2 is an authentication key corresponding to the first authentication key stored in the first gateway.
  • the first gateway compares the first response value with the second response value. If the first response value is the same as the second response value, the first gateway authenticates the identity of the source primary node.
  • the identity authentication process of the first gateway to the destination master node is similar to the identity authentication process of the source gateway to the source master node, and is not described here.
  • the source master node sends an access request to the destination master node.
  • the destination master node After receiving the access request of the source master node, the destination master node sends a second authentication request to the second gateway, where the second gateway is the gateway to which the destination master node belongs.
  • the second gateway After receiving the second authentication request, the second gateway sends the second random number and the second authentication key to the source master node, where the second random number is a random number generated by the second gateway, and the second authentication key The order is randomly selected by the second gateway.
  • the second gateway searches for the corresponding authentication key stored in itself according to the second authentication key order, and calculates a third response value hash2 (RM2, AK3) using the hash2 function, and sends the same to the destination master node.
  • RM2, AK3 third response value hash2
  • the destination master node receives the third response value sent by the second gateway.
  • the hash2 function is a function pre-agreed by the second gateway and the source master node
  • RM2 is a second random number
  • AK3 is an authentication key corresponding to the second authentication key stored in the second gateway.
  • the source master node After the source master node receives the second random number sent by the second gateway and the second authentication key order, the source master node searches for the corresponding authentication key stored in itself according to the second authentication key order, and calculates using the hash2 function. Obtaining a fourth response value hash2 (RM2, AK2), wherein the hash2 function is a function pre-agreed by the second gateway and the source master node, RM2 is a second random number, and AK4 is a second authentication key stored at the source master node. The corresponding authentication key.
  • the source master sends the fourth response value to the destination master node.
  • the destination master node receives the fourth response value sent by the source master node.
  • the destination master node compares the third response value with the fourth response value. If the third response value is the same as the fourth response value, the destination primary node passes the identity authentication of the source primary node, and the destination primary node allows the source primary node to access. .
  • this authentication method is only suitable for authentication between the source master node and the destination master node, and is not suitable for identity authentication between the source slave node and the destination slave node. If the identity authentication between the source master node and the destination slave node and the identity authentication between the source slave node and the destination slave node also adopt this authentication method, the power of the source slave node and the destination slave node are largely consumed, and the source slave node is affected. Endurance with the purpose of the node.
  • the embodiment of the present application provides an authentication method, device, and system based on an ION (Identity oriented network) protocol architecture, which can be adapted to identity authentication between a source primary node and a destination secondary node, a source slave node, and The purpose is to authenticate the identity between the nodes, reduce the power consumption of the source slave node and the destination slave node, and improve the endurance capability of the source slave node and the destination slave node.
  • the ION protocol architecture is a new protocol architecture, as shown in FIG. 4, which is different from the traditional IPv6 protocol architecture in that the ION protocol architecture is in the IP layer of the IPv6 protocol architecture (layer 3).
  • An identification layer (3.5 layers) is added between the transmission layer (4 layers).
  • nodes using the ION protocol architecture can use the identity of the identity layer as the only constant identity.
  • the identity layer is located above the IP layer, so nodes under the ION protocol architecture can address the identity of the identity layer through the IP layer.
  • the identifier of a node in the ION protocol architecture refers to the identifier of the identity layer.
  • the communication system of the present application further includes an IDentity Management System (IDMS), an Identity and Locater Mapping System (ILMS), and a key generation center. (IBS-based Key Management System, IKMS).
  • IDMS IDentity Management System
  • ILMS Identity and Locater Mapping System
  • IKMS Key Management System
  • the identity management system is configured to assign a source master node identifier to the source master node, a source slave node identifier to the source slave node, a destination master node identifier to the destination master node, and a destination slave node identifier for the destination slave node.
  • the identity management system sends the source master node identifier to the source master node, sends the source slave node identifier to the source slave node, sends the destination master node identifier to the destination master node, and sends the destination slave node identifier to the destination slave node.
  • the identity management system is also used to record the attributes of the source master node, the attributes of the source slave node, the attributes of the destination master node, and the attributes of the destination slave node.
  • the identity management system is also used to record the correspondence between the source master node and the source slave node. And, the correspondence between the destination master node and the destination slave node.
  • an attribute table as shown in Table 1 and a correspondence relationship table shown in Table 2 can be set in the identity management system.
  • the attribute table is used to record the attributes of the source master node, the attributes of the source slave node, the attributes of the destination master node, and the attributes of the destination slave node.
  • the correspondence table is used to record the correspondence between the source master node and the source slave node, and the correspondence between the destination master node and the destination slave node. It can be understood that Table 1 and Table 2 are only a specific example, and are not specifically limited.
  • the identity and location mapping management system is used to record the global positioning address of the source primary node and the global positioning address of the destination primary node.
  • the source master node uses the same source master node global location address as the source slave node under its jurisdiction
  • the destination master node uses the same destination master node global location address with the destination slave node under its jurisdiction.
  • the identity and location mapping management system sends the same source master node global positioning address to the source master node and the source slave node under its jurisdiction, and sends the same destination master node global positioning address to the destination master node and the destination slave node under its jurisdiction. Taking the source trusted domain and the destination trusted domain shown in FIG.
  • the source primary node A and the source secondary nodes a to c under its jurisdiction use the source primary node A global positioning address
  • the source primary node B uses the source primary node.
  • B global positioning address, the source master node C and the source slave nodes d and e under its jurisdiction use the source master node C to globally locate the address;
  • the destination master node X and the destination slave node x to z under its jurisdiction use the destination master node X globally
  • the destination master node Y uses the destination master node Y global location address
  • the destination master node Z and the destination slave nodes v, w under its jurisdiction use the destination master node Z to globally locate the address.
  • the correspondence table shown in Table 2 and the global positioning address table shown in Table 3 can be set in the identity and location mapping management system.
  • the global positioning address table is used to record the correspondence between the source primary node and the global positioning address, and the correspondence between the destination primary node and the global positioning address.
  • you need to query the global locating address of the source or destination node You can first query the source master node corresponding to the source slave node or the corresponding destination master node of the destination slave node through Table 2, and then query the global location address corresponding to the source master node or the destination master node through Table 3.
  • Table 3 is only a specific example, and is not specifically limited.
  • the key generation center is configured to generate a source master private key for the source master node based on the source master node public key.
  • the source master node public key may be the source master node identifier
  • the key generation center generates a private key corresponding to the source slave node public key based on the source master node identifier.
  • the source master private key is paired with the source master node public key, that is, when one of the communication parties uses the source master private key to sign to obtain a signed message, the other party can only use the source master node public key pair. Sign the message for verification.
  • the key generation center is further configured to generate a source slave node private key based on the source slave node public key, a destination master node private key based on the destination master node public key, and a destination slave node based on the destination node
  • the public key is used to generate the destination slave private key for the purpose of the node, and the description is not extended here.
  • the key generation center sends the source master private key to the source master node, sends the source slave node private key to the source slave node, sends the destination master node private key to the destination master node, and sends the destination slave node private key to Purpose from the node.
  • the relationship between the node and the key may be as shown in the node and key correspondence table shown in FIG. 4. It can be understood that Table 4 is a specific example, and is not specifically limited.
  • the identity management system, the identity and location mapping management system, and the key generation center are all logical entities, such as servers and the like.
  • the actual product names of identity management systems, identity and location mapping management systems, and key generation centers may be different in different systems.
  • key generation centers in some systems are called private key generators. (Private-Key Generator, PKG), of course, the change of product name does not affect the essence of the key generation center.
  • the identity management system, the identity and location mapping management system, and the key generation center can be deployed in a very flexible manner.
  • the identity management system, the identity and location mapping management system, and the key generation center can be separately deployed and can be centralized. The deployment may also be deployed with other devices, which is not specifically limited in this application.
  • the source master node is configured to store the source master node identifier sent by the identity management system, the source master node global location address sent by the identity and location mapping management system, and the source master node private key sent by the key generation center.
  • the source master node is also used to store the mapping relationship of the local locating addresses of the source slave nodes under its jurisdiction.
  • the source master node A can be configured with a local location address mapping table as shown in Table 5.
  • the local location address mapping table shown in Table 5 is used to record the source master node A.
  • Table 5 is a specific example, and is not specifically limited.
  • the destination master node is similar to the source master node, and the description is not extended here.
  • Source slave node identifier Locally located address Source from node a Source slave node a local location address Source from node b Source from node b local location address Source from node c Source from node c local location address
  • the source slave node is configured to store a source slave node identifier, a source master node global location address of the corresponding source master node sent by the identity and location mapping management system, and a source master node private key sent by the key generation center.
  • the source slave node is also used to store its own local location address. It can be understood that the destination slave node is similar to the source master node, and the description will not be repeated here.
  • FIG. 5 is an interaction diagram of an authentication method based on an ION protocol architecture.
  • the embodiment of the present application may be applied to an application scenario in which the source slave node needs to access the target slave node.
  • the authentication method based on the ION protocol architecture includes the following steps:
  • the source slave node sends a query request to the source master node.
  • the source master node receives the query request sent by the source slave node.
  • the query request is used to instruct the source master node to query the identity and location of the destination slave node.
  • the query request may include an identity identifier of the destination slave node, and the source master node queries the identity and location of the destination slave node according to the identity of the node.
  • the identity of the destination slave node may be a fixed identifier, such as an Internet Protocol (IP) address, a mobile phone number, an International Mobile Equipment Identity (IMEI), and an International Mobile Subscriber Identity (International Mobile Subscriber Identity (IMSI), IP Multimedia Private Identity (IMPI), IP Multimedia Public Identity (IMPU), etc., may also be temporarily assigned identifiers, for example, temporary mobile subscriber identity. (Temporary Mobile Subscriber Identity, TMSI), Globally Unique Temporary UE Identity (GUTI), and the like.
  • IP Internet Protocol
  • IMEI International Mobile Equipment Identity
  • IMSI International Mobile Subscriber Identity
  • IMPI IP Multimedia Private Identity
  • IMPU IP Multimedia Public Identity
  • S104 The source master node sends an identity query request to the identity management system.
  • the identity management system receives an identity query request sent by the source master node.
  • the identity query request includes at least an identity of the destination slave node.
  • S106 The identity management system sends an identity query result to the source master node.
  • the source master node receives the identity query result returned by the identity management system.
  • the identity management system after receiving the identity query request, queries the attribute table (for example, Table 1) according to the identity of the destination slave node carried in the identity query request, so as to obtain the target from the query.
  • the node attribute of a node is a slave node.
  • the identity management system queries the correspondence relationship table (for example, Table 2) from the identity of the node according to the purpose, so as to query the master node corresponding to the destination slave node as the destination master node.
  • the identity management system sends an identity query result to the source master node, where the identity query result includes a node attribute identifier and an identifier of the destination master node, and the node attribute identifier is used to indicate that the destination slave node attribute is The slave node, the identifier of the destination master node is used to indicate that the master node corresponding to the destination slave node is the destination master node.
  • the source master node sends a location query request to the identity and location mapping management device.
  • the identity and location mapping management device receives the location query request sent by the source master node.
  • the location query request includes at least an identifier of the target primary node.
  • the identity and location mapping management device returns a location query result to the source primary node.
  • the source master node receives the location query result returned by the identity and location mapping management device.
  • the identity and location mapping management device after receiving the location query request, queries the correspondence table (for example, Table 2) according to the destination of the destination query request in the location query request to obtain the destination.
  • the primary node corresponding to the node is the destination primary node, and the destination primary node identifier is obtained.
  • the identity and location mapping management device queries the global positioning address table (for example, Table 3) according to the destination primary node identifier to obtain a global positioning address of the destination primary node.
  • the identity and location mapping management device returns a location query result to the source master node, wherein the location query result includes at least a global location address of the destination master node.
  • S112 The source master node returns the identity query result and the location query result to the source slave node.
  • the source slave node receives the identity query result sent by the source master node and the location query result.
  • S114 The source master node sends a first destination signature message to the destination master node according to the global positioning address of the destination master node.
  • the destination master node receives the first destination signature message sent by the source master node.
  • the destination master node sends a first verification result to the source master node.
  • the source master node receives the first verification result sent by the destination master node.
  • the first verification result is a result of verifying the first destination signature message, and the first verification result is used to indicate that the destination slave node passes the identity authentication of the source slave node.
  • the step S114 to the step S116 are the process of verifying the source slave node by the destination node, and the specific implementation manner of the destination slave node verifying the source slave node may include the following two types:
  • the process of verifying the source slave node from the node may include the following steps: the source slave node sends the first message to the source master node.
  • the source master node receives the first message sent by the source slave node.
  • the source master node uses the source master node private key to sign the first message to obtain the first destination signature message.
  • the source master node sends the first destination signature message to the destination master node.
  • the destination master node receives the first destination signature message sent by the source master node.
  • the destination master node verifies the first destination signature message by using a source master node public key to obtain a first verification result.
  • the destination master node returns a first verification result to the source master node.
  • the source master node receives the first verification result returned by the destination master node.
  • the source master node returns a first verification result to the source slave node.
  • the source slave node receives the first verification result returned by the source master node.
  • the process of verifying the source slave node from the node may include the following steps: the source slave node signs the first message using the source slave node private key to obtain The first original signed message.
  • the source slave node sends the first original signature message to the source master node.
  • the source master node receives the first original signature message sent by the source slave node.
  • the source master node uses the source master node private key to sign the first original signature message again to obtain the first destination signature message.
  • the source master node sends the first destination signature message to the destination master node.
  • the destination master node receives the first destination signature message sent by the source master node.
  • the destination master node verifies the first destination signature message by using the source master node public key to obtain a first original signature message.
  • the destination master node sends the first original signature message to the destination slave node.
  • the destination receives the first original signature message sent by the destination master node from a node.
  • the destination verifies the first original signature message from the node using the source slave node public key to obtain a first verification result.
  • the destination returns a first verification result from the node to the destination master node.
  • the destination master node receives the first verification result returned by the destination slave node.
  • the destination master node returns a first verification result to the source master node.
  • the source master node receives the first verification result returned by the destination master node.
  • the source master node returns a first verification result to the source slave node.
  • the source slave node receives the first verification result returned by the source master node. It can be understood that in a complicated communication environment, a dual authentication method can be adopted, thereby improving communication security.
  • the destination master node sends a second destination signature message to the source master node.
  • the source master node receives the second destination signature message sent by the destination master node.
  • the source master node sends a second verification result to the destination master node.
  • the destination master node receives the second verification result sent by the source master node.
  • the second verification result is a result of verifying the second destination signature message, and the second verification result is used to indicate that the source slave node passes the identity authentication of the destination slave node.
  • step S118 to step S120 are processes in which the source slave node performs verification on the destination slave node.
  • the specific implementation manner in which the source slave node authenticates the destination slave node may be: as shown in FIG. 8, the destination slave node sends a second message to the destination master node.
  • the destination master node receives the second message sent by the destination slave node.
  • the destination master node signs the second message by using the destination master node private key to obtain the second destination signature message.
  • the destination master node sends the second destination signature message to the source master node.
  • the source master node receives the second destination signature message sent by the destination master node.
  • the source master node verifies the second destination signature message by using the destination master node public key, thereby obtaining a second verification result.
  • the source master node sends the second verification result to the destination master node and the source slave node.
  • the destination master node receives the second verification result sent by the source master node.
  • the destination master node sends the second verification result to the destination slave node.
  • the destination receives the second verification result sent by the destination master node from a node.
  • S122 Perform data communication between the source slave node and the destination slave node.
  • the data communication between the source slave node and the destination slave node includes the following steps: the source slave node sends the original data packet to the source master node. .
  • the source master node receives the original data packet sent by the source slave node.
  • the original data packet includes the source slave node identifier (ID SSN ), the local locator address of the source slave node (Local Locator SSN ), the destination slave node identifier (ID DSN ), and the global destination of the destination master node.
  • Location Locator Global Locator DMN
  • the source master node replaces the local locator address (Local Locator SSN ) of the source slave node in the original data packet with a global locator address (Global Locator SMN ) of the source master node, thereby obtaining an intermediate data packet.
  • the source master node sends the intermediate data packet to the destination master node.
  • the destination master node receives an intermediate data packet sent by the source master node.
  • the destination master node replaces the global locator address (Global Locator DMN ) of the destination master node in the intermediate data packet with the local locator DSN of the destination slave node, thereby obtaining a destination data packet.
  • the destination master node sends the destination data packet to the destination slave node.
  • the destination receives the destination data packet sent by the destination master node from a node.
  • the nodes in the ION protocol architecture have the identifier of the identifier layer, and the identifier of the identifier layer can be addressed through the IP layer. Therefore, when performing identity verification, there is no need to assist through the gateway.
  • the identity authentication between the source master node and the destination master node can be realized, thereby greatly reducing the process of identity authentication.
  • the source slave node trusts the source master node, and the destination slave node also trusts the destination master node, so In the case that the destination master node passes the authentication of the source master node, it can be considered that the destination slave node also passes the identity authentication of the source slave node, thereby reducing the source slave node and the destination slave node participating in the identity authentication process, thereby reducing The power consumption of the source slave node and the destination slave node.
  • FIG. 10 is an interaction diagram of another authentication method based on an ION protocol architecture according to an embodiment of the present application.
  • the application scenario of the application may be applied to the application scenario where the source master node needs to access the target slave node.
  • the authentication method based on the ION protocol architecture includes the following steps:
  • S202 The source master node sends an identity query request to the identity management system.
  • the identity management system receives an identity query request sent by the source master node.
  • the identity query request includes at least an identity of the destination slave node.
  • S204 The identity management system sends an identity query result to the source master node.
  • the source master node receives the identity query result returned by the identity management system.
  • the source master node sends a location query request to the identity and location mapping management device.
  • the identity and location mapping management device receives the location query request sent by the source master node.
  • the location query request includes at least an identifier of the target primary node.
  • the identity and location mapping management device returns a location query result to the source primary node.
  • the source master node receives the location query result returned by the identity and location mapping management device.
  • the source master node sends a first destination signature message to the destination master node according to the global positioning address of the destination master node.
  • the destination master node receives the first destination signature message sent by the source master node.
  • the destination master node sends a first verification result to the source master node.
  • the source master node receives the first verification result sent by the destination master node.
  • the first verification result is a result of verifying the first destination signature message, and the first verification result is used to indicate that the destination slave node passes the identity authentication of the source master node.
  • the step S210 to the step S212 is a process for the destination node to verify the source master node, and the specific implementation manner of the destination node to verify the source master node may be:
  • the source master node signs the first message by using the source master node private key to obtain the first destination signature message.
  • the source master node sends the first destination signature message to the destination master node.
  • the destination master node receives the first destination signature message sent by the source master node.
  • the destination master node verifies the first destination signature message by using a source master node public key to obtain a first verification result.
  • the destination master node returns a first verification result to the source master node and the destination slave node.
  • the source master node and the destination slave node receive a first verification result returned by the destination master node.
  • the destination master node sends a second destination signature message to the source master node.
  • the source master node receives the second destination signature message sent by the destination master node.
  • the source master node sends a second verification result to the destination master node.
  • the destination master node receives the second verification result sent by the source master node.
  • the second verification result is a result of verifying the second destination signature message, and the second verification result is used to indicate that the source master node passes the identity authentication of the destination slave node.
  • steps S214 to S216 are processes in which the source master node performs verification on the destination slave node.
  • the specific implementation manner of the source master node performing the verification on the destination slave node may be as follows: As shown in FIG. 12, the destination sends a second message from the node to the destination master node. Correspondingly, the destination master node receives the second message sent by the destination slave node. The destination master node signs the second message by using the destination master node private key to obtain the second destination signature message. The destination master node sends the second destination signature message to the source master node. Correspondingly, the source master node receives the second destination signature message sent by the destination master node.
  • the source master node verifies the second destination signature message by using the destination master node public key, thereby obtaining a second verification result.
  • the source master node sends the second verification result to the destination master node.
  • the destination master node receives the second verification result sent by the source master node.
  • the destination master node sends the second verification result to the destination slave node.
  • the destination receives the second verification result sent by the destination master node from a node.
  • S218 The source master node and the destination slave node perform data communication with each other.
  • the source master node sends the original data packet to the destination master node.
  • the destination master node receives the original data packet sent by the source master node.
  • the original data packet includes the source primary node identifier (ID SMN ), the global primary address (Global Locator SMN ) of the source primary node, the destination secondary node identifier (ID DSN ), and the global destination of the destination primary node.
  • Location Locator Global Locator DMN
  • the destination master node replaces the global locator address (Global Locator DMN ) of the destination master node in the original data packet with the local locator DSN of the destination slave node, thereby obtaining a destination data packet.
  • the destination master node sends the destination data packet to the destination slave node, and correspondingly, the destination slave node receives the destination data packet sent by the destination master node.
  • the nodes in the ION protocol architecture have the identifier of the identifier layer, and the identifier of the identifier layer can be addressed through the IP layer. Therefore, when performing identity verification, there is no need to assist through the gateway.
  • the identity authentication between the source master node and the destination master node can be realized, thereby greatly reducing the process of identity authentication.
  • the destination slave node and the destination master node are both located in the destination trusted domain, and the destination slave node trusts the destination master node.
  • the destination slave node when the destination master node authenticates the source master node, the destination slave node can also be considered as The identity authentication of the source master node is performed, thereby reducing the purpose of the slave node participating in the identity authentication process, thereby reducing the resource consumption of the destination slave node.
  • an embodiment of the present invention further provides a device (shown in FIG. 14) for implementing the method described in the foregoing FIG. 5 and FIG.
  • the apparatus 100 includes a transmitter 103, a receiver 104, a memory 102, and a processor 101 coupled to the memory 102.
  • the number of the processors 101 may be one or more, and one processor in FIG. example).
  • the transmitter 103, the receiver 104, the memory 102, and the processor 101 may be connected by a bus or other means (in FIG. 14 for example by a bus connection).
  • the transmitter 103 is for transmitting data to the outside
  • the receiver 104 is for receiving data from the outside.
  • the memory 102 is used to store program code
  • the processor 101 is used to call and run program code stored in the memory 102.
  • the program code stored in the memory 102 is specifically used to implement the functions of the source master node in the embodiment of FIG. 5.
  • the processor 101 is configured to call the program code stored in the memory 102 and perform the following steps:
  • the source master node When the access node needs to access the destination slave node in the destination trusted domain, the source master node sends an identity query request to the identity management system through the transmitter 103, where the access node is the source master node Or the source slave node, the identity query request is used to instruct the identity management system to query the identity of the destination slave node;
  • the source master node receives the identity query result returned by the identity management system by using the receiver 104, where the identity query result is used to indicate that the attribute of the destination slave node is a slave node, and the destination slave node corresponds to The master node is the target master node;
  • the source master node sends a location query request to the identity and location mapping management device by using the transmitter 103, where the location query request is used to instruct the identity and location mapping management device to query the location of the destination master node;
  • the source master node receives the location query result returned by the identity and location mapping management device by using the receiver 104, where the location query result includes a global location address of the destination master node;
  • the source master node sends a first destination signature message to the destination master node by using the global positioning address of the destination master node by the transmitter 103;
  • the source master node receives the first verification result sent by the destination master node by using the receiver 104, where the first verification result is a result obtained by verifying, by the destination master node, the first destination signature message.
  • the first verification result is used to indicate that the destination slave node passes the identity authentication of the access node.
  • data communication between the source slave node and the destination slave node includes:
  • the source master node receives the original data packet sent by the source slave node through the receiver 104, where the original data packet includes the source slave node identifier, the local location address of the source slave node, and the destination slave node identifier. And a global positioning address of the destination primary node;
  • the source master node replaces the local locating address of the source slave node in the original data packet with the global locating address of the source master node by using the processor 101, thereby obtaining an intermediate data packet;
  • the source master node sends the intermediate data packet to the destination master node by using the transmitter 103, so that the destination master node replaces the global positioning address of the destination master node in the intermediate data packet with Declaring the destination local address of the slave node, thereby obtaining the destination data packet, and transmitting the destination data packet to the destination slave node.
  • the specific implementation manner in which the destination slave node authenticates the source slave node may include the following two types:
  • the source master node receives the first original signature message sent by the source slave node by using the receiver 104, where the first source signature message is that the source slave node uses the source slave node private
  • the key is obtained by signing the first message; the source master node signs the first original signature message by using the source master node private key by the processor 101 to obtain the first destination signature message.
  • the source master node receives the first message sent by the source slave node through the receiver 104; the source master node uses the source master node private key to the first by the processor 101. The message is signed to obtain the first destination signature message.
  • data communication between the source master node and the destination slave node includes:
  • the source master node sends the original data packet to the destination master node by using the transmitter 103, where the original data packet includes the source master node identifier, the global location address of the source master node, and the destination slave node identifier. And the global positioning address of the destination master node, so that the destination master node replaces the global positioning address of the destination master node in the original data packet with the local positioning address of the destination slave node, thereby obtaining the purpose
  • the data packet is sent to the destination slave node.
  • the specific implementation manner in which the destination slave node verifies the source master node may include: the source master node uses the source by using the processor 101.
  • the master node private key signs the first message to obtain the first destination signature message.
  • the source master node is a node with strong endurance capability in the source trusted domain; the source slave node is a node with weak endurance capability in the source trusted domain; The node is a node with strong endurance capability in the trusted domain of the destination; the destination slave node is a node with weak endurance capability in the destination trusted domain.
  • the specific implementation manner in which the access node performs verification on the destination slave node may include:
  • the source master node sends a second verification result to the destination master node by using the transmitter 103, where the second verification result is a result obtained by the source master node verifying the second destination signature message.
  • the second verification result is used to indicate that the access node passes the identity authentication of the destination slave node.
  • the first destination signature message and the second destination signature message are both identity-based signature messages.
  • the execution steps of the processor 101 and other technical features involved in the processor 101 may also refer to the related content of the source master node in the method embodiments shown in FIG. 5 and FIG. , no longer repeat them here.
  • the program code stored in the memory 102 is specifically used to implement the functions of the destination master node in the embodiment of FIG. 5 and FIG.
  • the processor 101 is configured to call the program code stored in the memory 102 and perform the following steps:
  • the destination master node When the access node needs to access the destination slave node in the destination trusted domain, the destination master node receives the first destination signature message sent by the source master node by using the receiver 104.
  • the destination primary node sends a first verification result to the source primary node by using the transmitter 103, where the first verification result is a result obtained by verifying the first destination signature message, where the first verification result is used Instructing the destination slave node to pass identity authentication of the source slave node.
  • data communication between the source slave node and the destination slave node includes:
  • the destination master node receives the intermediate data packet sent by the source master node by using the receiver 104, wherein the intermediate data packet is that the source master node replaces the source localization address of the source slave node in the original data packet with the source.
  • the global positioning address of the master node is obtained;
  • the original data packet includes the source slave node identifier, a local location address of the source slave node, a destination slave node identifier, and a global location address of the destination master node;
  • the destination master node replaces the global positioning address of the destination master node in the intermediate data packet with the local positioning address of the destination slave node by using the processor 101, thereby obtaining a destination data packet;
  • the destination master node sends the destination data packet to the destination slave node through the transmitter 103.
  • Communication includes:
  • the destination master node receives the original data packet sent by the source master node by using the receiver 104, where the original data packet includes the source master node identifier, the global location address of the source master node, and the destination slave node identifier. And a global positioning address of the destination primary node;
  • the destination master node replaces the global positioning address of the destination master node in the original data packet with the local positioning address of the destination slave node by the processor 101, thereby obtaining a destination data packet;
  • the destination master node sends the destination data packet to the destination slave node through the transmitter 103.
  • the source master node is a node with strong endurance capability in the source trusted domain; the source slave node is a node with weak endurance capability in the source trusted domain; The node is a node with strong endurance capability in the trusted domain of the destination; the destination slave node is a node with weak endurance capability in the destination trusted domain.
  • the specific implementation manner in which the access node performs verification on the destination slave node may include:
  • the destination master node sends a second destination signature message to the source master node by using the transmitter 103;
  • the second verification result is used to indicate that the access node passes the identity authentication of the destination slave node.
  • the first destination signature message and the second destination signature message are both identity-based signature messages.
  • the destination master node receives, by the receiver 104, the second message sent by the destination slave node;
  • the destination master node signs the second message by the processor 101 using the destination master node private key to obtain the second destination signature message.
  • the execution steps of the processor 101 and other technical features involved in the processor 101 may also refer to the related content of the target master node in the method embodiment shown in FIG. 5 and FIG. , no longer repeat them here.
  • FIG. 15 is a schematic diagram showing the structure of a source master node and a destination master node according to an embodiment of the present invention, and a communication system formed by the two. As shown in FIG. 15, there may be a communication connection between the source master node 200 and the destination master node 300, which enables data communication between the two. The description is expanded below.
  • the source master node 200 may include a receiving unit 210, a transmitting unit 230, a processing unit 250, and a storage unit 270.
  • the receiving unit 210 may be a receiver, and the sending unit 230 may be a transmitter.
  • the receiving unit 210 and the transmitting unit 230 may also be the same transceiver.
  • Processing unit 250 can be a processor, a processing chip, and integrated processing circuitry, and the like.
  • the storage unit 270 can be a hard disk, a memory, or a NLAND Flash or the like.
  • the receiving unit 210 is configured to receive a query request sent by the source master node, where the query request includes at least an identity identifier of the destination slave node;
  • the source master node When the access node needs to access the destination slave node in the destination trusted domain, the source master node sends an identity query request to the identity management system by using the sending unit 230, where the access node is the source master node Or the source slave node, the identity query request is used to instruct the identity management system to query the identity of the destination slave node.
  • the source master node receives the identity query result returned by the identity management system by using the receiving unit 210, where the identity query result is used to indicate that the attribute of the destination slave node is a slave node, and the destination slave node corresponds to The master node is the destination master node.
  • the source master node sends a location query request to the identity and location mapping management device by using the sending unit 230, where the location query request is used to instruct the identity and location mapping management device to query the location of the destination master node.
  • the source master node receives the location query result returned by the identity and location mapping management device by the receiving unit 210, where the location query result includes a global positioning address of the destination master node.
  • the source master node sends a first destination signature message to the destination master node by using the global positioning address of the destination master node by the sending unit 230;
  • the source master node receives the first verification result sent by the destination master node by using the receiving unit 210, where the first verification result is a result obtained by verifying, by the destination master node, the first destination signature message.
  • the first verification result is used to indicate that the destination slave node passes the identity authentication of the access node.
  • the storage unit 270 is configured to store an identity query result, a first verification result, and the like.
  • the receiving unit 210 is configured to receive an original data packet sent by the source slave node, where the original data packet includes the a source slave node identifier, a local location address of the source slave node, a destination slave node identifier, and a global location address of the destination master node;
  • the processing unit 250 is configured to replace the local locating address of the source slave node in the original data packet with a global locating address of the source master node, thereby obtaining an intermediate data packet;
  • the sending unit 230 is configured to send the intermediate data packet to the destination primary node, so that the destination primary node replaces the global positioning address of the destination primary node in the intermediate data packet with the destination The destination address of the slave node is obtained, thereby obtaining the destination data packet, and transmitting the destination data packet to the destination slave node.
  • the receiving unit 210 is configured to receive a first original signature message sent by the source slave node, where the first original signature message is the source slave node using a source slave node private key Signing the first message;
  • the processing unit 250 is configured to use the source master node private key to sign the first original signature message to obtain the first destination signature message.
  • the access node when the access node is the source slave node,
  • the receiving unit 210 is configured to receive the first message sent by the source slave node
  • the processing unit 250 is configured to use the source master node private key to sign the first message to obtain the first destination signature message.
  • the sending unit 220 is configured to send an original data packet to the destination master node, where the original data packet includes the a source master node identifier, a global locating address of the source master node, a destination slave node identifier, and a global locating address of the destination master node, such that the destination master node uses the destination master node in the original data packet
  • the global positioning address is replaced with the local positioning address of the destination slave node, thereby obtaining the destination data packet, and transmitting the destination data packet to the destination slave node.
  • the terminal device when the access node is the source master node, the terminal device further includes a processing unit 250, where the processing unit 250 is configured to sign the first message by using a source master node private key. To obtain the first destination signature message.
  • the source master node is a node with strong endurance capability in the source trusted domain; the source slave node is a node with weak endurance capability in the source trusted domain; The node is a node with strong endurance capability in the trusted domain of the destination; the destination slave node is a node with weak endurance capability in the destination trusted domain.
  • the receiving unit 210 is configured to receive a second destination signature message sent by the destination master node
  • the sending unit 220 is configured to send a second verification result to the destination master node, where the second verification result is a result obtained by the source master node verifying the second destination signature message, where the The second verification result is used to indicate that the access node passes the identity authentication of the destination slave node.
  • the first destination signature message and the second destination signature message are both identity-based signature messages.
  • the destination master node 300 may include a receiving unit 310, a transmitting unit 330, a processing unit 350, and a storage unit 370.
  • the receiving unit 310 may be a receiver, and the sending unit 330 may be a transmitter.
  • the receiving unit 310 and the transmitting unit 330 may also be the same transceiver.
  • Processing unit 350 can be a processor, a processing chip, and an integrated processing circuit or the like.
  • the storage unit 370 can be a hard disk, a memory, or a NLAND Flash or the like.
  • the destination master node When the access node needs to access the destination slave node in the destination trusted domain, the destination master node receives the first destination signature message sent by the source master node by the receiving unit 310.
  • the destination master node sends a first verification result to the source master node by using the sending unit 330, where the first verification result is a result obtained by verifying the first destination signature message, where the first verification result is used by Instructing the destination slave node to pass identity authentication of the source slave node.
  • the storage unit 370 is configured to store the first signature message and the first verification result and the like.
  • the receiving unit 310 is configured to receive an intermediate data packet sent by the source master node, where the intermediate data packet is The source master node obtains the source location address of the source data packet in the original data packet by replacing the local location address of the source node with the global location address of the source master node; the original data packet includes the source slave node identifier, and the local location of the source slave node The address, the destination slave node identifier, and the global positioning address of the destination master node;
  • the processing unit 350 is configured to replace the global positioning address of the destination primary node in the intermediate data packet with a local positioning address of the destination secondary node, thereby obtaining a destination data packet;
  • the sending unit 320 is configured to send the destination data packet to the destination slave node.
  • the receiving unit 310 is configured to receive an original data packet sent by the source master node, where the original data packet includes the a source master node identifier, a global location address of the source master node, a destination slave node identifier, and a global location address of the destination master node;
  • the processing unit 350 is configured to replace a global positioning address of the destination primary node in the original data packet with a local positioning address of the destination secondary node, thereby obtaining a destination data packet;
  • the sending unit 320 is configured to send the destination data packet to the destination slave node.
  • the source master node is a node with strong endurance capability in the source trusted domain; the source slave node is a node with weak endurance capability in the source trusted domain; The node is a node with strong endurance capability in the trusted domain of the destination; the destination slave node is a node with weak endurance capability in the destination trusted domain.
  • the sending unit 320 is configured to send a second destination signature message to the source master node, where the receiving unit 310 is configured to receive a second verification result sent by the source master node, where The second verification result is a result obtained by the source master node verifying the second destination signature message, and the second verification result is used to indicate that the access node passes the identity authentication of the destination slave node.
  • the first destination signature message and the second destination signature message are both identity-based signature messages.
  • the receiving unit 310 is configured to receive the second message sent by the destination slave node
  • the processing unit 350 is configured to sign the second message by using the destination master private key to obtain the second destination signature message.
  • the present application further provides a communication system, where the communication system includes a source master node and a destination master node, wherein the source master node may be the source master node shown in FIG. 14, and the destination master node may be FIG. The destination master node shown.
  • the source master node may be the source master node shown in FIG. 15, and the destination master node may be the destination master node shown in FIG.
  • embodiments of the present invention can be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or a combination of software and hardware. Moreover, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) including computer usable program code.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Software Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例提供了一种认证方法、设备以及系统。所述方法包括：当访问节点需要对目的可信域中的目的从节点进行访问时，源主节点向身份管理系统发送身份查询请求；源主节点接收身份管理系统返回的身份查询结果，身份查询结果用于指示目的从节点的属性为从节点，目的从节点对应的主节点为目的主节点；源主节点向身份与位置映射管理设备发送位置查询请求；源主节点接收身份与位置映射管理设备返回的位置查询结果，位置查询结果包括目的主节点的全局定位地址；源主节点基于目的主节点的全局定位地址向目的主节点发送第一目的签名消息；源主节点接收目的主节点发送的第一验证结果，第一验证结果用于指示目的从节点通过了对访问节点的身份认证。

Description

认证方法、设备以及系统 技术领域
本发明涉及通信领域，尤其涉及一种认证方法、设备以及系统。
背景技术
现今，物联网设备(Internet of Things，IOT)已经被广泛应用于环境探测、健康护理、智能家庭、物流跟踪等方面，极大的方便了人们的生活。物联网设备可以直接与互联网络进行通信，利用互联网络提供的数据传输服务为用户呈现丰富的应用体验。
但是，物联网设备的电量储备能力一般较弱，经常通过互联网络进行数据通信会大量消耗物联网设备的电量，影响物联网设备的使用寿命。尤其是对于体积比较小的物联网设备，电池通常会做得很小，无法支持物联网设备长时间进行数据通讯。
发明内容
本申请实施例提供了认证方法、设备以及系统，减少源从节点以及目的从节点参与身份认证流程，从而减少了源从节点和/或目的从节点的资源消耗。
第一方面，提供了一种认证方法，应用于通信系统，所述通信系统包括源可信域以及目的可信域，所述源可信域包括源主节点以及源从节点，所述目的可信域包括目的主节点以及目的从节点，所述源从节点为所述源主节点的从属节点，所述目的从节点为所述目的主节点的从属节点，所述包括如下步骤：
当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述源主节点向身份管理系统发送身份查询请求，其中，所述访问节点是所述源主节点或者所述源从节点，所述身份查询请求用于指示所述身份管理系统对所述目的从节点的身份进行查询；
所述源主节点接收所述身份管理系统返回的身份查询结果，其中，所述身份查询结果用于指示所述目的从节点的属性为从节点，并且，所述目的从节点对应的主节点为所述目的主节点；
所述源主节点向身份与位置映射管理设备发送位置查询请求，其中，所述位置查询请求用于指示所述身份与位置映射管理设备对所述目的主节点的位置进行查询；
所述源主节点接收所述身份与位置映射管理设备返回的位置查询结果，其中，所述位置查询结果包括所述目的主节点的全局定位地址；
所述源主节点基于所述目的主节点的全局定位地址向所述目的主节点发送第一目的签名消息；
所述源主节点接收所述目的主节点发送的第一验证结果，其中，所述第一验证结果是对所述目的主节点对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述访问节点的身份认证。
第二方面，提供了一种认证方法，应用于通信系统，所述通信系统包括源可信域以及目的可信域，所述源可信域包括源主节点以及源从节点，所述目的可信域包括目的主节点以及目的从节点，所述源从节点为所述源主节点的从属节点，所述目的从节点为所述目的 主节点的从属节点，所述包括如下步骤：
当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述目的主节点接收所述源主节点发送的第一目的签名消息；
所述目的主节点向所述源主节点发送第一验证结果，所述第一验证结果是对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述源从节点的身份认证。
第一方面以及第二方面分别从源主节点侧以及目的主节点侧描述了本发明实施例提供的一种认证方法的方法，通过实施该方法，减少源从节点和/或目的从节点参与身份认证流程，从而减少了源从节点和/或目的从节点的资源消耗。
结合第一方面或者第二方面，在一些可能的实施例中，当所述访问节点为所述源从节点时，所述源从节点向所述源主节点发送原始数据包。相应地，所述源主节点接收所述源从节点发送的原始数据包。其中，所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址。所述源主节点将所述原始数据包中的所述源从节点的本地定位地址替换为所述源主节点的全局定位地址，从而得到中间数据包。所述源主节点将所述中间数据包发送给所述目的主节点。相应地，所述目的主节点接收所述源主节点发送的所述中间数据包。所述目的主节点将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包。所述目的主节点将所述目的数据包发送给所述目的从节点。相应地，所述目的从节点接收所述目的主节点发送的所述目的数据包。
结合第一方面或者第二方面，在一些可能的实施例中，当所述访问节点为所述源从节点时，所述源主节点获得第一目的签名消息的方式至少包括以下两种：
在第一种方式中，所述源从节点使用源从节点私钥对第一消息进行签名，以得到第一原始签名消息。所述源从节点将所述第一原始签名消息发送给所述源主节点。相应地，所述源主节点接收所述源从节点发送的所述第一原始签名消息。所述源主节点使用所述源主节点私钥对所述第一原始签名消息进行签名得到所述第一目的签名消息。可以理解，在通讯环境比较复杂的场景下，可以采用双重认证方式，从而提高通讯的安全性。
在第二种方式中，所述源从节点向所述源主节点发送第一消息。相应地，所述源主节点接收所述源从节点发送的第一消息。所述源主节点使用所述源主节点私钥对所述第一消息进行签名得到所述第一目的签名消息。可以理解，在通讯环境比较简答的场景下，可以采用单次认证方式，从而减少认证的复杂度，减少资源的消耗。
结合第一方面或者第二方面，在一些可能的实施例中，当所述访问节点为所述源主节点时，所述源主节点将原始数据包发送给所述目的主节点。相应地，所述目的主节点接收所述源主节点发送的所述原始数据包。其中，所述原始数据包包括所述源主节点标识、所述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址。所述目的主节点将所述原始数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包。所述目的主节点将所述目的数据包发送给所述目的从节点，相应地，所述目的从节点接收所述目的主节点发送的所述目的数据包。
结合第一方面或者第二方面，在一些可能的实施例中，当所述访问节点为所述源主节 点时，所述源主节点使用源主节点私钥对第一消息进行签名，以得到所述第一目的签名消息。
结合第一方面或者第二方面，在一些可能的实施例中，所述源主节点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。可以理解，源主节点以及目的主节点主要参与了身份认证的流程，需要耗费比较多的资源，源从节点以及目的从节点较少参与身份认证的流程，不需要耗费很多资源，所以，可以选取续航能力强的节点作为源主节点以及目的主节点，选取续航能力弱的节点作为源主节点以及目的主节点。
结合第一方面或者第二方面，在一些可能的实施例中，所述目的主节点向所述源主节点发送第二目的签名消息。相应地，所述源主节点接收所述目的主节点发送的第二目的签名消息。所述源主节点对所述第二目的签名消息进行验证，从而获得第二验证结果。所述源主节点向所述目的主节点发送所述第二验证结果。相应地，所述目的主节点接收所述源主节点发送的所述第二验证结果。其中，所述第二验证结果用于指示所述访问节点通过了对所述目的从节点的身份认证。可以理解，在本实施例中，访问节点以及目的从节点之间相互之间进行了身份认证，能够确保访问节点以及目的从节点的身份都是可信的，提高了通信的安全性。
结合第一方面或者第二方面，在一些可能的实施例中，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
结合第一方面或者第二方面，在一些可能的实施例中，所述目的主节点向所述源主节点发送第二目的签名消息之前包括：
所述目的从节点向所述目的主节点发送第二消息。相应地，所述目的主节点接收所述目的从节点发送的第二消息。所述目的主节点使用目的主节点私钥对第二消息进行签名，以得到所述第二目的签名消息。
第三方面，提供了一种终端设备，应用于通信系统，所述通信系统包括源可信域以及目的可信域，所述源可信域包括源主节点以及源从节点，所述目的可信域包括目的主节点以及目的从节点，所述源从节点为所述源主节点的从属节点，所述目的从节点为所述目的主节点的从属节点，所述终端设备为所述源主节点，所述终端设备包括发送单元以及接收单元，
当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述发送单元用于向身份管理系统发送身份查询请求，其中，所述访问节点是所述源主节点或者所述源从节点，所述身份查询请求用于指示所述身份管理系统对所述目的从节点的身份进行查询；
所述接收单元用于接收所述身份管理系统返回的身份查询结果，其中，所述身份查询结果用于指示所述目的从节点的属性为从节点，并且，所述目的从节点对应的主节点为所述目的主节点；
所述发送单元用于向身份与位置映射管理设备发送位置查询请求，其中，所述位置查询请求用于指示所述身份与位置映射管理设备对所述目的主节点的位置进行查询；
所述接收单元用于接收所述身份与位置映射管理设备返回的位置查询结果，其中，所 述位置查询结果包括所述目的主节点的全局定位地址；
所述发送单元用于基于所述目的主节点的全局定位地址向所述目的主节点发送第一目的签名消息；
所述接收单元用于接收所述目的主节点发送的第一验证结果，其中，所述第一验证结果是对所述目的主节点对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述访问节点的身份认证。
在一些可能的实施例中，当所述访问节点为所述源从节点时，所述终端设备还包括处理单元，
所述接收单元用于接收所述源从节点发送的原始数据包，其中，所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
所述处理单元用于将所述原始数据包中的所述源从节点的本地定位地址替换为所述源主节点的全局定位地址，从而得到中间数据包；
所述发送单元用于将所述中间数据包发送给所述目的主节点，以使得所述目的主节点将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包，并将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，所述接收单元用于接收所述源从节点发送的第一原始签名消息，其中，所述第一原始签名消息是所述源从节点使用源从节点私钥对第一消息进行签名得到的；
所述处理单元用于使用所述源主节点私钥对所述第一原始签名消息进行签名得到所述第一目的签名消息。
在一些可能的实施例中，当所述访问节点为所述源从节点时，所述接收单元用于接收所述源从节点发送的第一消息；
所述处理单元用于使用所述源主节点私钥对所述第一消息进行签名得到所述第一目的签名消息。
在一些可能的实施例中，当所述访问节点为所述源主节点时，所述发送单元用于将原始数据包发送给所述目的主节点，其中，所述原始数据包包括所述源主节点标识、所述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址，以使得所述目的主节点将所述原始数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包，并将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，当所述访问节点为所述源主节点时，所述终端设备还包括处理单元，所述处理单元用于使用源主节点私钥对第一消息进行签名，以得到所述第一目的签名消息。
在一些可能的实施例中，所述源主节点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。
在一些可能的实施例中，所述接收单元用于接收所述目的主节点发送的第二目的签名消息；
所述发送单元用于向所述目的主节点发送第二验证结果，其中，所述第二验证结果是所述源主节点对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述访问节点通过了对所述目的从节点的身份认证。
在一些可能的实施例中，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
第四方面，提供了一种终端设备，应用于通信系统，所述通信系统包括源可信域以及目的可信域，所述源可信域包括源主节点以及源从节点，所述目的可信域包括目的主节点以及目的从节点，所述源从节点为所述源主节点的从属节点，所述目的从节点为所述目的主节点的从属节点，所述终端设备为所述目的主节点，所述终端设备包括接收单元以及发送单元，
当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述接收单元用于接收所述源主节点发送的第一目的签名消息；
所述发送单元用于向所述源主节点发送第一验证结果，所述第一验证结果是对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述源从节点的身份认证。
在一些可能的实施例中，当所述访问节点为所述源从节点时，所述终端设备还包括处理单元，
所述接收单元用于接收所述源主节点发送的中间数据包，其中，所述中间数据包是所述源主节点将原始数据包中的源从节点的本地定位地址替换为源主节点的全局定位地址从而得到的；所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
所述处理单元用于将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包；
所述发送单元用于将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，当所述访问节点为所述源主节点时，所述终端设备还包括处理单元，
所述接收单元用于接收所述源主节点发送的原始数据包，其中，所述原始数据包包括所述源主节点标识、所述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
所述处理单元用于将所述原始数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包；
所述发送单元用于将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，所述源主节点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。
在一些可能的实施例中，所述发送单元用于向所述源主节点发送第二目的签名消息；
所述接收单元用于接收所述源主节点发送的第二验证结果，其中，所述第二验证结果是所述源主节点对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指 示所述访问节点通过了对所述目的从节点的身份认证。
在一些可能的实施例中，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
在一些可能的实施例中，所述终端设备还包括处理单元，所述接收单元用于接收所述目的从节点发送的第二消息；
所述处理单元用于使用目的主节点私钥对第二消息进行签名，以得到所述第二目的签名消息。
第五方面，提供了一种终端设备，包括存储器以及与所述存储器耦合的处理器、发射器和接收器，其中：所述发射器用于与向外部发送数据，所述接收器用于接收外部发送的数据，所述存储器用于存储第一方面任意一项所述的方法的实现代码，所述处理器用于执行所述存储器中存储的程序代码，即执行第一方面任意一项所述的方法。
第六方面，提供了一种终端设备，其特征在于，包括存储器以及与所述存储器耦合的处理器、发射器和接收器，其中：所述发射器用于与向外部发送数据，所述接收器用于接收外部发送的数据，所述存储器用于存储第二方面任意一项所述的方法的实现代码，所述处理器用于执行所述存储器中存储的程序代码，即执行第二方面任意一项所述的方法。
第七方面，提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时实现如第一方面任意一项所述的方法。
第八方面，提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，所述计算机程序被处理器执行时实现如第二方面任意一项所述方法。
第九方面，一种通讯系统，所述通信系统包括源可信域以及目的可信域，所述源可信域包括源主节点以及源从节点，所述目的可信域包括目的主节点以及目的从节点，所述源从节点为所述源主节点的从属节点，所述目的从节点为所述目的主节点的从属节点，其中，所述源主节点用于执行第一方面任意一项所述的方法，所述目的主节点用于执行第二方面任意一项所述的方法。
附图说明
为了更清楚地说明本发明实施例或背景技术中的技术方案，下面将对本发明实施例或背景技术中所需要使用的附图进行说明。
图1是本申请实施例涉及的通信系统的示意图；
图2是现有技术中网关对源主节点与目的主节点的身份认证的流程交互图；
图3是现有技术中源主节点与目的主节点之间的身份认证的流程交互图；
图4是IPv6协议架构与ION协议架构的对比示意图；
图5是本申请实施例提供了一种基于ION协议架构的认证方法的交互图；
图6是本申请实施中目的从节点对源从节点进行验证的第一种方式的流程交互图；
图7是本申请实施中目的从节点对源从节点进行验证的第二种方式的流程交互图；
图8是本申请实施中源从节点与所述目的从节点之间相互进行数据通信的数据包示意图；
图9是本申请实施中源从节点对目的从节点进行验证的第二种方式的流程交互图；
图10是本申请实施例提供了另一种基于ION协议架构的认证方法的交互图；
图11是本申请实施中目的从节点对源主节点进行验证的具体实施方式的流程交互图；
图12是本申请实施中源主节点对目的从节点进行验证的具体实施方式的流程交互图；
图13本申请实施中源主节点与所述目的从节点之间相互进行数据通信的数据包示意图
图14是本申请实施例提供的一种装置的结构示意图；
图15是本申请实施例提供的源主节点和目的主节点以及二者构成的通信系统的结构示意图。
具体实施方式
下面结合附图以及具体的实施方式对本申请实施例进行详细的介绍。
为了便于对本申请实施例理解，下面先对可信域进行介绍。可信域的特点为：在同一个可信域中，节点之间是互相信任的，即，在同一个可信域中，节点之间无需互相认证就可以互相访问。可信域可以是根据节点的社交关系建立的，其中，所述社交关系可以是物所属关系，例如，个人笔记本、冰箱、电视、电表以及水表等是属于同一用户的节点，可以构成一个可信域。所述社交关系可以是同地域物物关系，例如，温度传感、湿度传感器、烟雾传感器以及消防设备等是属于同一仓库地域，可以构成一个可信域。所述社交关系可以是同工物物关系，例如，流速传感器、水位传感器以及灌溉设备等同为一个灌溉系统工作，可以构成一个可信域。由于可信域中的节点可以根据社交关系确定相互之间的身份，所以，可信域的建立可以将散落的，零碎的节点统一成有机整体，从而提高了管理的效率，以及，降低了管理的成本。可以理解，所述社交关系不限于上述物所属关系、同地域物物关系以及同工物物关系，在实际应用中所述社交关系还可以是其他关系，此处不作具体限定。
在本申请实施例中，可信域中的节点为逻辑实体，具体可以是终端设备(Terminal)、用户设备(User Equipment)以及物联网(Internet of Things，IoT)设备等等中的任意一种或者多种的组合。其中，终端设备可以是台式计算机(computer)，笔记本电脑(notebook)，平板电脑(PAD)等等。用户设备可以是智能手机(smart phone)，智能手表(smart watch)，智能眼镜等等。物联网设备可以是传感器，电表以及水表等等。应理解，上述举例仅是为说明，不应构成具体限定。
参见图1，图1是本申请实施例涉及的通信系统的示意图。如图1所示，通信系统中至少存在源可信域以及目的可信域。
所述源可信域包括源主节点以及源从节点，其中，源从节点为源主节点管辖下的节点。源主节点为源可信域中续航能力强的节点，源从节点为源可信域中续航能力弱的节点。即，源主节点为可以外接电源的节点，或者，剩余电量比较多的可充电的节点；源从节点为不可以充电的节点，或者，剩余电量比较少的可充电的节点。例如，源主节点可以是台式计算机，笔记本电脑，平板电脑等等可以外接电源的终端设备，或者，源主节点可以是剩余电量超过80％的智能手机、智能手表或者智能眼镜等等可充电的用户设备。源从节点可以 是设置在高楼的阴暗角落的智能水表以及智能电表等等不可充电的物联网设备，或者，源从节点可以是剩余电量少于20％的智能手机、智能手表或者智能眼镜等等可充电的用户设备。可以理解，源主节点以及源从节点的身份是可以变化的，例如，源主节点的电量下跌至20％时，源主节点可以变成源从节点，源从节点的电量被充满至100％时，源从节点可以变成源主节点。
所述目的可信域包括目的主节点以及目的从节点，其中，目的从节点为目的主节点管辖下的节点。目的主节点为目的可信域中续航能力强的节点，目的从节点为目的可信域中续航能力弱的节点。即，目的主节点为可以外接电源的节点，或者，剩余电量比较多的可充电的节点；目的从节点为不可以充电的节点，或者，剩余电量比较少的可充电的节点。例如，目的主节点可以是台式计算机，笔记本电脑，平板电脑等等可以外接电源的终端设备，或者，目的主节点可以是剩余电量超过80％的智能手机、智能手表或者智能眼镜等等可充电的用户设备。目的从节点可以是设置在高楼的阴暗角落的智能水表以及智能电表等等不可充电的物联网设备，或者，目的从节点可以是剩余电量少于20％的智能手机、智能手表或者智能眼镜等等可充电的用户设备。可以理解，目的主节点以及目的从节点的身份是可以变化的，例如，目的主节点的电量下跌至20％时，目的主节点可以变成目的从节点，目的从节点的电量被充满至100％时，目的从节点可以变成目的主节点。
在源可信域中，源主节点之间可以通过IP(internet protocol)网络连接起来，源从节点连接至其对应的源主节点上；在目的可信域中，目的主节点之间可以通过IP网络连接起来，目的从节点连接至其对应的目的主节点上；在源可信域与目的可信域之间，至少一个源主节点与至少一个目的主节点通过IP网络进行连接。
现有技术提出了一种基于IPv6协议架构的源主节点与目的主节点之间的认证方法。所述方法包括两个环节，其中，第一个环节为：网关对源主节点与目的主节点的身份认证。第二个环节为：源主节点与目的主节点之间的身份认证。
在第一个环节中，如图2所示，源主节点向第一网关发出第一认证请求，其中，第一网关是源主节点所属的网关。第一网关在接收到第一认证请求之后，将第一随机数以及第一认证密钥次序发送给源主节点，其中，第一随机数是第一网关生成的随机数，第一认证密钥次序是第一网关随机选择的。相应地，源主节点接收第一网关发送的第一随机数以及第一认证密钥次序。
源主节点根据第一认证密钥次序查找到存储在自身的对应的认证密钥，并使用hash函数计算得到第一应答值hash(RM1，AK1)，其中，hash函数为网关与源主节点预先约定的函数，RM1为第一随机数，AK1为存储在源主节点的与第一认证密钥对应的认证密钥。源主节点将第一应答值发送给第一网关。相应地，第一网关接收源主节点发送的第一应答值。
第一网关根据第一认证密钥次序查找到存储在自身的对应的认证密钥，并使用hash1函数计算得到第二应答值hash1(RM1，AK2)。其中，hash1函数为第一网关与源主节点预先约定的函数，RM1为第一随机数，AK2为存储在第一网关的与第一认证密钥对应的认证密钥。第一网关将第一应答值与第二应答值进行比较，如果第一应答值与第二应答值相同，则第一网关对源主节点的身份认证通过。第一网关对目的主节点的身份认证过程与第一网 关对源主节点的身份认证过程相类似，此处不在展开描述。
在第二个环节中，如图3所示，源主节点向目的主节点发送访问请求。目的主节点在接收到源主节点的访问请求之后，向第二网关发送第二认证请求，其中，第二网关为目的主节点所属的网关。第二网关在接收到第二认证请求之后，将第二随机数以及第二认证密钥次序发送给源主节点，其中，第二随机数是第二网关生成的随机数，第二认证密钥次序是第二网关随机选择的。此外，第二网关根据第二认证密钥次序查找到存储在自身的对应的认证密钥，并使用hash2函数计算得到第三应答值hash2(RM2，AK3)，并发送给目的主节点。相应地，目的主节点接收第二网关发送的第三应答值。其中，hash2函数为第二网关与源主节点预先约定的函数，RM2为第二随机数，AK3为存储在第二网关的与第二认证密钥对应的认证密钥。
源主节点接收到第二网关发送的第二随机数以及第二认证密钥次序之后，源主节点根据第二认证密钥次序查找到存储在自身的对应的认证密钥，并使用hash2函数计算得到第四应答值hash2(RM2，AK2)，其中，hash2函数为第二网关与源主节点预先约定的函数，RM2为第二随机数，AK4为存储在源主节点的与第二认证密钥对应的认证密钥。源主节点将第四应答值发送给目的主节点。相应地，目的主节点接收源主节点发送的第四应答值。
目的主节点将第三应答值与第四应答值进行比较，如果第三应答值与第四应答值相同，则目的主节点对源主节点的身份认证通过，目的主节点允许源主节点进行访问。
但是，这种认证方法只适合源主节点与目的主节点之间进行认证，不适合涉及源从节点以及目的从节点之间的身份认证。如果源主节点与目的从节点之间的身份认证以及源从节点与目的从节点之间的身份认证也采用这种认证方法，会大量消耗源从节点与目的从节点的电量，影响源从节点与目的从节点的续航能力。
为了解决上述问题，本申请实施例提供了一种基于ION(Identity oriented network)协议架构的认证方法、设备以及系统，能够适合涉及源主节点与目的从节点之间的身份认证，源从节点以及目的从节点之间的身份认证，减少源从节点与目的从节点的电量消耗，提高源从节点与目的从节点的续航能力。在本申请实施例中，ION协议架构是一种新型的协议架构，如图4所示，与传统的IPv6协议架构的不同之处在于：ION协议架构在IPv6协议架构的IP层(3层)和传输层(4层)之间增加了标识层(3.5层)。这样，采用ION协议架构的节点都可以采用标识层的标识作为唯一不变的身份标识。而且，标识层位于IP层之上，所以，ION协议架构下的节点可以通过IP层对标识层的标识进行寻址。本申请文件中，ION协议架构下的节点的标识都是指标识层的标识。
为了能够实现本申请实施例提供的认证方法，本申请的通讯系统还包括身份管理系统(IDentity Management System，IDMS)、身份与位置映射管理系统(Identity and Locater Mapping System，ILMS)以及密钥生成中心(IBS-based Key Management System，IKMS)。
身份管理系统用于为源主节点分配源主节点标识，为源从节点分配源从节点标识，为目的主节点分配目的主节点标识，以及，为目的从节点分配目的从节点标识。身份管理系 统将源主节点标识发送给源主节点，将源从节点标识发送给源从节点，将目的主节点标识发送给目的主节点，以及，将目的从节点标识发送给目的从节点。身份管理系统还用于记载源主节点的属性、源从节点的属性、目的主节点的属性、目的从节点的属性；此外，身份管理系统还用于记载源主节点与源从节点的对应关系，以及，目的主节点与目的从节点的对应关系。以图1所示的源可信域以及目的可信域为例，身份管理系统中可以设置如表1所示的属性表格以及表2所示的对应关系表格。其中，属性表格用于记载源主节点的属性、源从节点的属性、目的主节点的属性，以及，目的从节点的属性。对应关系表格用于记载源主节点以及源从节点的对应关系，以及，目的主节点以及目的从节点的对应关系。可以理解，表1以及表2只是作为一种具体的示例，而非具体限定。
表1 属性表格
Figure PCTCN2018089627-appb-000001
表2 对应关系表格
Figure PCTCN2018089627-appb-000002
身份与位置映射管理系统用于记载源主节点的全局定位地址，以及，目的主节点的全局定位地址。其中，源主节点与其管辖下的源从节点使用同一个源主节点全局定位地址，目的主节点与其管辖下的目的从节点使用同一个目的主节点全局定位地址。身份与位置映射管理系统向源主节点以及其管辖下的源从节点发送同一个源主节点全局定位地址，向目的主节点以及其管辖下的目的从节点发送同一个目的主节点全局定位地址。以图1所示的源可信域以及目的可信域为例，源主节点A以及其管辖下的源从节点a～c使用源主节点A全局定位地址，源主节点B使用源主节点B全局定位地址，源主节点C以及其管辖下的源从节点d、e使用源主节点C全局定位地址；目的主节点X以及其管辖下的目的从节点x～z使用目的主节点X全局定位地址，目的主节点Y使用目的主节点Y全局定位地址，目的主节点Z以及其管辖下的目的从节点v、w使用目的主节点Z全局定位地址。在一具体实施例中，身份与位置映射管理系统中可以设置如表2所示的对应关系表格以及表3所示的全局定位地址表格。其中，全局定位地址表格用于记载源主节点与全局定位地址的对应关系，以及，目的主节点与全局定位地址的对应关系。当需要查询源主节点或者目的主节点的全局定位地址时，可以通过表3直接查询源主节点或者目的主节点的全局定位地址；当需要查询源从节点或者目的从节点的全局定位地址时，可以先通过表2查询源从节点对应的源主节点，或者，目的从节点的对应的目的主节点，然后，再通过表3查询源主节点或者目的主节点对应的全局定位地址。可以理解，表3只是作为一种具体的示例，而非具体限定。
表3 全局定位地址表格
Figure PCTCN2018089627-appb-000003
密钥生成中心用于基于源主节点公钥为源主节点生成源主节点私钥。具体地，所述源主节点公钥可以是所述源主节点标识，所述密钥生成中心基于所述源主节点标识生成与所述源从节点公钥对应的私钥。源主节点私钥与源主节点公钥是配对使用的，即，当通讯双方中的其中一方使用源主节点私钥进行签名以获得签名消息时，另一方只能使用源主节点公钥对签名消息进行验证。类似地，密钥生成中心还用于基于源从节点公钥为源从节点生成源从节点私钥，基于目的主节点公钥为目的主节点生成目的主节点私钥，以及，基于目的从节点公钥为目的从节点生成目的从节点私钥，此处不再展开描述。密钥生成中心将源主节点私钥发送给源主节点，将源从节点私钥发送给源从节点，将目的主节点私钥发送给目的主节点，以及，将目的从节点私钥发送给目的从节点。以图1所示的源可信域以及目的可信域为例，节点与密钥之间的关系可以如图4所示的节点与密钥对应表格所示。可以理解，表4是作为一种具体的示例，而非具体限定。
表4 节点与密钥对应表格
Figure PCTCN2018089627-appb-000004
可以理解，身份管理系统、身份与位置映射管理系统以及密钥生成中心均是逻辑实体，例如，服务器等等。在实际应用中，身份管理系统、身份与位置映射管理系统以及密钥生成中心在不同系统中的实际产品名称可能不尽相同，例如，有些系统中的密钥生成中心被称为私钥生成器(Private-Key Generator，PKG)，当然产品名称的改变并不影响密钥生成中心的实质。并且，身份管理系统、身份与位置映射管理系统以及密钥生成中心的部署方式可以是非常灵活的，例如，身份管理系统、身份与位置映射管理系统以及密钥生成中心可以分别单独部署，可以集中部署，也可以和其他的设备部署在一起，本申请不作具体限定。
源主节点用于存储身份管理系统发送的源主节点标识、身份与位置映射管理系统发送的源主节点全局定位地址，以及密钥生成中心发送的源主节点私钥。源主节点还用于存储其管辖下的源从节点的本地定位地址的映射关系。以源主节点A为例，源主节点A中可以设置如表5所示的本地定位地址映射表，其中，表5所示的本地定位地址映射表用于记载源主节点A管辖下源从节点的源从节点标识与本地定位地址的对应关系。可以理解，表5是作为一种具体的示例，而非具体限定。目的主节点与源主节点向类似，此处不再展开描述。
表5 本地定位地址映射表
源从节点标识 本地定位地址
源从节点a标识 源从节点a本地定位地址
源从节点b标识 源从节点b本地定位地址
源从节点c标识 源从节点c本地定位地址
源从节点用于存储身份管理系统发送的源从节点标识、身份与位置映射管理系统发送的对应的源主节点的源主节点全局定位地址，以及密钥生成中心发送的源主节点私钥。此外，源从节点还用于存储自身的本地定位地址。可以理解，目的从节点与源主节点相类似，此处不再展开描述。
参阅图5，图5是本申请实施例提供了一种基于ION协议架构的认证方法的交互图。本申请实施例可以应用在所述源从节点需要访问所述目的从节点的应用场景。如图5所示，所述基于ION协议架构的认证方法包括如下步骤：
S102：所述源从节点向所述源主节点发送查询请求。相应地，所述源主节点接收所述源从节点发送的查询请求。其中，所述查询请求用于指示所述源主节点对所述目的从节点的身份以及位置进行查询。
在本申请实施例中，所述查询请求可以包括目的从节点的身份标识，所述源主节点根据所述目的从节点的身份标识对所述目的从节点的身份以及位置进行查询。所述目的从节点的身份标识可以是固定不变的标识，例如，网络协议(Internet Protocol，IP)地址、手机号码、国际移动设备标识(International Mobile Equipment Identity，IMEI)、国际移动用户识别码(International Mobile Subscriber Identity，IMSI)、IP多媒体私有标识(IP Multimedia Private Identity，IMPI)、IP多媒体公共标识(IP Multimedia Public Identity，IMPU)等等，也可以是临时分配的标识，例如，临时移动用户标识符(TemporaryMobileSubscriberIdentity，TMSI)、全球唯一临时UE标识(Globally Unique Temporary UE Identity，GUTI)等等。
S104：所述源主节点向身份管理系统发送身份查询请求。相应地，所述身份管理系统接收所述源主节点发送的身份查询请求。其中，所述身份查询请求至少包括目的从节点的身份标识。
S106：所述身份管理系统向所述源主节点发送身份查询结果。相应地，所述源主节点接收所述身份管理系统返回的身份查询结果。
在本申请实施例中，身份管理系统在接收到身份查询请求之后，根据所述身份查询请求中携带的目的从节点的身份标识查询属性表格(例如，表1)，从而查询得到所述目的从节点的节点属性为从节点。然后，身份管理系统根据所述目的从节点的身份标识查询对应关系表(例如，表2)，从而查询得到所述目的从节点对应的主节点为所述目的主节点。最后，身份管理系统向所述源主节点发送身份查询结果，其中，所述身份查询结果包括节点属性标识以及目的主节点的标识，所述节点属性标识用于指示所述目的从节点的属性为从节点，所述目的主节点的标识用于指示所述目的从节点对应的主节点为所述目的主节点。
S108：所述源主节点向身份与位置映射管理设备发送位置查询请求。相应地，所述身份与位置映射管理设备接收所述源主节点发送的位置查询请求。其中，所述位置查询请求至少包括所述目的主节点的标识。
S110：所述身份与位置映射管理设备向所述源主节点返回位置查询结果。相应地，所述源主节点接收所述身份与位置映射管理设备返回的位置查询结果。
在本申请实施例中，身份与位置映射管理设备在接收到位置查询请求之后，根据所述 位置查询请求中携带的目的从节点的身份标识查询对应关系表格(例如，表2)查询得到目的从节点对应的主节点为目的主节点，并得到目的主节点标识。然后，身份与位置映射管理设备根据所述目的主节点标识查询全局定位地址表格(例如，表3)查询得到目的主节点的全局定位地址。最后，所述身份与位置映射管理设备向所述源主节点返回位置查询结果，其中，所述位置查询结果至少包括所述目的主节点的全局定位地址。
S112：所述源主节点将所述身份查询结果以及所述位置查询结果返回给所述源从节点。相应地，所述源从节点接收所述源主节点发送的所述身份查询结果以及所述位置查询结果。
S114：所述源主节点基于所述目的主节点的全局定位地址向所述目的主节点发送第一目的签名消息。相应地，所述目的主节点接收所述源主节点发送的第一目的签名消息。
S116：所述目的主节点向所述源主节点发送第一验证结果。相应地，所述源主节点接收所述目的主节点发送的第一验证结果。其中，所述第一验证结果是对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述源从节点的身份认证。
在本申请实施例中，步骤S114～步骤S116为目的从节点对源从节点进行验证的过程，所述目的从节点对源从节点进行验证的具体实施方式可以包括以下两种：
在第一种方式中，如图6所示，目的从节点对源从节点进行验证的过程可以包括以下几个步骤：所述源从节点向所述源主节点发送第一消息。相应地，所述源主节点接收所述源从节点发送的第一消息。所述源主节点使用所述源主节点私钥对所述第一消息进行签名得到所述第一目的签名消息。所述源主节点向所述目的主节点发送所述第一目的签名消息。相应地，所述目的主节点接收所述源主节点发送的所述第一目的签名消息。所述目的主节点使用源主节点公钥对所述第一目的签名消息进行验证，以获得第一验证结果。所述目的主节点向所述源主节点返回第一验证结果。相应地，所述源主节点接收所述目的主节点返回的第一验证结果。所述源主节点向所述源从节点返回第一验证结果。相应地，所述源从节点接收所述源主节点返回的第一验证结果。可以理解，在通讯环境比较简答的场景下，可以采用单次认证方式，从而减少认证的复杂度，减少资源的消耗。
在第二种方式中，如图7所示，目的从节点对源从节点进行验证的过程可以包括以下几个步骤：所述源从节点使用源从节点私钥对第一消息进行签名以获得第一原始签名消息。所述源从节点将所述第一原始签名消息发送给所述源主节点。相应地，所述源主节点接收所述源从节点发送的第一原始签名消息。所述源主节点使用所述源主节点私钥对所述第一原始签名消息再次进行签名以获得所述第一目的签名消息。所述源主节点向所述目的主节点发送所述第一目的签名消息。相应地，所述目的主节点接收所述源主节点发送的所述第一目的签名消息。所述目的主节点使用所述源主节点公钥对所述第一目的签名消息进行验证，以获得第一原始签名消息。所述目的主节点将所述第一原始签名消息发送给所述目的从节点。相应地，所述目的从节点接收所述目的主节点发送的所述第一原始签名消息。所述目的从节点使用源从节点公钥对所述第一原始签名消息进行验证，以获得第一验证结果。所述目的从节点向所述目的主节点返回第一验证结果。相应地，所述目的主节点接收所述目的从节点返回的第一验证结果。所述目的主节点向所述源主节点返回第一验证结果。相应地，所述源主节点接收所述目的主节点返回的第一验证结果。所述源主节点向所述源从 节点返回第一验证结果。相应地，所述源从节点接收所述源主节点返回的第一验证结果。可以理解，在通讯环境比较复杂的场景下，可以采用双重认证方式，从而提高通讯的安全性。
S118：所述目的主节点向所述源主节点发送第二目的签名消息。相应地，所述源主节点接收所述目的主节点发送的第二目的签名消息。
S120：所述源主节点向所述目的主节点发送第二验证结果。相应地，所述目的主节点接收所述源主节点发送的第二验证结果。其中，所述第二验证结果是对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述源从节点通过了对所述目的从节点的身份认证。
在本申请实施例中，步骤S118～步骤S120为源从节点对目的从节点进行验证的过程。所述源从节点对目的从节点进行验证的具体实施方式可以为：如图8所示，所述目的从节点向所述目的主节点发送第二消息。相应地，所述目的主节点接收所述目的从节点发送的第二消息。所述目的主节点使用目的主节点私钥对第二消息进行签名，以得到所述第二目的签名消息。所述目的主节点将所述第二目的签名消息发送给所述源主节点。相应地，所述源主节点接收所述目的主节点发送的所述第二目的签名消息。所述源主节点使用目的主节点公钥对所述第二目的签名消息进行验证，从而获得第二验证结果。所述源主节点将所述第二验证结果发送给所述目的主节点以及所述源从节点。相应地，所述目的主节点接收所述源主节点发送的所述第二验证结果。所述目的主节点将所述第二验证结果发送给所述目的从节点。相应地，所述目的从节点接收所述目的主节点发送的所述第二验证结果。
S122：所述源从节点与所述目的从节点之间相互进行数据通信。
在本申请实施例中，如图9所示，源从节点与所述目的从节点之间相互进行数据通信具体包括以下几个步骤：所述源从节点向所述源主节点发送原始数据包。相应地，所述源主节点接收所述源从节点发送的原始数据包。其中，所述原始数据包包括所述源从节点标识(ID SSN)、所述源从节点的本地定位地址(Local Locator SSN)、目的从节点标识(ID DSN)以及所述目的主节点的全局定位地址(Global Locator DMN)。所述源主节点将所述原始数据包中的所述源从节点的本地定位地址(Local Locator SSN)替换为所述源主节点的全局定位地址(Global Locator SMN)，从而得到中间数据包。所述源主节点将所述中间数据包发送给所述目的主节点。相应地，所述目的主节点接收所述源主节点发送的中间数据包。所述目的主节点将所述中间数据包中的所述目的主节点的全局定位地址(Global Locator DMN)替换为所述目的从节点的本地定位地址(Global Locator DSN)，从而获得目的数据包。所述目的主节点将所述目的数据包发送给所述目的从节点。相应地，所述目的从节点接收所述目的主节点发送的所述目的数据包。
由于本申请采用了ION协议架构，ION协议架构下的节点都具有标识层的标识，能够通过IP层对标识层的标识进行寻址，所以，在进行身份验证时，无需通过网关进行协助，就能够实现源主节点与目的主节点之间的身份认证，从而大大地减少了身份认证的流程。而且，由于源从节点与源主节点均位于源可信域，目的从节点与目的主节点均位于目的可信域，源从节点信任源主节点，目的从节点也信任目的主节点，所以，在目的主节点对源主节点的身份验证通过的情况下，就可以认为目的从节点也通过了对源从节点的身份认证， 因而，减少源从节点以及目的从节点参与身份认证流程，从而减少了源从节点以及目的从节点的电量消耗。
参阅图10，图10是本申请实施例提供了另一种基于ION协议架构的认证方法的交互图。本申请实施例可以应用在所述源主节点需要访问所述目的从节点的应用场景。如图10所示，所述基于ION协议架构的认证方法包括如下步骤：
S202：所述源主节点向身份管理系统发送身份查询请求。相应地，所述身份管理系统接收所述源主节点发送的身份查询请求。其中，所述身份查询请求至少包括目的从节点的身份标识。
S204：所述身份管理系统向所述源主节点发送身份查询结果。相应地，所述源主节点接收所述身份管理系统返回的身份查询结果。
S206：所述源主节点向身份与位置映射管理设备发送位置查询请求。相应地，所述身份与位置映射管理设备接收所述源主节点发送的位置查询请求。其中，所述位置查询请求至少包括所述目的主节点的标识。
S208：所述身份与位置映射管理设备向所述源主节点返回位置查询结果。相应地，所述源主节点接收所述身份与位置映射管理设备返回的位置查询结果。
S210：所述源主节点基于所述目的主节点的全局定位地址向所述目的主节点发送第一目的签名消息。相应地，所述目的主节点接收所述源主节点发送的第一目的签名消息。
S212：所述目的主节点向所述源主节点发送第一验证结果。相应地，所述源主节点接收所述目的主节点发送的第一验证结果。其中，所述第一验证结果是对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述源主节点的身份认证。
在本申请实施例中，步骤S210～步骤S212为目的从节点对源主节点进行验证的过程，所述目的从节点对源主节点进行验证的具体实施方式可以为：
如图11所示，所述源主节点使用源主节点私钥对第一消息进行签名，以得到所述第一目的签名消息。所述源主节点向所述目的主节点发送所述第一目的签名消息。相应地，所述目的主节点接收所述源主节点发送的所述第一目的签名消息。所述目的主节点使用源主节点公钥对所述第一目的签名消息进行验证，以获得第一验证结果。所述目的主节点向所述源主节点以及所述目的从节点返回第一验证结果。相应地，所述源主节点以及所述目的从节点接收所述目的主节点返回的第一验证结果。
S214：所述目的主节点向所述源主节点发送第二目的签名消息。相应地，所述源主节点接收所述目的主节点发送的第二目的签名消息。
S216：所述源主节点向所述目的主节点发送第二验证结果。相应地，所述目的主节点接收所述源主节点发送的第二验证结果。其中，所述第二验证结果是对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述源主节点通过了对所述目的从节点的身份认证。
在本申请实施例中，步骤S214～步骤S216为源主节点对目的从节点进行验证的过程。所述源主节点对目的从节点进行验证的具体实施方式可以为：如图12所示，所述目的从节 点向所述目的主节点发送第二消息。相应地，所述目的主节点接收所述目的从节点发送的第二消息。所述目的主节点使用目的主节点私钥对第二消息进行签名，以得到所述第二目的签名消息。所述目的主节点将所述第二目的签名消息发送给所述源主节点。相应地，所述源主节点接收所述目的主节点发送的所述第二目的签名消息。所述源主节点使用目的主节点公钥对所述第二目的签名消息进行验证，从而获得第二验证结果。所述源主节点将所述第二验证结果发送给所述目的主节点。相应地，所述目的主节点接收所述源主节点发送的所述第二验证结果。所述目的主节点将所述第二验证结果发送给所述目的从节点。相应地，所述目的从节点接收所述目的主节点发送的所述第二验证结果。
S218：所述源主节点与所述目的从节点之间相互进行数据通信。
在本申请实施例中，如图13所示，所述源主节点将原始数据包发送给所述目的主节点。相应地，所述目的主节点接收所述源主节点发送的所述原始数据包。其中，所述原始数据包包括所述源主节点标识(ID SMN)、所述源主节点的全局定位地址(Global Locator SMN)、目的从节点标识(ID DSN)以及所述目的主节点的全局定位地址(Global Locator DMN)。所述目的主节点将所述原始数据包中的所述目的主节点的全局定位地址(Global Locator DMN)替换为所述目的从节点的本地定位地址(Global Locator DSN)，从而获得目的数据包。所述目的主节点将所述目的数据包发送给所述目的从节点，相应地，所述目的从节点接收所述目的主节点发送的所述目的数据包。
由于本申请采用了ION协议架构，ION协议架构下的节点都具有标识层的标识，能够通过IP层对标识层的标识进行寻址，所以，在进行身份验证时，无需通过网关进行协助，就能够实现源主节点与目的主节点之间的身份认证，从而大大地减少了身份认证的流程。而且，目的从节点与目的主节点均位于目的可信域，目的从节点信任目的主节点，所以，在目的主节点对源主节点的身份验证通过的情况下，就可以认为目的从节点也通过了对源主节点的身份认证，因而，减少目的从节点参与身份认证流程，从而减少了目的从节点的资源消耗。
基于同一发明构思，本发明实施例还提供一种装置(如图14所示)，该装置用于实现前述图5以及图10实施例所描述的方法。如图14所示，装置100包括：发射器103、接收器104、存储器102和与存储器102耦合的处理器101(处理器101的数量可以是一个或多个，图14中以一个处理器为例)。发射器103、接收器104、存储器102和处理器101可通过总线或者其它方式连接(图14中以通过总线连接为例)。其中，发射器103用于向外部发送数据，接收器104用于从外部接收数据。存储器102用于存储程序代码，处理器101用于调用并运行存储于存储器102中的程序代码。
当装置100为源主节点时，存储器102中存储的程序代码具体用于实现图5实施例中的所述源主节点的功能。具体的，处理器101用于调用存储器102中存储的程序代码，并执行以下步骤：
当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述源主节点通过发射器103向身份管理系统发送身份查询请求，其中，所述访问节点是所述源主节点或者所述源从节点，所述身份查询请求用于指示所述身份管理系统对所述目的从节点的身份进行 查询；
所述源主节点通过接收器104接收所述身份管理系统返回的身份查询结果，其中，所述身份查询结果用于指示所述目的从节点的属性为从节点，并且，所述目的从节点对应的主节点为所述目的主节点；
所述源主节点通过发射器103向身份与位置映射管理设备发送位置查询请求，其中，所述位置查询请求用于指示所述身份与位置映射管理设备对所述目的主节点的位置进行查询；
所述源主节点通过接收器104接收所述身份与位置映射管理设备返回的位置查询结果，其中，所述位置查询结果包括所述目的主节点的全局定位地址；
所述源主节点通过发射器103基于所述目的主节点的全局定位地址向所述目的主节点发送第一目的签名消息；
所述源主节点通过接收器104接收所述目的主节点发送的第一验证结果，其中，所述第一验证结果是对所述目的主节点对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述访问节点的身份认证。
在一些可能的实施例中，当所述访问节点为所述源从节点时，所述源从节点与所述目的从节点之间相互进行数据通信包括：
所述源主节点通过接收器104接收所述源从节点发送的原始数据包，其中，所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
所述源主节点通过处理器101将所述原始数据包中的所述源从节点的本地定位地址替换为所述源主节点的全局定位地址，从而得到中间数据包；
所述源主节点通过发射器103将所述中间数据包发送给所述目的主节点，以使得所述目的主节点将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包，并将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，当所述访问节点为所述源从节点时，所述目的从节点对源从节点进行验证的具体实施方式可以包括以下两种：
在第一种方式中，所述源主节点通过接收器104接收所述源从节点发送的第一原始签名消息，其中，所述第一原始签名消息是所述源从节点使用源从节点私钥对第一消息进行签名得到的；所述源主节点通过处理器101使用所述源主节点私钥对所述第一原始签名消息进行签名得到所述第一目的签名消息。
在第二种方式中，所述源主节点通过接收器104接收所述源从节点发送的第一消息；所述源主节点通过处理器101使用所述源主节点私钥对所述第一消息进行签名得到所述第一目的签名消息。
在一些可能的实施例中，当所述访问节点为所述源主节点时，所述源主节点与所述目的从节点之间相互进行数据通信包括：
所述源主节点通过发射器103将原始数据包发送给所述目的主节点，其中，所述原始数据包包括所述源主节点标识、所述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址，以使得所述目的主节点将所述原始数据包中的所述目的主节 点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包，并将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，当所述访问节点为所述源主节点时，所述目的从节点对源主节点进行验证的具体实施方式可以包括：所述源主节点通过处理器101使用源主节点私钥对第一消息进行签名，以得到所述第一目的签名消息。
在一些可能的实施例中，所述源主节点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。
在一些可能的实施例中，所述访问节点对目的从节点进行验证的具体实施方式可以包括：
所述源主节点通过接收器104接收所述目的主节点发送的第二目的签名消息；
所述源主节点通过发射器103向所述目的主节点发送第二验证结果，其中，所述第二验证结果是所述源主节点对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述访问节点通过了对所述目的从节点的身份认证。
在一些可能的实施例中，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
需要说明的，当装置100为源主节点时，处理器101的执行步骤以及处理器101涉及的其他技术特征还可参照图5以及图10所示方法实施例中所述源主节点的相关内容，这里不再赘述。
当装置100为目的主节点时，存储器102中存储的程序代码具体用于实现图5以及图10实施例中的所述目的主节点的功能。具体的，处理器101用于调用存储器102中存储的程序代码，并执行以下步骤：
当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述目的主节点通过接收器104接收所述源主节点发送的第一目的签名消息；
所述目的主节点通过发射器103向所述源主节点发送第一验证结果，所述第一验证结果是对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述源从节点的身份认证。
在一些可能的实施例中，当所述访问节点为所述源从节点时，所述源从节点与所述目的从节点之间相互进行数据通信包括：
所述目的主节点通过接收器104接收所述源主节点发送的中间数据包，其中，所述中间数据包是所述源主节点将原始数据包中的源从节点的本地定位地址替换为源主节点的全局定位地址从而得到的；所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
所述目的主节点通过处理器101将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包；
所述目的主节点通过发射器103将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，当所述访问节点为所述源主节点时，当所述访问节点为所述 源主节点时，所述源主节点与所述目的从节点之间相互进行数据通信包括：
所述目的主节点通过接收器104接收所述源主节点发送的原始数据包，其中，所述原始数据包包括所述源主节点标识、所述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
所述目的主节点通过处理器101将所述原始数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包；
所述目的主节点通过发射器103将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，所述源主节点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。
在一些可能的实施例中，所述访问节点对目的从节点进行验证的具体实施方式可以包括：
所述目的主节点通过发射器103向所述源主节点发送第二目的签名消息；
所述目的主节点通过接收器104接收所述源主节点发送的第二验证结果，其中，所述第二验证结果是所述源主节点对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述访问节点通过了对所述目的从节点的身份认证。
在一些可能的实施例中，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
在一些可能的实施例中，所述目的主节点通过接收器104接收所述目的从节点发送的第二消息；
所述目的主节点通过处理器101使用目的主节点私钥对第二消息进行签名，以得到所述第二目的签名消息。
需要说明的，当装置100为目的主节点时，处理器101的执行步骤以及处理器101涉及的其他技术特征还可参照图5以及图10所示方法实施例中所述目的主节点的相关内容，这里不再赘述。
图15示出了本发明实施例提供的源主节点和目的主节点的一种实施例，以及二者构成的通信系统的结构示意图。如图15所示，源主节点200和目的主节点300之间可存在通信连接，可实现二者之间的数据通信。下面展开描述。
如图15所示，源主节点200可包括：接收单元210、发送单元230、处理单元250以及存储单元270。其中，接收单元210可以是接收器，发送单元230可以是发射器。在一些实施例中，接收单元210以及发送单元230还可以是同一个收发器。处理单元250可以是处理器、处理芯片以及集成处理电路等等。存储单元270可以是硬盘、内存或者NLAND Flash等等。
当所述源从节点需要访问所述目的从节点时，接收单元210用于接收所述源主节点发送的查询请求，其中，所述查询请求至少包括目的从节点的身份标识；
当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述源主节点通过发送单元230向身份管理系统发送身份查询请求，其中，所述访问节点是所述源主节点或者 所述源从节点，所述身份查询请求用于指示所述身份管理系统对所述目的从节点的身份进行查询。
所述源主节点通过接收单元210接收所述身份管理系统返回的身份查询结果，其中，所述身份查询结果用于指示所述目的从节点的属性为从节点，并且，所述目的从节点对应的主节点为所述目的主节点。
所述源主节点通过发送单元230向身份与位置映射管理设备发送位置查询请求，其中，所述位置查询请求用于指示所述身份与位置映射管理设备对所述目的主节点的位置进行查询。
所述源主节点通过接收单元210接收所述身份与位置映射管理设备返回的位置查询结果，其中，所述位置查询结果包括所述目的主节点的全局定位地址。
所述源主节点通过发送单元230基于所述目的主节点的全局定位地址向所述目的主节点发送第一目的签名消息；
所述源主节点通过接收单元210接收所述目的主节点发送的第一验证结果，其中，所述第一验证结果是对所述目的主节点对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述访问节点的身份认证。
存储单元270用于存储身份查询结果以及第一验证结果等等。
在一些可能的实施例中，当所述访问节点为所述源从节点时，所述接收单元210用于接收所述源从节点发送的原始数据包，其中，所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
所述处理单元250用于将所述原始数据包中的所述源从节点的本地定位地址替换为所述源主节点的全局定位地址，从而得到中间数据包；
所述发送单元230用于将所述中间数据包发送给所述目的主节点，以使得所述目的主节点将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包，并将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，所述接收单元210用于接收所述源从节点发送的第一原始签名消息，其中，所述第一原始签名消息是所述源从节点使用源从节点私钥对第一消息进行签名得到的；
所述处理单元250用于使用所述源主节点私钥对所述第一原始签名消息进行签名得到所述第一目的签名消息。
在一些可能的实施例中，当所述访问节点为所述源从节点时，
所述接收单元210用于接收所述源从节点发送的第一消息；
所述处理单元250用于使用所述源主节点私钥对所述第一消息进行签名得到所述第一目的签名消息。
在一些可能的实施例中，当所述访问节点为所述源主节点时，所述发送单元220用于将原始数据包发送给所述目的主节点，其中，所述原始数据包包括所述源主节点标识、所述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址，以使得所述目的主节点将所述原始数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包，并将所述目的数据包发送给所述目的从节 点。
在一些可能的实施例中，当所述访问节点为所述源主节点时，所述终端设备还包括处理单元250，所述处理单元250用于使用源主节点私钥对第一消息进行签名，以得到所述第一目的签名消息。
在一些可能的实施例中，所述源主节点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。
在一些可能的实施例中，所述接收单元210用于接收所述目的主节点发送的第二目的签名消息；
所述发送单元220用于向所述目的主节点发送第二验证结果，其中，所述第二验证结果是所述源主节点对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述访问节点通过了对所述目的从节点的身份认证。
在一些可能的实施例中，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
需要说明，图15实施例中未提及的内容以及各个功能单元的具体实现，请参考图5以及图10实施例，这里不再赘述。
如图15所示，目的主节点300可包括：接收单元310、发送单元330、处理单元350以及存储单元370。其中，接收单元310可以是接收器，发送单元330可以是发射器。在一些实施例中，接收单元310以及发送单元330还可以是同一个收发器。处理单元350可以是处理器、处理芯片以及集成处理电路等等。存储单元370可以是硬盘、内存或者NLAND Flash等等。
当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述目的主节点通过接收单元310接收所述源主节点发送的第一目的签名消息。
所述目的主节点通过发送单元330向所述源主节点发送第一验证结果，所述第一验证结果是对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述源从节点的身份认证。
存储单元370用于存储第一签名消息以及第一验证结果等等。
在一些可能的实施例中，当所述访问节点为所述源从节点时，所述接收单元310用于接收所述源主节点发送的中间数据包，其中，所述中间数据包是所述源主节点将原始数据包中的源从节点的本地定位地址替换为源主节点的全局定位地址从而得到的；所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
所述处理单元350用于将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包；
所述发送单元320用于将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，当所述访问节点为所述源主节点时，所述接收单元310用于接收所述源主节点发送的原始数据包，其中，所述原始数据包包括所述源主节点标识、所 述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
所述处理单元350用于将所述原始数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包；
所述发送单元320用于将所述目的数据包发送给所述目的从节点。
在一些可能的实施例中，所述源主节点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。
在一些可能的实施例中，所述发送单元320用于向所述源主节点发送第二目的签名消息；所述接收单元310用于接收所述源主节点发送的第二验证结果，其中，所述第二验证结果是所述源主节点对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述访问节点通过了对所述目的从节点的身份认证。
在一些可能的实施例中，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
在一些可能的实施例中，所述接收单元310用于接收所述目的从节点发送的第二消息；
所述处理单元350用于使用目的主节点私钥对第二消息进行签名，以得到所述第二目的签名消息。
需要说明，图15实施例中未提及的内容以及各个功能单元的具体实现，请参考图5实施例，这里不再赘述。
本申请还提供了一种通信系统，所述通信系统包括源主节点以及目的主节点，其中，所述源主节点可以是图14所示的源主节点，所述目的主节点可以是图14所示的目的主节点。所述源主节点可以是图15所示的源主节点，所述目的主节点可以是图15所示的目的主节点。
本领域内的技术人员应明白，本发明的实施例可提供为方法、系统、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框 中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (37)

  1. 一种认证方法，其特征在于，应用于通信系统，所述通信系统包括源可信域以及目的可信域，所述源可信域包括源主节点以及源从节点，所述目的可信域包括目的主节点以及目的从节点，所述源从节点为所述源主节点的从属节点，所述目的从节点为所述目的主节点的从属节点，所述包括如下步骤：
    当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述源主节点向身份管理系统发送身份查询请求，其中，所述访问节点是所述源主节点或者所述源从节点，所述身份查询请求用于指示所述身份管理系统对所述目的从节点的身份进行查询；
    所述源主节点接收所述身份管理系统返回的身份查询结果，其中，所述身份查询结果用于指示所述目的从节点的属性为从节点，并且，所述目的从节点对应的主节点为所述目的主节点；
    所述源主节点向身份与位置映射管理设备发送位置查询请求，其中，所述位置查询请求用于指示所述身份与位置映射管理设备对所述目的主节点的位置进行查询；
    所述源主节点接收所述身份与位置映射管理设备返回的位置查询结果，其中，所述位置查询结果包括所述目的主节点的全局定位地址；
    所述源主节点基于所述目的主节点的全局定位地址向所述目的主节点发送第一目的签名消息；
    所述源主节点接收所述目的主节点发送的第一验证结果，其中，所述第一验证结果是对所述目的主节点对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述访问节点的身份认证。
  2. 根据权利要求1所述的方法，其特征在于，当所述访问节点为所述源从节点时，
    所述源主节点接收所述源从节点发送的原始数据包，其中，所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
    所述源主节点将所述原始数据包中的所述源从节点的本地定位地址替换为所述源主节点的全局定位地址，从而得到中间数据包；
    所述源主节点将所述中间数据包发送给所述目的主节点，以使得所述目的主节点将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包，并将所述目的数据包发送给所述目的从节点。
  3. 根据权利要求2所述的方法，其特征在于，当所述访问节点为所述源从节点时，所述源主节点向所述目的主节点发送第一目的签名消息之前包括：
    所述源主节点接收所述源从节点发送的第一原始签名消息，其中，所述第一原始签名消息是所述源从节点使用源从节点私钥对第一消息进行签名得到的；
    所述源主节点使用所述源主节点私钥对所述第一原始签名消息进行签名得到所述第一目的签名消息。
  4. 根据权利要求2所述的方法，其特征在于，当所述访问节点为所述源从节点时，所述源主节点向所述目的主节点发送第一目的签名消息之前包括：
    所述源主节点接收所述源从节点发送的第一消息；
    所述源主节点使用所述源主节点私钥对所述第一消息进行签名得到所述第一目的签名消息。
  5. 根据权利要求1所述的方法，其特征在于，当所述访问节点为所述源主节点时，
    所述源主节点将原始数据包发送给所述目的主节点，其中，所述原始数据包包括所述源主节点标识、所述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址，以使得所述目的主节点将所述原始数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包，并将所述目的数据包发送给所述目的从节点。
  6. 根据权利要求5所述的方法，其特征在于，当所述访问节点为所述源主节点时，所述源主节点向所述目的主节点发送第一目的签名消息之前包括：
    所述源主节点使用源主节点私钥对第一消息进行签名，以得到所述第一目的签名消息。
  7. 根据权利要求1至6任一权利要求所述的方法，其特征在于，所述源主节点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。
  8. 根据权利要求1至7任一权利要求所述的方法，其特征在于，所述方法还包括：
    所述源主节点接收所述目的主节点发送的第二目的签名消息；
    所述源主节点向所述目的主节点发送第二验证结果，其中，所述第二验证结果是所述源主节点对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述访问节点通过了对所述目的从节点的身份认证。
  9. 根据权利要求8所述的方法，其特征在于，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
  10. 一种认证方法，其特征在于，应用于通信系统，所述通信系统包括源可信域以及目的可信域，所述源可信域包括源主节点以及源从节点，所述目的可信域包括目的主节点以及目的从节点，所述源从节点为所述源主节点的从属节点，所述目的从节点为所述目的主节点的从属节点，所述包括如下步骤：
    当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述目的主节点接收所述源主节点发送的第一目的签名消息；
    所述目的主节点向所述源主节点发送第一验证结果，所述第一验证结果是对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述源从节点的身份认证。
  11. 根据权利要求10所述的方法，其特征在于，当所述访问节点为所述源从节点时，
    所述目的主节点接收所述源主节点发送的中间数据包，其中，所述中间数据包是所述源主节点将原始数据包中的源从节点的本地定位地址替换为源主节点的全局定位地址从而得到的；所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
    所述目的主节点将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目 的从节点的本地定位地址，从而获得目的数据包；
    所述目的主节点将所述目的数据包发送给所述目的从节点。
  12. 根据权利要求10所述的方法，其特征在于，当所述访问节点为所述源主节点时，
    所述目的主节点接收所述源主节点发送的原始数据包，其中，所述原始数据包包括所述源主节点标识、所述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
    所述目的主节点将所述原始数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包；
    所述目的主节点将所述目的数据包发送给所述目的从节点。
  13. 根据权利要求10至12任一权利要求所述的方法，其特征在于，
    所述源主节点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。
  14. 根据权利要求10所述的方法，其特征在于，所述方法还包括：
    所述目的主节点向所述源主节点发送第二目的签名消息；
    所述目的主节点接收所述源主节点发送的第二验证结果，其中，所述第二验证结果是所述源主节点对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述访问节点通过了对所述目的从节点的身份认证。
  15. 根据权利要求14所述的方法，其特征在于，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
  16. 根据权利要求14或者15所述的方法，其特征在于，所述目的主节点向所述源主节点发送第二目的签名消息之前包括：
    所述目的主节点接收所述目的从节点发送的第二消息；
    所述目的主节点使用目的主节点私钥对第二消息进行签名，以得到所述第二目的签名消息。
  17. 一种终端设备，其特征在于，应用于通信系统，所述通信系统包括源可信域以及目的可信域，所述源可信域包括源主节点以及源从节点，所述目的可信域包括目的主节点以及目的从节点，所述源从节点为所述源主节点的从属节点，所述目的从节点为所述目的主节点的从属节点，所述终端设备为所述源主节点，所述终端设备包括发送单元以及接收单元，
    当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述发送单元用于向身份管理系统发送身份查询请求，其中，所述访问节点是所述源主节点或者所述源从节点，所述身份查询请求用于指示所述身份管理系统对所述目的从节点的身份进行查询；
    所述接收单元用于接收所述身份管理系统返回的身份查询结果，其中，所述身份查询结果用于指示所述目的从节点的属性为从节点，并且，所述目的从节点对应的主节点为所述目的主节点；
    所述发送单元用于向身份与位置映射管理设备发送位置查询请求，其中，所述位置查询请求用于指示所述身份与位置映射管理设备对所述目的主节点的位置进行查询；
    所述接收单元用于接收所述身份与位置映射管理设备返回的位置查询结果，其中，所述位置查询结果包括所述目的主节点的全局定位地址；
    所述发送单元用于基于所述目的主节点的全局定位地址向所述目的主节点发送第一目的签名消息；
    所述接收单元用于接收所述目的主节点发送的第一验证结果，其中，所述第一验证结果是对所述目的主节点对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述访问节点的身份认证。
  18. 根据权利要求17所述的终端设备，其特征在于，当所述访问节点为所述源从节点时，所述终端设备还包括处理单元，
    所述接收单元用于接收所述源从节点发送的原始数据包，其中，所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
    所述处理单元用于将所述原始数据包中的所述源从节点的本地定位地址替换为所述源主节点的全局定位地址，从而得到中间数据包；
    所述发送单元用于将所述中间数据包发送给所述目的主节点，以使得所述目的主节点将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包，并将所述目的数据包发送给所述目的从节点。
  19. 根据权利要求18所述的终端设备，其特征在于，
    所述接收单元用于接收所述源从节点发送的第一原始签名消息，其中，所述第一原始签名消息是所述源从节点使用源从节点私钥对第一消息进行签名得到的；
    所述处理单元用于使用所述源主节点私钥对所述第一原始签名消息进行签名得到所述第一目的签名消息。
  20. 根据权利要求18所述的终端设备，其特征在于，当所述访问节点为所述源从节点时，
    所述接收单元用于接收所述源从节点发送的第一消息；
    所述处理单元用于使用所述源主节点私钥对所述第一消息进行签名得到所述第一目的签名消息。
  21. 根据权利要求17所述的终端设备，其特征在于，当所述访问节点为所述源主节点时，
    所述发送单元用于将原始数据包发送给所述目的主节点，其中，所述原始数据包包括所述源主节点标识、所述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址，以使得所述目的主节点将所述原始数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包，并将所述目的数据包发送给所述目的从节点。
  22. 根据权利要求21所述的终端设备，其特征在于，当所述访问节点为所述源主节点时，所述终端设备还包括处理单元，所述处理单元用于使用源主节点私钥对第一消息进行签名，以得到所述第一目的签名消息。
  23. 根据权利要求17至22任一权利要求所述的终端设备，其特征在于，所述源主节 点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。
  24. 根据权利要求17至22任一权利要求所述的终端设备，其特征在于，
    所述接收单元用于接收所述目的主节点发送的第二目的签名消息；
    所述发送单元用于向所述目的主节点发送第二验证结果，其中，所述第二验证结果是所述源主节点对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述访问节点通过了对所述目的从节点的身份认证。
  25. 根据权利要求24所述的终端设备，其特征在于，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
  26. 一种终端设备，其特征在于，应用于通信系统，所述通信系统包括源可信域以及目的可信域，所述源可信域包括源主节点以及源从节点，所述目的可信域包括目的主节点以及目的从节点，所述源从节点为所述源主节点的从属节点，所述目的从节点为所述目的主节点的从属节点，所述终端设备为所述目的主节点，所述终端设备包括接收单元以及发送单元，
    当访问节点需要对所述目的可信域中的目的从节点进行访问时，所述接收单元用于接收所述源主节点发送的第一目的签名消息；
    所述发送单元用于向所述源主节点发送第一验证结果，所述第一验证结果是对所述第一目的签名消息进行验证得到的结果，所述第一验证结果用于指示所述目的从节点通过了对所述源从节点的身份认证。
  27. 根据权利要求26所述的终端设备，其特征在于，当所述访问节点为所述源从节点时，所述终端设备还包括处理单元，
    所述接收单元用于接收所述源主节点发送的中间数据包，其中，所述中间数据包是所述源主节点将原始数据包中的源从节点的本地定位地址替换为源主节点的全局定位地址从而得到的；所述原始数据包包括所述源从节点标识、所述源从节点的本地定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
    所述处理单元用于将所述中间数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包；
    所述发送单元用于将所述目的数据包发送给所述目的从节点。
  28. 根据权利要求26所述的终端设备，其特征在于，当所述访问节点为所述源主节点时，所述终端设备还包括处理单元，
    所述接收单元用于接收所述源主节点发送的原始数据包，其中，所述原始数据包包括所述源主节点标识、所述源主节点的全局定位地址、目的从节点标识以及所述目的主节点的全局定位地址；
    所述处理单元用于将所述原始数据包中的所述目的主节点的全局定位地址替换为所述目的从节点的本地定位地址，从而获得目的数据包；
    所述发送单元用于将所述目的数据包发送给所述目的从节点。
  29. 根据权利要求16至28任一权利要求所述的终端设备，其特征在于，
    所述源主节点为所述源可信域中续航能力强的节点；所述源从节点为所述源可信域中续航能力弱的节点；所述目的主节点为所述目的可信域中续航能力强的节点；所述目的从节点为所述目的可信域中续航能力弱的节点。
  30. 根据权利要求26所述的终端设备，其特征在于，
    所述发送单元用于向所述源主节点发送第二目的签名消息；
    所述接收单元用于接收所述源主节点发送的第二验证结果，其中，所述第二验证结果是所述源主节点对所述第二目的签名消息进行验证得到的结果，所述第二验证结果用于指示所述访问节点通过了对所述目的从节点的身份认证。
  31. 根据权利要求30所述的终端设备，其特征在于，所述第一目的签名消息以及所述第二目的签名消息均为基于身份的签名消息。
  32. 根据权利要求30或者31所述的终端设备，其特征在于，所述终端设备还包括处理单元，
    所述接收单元用于接收所述目的从节点发送的第二消息；
    所述处理单元用于使用目的主节点私钥对第二消息进行签名，以得到所述第二目的签名消息。
  33. 一种终端设备，其特征在于，包括存储器以及与所述存储器耦合的处理器、发射器和接收器，其中：所述发射器用于与向外部发送数据，所述接收器用于接收外部发送的数据，所述存储器用于存储权利要求1-9任一权利要求所述方法的实现代码，所述处理器用于执行所述存储器中存储的程序代码，即执行权利要求1-9任一权利要求所述方法。
  34. 一种终端设备，其特征在于，包括存储器以及与所述存储器耦合的处理器、发射器和接收器，其中：所述发射器用于与向外部发送数据，所述接收器用于接收外部发送的数据，所述存储器用于存储权利要求10-16任一权利要求所述方法的实现代码，所述处理器用于执行所述存储器中存储的程序代码，即执行权利要求10-16任一权利要求所述方法。
  35. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求1至9任一项所述方法。
  36. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机程序，其特征在于，所述计算机程序被处理器执行时实现如权利要求10至16任一项所述方法。
  37. 一种通讯系统，其特征在于，所述通信系统包括源可信域以及目的可信域，所述源可信域包括源主节点以及源从节点，所述目的可信域包括目的主节点以及目的从节点，所述源从节点为所述源主节点的从属节点，所述目的从节点为所述目的主节点的从属节点，其中，所述源主节点用于执行权利要求1-9任一权利要求所述方法，所述目的主节点用于执行权利要求10-16任一权利要求所述方法。
PCT/CN2018/089627 2017-06-02 2018-06-01 认证方法、设备以及系统 WO2018219351A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710411234.9 2017-06-02
CN201710411234.9A CN108989270B (zh) 2017-06-02 2017-06-02 认证方法、设备以及系统

Publications (1)

Publication Number Publication Date
WO2018219351A1 true WO2018219351A1 (zh) 2018-12-06

Family

ID=64455670

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/089627 WO2018219351A1 (zh) 2017-06-02 2018-06-01 认证方法、设备以及系统

Country Status (2)

Country Link
CN (1) CN108989270B (zh)
WO (1) WO2018219351A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109634965A (zh) * 2018-12-17 2019-04-16 郑州云海信息技术有限公司 背板配置信息访问方法、装置、设备及介质

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110768838A (zh) * 2019-10-29 2020-02-07 北京浪潮数据技术有限公司 一种snmp消息处理方法及相关装置
CN113472716B (zh) * 2020-03-30 2023-09-19 中移互联网有限公司 系统访问方法、网关设备、服务器、电子设备及存储介质
CN112202812A (zh) * 2020-10-27 2021-01-08 中国联合网络通信集团有限公司 基于区块链的水利物联网终端接入认证方法及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100083355A1 (en) * 2008-09-30 2010-04-01 International Business Machines Corporation Discovery profile based unified credential processing for disparate security domains
CN102340487A (zh) * 2010-07-21 2012-02-01 航天信息股份有限公司 多信任域之间的完整性报告传递方法和系统
CN103795530A (zh) * 2012-10-31 2014-05-14 华为技术有限公司 一种跨域控制器认证的方法、装置及主机
CN103856477A (zh) * 2012-12-06 2014-06-11 阿里巴巴集团控股有限公司 一种可信计算系统及相应的认证方法和设备

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101374159B (zh) * 2008-10-08 2012-05-23 中国科学院计算技术研究所 一种p2p网络可信控制方法及系统
CN101399671B (zh) * 2008-11-18 2011-02-02 中国科学院软件研究所 一种跨域认证方法及其系统
CN102104872A (zh) * 2011-02-23 2011-06-22 中兴通讯股份有限公司 安全访问wapi网络的方法、装置及系统
CN103491072B (zh) * 2013-09-06 2017-03-15 中国航天系统科学与工程研究院 一种基于双单向隔离网闸的边界访问控制方法
US10050978B2 (en) * 2015-10-16 2018-08-14 Dell Products Lp Systems and methods for securing command and data interfaces to sensors and devices through the use of a protected security zone

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100083355A1 (en) * 2008-09-30 2010-04-01 International Business Machines Corporation Discovery profile based unified credential processing for disparate security domains
CN102340487A (zh) * 2010-07-21 2012-02-01 航天信息股份有限公司 多信任域之间的完整性报告传递方法和系统
CN103795530A (zh) * 2012-10-31 2014-05-14 华为技术有限公司 一种跨域控制器认证的方法、装置及主机
CN103856477A (zh) * 2012-12-06 2014-06-11 阿里巴巴集团控股有限公司 一种可信计算系统及相应的认证方法和设备

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
DONGHUI WANG: "IBS Enabled Authentication for IoT in ION Framework", 2017, pages 1 - 27, XP055633631, Retrieved from the Internet <URL:https://iotweek.blob.core.windows.net/slides2017/GIoTS/GIoTS%20Paper%20Session-%20IoT%20Security%20and%20Privacy/Bin%20Da%20IBS%20for%20IoT%20in%20ION%20Framework.pdf> *
WANG, DONGHUI ET AL.: "IBS enabled authentication for IoT in ION Framework", IEEE 2017 GLOBAL INTERNET OF THINGS SUMMIT (GIOTS), 9 June 2017 (2017-06-09), XP033145238, DOI: 10.1109/GIOTS.2017.8016271 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109634965A (zh) * 2018-12-17 2019-04-16 郑州云海信息技术有限公司 背板配置信息访问方法、装置、设备及介质
CN109634965B (zh) * 2018-12-17 2021-10-29 郑州云海信息技术有限公司 背板配置信息访问方法、装置、设备及介质

Also Published As

Publication number Publication date
CN108989270B (zh) 2021-03-05
CN108989270A (zh) 2018-12-11

Similar Documents

Publication Publication Date Title
WO2018219351A1 (zh) 认证方法、设备以及系统
Nizzi et al. IoT security via address shuffling: The easy way
CN107852430B (zh) 用于在局域网中形成网关的设备以及计算机可读存储介质
Tayeb et al. A survey on IoT communication and computation frameworks: An industrial perspective
CN106797409B (zh) 用于在物联网(iot)中的设备位置注册的服务器
CN106664561B (zh) 用于确保预关联服务发现安全的系统和方法
Cox et al. Smokescreen: flexible privacy controls for presence-sharing
CN109873815A (zh) 基于边缘计算的异构物联网认证方法、物联网安全平台
Devi et al. Mutual authentication scheme for IoT application
Jia et al. A2 chain: a blockchain‐based decentralized authentication scheme for 5G‐enabled IoT
US10693866B2 (en) System, apparatus and method for first hop security
Li et al. A mobile phone based WSN infrastructure for IoT over future internet architecture
CN106302110A (zh) 一种基于隐私保护的社交网络位置共享方法
WO2018205148A1 (zh) 一种数据包校验方法及设备
WO2021225867A1 (en) Contact tracing among workers and employees
Sen A robust and efficient node authentication protocol for mobile ad hoc networks
Huang et al. Human interactive secure ID management in body sensor networks
CN103167002A (zh) 发送名片的方法及系统
CN103795581A (zh) 地址处理方法和设备
Wang et al. A secure IPv6 address configuration scheme for a MANET
Ahmed et al. Secured Service Discovery Technique in IoT.
Djamaa et al. Fetchiot: Efficient resource fetching for the internet of things
CN114666155A (zh) 设备接入方法、系统、装置、物联网设备和网关设备
US11212088B2 (en) Private key generation method and system, and device
CN114554567A (zh) 通信的方法及通信装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18808910

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18808910

Country of ref document: EP

Kind code of ref document: A1