WO2022089012A1 - Communication method, electronic device and computer-readable storage medium - Google Patents

Communication method, electronic device and computer-readable storage medium Download PDF

Info

Publication number
WO2022089012A1
WO2022089012A1 PCT/CN2021/116982 CN2021116982W WO2022089012A1 WO 2022089012 A1 WO2022089012 A1 WO 2022089012A1 CN 2021116982 W CN2021116982 W CN 2021116982W WO 2022089012 A1 WO2022089012 A1 WO 2022089012A1
Authority
WO
WIPO (PCT)
Prior art keywords
electronic device
message
communication
information
packet
Prior art date
Application number
PCT/CN2021/116982
Other languages
French (fr)
Chinese (zh)
Inventor
张志军
王皓
郭兴民
姚松平
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2022089012A1 publication Critical patent/WO2022089012A1/en

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing data switching networks
    • H04L43/10Active monitoring, e.g. heartbeat, ping or trace-route
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing data switching networks
    • H04L43/08Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22Parsing or analysis of headers
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present application belongs to the field of communication technologies, and in particular, relates to a communication method, an electronic device, and a computer-readable storage medium.
  • path attack also known as “path discrimination”
  • DoS Denial of Service
  • the embodiments of the present application provide a communication method, an electronic device, and a computer-readable storage medium, which can solve the problem that the current "path attack” solution has high cost and is not conducive to promotion and application.
  • an embodiment of the present application provides a communication method, including:
  • the first electronic device monitors the communication link
  • the first electronic device controls the Wi-Fi communication module of the first electronic device to enter the promiscuous mode, and sends the first message in the form of broadcasting.
  • the first electronic device can monitor the link state of the communication link related to the device.
  • the communication service between the first electronic device and other electronic devices in the local area network may be interrupted.
  • the first electronic device can control the Wi-Fi communication module of the first electronic device to enter a promiscuous mode (also called a debug mode).
  • a promiscuous mode also called a debug mode
  • the Wi-Fi communication module of the first electronic device can receive all packets passing through the Wi-Fi communication module, regardless of whether the destination address of the packets is directed to the first electronic device.
  • the promiscuous mode is used for fault detection or functional testing of the Wi-Fi communication module, but in the communication method of the present application, the promiscuous mode is used to maintain the communication service of the Wi-Fi communication module.
  • the first electronic device When the first electronic device controls the Wi-Fi communication module to enter the promiscuous mode, the first electronic device can monitor the information broadcast by other electronic devices in the local area network through the promiscuous mode, and the first electronic device can encapsulate the information to be transmitted into the first electronic device. A message, the first message is sent in the form of broadcast.
  • the first electronic device can perform data interaction with other electronic devices in the local area network through the promiscuous mode of the Wi-Fi communication module and the broadcast mechanism, so as to maintain the communication service and avoid interruption of the communication service.
  • the monitoring of the communication link by the first electronic device includes:
  • the first electronic device monitors the communication link through a heartbeat interlock mechanism.
  • the first electronic device when the first electronic device monitors the communication link, the first electronic device may establish a heartbeat interlock mechanism with the electronic device at the opposite end of the communication link.
  • the first electronic device can establish a heartbeat interlocking mechanism with the electronic device at the opposite end of the communication link
  • the first electronic device and the electronic device at the opposite end can detect whether the communication link fails by sending heartbeat information to each other.
  • either end cannot receive the heartbeat information, it means that the communication link is under attack, and the electronic device that cannot receive the heartbeat information will stop maintaining the heartbeat interlock mechanism, so that the electronic device at the opposite end cannot receive the heartbeat information.
  • the electronic devices at both ends of the communication link can successively detect that the communication link is attacked through the heartbeat interlocking mechanism.
  • the first packet is an injection packet
  • the sending of the first packet in the form of broadcasting includes:
  • the first electronic device injects the injection message into the air interface of the Wi-Fi communication module, and sends the injection message in the form of broadcast.
  • the above-mentioned first packet may be an injection packet.
  • the injection message may be injected into the air interface of the Wi-Fi communication module, and the injection message may be sent in the form of broadcasting.
  • the first electronic device injects the injection message into the air interface for broadcasting, and may not perform the carrier sensing action and the collision detection action specified in the 802.11 protocol, so as to ensure that the Wi-Fi communication module can smoothly broadcast the injection message.
  • the first packet includes a fault packet
  • the fault packet includes fault information of the communication link.
  • the first message broadcast by the first electronic device may include a fault message.
  • the fault message is used to record the fault information of the communication link.
  • the fault information may include one or more items of information such as fault time, fault object, and fault type.
  • the first packet includes a service packet
  • the service packet includes service information of the first electronic device.
  • the first message broadcast by the first electronic device may also include a service message.
  • the first electronic device has a specific service function, and when the first electronic device performs the service function, it may generate service information that needs to be transmitted externally.
  • the infrared sensor when it detects abnormal infrared information in a certain area, it can transmit the location information of the area to the camera, and the camera adjusts the direction of the lens according to the received location information, takes the image of the above area, and completes the connection between the infrared sensor and the camera. linkage.
  • the location information of the above area is the business information that the infrared sensor needs to transmit to the camera.
  • the first message broadcast by the first electronic device may include a service message.
  • the service message includes service information of the first electronic device.
  • the first electronic device transmits the service information to other electronic devices in the local area network through the service message.
  • the method further includes:
  • the first electronic device counts the number of first response information received within a preset response time period, where the first response information is information fed back by the second electronic device after receiving the first message, and the first response information is the information fed back by the second electronic device after receiving the first message.
  • An electronic device and the second electronic device are in the same local area network;
  • the first electronic device If the quantity of the first response information is less than or equal to a preset first response threshold, the first electronic device rebroadcasts the first message.
  • the second electronic device in the local area network that receives the first message can feed back the first response information to the first electronic device.
  • the first electronic device may count the number of received first response information within a preset response time period.
  • the first electronic device may determine that the broadcast of the first message is successful.
  • the first electronic device may determine that the broadcast of the first message fails, and re-broadcast the first message.
  • the method further includes:
  • the first electronic device When the first electronic device receives the second message broadcast by the second electronic device, the first electronic device verifies the signature of the second message;
  • the first electronic device saves the second message.
  • the first electronic device when the first electronic device receives the second message broadcast by the second electronic device, the first electronic device can use the public key of the second electronic device to verify the signature of the second message.
  • the first electronic device can use its own private key to sign the second message and store it locally.
  • the first electronic device may perform the first preset operation.
  • the specific form of the first preset operation can be set according to the actual situation.
  • the first preset operation may be that the first electronic device discards the message; or, the first preset operation may be that the first electronic device records and stores the message as a malicious message.
  • the method further includes:
  • the first electronic device sends first response information to the second electronic device.
  • the first electronic device can also send the first response information to the second electronic device that sends the second message, informing the second electronic device that it has received the above-mentioned Second message.
  • the method further includes:
  • the first electronic device When the first electronic device receives the audit request sent by the management device, the first electronic device sends the locally stored second message to the management device.
  • the management device may be any electronic device in the current communication system, or the management device may also be an electronic device outside the current communication system.
  • the management device may be communicatively connected to each electronic device through wired communication connection and/or wireless communication connection, and the embodiment of the present application does not impose any limitation on the communication connection between the management device and the electronic device.
  • the management device can send audit requests to each electronic device in the local area network.
  • the audit request is used to instruct each electronic device to send the locally stored first message and/or the second message to the management device, so that the management device can restore the fault according to the first message and/or the second message sent by each electronic device Development process and understanding the business operation of individual electronic devices during failures.
  • device 1 first detects that the communication link is faulty, broadcasts message 1, and message 1 records failure time 1; then device 2 broadcasts message 2, and message 2 records failure time 2 ; Device 3 broadcasts message 3 after a delay, and message 3 records failure time 3.
  • the management device obtains the message 1, message 2 and message 3 from each electronic device through the audit request, and obtains the failure time 1, the failure time through the message 1, the message 2 and the message 3. time 2 and failure time 3.
  • the management device can infer the node that fails first and the development process of the failure through the failure time 1, the failure time 2, and the failure time 3.
  • the first electronic device When the first electronic device receives the audit request, the first electronic device can send the locally stored second message to the management device, so that the management device can restore the facts according to the second message of the first electronic device.
  • the method further includes:
  • the first electronic device sends an audit request to each second electronic device, and the first electronic device and the second electronic device are in the same local area network;
  • the first electronic device receives a third message returned by each of the second electronic devices, where the third message is the first message and/or the second message received and saved by the second electronic device;
  • the first electronic device determines a target message corresponding to each of the third messages according to the third messages returned by each of the second electronic devices and a preset processing rule.
  • the first electronic device may be designated as the management device by the user.
  • the first electronic device may send an audit request to each second electronic device in the local area network.
  • Each second electronic device returns a third message to the first electronic device when receiving the audit request.
  • the third message is the first message saved by the second electronic device and/or the second message broadcast by other second electronic devices.
  • the first electronic device determines the target message corresponding to each third message according to the third message returned by each second electronic device and the preset processing rule.
  • the above-mentioned target message may be understood as a message with higher authenticity and integrity, and may also be understood as a true version and/or a complete version of the third message.
  • the above preset processing rules can be set according to actual needs.
  • the above-mentioned preset processing rules may include any one or a combination of operations such as screening, splicing and restoration, and voting.
  • the target packet corresponding to each of the third packets is determined according to the third packets returned by each of the second electronic devices and a preset processing rule, including :
  • the first electronic device performs a splicing and restoration operation on each of the third packets to obtain a target packet corresponding to each of the third packets.
  • the first electronic device can perform a splicing and restoration operation on the incomplete third packets, and then multiple third packets expressing the same content are deleted. The comparison and splicing are performed, thereby restoring the target message with higher integrity corresponding to the third message.
  • the target packet corresponding to each of the third packets is determined according to the third packets returned by each of the second electronic devices and a preset processing rule, including :
  • a voting operation is performed on the third packet with the at least two versions, and the version with the highest number of votes is used as the corresponding third packet with the at least two versions. target message.
  • these attacked second electronic devices may forge or tamper with the third packet, resulting in at least two versions of some third packets.
  • the first electronic device can perform a voting operation on these third packets with at least two versions.
  • the version with the highest number of votes is used as the target message corresponding to the third message with at least two versions.
  • the above fault may be a path attack.
  • the electronic devices at both ends of the communication link cannot perform normal data exchange.
  • the first electronic device can maintain the communication service with other electronic devices through the above-mentioned communication method.
  • the above-mentioned fault may also be a link fault other than a path attack.
  • the first electronic device When the first electronic device detects any link failure that affects the normal operation of the communication link, the first electronic device can maintain the communication service through the above communication method, and the present application does not limit the failure type of the above failure.
  • an embodiment of the present application provides a communication device, including:
  • the link monitoring module is used to monitor the communication link
  • the service maintenance module is configured to control the Wi-Fi communication module of the first electronic device to enter the promiscuous mode when the communication link fails, and send the first message in the form of broadcasting.
  • the link monitoring module is specifically configured to monitor the communication link through a heartbeat interlocking mechanism.
  • the first message is an injection message
  • the service maintenance module includes:
  • the injection sub-module is used for injecting the injection message into the air interface of the Wi-Fi communication module, and sending the injection message in the form of broadcast.
  • the first packet includes a fault packet
  • the fault packet includes fault information of the communication link.
  • the first packet includes a service packet
  • the service packet includes service information of the first electronic device.
  • the apparatus further includes:
  • a response statistics module configured to count the number of first response information received within a preset response time period, where the first response information is information fed back after the second electronic device receives the first message, and the first response information is the information fed back after the second electronic device receives the first message.
  • An electronic device and the second electronic device are in the same local area network;
  • a rebroadcasting module configured to rebroadcast the first message if the quantity of the first response information is less than or equal to a preset first response threshold.
  • the apparatus further includes:
  • a signature verification module configured to verify the signature of the second message when receiving the second message broadcast by the second electronic device
  • a message storage module configured to save the second message if the signature verification of the second message passes.
  • the apparatus further includes:
  • a response sending module configured to send first response information to the second electronic device.
  • the apparatus further includes:
  • the message sending module is configured to send the second message stored locally to the management device when receiving the audit request sent by the management device.
  • the apparatus further includes:
  • an audit request module configured to send an audit request to each second electronic device, where the first electronic device and the second electronic device are in the same local area network;
  • a message receiving module configured to receive a third message returned by each of the second electronic devices, where the third message is the first message and/or the second message received and saved by the second electronic device ;
  • a fact confirmation module configured to determine a target message corresponding to each of the third messages according to the third messages returned by each of the second electronic devices and a preset processing rule.
  • the fact confirmation module includes:
  • the splicing sub-module is configured to perform a splicing and restoration operation on each of the third packets to obtain target packets corresponding to each of the third packets.
  • the fact confirmation module includes:
  • a voting submodule configured to perform a voting operation on the third message with at least two versions when any of the third messages has at least two versions, and use the version with the highest number of votes as the version with the at least two versions
  • the target packet corresponding to the third packet of .
  • an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor.
  • the processor executes the computer program, the electronic device realizes the steps of the above method.
  • a computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, enables an electronic device to implement the steps of the above method.
  • a chip system in a fifth aspect, is provided, the chip system may be a single chip or a chip module composed of multiple chips, the chip system includes a memory and a processor, and the processor executes the storage in the memory.
  • the first electronic device monitors the communication link, and when the first electronic device detects that the communication link is faulty, the first electronic device controls the Wi-Fi communication module of the first electronic device to enter the hybrid mode, and send the first message in the form of broadcast.
  • the first electronic device and the Wi-Fi communication module of the opposite end electronic device both enter the promiscuous mode.
  • the Wi-Fi communication module can receive all the packets that pass through the Wi-Fi communication module, regardless of whether the destination address of the packets points to the device. Therefore, the first electronic device and the electronic device at the opposite end of the communication link can perform data interaction through a broadcast mechanism to maintain the communication service and avoid interruption of the communication service.
  • the communication method provided by the present application maintains the communication service by changing the working mode of the Wi-Fi communication module, without adding extra cost, and solves the current "path attack” solution.
  • the cost is high, which is not conducive to the problem of promotion and application, and has strong ease of use and practicability.
  • FIG. 1 is a schematic diagram of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of an application scenario provided by an embodiment of the present application.
  • FIG. 3 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 4 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 8 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 9 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 10 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 11 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 12 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 13 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 14 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 15 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • 16 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • 17 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 18 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 19 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 20 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • 21 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 22 is a schematic diagram of another application scenario provided by an embodiment of the present application.
  • FIG. 24 is a schematic diagram of an electronic device provided by an embodiment of the present application.
  • the term “if” may be contextually interpreted as “when” or “once” or “in response to determining” or “in response to detecting “.
  • the phrases “if it is determined” or “if the [described condition or event] is detected” may be interpreted, depending on the context, to mean “once it is determined” or “in response to the determination” or “once the [described condition or event] is detected. ]” or “in response to detection of the [described condition or event]”.
  • references in this specification to "one embodiment” or “some embodiments” and the like mean that a particular feature, structure or characteristic described in connection with the embodiment is included in one or more embodiments of the present application.
  • appearances of the phrases “in one embodiment,” “in some embodiments,” “in other embodiments,” “in other embodiments,” etc. in various places in this specification are not necessarily All refer to the same embodiment, but mean “one or more but not all embodiments” unless specifically emphasized otherwise.
  • the terms “including”, “including”, “having” and their variants mean “including but not limited to” unless specifically emphasized otherwise.
  • the communication method provided by the embodiments of the present application can be applied to mobile phones, tablet computers, wearable devices, in-vehicle devices, augmented reality (AR)/virtual reality (VR) devices, notebook computers, super mobile personal computers ( Ultra-mobile personal computer, UMPC), netbook, personal digital assistant (personal digital assistant, PDA), smart home equipment and other electronic devices supporting wireless fidelity (Wireless Fidelity, Wi-Fi) communication function, the embodiment of the present application There is no restriction on the specific type of electronic equipment.
  • the smart home device can be a smart home that supports Wi-Fi communication functions, such as smart door locks, smart lamps, sweeping robots, smart curtains, smart air conditioners, and smart speakers. equipment.
  • the electronic devices in the Internet of Things can sign and encrypt the information to be transmitted, so as to ensure that the information will not be leaked during the transmission process, and the receiver of the information can verify the information through the signature.
  • the source of information so as to achieve trusted communication on the premise that the physical link is reachable.
  • path attack also known as “path discrimination”
  • DoS Denial of Service
  • this attack method attacks the availability of communication links and achieves targeted DoS, which makes specific electronic devices unable to transmit information externally, which is easy to damage to users. It poses a threat to personal and property safety and brings inconvenience to the user's life.
  • the monitoring device cannot transmit information to the outside world. Even if the monitoring device works normally and detects the illegal intrusion of a thief, the monitoring device cannot transmit the warning information to the user, resulting in User's property loss; Assuming that the control device of the smart door lock has suffered a "path attack", at this time, the control device cannot transmit information to the outside world, and cannot control the smart door lock to perform measures such as closing, unlocking, powering off, and starting protection.
  • each electronic device in the Internet of Things communicates with each other through P2P.
  • the information goes directly to the peer device without forwarding. , completely avoiding the "path attack”.
  • the embodiments of the present application provide a communication method, an electronic device, and a computer-readable storage medium, which can mitigate the threat of "path attack” without increasing additional costs, and solve the current "path attack” solution.
  • the cost of the scheme is high, which is not conducive to the problem of promotion and application, and has strong ease of use and practicability.
  • the communication system is a system to which the communication method provided by the embodiment of the present application is applied.
  • the communication system includes at least two electronic devices 101 (only two are shown in FIG. 1 ) and at least one routing device 102 (only one is shown in FIG. 1 ).
  • Both the electronic device 101 and the routing device 102 are provided with a Wi-Fi communication module.
  • the above-mentioned routing device 102 is used to create a local area network and open a hotspot through the Wi-Fi communication module of the device.
  • the above-mentioned routing device 102 may be a dedicated network device, or the above-mentioned routing device 102 may also be an electronic device 101 .
  • the above-mentioned routing device 102 may be a router dedicated to creating a local area network.
  • the above-mentioned routing device 102 may also be a desktop computer, and the desktop computer opens a hotspot, allowing other electronic devices 101 to access.
  • the above-mentioned electronic device 101 can access the hotspot opened by the routing device 102 through the Wi-Fi communication module of the device, enter the local area network, and exchange information with other electronic devices 101 through the local area network.
  • Routing devices create local area networks and open hotspots to allow other electronic devices to access.
  • any electronic device may be defined as the first electronic device, and the electronic device at the opposite end of the first electronic device may be defined as the second electronic device.
  • the first electronic device may directly communicate with the second electronic device.
  • the first electronic device and the second electronic device form a peer-to-peer (Peer to Peer, P2P) communication link.
  • P2P peer to Peer
  • the first electronic device may not be directly communicatively connected to the second electronic device.
  • the first electronic device and the second electronic device can access the hotspot opened by the routing device through the Wi-Fi communication module to enter the local area network, and the first electronic device exchanges information with the second electronic device through the local area network.
  • the first electronic device, the routing device, and the second electronic device form a communication link, and the routing device is an intermediate node between the first electronic device and the second electronic device.
  • the communication system includes electronic device A, electronic device B, electronic device C, and routing device D.
  • the electronic device A can establish a P2P communication link with the electronic device B, and when the electronic device A and the electronic device B exchange information, no intermediate node forwarding is required.
  • the electronic device A can form a communication link with the routing device D and the electronic device C.
  • the routing device D is an intermediate node between the electronic device A and the electronic device C.
  • routing devices there may be one or more routing devices. When there are multiple routing devices in the communication link, these routing devices are all intermediate nodes of the communication link.
  • the intermediate node of the communication link may be hacked, and the attacked intermediate node may selectively discard some or all of the packets from a specific electronic device, so that the specific electronic device cannot transmit the information. to other electronic devices.
  • the electronic device can select an appropriate method according to the actual scene to detect whether the communication link where the device is located is subject to a "path attack".
  • the first electronic device and the second electronic device may establish a heartbeat interlock mechanism, and detect whether the communication link suffers from a "path attack" through the heartbeat interlock mechanism.
  • an active party and a passive party can be included.
  • the active party can send the first heartbeat information to the passive party, and the passive party can return the second heartbeat information in response to the active party.
  • the specific duration of the heartbeat cycle can be set according to the actual situation.
  • the duration of the heartbeat cycle may be set to 100ms, 120ms, 150ms, or the like.
  • an appropriate duration should be selected according to actual needs. If the duration of the heartbeat period is too short, the heartbeat interlock detection is too frequent, and the transmission of a large amount of heartbeat information will increase the network overhead of the communication system. If the duration of the heartbeat cycle is too long, the detection is likely to be untimely, and the significance of detection is lost.
  • the active party can set the specific content of the first heartbeat information by itself. For example, the active party may set the content of the first heartbeat information to "0101", "1234", "4523” and so on.
  • the active party can set the replacement timing of the content of the first heartbeat information by itself. For example, the active party can change the content of the first heartbeat information every preset heartbeat cycle; or, the active party can change the content of the first heartbeat information every preset heartbeat cycle; or, the active party can also never replace the first heartbeat information.
  • the content of the heartbeat information can change the content of the first heartbeat information every preset heartbeat cycle; or, the active party can change the content of the first heartbeat information every preset heartbeat cycle; or, the active party can also never replace the first heartbeat information.
  • the active party When the active party sends the first heartbeat information, it will use the private key of the active party to sign the content of the first heartbeat information (hereinafter referred to as the first content information). Then the active party sends the signed first heartbeat information to the intermediate node, and the intermediate node forwards the first heartbeat information to the passive party.
  • the first content information hereinafter referred to as the first content information.
  • the passive party When the passive party receives the first heartbeat information forwarded by the intermediate node, the passive party uses the public key of the active party to verify the signature of the first heartbeat information, and if the verification passes, the passive party obtains the second content information.
  • the passive party signs the second content information using the passive party's private key to obtain second heartbeat information, and sends the second heartbeat information to the intermediate node, which forwards the second heartbeat information to the active party.
  • the passive party's public key is used to verify the signature of the second heartbeat information, and if the verification is passed, the active party obtains the third content information.
  • the active party compares the third content information with the first content information, and if the third content information is consistent with the first content information, it means that the second heartbeat information is sent by the passive party and has not been tampered with.
  • the intermediate node When the communication link between the active party and the passive party suffers from a "path attack", the intermediate node will drop the packets of the active party and/or the passive party in a targeted manner. At this time, the active party cannot receive the second heartbeat information responded by the passive party or the passive party cannot receive the first heartbeat information sent by the active party, so that the active party and the passive party discover that the communication link is attacked.
  • the intermediate node when the intermediate node specifically discards the message of the active party, the active party will send the first heartbeat information to the intermediate node, but the intermediate node does not forward the first heartbeat information.
  • the passive party determines that the communication link is under attack.
  • the first preset duration can be set according to actual conditions. Typically, the first preset duration should be longer than the heartbeat period. For example, assuming that the heartbeat period is 100ms, the first preset duration may be set to durations such as 120ms, 130ms, and 150ms.
  • the passive party since the passive party does not receive the first heartbeat information, the passive party cannot feed back the second heartbeat information to the intermediate node. Therefore, the active party cannot receive the second heartbeat information fed back by the passive party.
  • the active party When the active party detects that it has not received the second heartbeat information fed back by the passive party within the second preset time period after sending the first heartbeat information, the active party determines that the communication link is under attack and stops sending the first heartbeat information. .
  • the second preset duration can be set according to actual conditions.
  • the first preset duration may be set to durations such as 20ms, 30ms, and 50ms.
  • the active party sends the first heartbeat information to the intermediate node, and the intermediate node forwards the first heartbeat information to the passive party.
  • the passive party When the passive party receives the first heartbeat information, it returns the second heartbeat information to the intermediate node. However, the intermediate node does not forward the second heartbeat information.
  • the active party When the active party detects that it has not received the second heartbeat information fed back by the passive party within the second preset time period after sending the first heartbeat information, the active party determines that the communication link is under attack and stops sending the next heartbeat cycle. First heartbeat information.
  • the passive party cannot receive the first heartbeat information in the next heartbeat cycle.
  • the passive party determines that the communication link is under attack.
  • both the active party and the passive party can use the heartbeat interlocking mechanism. Attacks on communication links were detected one after another.
  • the active party receives the second heartbeat information returned by the passive party, but the third content information is inconsistent with the first content information, it means that the communication link between the active party and the passive party may have suffered a "path attack". attack.
  • the intermediate node is controlled by a hacker, and the hacker controls the intermediate node to tamper with the message of the active party or the passive party.
  • the active party may stop sending the first heartbeat information, so that the passive party knows that the communication link is attacked.
  • the electronic devices on the communication link can successively detect that the communication link is attacked through the heartbeat interlocking mechanism.
  • the time when each electronic device on the communication link detects that the communication link is attacked may be different.
  • the time when each electronic device detects that the communication link is attacked is related to the heartbeat cycle, the first preset duration, and the second preset duration, etc. factors are related.
  • the electronic device 11 , the routing device 12 and the electronic device 13 form a communication link.
  • the electronic device 11 and the electronic device 13 are electronic devices with a heartbeat interlock mechanism established, and the routing device 12 is an intermediate node between the electronic device 11 and the electronic device 13 .
  • the heartbeat period is 100ms
  • the first preset duration is 150ms
  • the second preset duration is 50ms.
  • the electronic device 11 uses the private key of the electronic device 11 to sign the first content information "0101", obtains the first heartbeat information, and sends the first heartbeat information to the routing device 12 .
  • the routing device 12 receives the first heartbeat information, and forwards the first heartbeat information to the electronic device 13 .
  • the electronic device 13 receives the first heartbeat information forwarded by the routing device 12 .
  • the electronic device 13 verifies the signature of the first heartbeat information by using the public key of the electronic device 11, and the verification is passed, and the second content information "0101" is obtained.
  • the electronic device 13 signs the second content information using the private key of the electronic device 13 to obtain second heartbeat information, and sends the second heartbeat information to the routing device 12 .
  • the routing device 12 receives the second heartbeat information. Since the routing device 12 will discard the packets of the electronic device 13 in a targeted manner, the routing device discards the second heartbeat information and does not forward the second heartbeat information.
  • the electronic device 11 waits for the second preset time period and does not detect the second heartbeat information. At this time, the electronic device 11 determines that the communication link is under attack, so the electronic device 11 stops the heartbeat interlocking mechanism and does not send the first heartbeat information of the next heartbeat cycle.
  • the electronic device 13 waits for the first preset time period and does not detect new first heartbeat information. At this point, the electronic device 13 determines that the communication link is under attack. The electronic device 13 stops the heartbeat interlock mechanism.
  • the electronic device 21 , the routing device 22 and the electronic device 23 form a communication link.
  • the electronic device 21 and the electronic device 23 are electronic devices with a heartbeat interlock mechanism established, and the routing device 22 is an intermediate node between the electronic device 21 and the electronic device 23 .
  • the heartbeat period is 100ms
  • the first preset duration is 150ms
  • the second preset duration is 50ms.
  • the electronic device 21 uses the private key of the electronic device 21 to sign the first content information "0101", obtains the first heartbeat information, and sends the first heartbeat information to the routing device 22 .
  • the routing device 22 receives the first heartbeat information, and forwards the first heartbeat information to the electronic device 23 .
  • the electronic device 23 receives the first heartbeat information forwarded by the routing device 22 .
  • the electronic device 23 uses the public key of the electronic device 21 to verify the signature of the first heartbeat information, and the verification is passed, and the second content information "0101" is obtained.
  • the electronic device 23 signs the second content information using the private key of the electronic device 23 to obtain second heartbeat information, and sends the second heartbeat information to the routing device 22 .
  • the routing device 22 receives the second heartbeat information, and forwards the second heartbeat information to the electronic device 21 .
  • the electronic device 21 receives the second heartbeat information forwarded by the routing device 22 .
  • the electronic device 21 uses the public key of the electronic device 23 to verify the signature of the second heartbeat information, and the verification is passed, and the third content information "0101" is obtained. If the third content information is consistent with the first content information, the electronic device 21 and the electronic device 23 have completed the heartbeat interlock detection in this cycle.
  • the routing device 22 is attacked, and the routing device will discard the packets of the electronic device 21 in a targeted manner.
  • the electronic device 21 uses the private key of the electronic device 21 to sign the first content information “1111”, obtains the first heartbeat information, and sends the first heartbeat information to the routing device 22 .
  • the routing device 22 receives the first heartbeat information. Since the routing device 22 will discard the packets of the electronic device 21 in a targeted manner, the routing device discards the first heartbeat information and does not forward the first heartbeat information.
  • the electronic device 21 does not detect the second heartbeat information fed back by the electronic device 23 after waiting for the second preset time period, and the electronic device 21 determines that the communication link is attacked.
  • the electronic device 21 stops the heartbeat interlocking mechanism and no longer sends the first heartbeat information.
  • the electronic device 23 does not detect new first heartbeat information after waiting for the first preset time period, and the electronic device 23 determines that the communication link is attacked.
  • the electronic device 23 stops the heartbeat interlock mechanism.
  • the electronic devices on the communication link can successively detect that the communication link is attacked through the heartbeat interlocking mechanism.
  • the electronic device can adjust the Wi-Fi communication module so that the Wi-Fi communication module enters a promiscuous mode (also called a debug mode).
  • a promiscuous mode also called a debug mode
  • the Wi-Fi communication module of the electronic device When the Wi-Fi communication module is in the non-promiscuous mode, the Wi-Fi communication module of the electronic device only receives packets (including broadcast packets) whose destination address is directed to the device, and discards all other packets.
  • the Wi-Fi communication module of the electronic device can receive all the messages passing through the Wi-Fi communication module, regardless of whether the destination address of the message points to the device.
  • the first electronic device and the second electronic device When the communication link is attacked, the first electronic device and the second electronic device will successively enter the promiscuous mode.
  • the electronic device can encapsulate the information to be transmitted into a message, and broadcast the message to the outside world through a broadcast mechanism.
  • the Wi-Fi communication module of the surrounding electronic device is in the promiscuous mode, the surrounding electronic device can monitor the message broadcasted by the electronic device.
  • the second electronic device can obtain the message broadcasted by the first electronic device through the Wi-Fi communication module in the promiscuous mode. At this time, the first electronic device and the second electronic device establish an emergency trusted channel through the broadcast mechanism, transmit the message in the form of broadcast, and maintain the communication service. Although the communication service is degraded, the communication service will not be interrupted.
  • the Wi-Fi communication module may fail to broadcast the message smoothly due to factors such as network congestion and channel noise. Therefore, if the electronic device detects that within a period of time, the Wi-Fi communication module cannot broadcast the message due to network congestion, channel noise, etc., the electronic device can encapsulate the information to be transmitted into an injection message, and inject the message into the message. It is injected into the radio interface of the Wi-Fi communication module, and the injection message is sent to the outside in the form of broadcast.
  • the electronic device injects the injected message into the air interface for broadcasting, and does not need to perform the carrier sense action and collision detection action specified in the 802.11 protocol, so as to ensure that the Wi-Fi communication module can smoothly broadcast the above-mentioned injected message.
  • the notebook computer 31 , the notebook computer 33 , the desktop computer 34 and the smart TV 35 are electronic devices in the Internet of Things, and the router 32 is an intermediate node where the routing device is attacked.
  • the notebook computer 31, the notebook computer 33, the desktop computer 34 and the smart TV 35 discover that the communication link is attacked through the heartbeat interlocking mechanism. Therefore, the notebook computer 31, the notebook computer 33, the desktop computer 34 and the smart TV 35 control their respective Wi-Fi communication modules to enter promiscuous mode.
  • the notebook computer 31 When the notebook computer 31 wants to transmit information to the notebook computer 33, the notebook computer can encapsulate the information to be transmitted into an injection message, inject the injection message into the air interface of the Wi-Fi communication module of the device, and send it in the form of broadcast.
  • the injection message When the notebook computer 31 wants to transmit information to the notebook computer 33, the notebook computer can encapsulate the information to be transmitted into an injection message, inject the injection message into the air interface of the Wi-Fi communication module of the device, and send it in the form of broadcast.
  • the injection message The injection message.
  • the notebook computer 33 , the desktop computer 34 and the smart TV 35 all enter the promiscuous mode, the notebook computer 33 , the desktop computer 34 and the smart TV 35 can all monitor the injection message broadcast by the notebook computer 31 .
  • the electronic device on the communication link can establish an emergency trusted channel through the broadcast mechanism to maintain the communication service. Although communication through the broadcast mechanism will cause the communication service to be degraded, it will not interrupt the communication service.
  • the electronic device may send the same message multiple times in a certain broadcast channel, and/or the electronic device may The same message is sent on multiple different broadcast channels.
  • the electronic device when the electronic device sends the message A, it may send the message A every one second and continuously send the message A three times in the same broadcast channel. For another example, when the electronic device sends the message A, it can send the message A in the broadcast channel 1, the broadcast channel 2, and the broadcast channel 3 at the same time.
  • the first electronic device may not encrypt the data to be transmitted before broadcasting the data to be transmitted.
  • the first electronic device may use the public key of the second electronic device to encrypt the transmission content to obtain an encrypted message.
  • the second electronic device After the first electronic device uses the public key of the second electronic device to encrypt, only the second electronic device can decrypt the encrypted message by using the private key of the device to obtain the transmission content.
  • the notebook computer 41 , the notebook computer 43 , the desktop computer 44 and the smart TV 45 are electronic devices in the Internet of Things
  • the router 42 is a routing device
  • the router 42 is a notebook computer 41.
  • the notebook computer 41 and the notebook computer 43 establish a heartbeat interlock mechanism.
  • the router 42 When the router 42 is attacked, the router will discard the packets sent by the notebook computer 43 in a targeted manner, that is to say, the notebook computer 43 cannot transmit the packets through the router 42 to the outside.
  • the notebook computer 41 and the notebook computer 43 can resume communication through the broadcast mechanism.
  • the notebook computer 41 can use the public key of the notebook computer 43 to encrypt the data to be transmitted, and encapsulate the encrypted data to be transmitted as an injection message. Then, the notebook computer 43 injects the injection message into the air interface of the Wi-Fi communication module of the device and broadcasts it to the outside.
  • the notebook computer 43 and the desktop computer 44 around the notebook computer 41 are in promiscuous mode, so both the notebook computer 43 and the desktop computer 44 can receive the injection message, not only the notebook computer 43 can receive the injection message Inject messages.
  • the smart TV 45 is not in the promiscuous mode, so the smart TV 45 cannot receive the injection message broadcast by the notebook computer 41 .
  • the laptop computer 43 After the laptop computer 43 obtains the injection message, it can use the private key of the laptop computer 43 to decrypt the encrypted data in the injection message to obtain the data to be transmitted.
  • the desktop computer 44 After the desktop computer 44 obtains the injection message, since the desktop computer 44 does not have the private key of the laptop computer 43, the desktop computer 44 cannot decrypt the encrypted data in the injection message, and cannot know the content of the data to be transmitted.
  • the electronic device can use the public key of the receiver to encrypt the content of the message. At this point, only the receiver can decrypt the message with the private key to obtain the content of the message. Other electronic devices in the promiscuous mode in the communication system cannot directly obtain the content of the message after monitoring the message.
  • the electronic device can use the private key of the device to sign the content of the message when broadcasting the message, and prove by means of signature. The identity of the sender of this message.
  • the electronic device After the electronic device monitors the messages broadcast by other electronic devices, it can use the public key of the sender of the message to verify the signature of the message.
  • the electronic device can use the private key of the device to sign and store the above message.
  • the electronic device may perform the first preset operation on the message.
  • the specific form of the first preset operation can be set according to the actual situation.
  • the first preset operation may be that the electronic device discards the message; or, the first preset operation may be that the electronic device records and stores the message as a malicious message.
  • the electronic device can feed back the first response information to the sender of the message through a preset transmission protocol.
  • the preset transmission protocol can be set according to actual needs.
  • a transmission control protocol Transmission Control Protocol, TCP
  • TCP Transmission Control Protocol
  • the electronic device After the electronic device broadcasts the message, if the electronic device receives the first response information fed back by other electronic devices, it means that the message has been monitored by other electronic devices. At this time, the electronic device may feed back the second response information to the sender of the first response information.
  • the message sent by the electronic device may be referred to as a "fact".
  • electronic device A For example, assume that electronic device A, electronic device B, electronic device C, and electronic device D exist in the communication system.
  • electronic device A broadcasts a message
  • electronic device B may forge or tamper with the message broadcast by electronic device A.
  • the electronic device B may feed back false facts, thus causing the real facts to be covered up.
  • electronic device B can also determine the true facts from the facts recorded by electronic device C and electronic device D.
  • the electronic device can set the first response threshold. After the electronic device broadcasts the message to the outside world, the electronic device can determine whether the message is successfully broadcast according to the quantity of the first response information received within the preset response time period and the first response threshold.
  • the electronic device that broadcasts the message can determine that the message is broadcast successfully.
  • the electronic device that broadcasts the message may determine that the message broadcast fails.
  • the specific value of the first threshold can be set according to the number of electronic devices in the Internet of Things.
  • the first response threshold may be set to 1, 2, 3, 5, 10 and other values.
  • the preset response time can be set according to the actual situation.
  • the preset response duration can be set to 100ms, 200ms, 500ms, 1s, and the like.
  • the electronic device may perform a second preset operation. For example, after determining that the message broadcasting fails, the electronic device may re-broadcast the failed message until the electronic device determines that the message broadcasting is successful.
  • the electronic device may choose to broadcast the message in the same broadcast channel, or the electronic device may change the broadcasting channel and rebroadcast the failed message.
  • the electronic device can continue to broadcast message A on broadcast channel 1, or the electronic device can also change the broadcast channel, broadcast message A on broadcast channel 2.
  • the notebook computer 51 , the notebook computer 52 , the desktop computer 53 and the smart TV 54 are electronic devices in the Internet of Things.
  • Laptop 51, Laptop 52, Desktop 53 and Smart TV 54 are all in promiscuous mode.
  • the notebook computer 51 broadcasts the injection message to the outside world.
  • the first response threshold set by the notebook computer 51 is 3, and the preset response duration is 500 ms.
  • the notebook computer 51 only receives the first response information fed back by the notebook computer 52 and the smart TV 54 within 500 ms.
  • the number of first response information is 2, which is less than the first response threshold of 3. Then the notebook computer 51 determines that the above-mentioned injection message is broadcast. fail.
  • the notebook computer 51 rebroadcasts the above injection message.
  • the notebook computer 61 , the notebook computer 62 , the desktop computer 63 and the smart TV 64 are electronic devices in the Internet of Things.
  • Laptop 61, laptop 62, desktop 63 and smart TV 64 are all in promiscuous mode.
  • the notebook computer 61 broadcasts the injection message to the outside.
  • the first response threshold set by the notebook computer 61 is 2, and the preset response duration is 600 ms.
  • the notebook computer 62 , the desktop computer 63 and the smart TV 64 have all monitored the injection message. At this time, the notebook computer 62 , the desktop computer 63 and the smart TV 64 all feed back the first response information to the notebook computer 61 .
  • the notebook computer 61 receives the first response information fed back by the notebook computer 62, the desktop computer 63 and the smart TV 64 within 600 ms, and the number of first response information is 3, which is greater than the first response threshold 2, then the notebook computer 61 determines that the above injection The message is broadcast successfully.
  • the electronic device after the electronic device broadcasts the message, it can judge whether the message is successfully broadcasted through the received first response information fed back by other electronic devices. If the first response information monitored by the electronic device within the preset response time period is greater than the preset response threshold, the electronic device may determine that the message broadcast is successful. If the first response information received by the electronic device within the preset response time period is less than or equal to the preset response threshold, the electronic device can determine that the message broadcast failed and re-broadcast the message to prevent the message from being audited by others in the post-event auditing process. Node forgery or tampering.
  • the electronic devices on the communication link can enter the promiscuous mode, transmit messages in the form of broadcast, and monitor messages sent by other electronic devices to maintain communication services.
  • the first electronic device and the second electronic device can always perform data interaction in the form of broadcasting.
  • the first electronic device and the second electronic device may also negotiate and determine a new routing device. After the new routing device is determined, the new routing device can create a new local area network and open the hotspot. Other electronic devices are connected to the hotspot opened by the new routing device, and normal communication services are realized through the new local area network.
  • each electronic device may broadcast the Wi-Fi communication capability parameter of the device to the outside world.
  • the specific parameter type of the Wi-Fi communication capability parameter can be set according to actual requirements.
  • the Wi-Fi communication capability parameter may be set as one or more of parameters such as transmit power, receive sensitivity, and throughput.
  • the electronic device with the optimal Wi-Fi communication capability parameter is used as a new routing device.
  • the new routing device creates a local area network, opening hotspots to the outside world, allowing other electronic devices to access. Other electronic devices connect to the hotspot and restore communication services through the local area network created by the new routing device.
  • an electronic device may actively broadcast the network construction request message, and other electronic devices will feed back the first response information to the sending of the network construction request message after monitoring the network construction request message. square.
  • the sender of the network establishment request message When the first response information received by the sender of the network establishment request message is greater than the first response threshold, the sender of the network establishment request message creates a local area network, opens the hotspot to the outside world, and allows other electronic devices to access. Other electronic devices connect to the hotspot and restore communication services through the local area network created by the new routing device.
  • the message sent by the electronic device is referred to as a fact.
  • the facts that electronic devices need to transmit externally can include two types of facts.
  • the first category of facts is fault information.
  • the fault information may include one or more items of information such as fault time, fault object, and fault type.
  • the electronic device A determines that the communication link is attacked and enters the promiscuous mode.
  • the fact that electronic device A needs to broadcast to the outside may include the first moment (failure time), electronic device B (failure object), and information unreachable (failure type).
  • the electronic device B determines that the communication link is attacked and enters the promiscuous mode.
  • the fact that the electronic device B needs to broadcast to the outside may include the second moment (failure time), the electronic device A (the failure object), and the information unreachable (the failure type).
  • the second type of fact is business information.
  • electronic equipment may have specific business functions.
  • a camera can collect image information
  • an infrared sensor can collect infrared information.
  • an electronic device When an electronic device performs a business function, it may generate business information that needs to be transmitted externally.
  • the infrared sensor when it detects abnormal infrared information in a certain area, it can transmit the location information of the area to the camera, and the camera adjusts the direction of the lens according to the received location information, takes the image of the above area, and completes the connection between the infrared sensor and the camera. linkage.
  • the location information of the above area is the business information that the infrared sensor needs to transmit to the camera.
  • the central control device of the smart home receives the door opening command through the Internet, and then the central control device will send the door opening command to the smart door lock, and the smart door lock will execute the door opening operation after receiving the door opening command.
  • the above door opening instruction is the business information that the central control device needs to transmit to the smart door lock.
  • the management device may communicate with each electronic device in response to the user's operation, and obtain the facts recorded by each electronic device.
  • the management device may be any electronic device in the current communication system, or the management device may also be an electronic device outside the current communication system.
  • the management device may be communicatively connected to each electronic device through wired communication connection and/or wireless communication connection, and the embodiment of the present application does not impose any limitation on the communication connection between the management device and the electronic device.
  • the management device After the management device obtains the facts recorded by each electronic device.
  • the signature in each fact can be verified using the public key of the sender of each fact, verifying the identity of the sender of the fact. Then the management device can show the verified facts to the user, so that the user can understand the process of the communication link being attacked and the service information exchanged by each electronic device after the communication link is attacked.
  • the packets monitored by the electronic device may be incomplete. Therefore, after the management device obtains the facts recorded by each electronic device from each electronic device, if incomplete facts are found, the facts monitored by each electronic device can be spliced and restored to obtain complete facts.
  • the notebook computer 71 As shown in FIG. 12 , in the communication system shown in FIG. 12 , the notebook computer 71 , the smart TV 72 , the notebook computer 73 , and the desktop computer 74 are electronic devices in the Internet of Things.
  • the notebook computer 75 is a management device.
  • Laptop 71, smart TV 72, laptop 73 and desktop 74 are all in promiscuous mode.
  • the notebook computer 71 broadcasts an injection message, and the smart TV 72, the notebook computer 73, and the desktop computer 74 all monitor the injection message.
  • the smart TV 72 , the notebook computer 73 , and the desktop computer 74 only listen to part of the injected message.
  • the smart TV 72 has monitored the message segment A
  • the desktop computer 74 has monitored the message segment B
  • the laptop computer 73 has monitored the message segment C.
  • the notebook computer 75 When the notebook computer 75 is communicatively connected to the smart TV 72 , the notebook computer 73 , and the desktop computer 74 in response to the user's operation, the notebook computer 75 can obtain the message segment A from the smart TV 72 , the notebook computer 73 , and the desktop computer 74 . , message fragment B, and message fragment C.
  • the notebook computer 75 obtains the message fragment A, the message fragment B, and the message fragment C, it can The message segment A, the message segment B, and the message segment C are spliced into a complete injected message, so as to obtain the message broadcast by the notebook computer 71 at the above-mentioned moment.
  • the management device can obtain the fact recorded by the electronic device from each electronic device in the communication system.
  • the management device can splicing and restore the message fragments recorded by multiple electronic devices, so as to obtain complete facts.
  • some electronic devices may be controlled. These controlled electronic devices may send false facts to obfuscate the correct facts.
  • the management device can define the fact that there are multiple versions as a questionable fact, and vote on the questionable fact.
  • the management device can determine the version supported by the most electronic devices as the real version of the questionable fact according to the principle of minority obeying the majority.
  • the management device can also show the voting process to the user.
  • the management device may set strips with time as the axis, and divide the complete recording time into time segments, each time segment corresponding to a part of the strip. If the fact that the management device acquires a certain time period is not a suspicious fact and is monitored by multiple electronic devices, the strip corresponding to the time period is marked green. If the fact that the management device acquires a certain time period is not a suspicious fact, but is only monitored by one electronic device, it means that the authenticity of the fact needs further confirmation by the user, and the management device marks the strip corresponding to the time period in yellow.
  • the management device can mark the strip corresponding to the time period in red, and display the voting results of each electronic device. After the voting is over, the management device may generate a strip with three colors of red, yellow and blue. The user can visually check the voting behavior of each electronic device during the voting process through the strip, so that the user can find the electronic device that was attacked. For example, the user can view the voting results of each electronic device in the red strip. If a certain electronic device is voted by a minority every time, the user should check whether the electronic device is attacked.
  • the notebook computer 81 , the notebook computer 83 , the desktop computer 84 , and the smart TV 85 are electronic devices in the Internet of Things.
  • the router 82 is a routing device.
  • the notebook computer 86 is the management device.
  • the notebook computer 81 , the notebook computer 83 , the desktop computer 84 , and the smart TV 85 are all connected to the hotspot opened by the router 82 .
  • the router 82 and the smart TV 85 are attacked by hackers, the router 82 will stop forwarding the information of the laptop computer 81 and the desktop computer 84, and the communication link suffers a "path attack".
  • the notebook computer 81 , the notebook computer 83 , the desktop computer 84 , and the smart TV 85 enter the promiscuous mode after detecting that the communication link is attacked.
  • the notebook computer 81 broadcasts the injection message A to the outside world.
  • the notebook computer 83 , the desktop computer 84 , and the smart TV 85 all monitor the injection message A, and after verifying the signature of the injection message A, store the injection message A locally.
  • the notebook computer 86 is respectively connected in communication with the notebook computer 83 , the desktop computer 84 , and the smart TV 85 to obtain the facts recorded by the notebook computer 83 , the desktop computer 84 , and the smart TV 85 .
  • the notebook computer 83 monitors the injected packet A, but the notebook computer 83 only monitors part of the information of the injected packet A, that is, the packet fragment 1.
  • the desktop computer 84 monitors the injected message A, but the desktop computer 84 only monitors part of the information of the injected message A, that is, the injected message 2 .
  • the smart TV 85 has monitored the complete injection packet A, but the smart TV is controlled by a hacker, tampering with the injection packet A, and obtaining the injection packet B.
  • the notebook computer 83 sends the message fragment 1 to the notebook computer 86
  • the desktop computer 84 sends the message fragment 2 to the notebook computer 86
  • the smart TV 85 sends the injection message B to the laptop computer 86 .
  • the notebook computer 86 splices the packet fragment 1 and the packet fragment 2 into the injected packet A.
  • the notebook computer 86 finds that there are two versions of the injected message A and the injected message B in the same message. Therefore, the notebook computer 86 votes for the injected message A and the injected message B.
  • the smart TV 85 supports the injection of the message B.
  • the voting result of the injected message A and the injected message B is 2:1, so the notebook computer 86 determines that the injected message A is a true fact, and the injected message B is a false fact.
  • the management device can vote to determine the version supported by the most electronic devices as the real version of the questionable fact. thereby identifying the true facts.
  • a router 91 As shown in Fig. 16, a router 91, a notebook computer 92, a smart TV 93, a camera 94, an infrared detector 95, an alarm 96, and a monitoring host 97 are provided in the user's home.
  • the router 91 , the notebook computer 92 , the smart TV 93 , the camera 94 , the infrared detector 95 , the alarm 96 , and the monitoring host 97 are all provided with Wi-Fi communication modules.
  • the router 91 is a routing device, creates a local area network, and opens a hotspot.
  • the notebook computer 92 , the smart TV 93 , the camera 94 , the infrared detector 95 , and the alarm 96 are respectively connected to the hotspot opened by the router 91 through the Wi-Fi communication module of the device.
  • the infrared detector 95 and the camera 94 establish a heartbeat interlock mechanism, and the camera 94 establishes a heartbeat interlock mechanism with the notebook computer 92 and the alarm 96 respectively.
  • the Wi-Fi communication module of the monitoring host 97 is always in the promiscuous mode, and the monitoring host 97 is used to monitor and store all messages passing through the Wi-Fi communication module of the monitoring host 97 .
  • the router 91 and the laptop 92 are attacked by hackers. At this time, the router 91 discards the packets sent by the infrared detector 95 in a targeted manner.
  • the infrared detector 95 and the camera 94 will successively detect that the communication link is attacked. Therefore, the Wi-Fi communication module of the infrared detector 95 and the Wi-Fi communication module of the camera 94 will successively enter the promiscuous mode. .
  • the camera 94 Since the camera 94 detects that the communication link is attacked, the camera 94 stops sending the first heartbeat information or responding to the second heartbeat information, so the Wi-Fi communication module of the notebook computer 92 and the Wi-Fi communication module of the alarm 96 also enter one after another. Promiscuous mode.
  • the Wi-Fi communication module of the infrared detector 95 the Wi-Fi communication module of the camera 94 , the Wi-Fi communication module of the notebook computer 92 , and the Wi-Fi communication module of the alarm device 96
  • the Wi-Fi communication module of the monitoring host 97 is in the promiscuous mode, and the connection with the router 91 is disconnected.
  • the hacker enters the user's home and stays in area 1.
  • the area 1 is within the detection area of the infrared detector 95 , and the infrared detector 95 detects that an abnormal infrared signal exists in the area A, and generates an injection message 1 .
  • the injected message 1 includes the detection time, the location information of the area 1, and the detection event (ie, there is an abnormal infrared signal).
  • the infrared detector 95 uses the private key of the device to sign the injection message 1, injects the signed injection message 1 into the air interface of the Wi-Fi communication module of the device, and broadcasts the injection message to the outside world. 1.
  • the notebook computer 92 monitors the injected message 1, and uses the public key of the infrared detector 95 to verify the signature of the injected message 1. If the verification is passed, the notebook computer 92 signs the injection message 1 with the private key of the device and stores it locally.
  • the alarm 96 monitors the injected message 1, and uses the public key of the infrared detector 95 to verify the signature of the injected message 1. If the verification is passed, the alarm 96 signs the injection message 1 with the private key of the device and stores it locally.
  • the monitoring host 97 monitors the injected message 1 and uses the public key of the infrared detector 95 to verify the signature of the injected message 1 . If the verification is passed, the monitoring host 97 signs the injection message 1 with the private key of the device and stores it locally.
  • the camera 94 monitors the injected message 1, and uses the public key of the infrared detector 95 to verify the signature of the injected message 1. If the verification is passed, the camera 94 adjusts the shooting angle of the camera 94 according to the content of the injected message 1 to shoot the image of the area 1 . In addition, the camera 94 signs the injection message 1 with the private key of the device and stores it locally.
  • an injection message 2 is generated.
  • the injection message 2 includes the shooting time and the shooting image.
  • the camera 94 signs the injection message 2 using the private key of the device, injects the signed injection message 2 into the air interface of the Wi-Fi communication module of the device, and broadcasts the injection message 2 to the outside.
  • the notebook computer 92 monitors the injected message 2, and uses the public key of the camera 94 to verify the signature of the injected message 2. If the verification is passed, the notebook computer 92 signs the injection message 2 with the private key of the device and stores it locally.
  • the alarm 96 monitors the injected message 2, and uses the public key of the camera 94 to verify the signature of the injected message 2. If the verification is passed, the alarm 96 signs the injection message 2 with the private key of the device and stores it locally.
  • the monitoring host 97 monitors the injected message 2 and uses the public key of the camera 94 to verify the signature of the injected message 2 . If the verification is passed, the monitoring host 97 signs the injection message 2 with the private key of the device and stores it locally.
  • the infrared detector 95 monitors the injected message 2 and uses the public key of the camera 94 to verify the signature of the injected message 2 . If the verification is passed, the infrared detector 95 signs the injection message 2 with the private key of the device and stores it locally.
  • the desktop computer 98 is turned on. As shown in FIG. 21, the desktop computer 98 establishes a communication connection with the notebook computer 92, the smart TV 93, the camera 94, the infrared detector 95, the alarm 96, and the monitoring host 97 in response to the user's operation, respectively, and obtains the data recorded by each electronic device. fact.
  • the injection packet 1 recorded by the laptop computer 92 was tampered with the injection packet 3, and the injection packet 2 was tampered with the injection packet 4.
  • the Wi-Fi communication module of the smart TV 93 does not enter the promiscuous mode, so the smart TV 93 does not record the fact.
  • the camera 94 records the injection message 1 .
  • the infrared detector 95 records a fragment of the injected message 2 (message fragment 2.1).
  • the alarm 96 records the segment injected into message 1 (message segment 1.1) and the segment injected into message 2 (message segment 2.2).
  • the monitoring host 97 records the injected packet 1 and the fragment of the injected packet 2 (the packet fragment 2.3).
  • the desktop computer 98 After the desktop computer 98 obtains the facts recorded by each electronic device, it can splicing the message segment 2.1, the message segment 2.2 and the message segment 2.3 to obtain the injected message 2.
  • the first group is injection packet 1 and injection packet 3
  • the second group is injection packet 2 and injection packet 4.
  • the desktop computer 98 voted on the two groups of questionable facts separately.
  • the voting ratio of injected message 1 and injected message 3 is 3:1, and the voting ratio of injected message 2 and injected message 4 is 3:1. Therefore, the desktop computer 98 determines injected message 1 and injected message 2 as a real fact.
  • the desktop computer 98 presents the real facts to the user. At this time, the user can learn that the hacker has entered the user's home and stayed in the area 1 through the injection message 1 and the injection message 2, and the appearance of the hacker can be determined according to the photographed image in the injection message 2.
  • the electronic device when the electronic device detects that the communication link is attacked, the electronic device can control the Wi-Fi communication module to enter the promiscuous mode. At this time, the electronic device can broadcast the message to the outside in the form of broadcasting. In the promiscuous mode, the electronic device at the opposite end can monitor all the messages in the channel, so as to obtain the messages broadcast by the electronic device. That is to say, when the communication link is attacked, the first electronic device and the second electronic device can establish an emergency trusted channel through a broadcast mechanism to maintain the communication service. Although communication through the broadcast mechanism will cause the communication service to be degraded, it will not interrupt the communication service.
  • the electronic device can sign the message before broadcasting the message to the outside world. After the electronic device monitors the message, it can verify the signature of the message. If the verification is passed, the electronic device stores the message locally.
  • the management device can establish a communication connection from each electronic device, and obtain the facts recorded by each electronic device, that is, the messages stored by each electronic device.
  • the management device splices and votes the facts recorded by each electronic device to determine the real facts, so that users can understand the process of the communication link being attacked and the business information of each electronic device after the communication link is attacked through the real facts.
  • the communication method provided by this embodiment includes:
  • the first electronic device monitors the communication link
  • the first electronic device controls the Wi-Fi communication module of the first electronic device to enter the promiscuous mode, and sends the first message in the form of broadcasting.
  • FIG. 24 is a schematic diagram of an electronic device provided by an embodiment of the present application.
  • the electronic device 2400 may include a processor 2410, an external memory interface 2420, an internal memory 2421, a universal serial bus (USB) interface 2430, a charge management module 2440, a power management module 2441, a battery 2442, an antenna 1, an antenna 2 , mobile communication module 2450, wireless communication module 2460, audio module 2470, speaker 2470A, receiver 2470B, microphone 2470C, headphone jack 2470D, sensor module 2480, key 2490, motor 2491, indicator 2492, camera 2493, display screen 2494, and Subscriber identification module (subscriber identification module, SIM) card interface 2495 and so on.
  • SIM Subscriber identification module
  • the sensor module 2480 may include a pressure sensor 2480A, a gyroscope sensor 2480B, an air pressure sensor 2480C, a magnetic sensor 2480D, an acceleration sensor 2480E, a distance sensor 2480F, a proximity light sensor 2480G, a fingerprint sensor 2480H, a temperature sensor 2480J, a touch sensor 2480K, and ambient light.
  • Sensor 2480L Bone Conduction Sensor 2480M, etc.
  • the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on the electronic device 2400 .
  • the electronic device 2400 may include more or less components than shown, or combine some components, or separate some components, or arrange different components.
  • the illustrated components may be implemented in hardware, software, or a combination of software and hardware.
  • the processor 2410 may include one or more processing units, for example, the processor 2410 may include an application processor (application processor, AP), a modem processor, a graphics processor (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), controller, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural-network processing unit (neural-network processing unit, NPU), etc. Wherein, different processing units may be independent devices, or may be integrated in one or more processors.
  • application processor application processor, AP
  • modem processor graphics processor
  • image signal processor image signal processor
  • ISP image signal processor
  • controller video codec
  • digital signal processor digital signal processor
  • baseband processor baseband processor
  • neural-network processing unit neural-network processing unit
  • the controller can generate an operation control signal according to the instruction operation code and timing signal, and complete the control of fetching and executing instructions.
  • a memory may also be provided in the processor 2410 for storing instructions and data.
  • the memory in processor 2410 is cache memory. This memory may hold instructions or data that have just been used or recycled by the processor 2410. If the processor 2410 needs to use the instruction or data again, it can be called directly from the memory. Repeated access is avoided and the waiting time of the processor 2410 is reduced, thereby improving the efficiency of the system.
  • the processor 2410 may include one or more interfaces.
  • the interface may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, a universal asynchronous transceiver (universal asynchronous transmitter) receiver/transmitter, UART) interface, mobile industry processor interface (MIPI), general-purpose input/output (GPIO) interface, subscriber identity module (SIM) interface, and / or universal serial bus (universal serial bus, USB) interface, etc.
  • I2C integrated circuit
  • I2S integrated circuit built-in audio
  • PCM pulse code modulation
  • PCM pulse code modulation
  • UART universal asynchronous transceiver
  • MIPI mobile industry processor interface
  • GPIO general-purpose input/output
  • SIM subscriber identity module
  • USB universal serial bus
  • the I2C interface is a bidirectional synchronous serial bus that includes a serial data line (SDA) and a serial clock line (SCL).
  • the processor 2410 may contain multiple sets of I2C buses.
  • the processor 2410 can be respectively coupled to the touch sensor 2480K, charger, flash, camera 2493, etc. through different I2C bus interfaces.
  • the processor 2410 can couple the touch sensor 2480K through the I2C interface, so that the processor 2410 and the touch sensor 2480K communicate with each other through the I2C bus interface, so as to realize the touch function of the electronic device 2400.
  • the I2S interface can be used for audio communication.
  • the processor 2410 may contain multiple sets of I2S buses.
  • the processor 2410 may be coupled with the audio module 2470 through an I2S bus to implement communication between the processor 2410 and the audio module 2470.
  • the audio module 2470 can transmit audio signals to the wireless communication module 2460 through the I2S interface, so as to realize the function of answering calls through a Bluetooth headset.
  • the PCM interface can also be used for audio communications, sampling, quantizing and encoding analog signals.
  • the audio module 2470 and the wireless communication module 2460 may be coupled through a PCM bus interface.
  • the audio module 2470 can also transmit audio signals to the wireless communication module 2460 through the PCM interface, so as to realize the function of answering calls through the Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.
  • the UART interface is a universal serial data bus used for asynchronous communication.
  • the bus may be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication.
  • a UART interface is typically used to connect the processor 2410 with the wireless communication module 2460.
  • the processor 2410 communicates with the Bluetooth module in the wireless communication module 2460 through the UART interface to implement the Bluetooth function.
  • the audio module 2470 can transmit audio signals to the wireless communication module 2460 through the UART interface, so as to realize the function of playing music through the Bluetooth headset.
  • the MIPI interface can be used to connect the processor 2410 with the display screen 2494, the camera 2493 and other peripheral devices.
  • MIPI interfaces include camera serial interface (CSI), display serial interface (DSI), etc.
  • the processor 2410 communicates with the camera 2493 through a CSI interface to implement the photographing function of the electronic device 2400 .
  • the processor 2410 communicates with the display screen 2494 through the DSI interface to implement the display function of the electronic device 2400.
  • the GPIO interface can be configured by software.
  • the GPIO interface can be configured as a control signal or as a data signal.
  • the GPIO interface can be used to connect the processor 2410 with the camera 2493, the display screen 2494, the wireless communication module 2460, the audio module 2470, the sensor module 2480, and the like.
  • the GPIO interface can also be configured as I2C interface, I2S interface, UART interface, MIPI interface, etc.
  • the USB interface 2430 is an interface that conforms to the USB standard specification, and can specifically be a Mini USB interface, a Micro USB interface, a USB Type C interface, and the like.
  • the USB interface 2430 can be used to connect a charger to charge the electronic device 2400, and can also be used to transmit data between the electronic device 2400 and peripheral devices. It can also be used to connect headphones to play audio through the headphones.
  • the interface can also be used to connect other electronic devices, such as AR devices.
  • the interface connection relationship between the modules illustrated in the embodiment of the present invention is only a schematic illustration, and does not constitute a structural limitation of the electronic device 2400 .
  • the electronic device 2400 may also adopt different interface connection manners in the foregoing embodiments, or a combination of multiple interface connection manners.
  • the charging management module 2440 is used to receive charging input from the charger.
  • the charger may be a wireless charger or a wired charger.
  • the charging management module 2440 may receive charging input from the wired charger through the USB interface 2430 .
  • the charging management module 2440 may receive wireless charging input through the wireless charging coil of the electronic device 2400 . While the charging management module 2440 charges the battery 2442, it can also supply power to the electronic device through the power management module 2441.
  • the power management module 2441 is used to connect the battery 2442 , the charging management module 2440 and the processor 2410 .
  • the power management module 2441 receives input from the battery 2442 and/or the charging management module 2440, and supplies power to the processor 2410, the internal memory 2421, the display screen 2494, the camera 2493, and the wireless communication module 2460.
  • the power management module 2441 can also be used to monitor battery capacity, battery cycle times, battery health status (leakage, impedance) and other parameters.
  • the power management module 2441 may also be provided in the processor 2410 .
  • the power management module 2441 and the charging management module 2440 may also be provided in the same device.
  • the wireless communication function of the electronic device 2400 may be implemented by the antenna 1, the antenna 2, the mobile communication module 2450, the wireless communication module 2460, the modem processor, the baseband processor, and the like.
  • Antenna 1 and Antenna 2 are used to transmit and receive electromagnetic wave signals.
  • Each antenna in electronic device 2400 may be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization.
  • the antenna 1 can be multiplexed as a diversity antenna of the wireless local area network. In other embodiments, the antenna may be used in conjunction with a tuning switch.
  • the mobile communication module 2450 can provide wireless communication solutions including 2G/3G/4G/5G etc. applied on the electronic device 2400 .
  • the mobile communication module 2450 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), and the like.
  • the mobile communication module 2450 can receive electromagnetic waves from the antenna 1, filter and amplify the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation.
  • the mobile communication module 2450 can also amplify the signal modulated by the modulation and demodulation processor, and then convert it into electromagnetic waves and radiate it out through the antenna 1 .
  • at least part of the functional modules of the mobile communication module 2450 may be provided in the processor 2410 .
  • at least part of the functional modules of the mobile communication module 2450 may be provided in the same device as at least part of the modules of the processor 2410 .
  • the modem processor may include a modulator and a demodulator.
  • the modulator is used to modulate the low frequency baseband signal to be sent into a medium and high frequency signal.
  • the demodulator is used to demodulate the received electromagnetic wave signal into a low frequency baseband signal. Then the demodulator transmits the demodulated low-frequency baseband signal to the baseband processor for processing.
  • the low frequency baseband signal is processed by the baseband processor and passed to the application processor.
  • the application processor outputs sound signals through audio devices (not limited to the speaker 2470A, the receiver 2470B, etc.), or displays images or videos through the display screen 2494.
  • the modem processor may be a separate device.
  • the modem processor may be independent of the processor 2410, and may be provided in the same device as the mobile communication module 2450 or other functional modules.
  • the wireless communication module 2460 can provide applications on the electronic device 2400 including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellites Wireless communication solutions such as global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared technology (IR).
  • WLAN wireless local area networks
  • BT Bluetooth
  • GNSS global navigation satellite system
  • FM frequency modulation
  • NFC near field communication
  • IR infrared technology
  • the wireless communication module 2460 may be one or more devices integrating at least one communication processing module.
  • the wireless communication module 2460 receives electromagnetic waves via the antenna 2 , frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 2410 .
  • the wireless communication module 2460 can also receive the signal to be sent from the processor 2410 , perform frequency modulation on it, amplify the signal, and then convert it into an electromagnetic wave for radiation through the antenna 2 .
  • the antenna 1 of the electronic device 2400 is coupled with the mobile communication module 2450, and the antenna 2 is coupled with the wireless communication module 2460, so that the electronic device 2400 can communicate with the network and other devices through wireless communication technology.
  • the wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), broadband Code Division Multiple Access (WCDMA), Time Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC , FM, and/or IR technology, etc.
  • the GNSS may include global positioning system (global positioning system, GPS), global navigation satellite system (global navigation satellite system, GLONASS), Beidou navigation satellite system (beidou navigation satellite system, BDS), quasi-zenith satellite system (quasi -zenith satellite system, QZSS) and/or satellite based augmentation systems (SBAS).
  • global positioning system global positioning system, GPS
  • global navigation satellite system global navigation satellite system, GLONASS
  • Beidou navigation satellite system beidou navigation satellite system, BDS
  • quasi-zenith satellite system quadsi -zenith satellite system, QZSS
  • SBAS satellite based augmentation systems
  • the electronic device 2400 implements a display function through a GPU, a display screen 2494, and an application processor.
  • the GPU is a microprocessor for image processing, and connects the display screen 2494 and the application processor.
  • the GPU is used to perform mathematical and geometric calculations for graphics rendering.
  • Processor 2410 may include one or more GPUs that execute program instructions to generate or alter display information.
  • Display screen 2494 is used to display images, videos, and the like.
  • Display screen 2494 includes a display panel.
  • the display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matri24 organic light-emitting diode (active-matri24 organic light).
  • emitting diodes AMOLED
  • flexible light-emitting diodes fle24 light-emitting diodes, FLED
  • Miniled MicroLed, Micro-oLed, quantum dot light-emitting diodes (quantum dot light emitting diodes, QLED), etc.
  • the electronic device 2400 may include 1 or N display screens 2494, where N is a positive integer greater than 1.
  • the electronic device 2400 can realize the shooting function through the ISP, the camera 2493, the video codec, the GPU, the display screen 2494 and the application processor.
  • the ISP is used to process the data fed back by the camera 2493. For example, when taking a photo, the shutter is opened, the light is transmitted to the camera photosensitive element through the lens, the light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to the ISP for processing, and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on image noise, brightness, and skin tone. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, the ISP may be located in the camera 2493.
  • Camera 2493 is used to capture still images or video.
  • the object is projected through the lens to generate an optical image onto the photosensitive element.
  • the photosensitive element can be a charge coupled device (CCD) or a complementary metal oxide semiconductor (complementary metal-o24ide-semiconductor, CMOS) phototransistor.
  • CCD charge coupled device
  • CMOS complementary metal oxide semiconductor
  • the photosensitive element converts the optical signal into an electrical signal, and then transmits the electrical signal to the ISP to convert it into a digital image signal.
  • the ISP outputs the digital image signal to the DSP for processing.
  • DSP converts digital image signals into standard RGB, YUV and other formats of image signals.
  • the electronic device 2400 may include 1 or N cameras 2493 , where N is a positive integer greater than 1.
  • a digital signal processor is used to process digital signals, in addition to processing digital image signals, it can also process other digital signals. For example, when the electronic device 2400 selects a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy, and the like.
  • Video codecs are used to compress or decompress digital video.
  • Electronic device 2400 may support one or more video codecs. In this way, the electronic device 2400 can play or record videos in various encoding formats, such as: Moving Picture Experts Group (moving picture e24perts group, MPEG) 24, MPEG2, MPEG3, MPEG4 and so on.
  • Moving Picture Experts Group moving picture e24perts group, MPEG
  • MPEG2 Moving Picture Experts Group
  • MPEG3 MPEG4
  • the NPU is a neural-network (NN) computing processor.
  • NN neural-network
  • Applications such as intelligent cognition of the electronic device 2400 can be implemented through the NPU, such as image recognition, face recognition, speech recognition, text understanding, and the like.
  • the external memory interface 2420 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 2400.
  • the external memory card communicates with the processor 2410 through the external memory interface 2420 to realize the data storage function. For example to save files like music, video etc in external memory card.
  • Internal memory 2421 may be used to store computer executable program code, which includes instructions.
  • the internal memory 2421 may include a storage program area and a storage data area.
  • the storage program area can store an operating system, an application program required for at least one function (such as a sound playback function, an image playback function, etc.), and the like.
  • the storage data area may store data (such as audio data, phone book, etc.) created during the use of the electronic device 2400 and the like.
  • the internal memory 2421 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, universal flash storage (UFS), and the like.
  • the processor 2410 executes various functional applications and data processing of the electronic device 2400 by executing instructions stored in the internal memory 2421 and/or instructions stored in a memory provided in the processor.
  • the electronic device 2400 can implement audio functions through an audio module 2470, a speaker 2470A, a receiver 2470B, a microphone 2470C, an earphone interface 2470D, and an application processor. Such as music playback, recording, etc.
  • the audio module 2470 is used for converting digital audio information into analog audio signal output, and also for converting analog audio input into digital audio signal. Audio module 2470 may also be used to encode and decode audio signals. In some embodiments, the audio module 2470 may be provided in the processor 2410 , or some functional modules of the audio module 2470 may be provided in the processor 2410 .
  • Speakers 2470A also known as “horns", are used to convert audio electrical signals into sound signals. Electronic device 2400 can listen to music through speaker 2470A, or listen to hands-free calls.
  • the receiver 2470B also referred to as the "earpiece" is used to convert audio electrical signals into sound signals.
  • the electronic device 2400 answers a call or a voice message, the voice can be answered by placing the receiver 2470B close to the human ear.
  • Microphone 2470C also known as “microphone”, “microphone”, is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can make a sound by approaching the microphone 2470C through the human mouth, and input the sound signal into the microphone 2470C.
  • the electronic device 2400 may be provided with at least one microphone 2470C. In other embodiments, the electronic device 2400 can be provided with two microphones 2470C, which can implement a noise reduction function in addition to collecting sound signals. In other embodiments, the electronic device 2400 may also be provided with three, four or more microphones 2470C to collect sound signals, reduce noise, identify sound sources, and implement directional recording functions.
  • the headphone jack 2470D is used to connect wired headphones.
  • the earphone interface 2470D can be a USB interface 2430, or a 3.5mm open mobile terminal platform (OMTP) standard interface, a cellular telecommunications industry association of the USA (CTIA) standard interface.
  • OMTP open mobile terminal platform
  • CTIA cellular telecommunications industry association of the USA
  • the pressure sensor 2480A is used to sense pressure signals, and can convert the pressure signals into electrical signals.
  • the pressure sensor 2480A may be provided on the display screen 2494.
  • the capacitive pressure sensor may be comprised of at least two parallel plates of conductive material. When a force is applied to pressure sensor 2480A, the capacitance between the electrodes changes.
  • the electronic device 2400 determines the intensity of the pressure according to the change in capacitance. When a touch operation acts on the display screen 2494, the electronic device 2400 detects the intensity of the touch operation according to the pressure sensor 2480A.
  • the electronic device 2400 can also calculate the touched position according to the detection signal of the pressure sensor 2480A.
  • touch operations acting on the same touch position but with different touch operation intensities may correspond to different operation instructions. For example, when a touch operation whose intensity is less than the first pressure threshold acts on the short message application icon, the instruction for viewing the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, the instruction to create a new short message is executed.
  • the gyro sensor 2480B can be used to determine the motion attitude of the electronic device 2400 .
  • the angular velocity of electronic device 2400 about three axes may be determined by gyro sensor 2480B.
  • Gyro sensor 2480B can be used for image stabilization.
  • the gyroscope sensor 2480B detects the shaking angle of the electronic device 2400, calculates the distance to be compensated by the lens module according to the angle, and allows the lens to counteract the shaking of the electronic device 2400 through reverse motion to achieve anti-shake.
  • the gyroscope sensor 2480B can also be used for navigation and somatosensory game scenarios.
  • Air pressure sensor 2480C is used to measure air pressure. In some embodiments, the electronic device 2400 calculates the altitude from the air pressure value measured by the air pressure sensor 2480C to assist in positioning and navigation.
  • Magnetic sensor 2480D includes a Hall sensor.
  • the electronic device 2400 can detect the opening and closing of the flip holster using the magnetic sensor 2480D.
  • the electronic device 2400 can detect the opening and closing of the flip according to the magnetic sensor 2480D. Further, according to the detected opening and closing state of the leather case or the opening and closing state of the flip cover, characteristics such as automatic unlocking of the flip cover are set.
  • the acceleration sensor 2480E can detect the magnitude of the acceleration of the electronic device 2400 in various directions (generally three axes).
  • the magnitude and direction of gravity can be detected when the electronic device 2400 is stationary. It can also be used to identify the posture of electronic devices, and can be used in applications such as horizontal and vertical screen switching, pedometers, etc.
  • the electronic device 2400 can measure distance by infrared or laser. In some embodiments, when shooting a scene, the electronic device 2400 can use the distance sensor 2480F to measure the distance to achieve fast focusing.
  • Proximity light sensor 2480G may include, for example, light emitting diodes (LEDs) and light detectors, such as photodiodes.
  • the light emitting diodes may be infrared light emitting diodes.
  • the electronic device 2400 emits infrared light to the outside through light emitting diodes.
  • Electronic device 2400 uses photodiodes to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it may be determined that there is an object near the electronic device 2400 . When insufficient reflected light is detected, the electronic device 2400 may determine that there is no object near the electronic device 2400 .
  • the electronic device 2400 can use the proximity light sensor 2480G to detect that the user holds the electronic device 2400 close to the ear to talk, so as to automatically turn off the screen to save power.
  • Proximity light sensor 2480G can also be used in holster mode, pocket mode automatically unlock and lock screen.
  • the ambient light sensor 2480L is used to sense ambient light brightness.
  • the electronic device 2400 can adaptively adjust the brightness of the display screen 2494 according to the perceived ambient light brightness.
  • the ambient light sensor 2480L can also be used to automatically adjust the white balance when taking pictures.
  • the ambient light sensor 2480L can also cooperate with the proximity light sensor 2480G to detect whether the electronic device 2400 is in the pocket to prevent accidental touch.
  • the fingerprint sensor 2480H is used to collect fingerprints.
  • the electronic device 2400 can use the collected fingerprint characteristics to unlock fingerprints, access application locks, take photos with fingerprints, answer incoming calls with fingerprints, and the like.
  • Temperature sensor 2480J is used to detect temperature.
  • the electronic device 2400 utilizes the temperature detected by the temperature sensor 2480J to execute a temperature processing strategy. For example, when the temperature reported by the temperature sensor 2480J exceeds a threshold, the electronic device 2400 performs a performance reduction of the processor located near the temperature sensor 2480J in order to reduce power consumption and implement thermal protection.
  • the electronic device 2400 when the temperature is lower than another threshold, the electronic device 2400 heats the battery 2442 to avoid abnormal shutdown of the electronic device 2400 due to low temperature.
  • the electronic device 2400 boosts the output voltage of the battery 2442 to avoid abnormal shutdown caused by low temperature.
  • Touch sensor 2480K also known as "touch device”.
  • the touch sensor 2480K may be disposed on the display screen 2494, and the touch sensor 2480K and the display screen 2494 form a touch screen, also called “touch screen”.
  • the touch sensor 2480K is used to detect touch operations on or near it.
  • the touch sensor can pass the detected touch operation to the application processor to determine the type of touch event.
  • Visual output related to touch operations may be provided through display screen 2494 .
  • the touch sensor 2480K can also be disposed on the surface of the electronic device 2400, which is different from the location where the display screen 2494 is located.
  • the bone conduction sensor 2480M can acquire vibration signals.
  • the bone conduction sensor 2480M can acquire the vibration signal of the vibrating bone mass of the human voice.
  • the bone conduction sensor 2480M can also contact the human pulse and receive the blood pressure beating signal.
  • the bone conduction sensor 2480M can also be disposed in the earphone, combined with the bone conduction earphone.
  • the audio module 2470 can analyze the voice signal based on the vibration signal of the vocal vibration bone block obtained by the bone conduction sensor 2480M, so as to realize the voice function.
  • the application processor can analyze the heart rate information based on the blood pressure beat signal obtained by the bone conduction sensor 2480M, and realize the function of heart rate detection.
  • the keys 2490 include a power-on key, a volume key, and the like. Keys 2490 may be mechanical keys. It can also be a touch key.
  • the electronic device 2400 may receive key inputs and generate key signal inputs related to user settings and function control of the electronic device 2400 .
  • Motor 2491 can generate vibration alerts.
  • the motor 2491 can be used for incoming call vibration alerts, and can also be used for touch vibration feedback.
  • touch operations acting on different applications can correspond to different vibration feedback effects.
  • the motor 2491 can also correspond to different vibration feedback effects for touch operations on different areas of the display screen 2494 .
  • Different application scenarios for example: time reminder, receiving information, alarm clock, games, etc.
  • the touch vibration feedback effect can also support customization.
  • the indicator 2492 can be an indicator light, which can be used to indicate the charging status, the change of power, and can also be used to indicate messages, missed calls, notifications, and the like.
  • the SIM card interface 2495 is used to connect a SIM card.
  • the SIM card can be inserted into the SIM card interface 2495 or pulled out from the SIM card interface 2495 to achieve contact and separation with the electronic device 2400 .
  • the electronic device 2400 may support 1 or N SIM card interfaces, where N is a positive integer greater than 24.
  • the SIM card interface 2495 can support Nano SIM card, Micro SIM card, SIM card, etc.
  • the same SIM card interface 2495 can insert multiple cards at the same time.
  • the types of the plurality of cards may be the same or different.
  • the SIM card interface 2495 can also be compatible with different types of SIM cards.
  • the SIM card interface 2495 is also compatible with external memory cards.
  • the electronic device 2400 interacts with the network through the SIM card to realize functions such as call and data communication.
  • the electronic device 2400 employs an eSIM, ie: an embedded SIM card.
  • the eSIM card can be embedded in the electronic device 2400 and cannot be separated from the electronic device 2400 .
  • the disclosed apparatus/electronic device and method may be implemented in other manners.
  • the above-described embodiments of the apparatus/electronic device are only illustrative.
  • the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units. Or components may be combined or may be integrated into another system, or some features may be omitted, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
  • the integrated modules/units if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium.
  • the present application can implement all or part of the processes in the methods of the above embodiments, and can also be completed by instructing the relevant hardware through a computer program.
  • the computer program can be stored in a computer-readable storage medium, and the computer When the program is executed by the processor, the steps of the foregoing method embodiments can be implemented.
  • the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file or some intermediate form, and the like.
  • the computer-readable storage medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM, Read-Only Memory) ), random access memory (RAM, Random Access Memory), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content contained in the computer-readable storage medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, computer-readable Storage media exclude electrical carrier signals and telecommunications signals.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Environmental & Geological Engineering (AREA)
  • Health & Medical Sciences (AREA)
  • Cardiology (AREA)
  • General Health & Medical Sciences (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

The present application is applied in the field of communication technology, and provides a communication method, electronic devices, and a computer-readable storage medium. In the communication method provided by the present application, a first electronic device monitors a communication link. When the first electronic device detects that the communication link fails, the first electronic device controls a WiFi communication module of the first electronic device to enter a hybrid mode and sends a first message in the form of a broadcast. At said time, the first electronic device and other electronic devices in a local area network can perform data interaction in the form of a broadcast, maintain communication services, and prevent the interruption of communication services. When the first electronic device evades a "path attack" by means of the described communication method, the first electronic device maintains the communication service by means of changing a working mode of the WiFi communication module without adding additional costs, thus solving the problem in which a current "path attack" solution has high costs and is not conducive to promotion and application, and has strong ease of use and practicability.

Description

通信方法、电子设备及计算机可读存储介质Communication method, electronic device, and computer-readable storage medium
本申请要求于2020年10月30日提交国家知识产权局、申请号为202011198292.6、申请名称为“通信方法、电子设备及计算机可读存储介质”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。This application claims the priority of the Chinese patent application with the application number 202011198292.6 and the application name "communication method, electronic device and computer-readable storage medium" filed with the State Intellectual Property Office on October 30, 2020, the entire content of which is by reference Incorporated in this application.
技术领域technical field
本申请属于通信技术领域,尤其涉及通信方法、电子设备及计算机可读存储介质。The present application belongs to the field of communication technologies, and in particular, relates to a communication method, an electronic device, and a computer-readable storage medium.
背景技术Background technique
在物联网(Internet-of-Things,IoT)场景中,信息传输的安全性和隐私性非常重要。为此,物联网中的电子设备可以通过签名、加密等方式在物理链路可达的前提下实现可信通信。但是,如果物理链路本身存在缺陷,则电子设备无法实现可信通信。In the Internet-of-Things (IoT) scenario, the security and privacy of information transmission are very important. To this end, electronic devices in the Internet of Things can achieve trusted communication under the premise that the physical link is reachable by means of signatures and encryption. However, if the physical link itself is defective, the electronic device cannot achieve trusted communication.
当前存在一种威胁可信通信的攻击方式,称为“路径攻击”(又称“路径歧视”)。当发生“路径攻击”时,局域网中构成物理链路的关键中间节点不按照协议对数据包进行转发,该中间节点在物理层不转发,且有针对性地丢弃部分或全部来自特定节点的报文,从而实现针对性的拒绝服务(Denial of Service,DoS)攻击。“路径攻击”会导致特定的物联网设备无法对外传输信息,对用户的人身财产安全造成威胁。There is currently an attack method that threatens trusted communication, called "path attack" (also known as "path discrimination"). When a "path attack" occurs, the key intermediate nodes that constitute the physical link in the local area network do not forward the data packets according to the protocol, the intermediate nodes do not forward the data packets at the physical layer, and purposefully discard some or all of the packets from specific nodes. In order to achieve targeted Denial of Service (DoS) attacks. "Path attack" will cause specific IoT devices to be unable to transmit information externally, posing a threat to the personal and property safety of users.
对此,当前提出了诸如构建端对端(Peer to Peer,P2P)全互联网络、构建备用路径、引入异构路径等方案,这些方案虽然在一定程度上可以缓解“路径攻击”的威胁,但是这些方案成本高,不利于推广与应用。In this regard, solutions such as building a peer-to-peer (P2P) fully interconnected network, constructing alternate paths, and introducing heterogeneous paths have been proposed. Although these solutions can alleviate the threat of "path attack" to a certain extent, but The high cost of these solutions is not conducive to promotion and application.
发明内容SUMMARY OF THE INVENTION
本申请实施例提供了一种通信方法、电子设备及计算机可读存储介质,可以解决当前的“路径攻击”解决方案成本高,不利于推广与应用的问题。The embodiments of the present application provide a communication method, an electronic device, and a computer-readable storage medium, which can solve the problem that the current "path attack" solution has high cost and is not conducive to promotion and application.
第一方面,本申请实施例提供了一种通信方法,包括:In a first aspect, an embodiment of the present application provides a communication method, including:
第一电子设备对通信链路进行监测;the first electronic device monitors the communication link;
当所述通信链路发生故障时,所述第一电子设备控制所述第一电子设备的Wi-Fi通信模块进入混杂模式,并通过广播的形式发送第一报文。When the communication link fails, the first electronic device controls the Wi-Fi communication module of the first electronic device to enter the promiscuous mode, and sends the first message in the form of broadcasting.
需要说明的是,第一电子设备在进入局域网后,可以对与本设备相关的通信链路的链路状态进行监测。It should be noted that, after entering the local area network, the first electronic device can monitor the link state of the communication link related to the device.
当第一电子设备检测到通信链路发生故障时,第一电子设备与局域网内的其他电子设备的通信服务可能被中断。When the first electronic device detects that the communication link is faulty, the communication service between the first electronic device and other electronic devices in the local area network may be interrupted.
因此,第一电子设备可以控制第一电子设备的Wi-Fi通信模块进入混杂模式(又称调试模式)。Therefore, the first electronic device can control the Wi-Fi communication module of the first electronic device to enter a promiscuous mode (also called a debug mode).
当Wi-Fi通信模块进入混杂模式时,第一电子设备的Wi-Fi通信模块可以接收所有经过该Wi-Fi通信模块的报文,不论报文的目的地址是否指向第一电子设备。When the Wi-Fi communication module enters the promiscuous mode, the Wi-Fi communication module of the first electronic device can receive all packets passing through the Wi-Fi communication module, regardless of whether the destination address of the packets is directed to the first electronic device.
通常混杂模式用于对Wi-Fi通信模块进行故障检测或功能测试,但是,在本申请的通 信方法中,混杂模式用于维持Wi-Fi通信模块的通信服务。Generally, the promiscuous mode is used for fault detection or functional testing of the Wi-Fi communication module, but in the communication method of the present application, the promiscuous mode is used to maintain the communication service of the Wi-Fi communication module.
当第一电子设备控制Wi-Fi通信模块进入混杂模式时,第一电子设备可以通过混杂模式监听到局域网中其他电子设备广播的信息,并且,第一电子设备可以将需要传递的信息封装成第一报文,通过广播的形式发送第一报文。When the first electronic device controls the Wi-Fi communication module to enter the promiscuous mode, the first electronic device can monitor the information broadcast by other electronic devices in the local area network through the promiscuous mode, and the first electronic device can encapsulate the information to be transmitted into the first electronic device. A message, the first message is sent in the form of broadcast.
因此,第一电子设备可以通过Wi-Fi通信模块的混杂模式以及广播机制,与局域网内的其他电子设备进行数据交互,从而维持通信服务,避免通信服务中断。Therefore, the first electronic device can perform data interaction with other electronic devices in the local area network through the promiscuous mode of the Wi-Fi communication module and the broadcast mechanism, so as to maintain the communication service and avoid interruption of the communication service.
在第一方面的一种可能的实现方式中,所述第一电子设备对通信链路进行监测,包括:In a possible implementation manner of the first aspect, the monitoring of the communication link by the first electronic device includes:
所述第一电子设备通过心跳互锁机制对通信链路进行监测。The first electronic device monitors the communication link through a heartbeat interlock mechanism.
需要说明的是,第一电子设备在对通信链路进行监测时,第一电子设备可以与通信链路对端的电子设备建立心跳互锁机制。It should be noted that, when the first electronic device monitors the communication link, the first electronic device may establish a heartbeat interlock mechanism with the electronic device at the opposite end of the communication link.
当第一电子设备可以与通信链路对端的电子设备建立心跳互锁机制时,第一电子设备和对端的电子设备可以通过互相发送心跳信息的方式检测通信链路是否发生故障。When the first electronic device can establish a heartbeat interlocking mechanism with the electronic device at the opposite end of the communication link, the first electronic device and the electronic device at the opposite end can detect whether the communication link fails by sending heartbeat information to each other.
当任意一端接收不到心跳信息时,则表示该通信链路遭受攻击,接收不到心跳信息的电子设备将停止维持心跳互锁机制,从而使对端的电子设备也接收不到心跳信息。When either end cannot receive the heartbeat information, it means that the communication link is under attack, and the electronic device that cannot receive the heartbeat information will stop maintaining the heartbeat interlock mechanism, so that the electronic device at the opposite end cannot receive the heartbeat information.
因此,在通信链路发生故障时,通信链路两端的电子设备可以通过心跳互锁机制陆续检测到通信链路遭受攻击。Therefore, when the communication link fails, the electronic devices at both ends of the communication link can successively detect that the communication link is attacked through the heartbeat interlocking mechanism.
在第一方面的一种可能的实现方式中,所述第一报文为注入报文,所述通过广播的形式发送第一报文,包括:In a possible implementation manner of the first aspect, the first packet is an injection packet, and the sending of the first packet in the form of broadcasting includes:
所述第一电子设备将注入报文注入所述Wi-Fi通信模块的空口,以广播的形式发送所述注入报文。The first electronic device injects the injection message into the air interface of the Wi-Fi communication module, and sends the injection message in the form of broadcast.
需要说明的是,上述第一报文可以是注入报文。当第一电子设备在广播注入报文时,可以将注入报文注入Wi-Fi通信模块的空口中,以广播的形式发送注入报文。It should be noted that, the above-mentioned first packet may be an injection packet. When the first electronic device is broadcasting the injection message, the injection message may be injected into the air interface of the Wi-Fi communication module, and the injection message may be sent in the form of broadcasting.
第一电子设备将注入报文注入空口进行广播,可以不执行802.11协议规定的载波监听动作以及碰撞检测动作,确保Wi-Fi通信模块可以顺利广播上述注入报文。The first electronic device injects the injection message into the air interface for broadcasting, and may not perform the carrier sensing action and the collision detection action specified in the 802.11 protocol, so as to ensure that the Wi-Fi communication module can smoothly broadcast the injection message.
在第一方面的一种可能的实现方式中,所述第一报文包括故障报文,所述故障报文中包括所述通信链路的故障信息。In a possible implementation manner of the first aspect, the first packet includes a fault packet, and the fault packet includes fault information of the communication link.
需要说明的是,第一电子设备广播的第一报文可以包括故障报文。It should be noted that the first message broadcast by the first electronic device may include a fault message.
故障报文用于记录通信链路的故障信息。故障信息可以包括故障时间、故障对象、故障类型等信息中的一项或多项。The fault message is used to record the fault information of the communication link. The fault information may include one or more items of information such as fault time, fault object, and fault type.
在第一方面的一种可能的实现方式中,所述第一报文包括业务报文,所述业务报文包括所述第一电子设备的业务信息。In a possible implementation manner of the first aspect, the first packet includes a service packet, and the service packet includes service information of the first electronic device.
需要说明的是,第一电子设备广播的第一报文还可以包括业务报文。It should be noted that, the first message broadcast by the first electronic device may also include a service message.
通常第一电子设备具备特定的业务功能,当第一电子设备执行业务功能时,可能产生需要对外传输的业务信息。Usually, the first electronic device has a specific service function, and when the first electronic device performs the service function, it may generate service information that needs to be transmitted externally.
例如,当红外传感器检测到某个区域存在异常的红外信息,可以将该区域的位置信息传递至摄像头,摄像头根据接收到的位置信息调整镜头方向,拍摄上述区域的图像,完成红外传感器与摄像头的联动。此时,上述区域的位置信息就是红外传感器需要传递给摄像头的业务信息。For example, when the infrared sensor detects abnormal infrared information in a certain area, it can transmit the location information of the area to the camera, and the camera adjusts the direction of the lens according to the received location information, takes the image of the above area, and completes the connection between the infrared sensor and the camera. linkage. At this time, the location information of the above area is the business information that the infrared sensor needs to transmit to the camera.
因此,第一电子设备广播的第一报文可以包括业务报文。业务报文中包括第一电子设 备的业务信息。第一电子设备通过业务报文将业务信息传递至局域网中的其他电子设备。Therefore, the first message broadcast by the first electronic device may include a service message. The service message includes service information of the first electronic device. The first electronic device transmits the service information to other electronic devices in the local area network through the service message.
在第一方面的一种可能的实现方式中,在所述通过广播的形式发送第一报文之后,还包括:In a possible implementation manner of the first aspect, after the sending of the first packet in the form of broadcasting, the method further includes:
所述第一电子设备统计在预设响应时长内接收到的第一响应信息的数量,所述第一响应信息为第二电子设备接收到所述第一报文后反馈的信息,所述第一电子设备和所述第二电子设备处于同一局域网中;The first electronic device counts the number of first response information received within a preset response time period, where the first response information is information fed back by the second electronic device after receiving the first message, and the first response information is the information fed back by the second electronic device after receiving the first message. An electronic device and the second electronic device are in the same local area network;
若所述第一响应信息的数量小于或等于预设的第一响应阈值,则所述第一电子设备重新广播所述第一报文。If the quantity of the first response information is less than or equal to a preset first response threshold, the first electronic device rebroadcasts the first message.
需要说明的是,当第一电子设备通过广播的形式发送第一报文之后,局域网内接收到第一报文的第二电子设备可以反馈第一响应信息至第一电子设备。It should be noted that after the first electronic device sends the first message in the form of broadcasting, the second electronic device in the local area network that receives the first message can feed back the first response information to the first electronic device.
第一电子设备可以统计预设响应时长内接收到的第一响应信息的数量。The first electronic device may count the number of received first response information within a preset response time period.
如果第一电子设备接收到的第一响应信息的数量大于第一响应阈值,则表示局域网中有较多的电子设备监听到了上述报文。第一电子设备可以判定第一报文广播成功。If the quantity of the first response information received by the first electronic device is greater than the first response threshold, it means that more electronic devices in the local area network have monitored the above-mentioned message. The first electronic device may determine that the broadcast of the first message is successful.
如果第一电子设备接收到的第一响应信息的数量小于或等于第一响应阈值,则表示局域网中监听到上述第一报文的电子设备较少,该报文容易被伪造或篡改。此时,第一电子设备可以判定第一报文广播失败,重新广播第一报文。If the quantity of the first response information received by the first electronic device is less than or equal to the first response threshold, it indicates that few electronic devices in the local area network have monitored the above-mentioned first message, and the message is easily forged or tampered with. At this time, the first electronic device may determine that the broadcast of the first message fails, and re-broadcast the first message.
在第一方面的一种可能的实现方式中,在所述第一电子设备控制所述第一电子设备的Wi-Fi通信模块进入混杂模式之后,还包括:In a possible implementation manner of the first aspect, after the first electronic device controls the Wi-Fi communication module of the first electronic device to enter the promiscuous mode, the method further includes:
当所述第一电子设备接收到第二电子设备广播的第二报文时,所述第一电子设备对所述第二报文的签名进行验证;When the first electronic device receives the second message broadcast by the second electronic device, the first electronic device verifies the signature of the second message;
若所述第二报文的签名验证通过,则所述第一电子设备保存所述第二报文。If the signature verification of the second message passes, the first electronic device saves the second message.
需要说明的是,当第一电子设备接收到第二电子设备广播的第二报文时,第一电子设备可以使用第二电子设备的公钥对第二报文的签名进行验证。It should be noted that when the first electronic device receives the second message broadcast by the second electronic device, the first electronic device can use the public key of the second electronic device to verify the signature of the second message.
如果第二报文的签名验证通过,则表示该第二报文的发送方身份无误。此时,第一电子设备可以使用自身的私钥对第二报文进行签名并存储在本地。If the signature verification of the second packet passes, it means that the identity of the sender of the second packet is correct. At this time, the first electronic device can use its own private key to sign the second message and store it locally.
如果第二报文的签名验证失败,则表示该第二报文的发送方身份是伪造的。此时,第一电子设备可以执行第一预设操作。If the signature verification of the second packet fails, it means that the identity of the sender of the second packet is forged. At this time, the first electronic device may perform the first preset operation.
第一预设操作的具体形式可以根据实际情况进行设置。例如,第一预设操作可以为第一电子设备抛弃该报文;或者,第一预设操作可以为第一电子设备将该报文记录为恶意报文并存储。The specific form of the first preset operation can be set according to the actual situation. For example, the first preset operation may be that the first electronic device discards the message; or, the first preset operation may be that the first electronic device records and stores the message as a malicious message.
在第一方面的一种可能的实现方式中,在所述第二报文的签名验证通过之后,还包括:In a possible implementation manner of the first aspect, after the signature verification of the second packet is passed, the method further includes:
所述第一电子设备向所述第二电子设备发送第一响应信息。The first electronic device sends first response information to the second electronic device.
需要说明的是,当第二报文的签名验证通过之后,第一电子设备还可以像发送该第二报文的第二电子设备发送第一响应信息,告知该第二电子设备已收到上述第二报文。It should be noted that, after the signature verification of the second message is passed, the first electronic device can also send the first response information to the second electronic device that sends the second message, informing the second electronic device that it has received the above-mentioned Second message.
在第一方面的一种可能的实现方式中,在所述第一电子设备保存所述第二报文之后,还包括:In a possible implementation manner of the first aspect, after the first electronic device saves the second message, the method further includes:
当所述第一电子设备接收到管理设备发送的审计请求时,所述第一电子设备将本地保存的第二报文发送至所述管理设备。When the first electronic device receives the audit request sent by the management device, the first electronic device sends the locally stored second message to the management device.
需要说明的是,当用户察觉到局域网中的通信链路遭受了链路攻击之后,用户可以通 过管理设备进行事后审计。It should be noted that after the user perceives that the communication link in the LAN has suffered a link attack, the user can conduct an after-the-fact audit through the management device.
管理设备可以为当前通信系统中的任意电子设备,或者,管理设备也可以为当前通信系统以外的电子设备。管理设备可以通过有线通信连接和/或无线通信连接的方式与各个电子设备通信连接,本申请实施例对管理设备与电子设备的通信连接的方式不作任何限制。The management device may be any electronic device in the current communication system, or the management device may also be an electronic device outside the current communication system. The management device may be communicatively connected to each electronic device through wired communication connection and/or wireless communication connection, and the embodiment of the present application does not impose any limitation on the communication connection between the management device and the electronic device.
在进行事后审计时,管理设备可以向局域网中的各个电子设备发送审计请求。审计请求用于指示各个电子设备将本地保存的第一报文和/或第二报文发送至管理设备,以便管理设备根据各个电子设备发送的第一报文和/或第二报文还原故障发展过程以及了解故障期间各个电子设备的业务操作。When performing post-event audit, the management device can send audit requests to each electronic device in the local area network. The audit request is used to instruct each electronic device to send the locally stored first message and/or the second message to the management device, so that the management device can restore the fault according to the first message and/or the second message sent by each electronic device Development process and understanding the business operation of individual electronic devices during failures.
例如,假设局域网遭受到恶意攻击,设备1先检测到通信链路发生故障,广播报文1,报文1记录了故障时间1;然后设备2广播报文2,报文2记录了故障时间2;设备3在延迟一段时间后广播报文3,报文3记录了故障时间3。For example, assuming a malicious attack on the local area network, device 1 first detects that the communication link is faulty, broadcasts message 1, and message 1 records failure time 1; then device 2 broadcasts message 2, and message 2 records failure time 2 ; Device 3 broadcasts message 3 after a delay, and message 3 records failure time 3.
在事后审计的过程,管理设备通过审计请求从各个电子设备中获取到报文1、报文2和报文3,并通过报文1、报文2和报文3获取到故障时间1、故障时间2和故障时间3。In the post-audit process, the management device obtains the message 1, message 2 and message 3 from each electronic device through the audit request, and obtains the failure time 1, the failure time through the message 1, the message 2 and the message 3. time 2 and failure time 3.
之后,管理设备通过故障时间1、故障时间2和故障时间3可以推测首先发生故障的节点以及故障发展过程。Afterwards, the management device can infer the node that fails first and the development process of the failure through the failure time 1, the failure time 2, and the failure time 3.
当第一电子设备接收到审计请求时,第一电子设备可以将本地保存的第二报文发送至管理设备,以便于管理设备根据第一电子设备的第二报文还原事实。When the first electronic device receives the audit request, the first electronic device can send the locally stored second message to the management device, so that the management device can restore the facts according to the second message of the first electronic device.
在第一方面的一种可能的实现方式中,所述方法还包括:In a possible implementation manner of the first aspect, the method further includes:
第一电子设备向各个第二电子设备发送审计请求,所述第一电子设备和所述第二电子设备处于同一局域网中;The first electronic device sends an audit request to each second electronic device, and the first electronic device and the second electronic device are in the same local area network;
第一电子设备接收各个所述第二电子设备返回的第三报文,所述第三报文为所述第二电子设备接收并保存的第一报文和/或第二报文;The first electronic device receives a third message returned by each of the second electronic devices, where the third message is the first message and/or the second message received and saved by the second electronic device;
第一电子设备根据各个所述第二电子设备返回的第三报文以及预设处理规则,确定各个所述第三报文对应的目标报文。The first electronic device determines a target message corresponding to each of the third messages according to the third messages returned by each of the second electronic devices and a preset processing rule.
需要说明的是,在一些情景中,第一电子设备可能被用户指定为管理设备。It should be noted that, in some scenarios, the first electronic device may be designated as the management device by the user.
此时,第一电子设备可以向局域网内的各个第二电子设备发送审计请求。At this time, the first electronic device may send an audit request to each second electronic device in the local area network.
各个第二电子设备在接收到审计请求时,返回第三报文至第一电子设备。第三报文为第二电子设备保存的第一报文和/或其他第二电子设备广播的第二报文。Each second electronic device returns a third message to the first electronic device when receiving the audit request. The third message is the first message saved by the second electronic device and/or the second message broadcast by other second electronic devices.
然后,第一电子设备根据各个第二电子设备返回的第三报文以及预设处理规则,确定各个第三报文对应的目标报文。Then, the first electronic device determines the target message corresponding to each third message according to the third message returned by each second electronic device and the preset processing rule.
上述目标报文可以理解为真实性和完整性较高的报文,也可以理解为第三报文的真实版本和/或完整版本。The above-mentioned target message may be understood as a message with higher authenticity and integrity, and may also be understood as a true version and/or a complete version of the third message.
上述预设处理规则可以根据实际需求进行设置。例如,上述预设处理规则可以包括筛选、拼接还原、投票等操作中的任意一种或多种的组合。The above preset processing rules can be set according to actual needs. For example, the above-mentioned preset processing rules may include any one or a combination of operations such as screening, splicing and restoration, and voting.
在第一方面的一种可能的实现方式中,所述根据各个所述第二电子设备返回的第三报文以及预设处理规则,确定各个所述第三报文对应的目标报文,包括:In a possible implementation manner of the first aspect, the target packet corresponding to each of the third packets is determined according to the third packets returned by each of the second electronic devices and a preset processing rule, including :
第一电子设备对各个所述第三报文执行拼接还原操作,得到各个所述第三报文对应的目标报文。The first electronic device performs a splicing and restoration operation on each of the third packets to obtain a target packet corresponding to each of the third packets.
需要说明的是,由于各个第二电子设备进入混杂模式的时间不一,可能部分第二电子 设备监听并存储的第三报文存在部分残缺。It should be noted that, since the time at which each second electronic device enters the promiscuous mode is different, it is possible that some of the third packets monitored and stored by some of the second electronic devices are partially incomplete.
此时,如果第一电子设备检测到部分第三报文为残缺的报文,则第一电子设备可以对残缺的第三报文执行拼接还原操作,将表述同一内容的多个第三报文进行比对和拼接,从而还原出该第三报文对应的完整性较高的目标报文。At this time, if the first electronic device detects that some of the third packets are incomplete packets, the first electronic device can perform a splicing and restoration operation on the incomplete third packets, and then multiple third packets expressing the same content are deleted. The comparison and splicing are performed, thereby restoring the target message with higher integrity corresponding to the third message.
在第一方面的一种可能的实现方式中,所述根据各个所述第二电子设备返回的第三报文以及预设处理规则,确定各个所述第三报文对应的目标报文,包括:In a possible implementation manner of the first aspect, the target packet corresponding to each of the third packets is determined according to the third packets returned by each of the second electronic devices and a preset processing rule, including :
当任一所述第三报文存在至少两个版本时,对存在至少两个版本的第三报文执行投票操作,将票数最高的版本作为所述存在至少两个版本的第三报文对应的目标报文。When any of the third packets has at least two versions, a voting operation is performed on the third packet with the at least two versions, and the version with the highest number of votes is used as the corresponding third packet with the at least two versions. target message.
需要说明的是,由于可能部分第二电子设备被攻击,导致这些被攻击的第二电子设备伪造或篡改第三报文,导致部分第三报文存在至少两个版本。It should be noted that, because some second electronic devices may be attacked, these attacked second electronic devices may forge or tamper with the third packet, resulting in at least two versions of some third packets.
通常局域网中只有少数节点被攻击,因此,第一电子设备可以对这些存在至少两个版本的第三报文执行投票操作,根据少数服从多数的原则,将最多第二电子设备支持的版本,即票数最高的版本,作为上述存在至少两个版本的第三报文对应的目标报文。Usually only a few nodes in the local area network are attacked. Therefore, the first electronic device can perform a voting operation on these third packets with at least two versions. The version with the highest number of votes is used as the target message corresponding to the third message with at least two versions.
在第一方面的一种可能的实现方式中,上述故障可以为路径攻击。In a possible implementation manner of the first aspect, the above fault may be a path attack.
当通信链路发生路径攻击时,通信链路两端的电子设备无法进行正常的数据交互。此时,第一电子设备可以通过上述通信方法维持与其他电子设备的通信服务。When a path attack occurs on the communication link, the electronic devices at both ends of the communication link cannot perform normal data exchange. At this time, the first electronic device can maintain the communication service with other electronic devices through the above-mentioned communication method.
或者,在另一些可能实现方式中,上述故障也可以是路径攻击以外的链路故障。Or, in other possible implementation manners, the above-mentioned fault may also be a link fault other than a path attack.
当第一电子设备检测到任意影响通信链路正常运行的链路故障时,第一电子设备均可通过上述通信方法维持通信服务,本申请对上述故障的故障类型不予限制。When the first electronic device detects any link failure that affects the normal operation of the communication link, the first electronic device can maintain the communication service through the above communication method, and the present application does not limit the failure type of the above failure.
第二方面,本申请实施例提供了一种通信装置,包括:In a second aspect, an embodiment of the present application provides a communication device, including:
链路监测模块,用于对通信链路进行监测;The link monitoring module is used to monitor the communication link;
服务维持模块,用于当所述通信链路发生故障时,控制所述第一电子设备的Wi-Fi通信模块进入混杂模式,并通过广播的形式发送第一报文。The service maintenance module is configured to control the Wi-Fi communication module of the first electronic device to enter the promiscuous mode when the communication link fails, and send the first message in the form of broadcasting.
在第二方面的一种可能的实现方式中,所述链路监测模块,具体用于通过心跳互锁机制对通信链路进行监测。In a possible implementation manner of the second aspect, the link monitoring module is specifically configured to monitor the communication link through a heartbeat interlocking mechanism.
在第二方面的一种可能的实现方式中,所述第一报文为注入报文,所述服务维持模块,包括:In a possible implementation manner of the second aspect, the first message is an injection message, and the service maintenance module includes:
注入子模块,用于将注入报文注入所述Wi-Fi通信模块的空口,以广播的形式发送所述注入报文。The injection sub-module is used for injecting the injection message into the air interface of the Wi-Fi communication module, and sending the injection message in the form of broadcast.
在第二方面的一种可能的实现方式中,所述第一报文包括故障报文,所述故障报文中包括所述通信链路的故障信息。In a possible implementation manner of the second aspect, the first packet includes a fault packet, and the fault packet includes fault information of the communication link.
在第二方面的另一种可能的实现方式中,所述第一报文包括业务报文,所述业务报文包括所述第一电子设备的业务信息。In another possible implementation manner of the second aspect, the first packet includes a service packet, and the service packet includes service information of the first electronic device.
在第二方面的一种可能的实现方式中,所述装置还包括:In a possible implementation manner of the second aspect, the apparatus further includes:
响应统计模块,用于统计在预设响应时长内接收到的第一响应信息的数量,所述第一响应信息为第二电子设备接收到所述第一报文后反馈的信息,所述第一电子设备和所述第二电子设备处于同一局域网中;A response statistics module, configured to count the number of first response information received within a preset response time period, where the first response information is information fed back after the second electronic device receives the first message, and the first response information is the information fed back after the second electronic device receives the first message. An electronic device and the second electronic device are in the same local area network;
重新广播模块,用于若所述第一响应信息的数量小于或等于预设的第一响应阈值,则重新广播所述第一报文。A rebroadcasting module, configured to rebroadcast the first message if the quantity of the first response information is less than or equal to a preset first response threshold.
在第二方面的一种可能的实现方式中,所述装置还包括:In a possible implementation manner of the second aspect, the apparatus further includes:
签名验证模块,用于当接收到第二电子设备广播的第二报文时,对所述第二报文的签名进行验证;a signature verification module, configured to verify the signature of the second message when receiving the second message broadcast by the second electronic device;
报文存储模块,用于若所述第二报文的签名验证通过,则保存所述第二报文。A message storage module, configured to save the second message if the signature verification of the second message passes.
在第二方面的一种可能的实现方式中,所述装置还包括:In a possible implementation manner of the second aspect, the apparatus further includes:
响应发送模块,用于向所述第二电子设备发送第一响应信息。A response sending module, configured to send first response information to the second electronic device.
在第二方面的一种可能的实现方式中,所述装置还包括:In a possible implementation manner of the second aspect, the apparatus further includes:
报文发送模块,用于当接收到管理设备发送的审计请求时,将本地保存的第二报文发送至所述管理设备。The message sending module is configured to send the second message stored locally to the management device when receiving the audit request sent by the management device.
在第二方面的一种可能的实现方式中,所述装置还包括:In a possible implementation manner of the second aspect, the apparatus further includes:
审计请求模块,用于向各个第二电子设备发送审计请求,所述第一电子设备和所述第二电子设备处于同一局域网中;an audit request module, configured to send an audit request to each second electronic device, where the first electronic device and the second electronic device are in the same local area network;
报文接收模块,用于接收各个所述第二电子设备返回的第三报文,所述第三报文为所述第二电子设备接收并保存的第一报文和/或第二报文;A message receiving module, configured to receive a third message returned by each of the second electronic devices, where the third message is the first message and/or the second message received and saved by the second electronic device ;
事实确认模块,用于根据各个所述第二电子设备返回的第三报文以及预设处理规则,确定各个所述第三报文对应的目标报文。A fact confirmation module, configured to determine a target message corresponding to each of the third messages according to the third messages returned by each of the second electronic devices and a preset processing rule.
在第二方面的一种可能的实现方式中,所述事实确认模块,包括:In a possible implementation manner of the second aspect, the fact confirmation module includes:
拼接子模块,用于对各个所述第三报文执行拼接还原操作,得到各个所述第三报文对应的目标报文。The splicing sub-module is configured to perform a splicing and restoration operation on each of the third packets to obtain target packets corresponding to each of the third packets.
在第二方面的一种可能的实现方式中,所述事实确认模块,包括:In a possible implementation manner of the second aspect, the fact confirmation module includes:
投票子模块,用于当任一所述第三报文存在至少两个版本时,对存在至少两个版本的第三报文执行投票操作,将票数最高的版本作为所述存在至少两个版本的第三报文对应的目标报文。A voting submodule, configured to perform a voting operation on the third message with at least two versions when any of the third messages has at least two versions, and use the version with the highest number of votes as the version with the at least two versions The target packet corresponding to the third packet of .
第三方面,提供了一种电子设备,包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序,所述处理器执行所述计算机程序时,电子设备实现如上述方法的步骤。In a third aspect, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the electronic device realizes the steps of the above method.
第四方面,提供了一种计算机可读存储介质,所述计算机可读存储介质存储有计算机程序,所述计算机程序被处理器执行时,使得电子设备实现如上述方法的步骤。In a fourth aspect, a computer-readable storage medium is provided, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, enables an electronic device to implement the steps of the above method.
第五方面,提供了一种芯片系统,所述芯片系统可以为单个芯片,或者多个芯片组成的芯片模组,所述芯片系统包括存储器和处理器,所述处理器执行所述存储器中存储的计算机程序,以实现如上述方法的步骤。In a fifth aspect, a chip system is provided, the chip system may be a single chip or a chip module composed of multiple chips, the chip system includes a memory and a processor, and the processor executes the storage in the memory. A computer program to implement the steps of the above method.
本申请实施例与现有技术相比存在的有益效果是:The beneficial effects that the embodiments of the present application have compared with the prior art are:
在本申请的通信方法中,第一电子设备对通信链路进行监测,当第一电子设备检测到通信链路发生故障时,第一电子设备控制第一电子设备的Wi-Fi通信模块进入混杂模式,并通过广播的形式发送第一报文。In the communication method of the present application, the first electronic device monitors the communication link, and when the first electronic device detects that the communication link is faulty, the first electronic device controls the Wi-Fi communication module of the first electronic device to enter the hybrid mode, and send the first message in the form of broadcast.
也即是说,当通信链路发生故障时,第一电子设备及其对端的电子设备的Wi-Fi通信模块都会进入混杂模式。在混杂模式下,Wi-Fi通信模块可以接收所有经过该Wi-Fi通信模块的报文,不论报文的目的地址是否指向本设备。因此,第一电子设备及通信链路对端的电子设备可以通过广播机制进行数据交互,维持通信服务,避免通信服务中断。That is to say, when the communication link fails, the first electronic device and the Wi-Fi communication module of the opposite end electronic device both enter the promiscuous mode. In promiscuous mode, the Wi-Fi communication module can receive all the packets that pass through the Wi-Fi communication module, regardless of whether the destination address of the packets points to the device. Therefore, the first electronic device and the electronic device at the opposite end of the communication link can perform data interaction through a broadcast mechanism to maintain the communication service and avoid interruption of the communication service.
并且,与其他规避“路径攻击”的方案相比,本申请提供的通信方法通过改变Wi-Fi通信模块的工作模式维持通信服务,不增加额外的成本,解决了当前的“路径攻击”解决方案成本高,不利于推广与应用的问题,具有较强的易用性和实用性。Moreover, compared with other solutions to avoid "path attack", the communication method provided by the present application maintains the communication service by changing the working mode of the Wi-Fi communication module, without adding extra cost, and solves the current "path attack" solution. The cost is high, which is not conducive to the problem of promotion and application, and has strong ease of use and practicability.
附图说明Description of drawings
图1是本申请实施例提供的一种通信系统的示意图;1 is a schematic diagram of a communication system provided by an embodiment of the present application;
图2是本申请实施例提供的一种应用场景的示意图;FIG. 2 is a schematic diagram of an application scenario provided by an embodiment of the present application;
图3是本申请实施例提供的另一种应用场景的示意图;3 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图4是本申请实施例提供的另一种应用场景的示意图;4 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图5是本申请实施例提供的另一种应用场景的示意图;5 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图6是本申请实施例提供的另一种应用场景的示意图;6 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图7是本申请实施例提供的另一种应用场景的示意图;7 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图8是本申请实施例提供的另一种应用场景的示意图;8 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图9是本申请实施例提供的另一种应用场景的示意图;FIG. 9 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图10是本申请实施例提供的另一种应用场景的示意图;FIG. 10 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图11是本申请实施例提供的另一种应用场景的示意图;FIG. 11 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图12是本申请实施例提供的另一种应用场景的示意图;12 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图13是本申请实施例提供的另一种应用场景的示意图;13 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图14是本申请实施例提供的另一种应用场景的示意图;14 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图15是本申请实施例提供的另一种应用场景的示意图;FIG. 15 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图16是本申请实施例提供的另一种应用场景的示意图;16 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图17是本申请实施例提供的另一种应用场景的示意图;17 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图18是本申请实施例提供的另一种应用场景的示意图;FIG. 18 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图19是本申请实施例提供的另一种应用场景的示意图;19 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图20是本申请实施例提供的另一种应用场景的示意图;FIG. 20 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图21是本申请实施例提供的另一种应用场景的示意图;21 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图22是本申请实施例提供的另一种应用场景的示意图;FIG. 22 is a schematic diagram of another application scenario provided by an embodiment of the present application;
图23是本申请实施例提供的一种通信方法的流程示意图;23 is a schematic flowchart of a communication method provided by an embodiment of the present application;
图24是本申请实施例提供的电子设备的示意图。FIG. 24 is a schematic diagram of an electronic device provided by an embodiment of the present application.
具体实施方式Detailed ways
以下描述中,为了说明而不是为了限定,提出了诸如特定系统结构、技术之类的具体细节,以便透彻理解本申请实施例。然而,本领域的技术人员应当清楚,在没有这些具体细节的其它实施例中也可以实现本申请。在其它情况中,省略对众所周知的系统、装置、电路以及方法的详细说明,以免不必要的细节妨碍本申请的描述。In the following description, for the purpose of illustration rather than limitation, specific details such as a specific system structure and technology are set forth in order to provide a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be practiced in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present application with unnecessary detail.
应当理解,当在本申请说明书和所附权利要求书中使用时,术语“包括”指示所描述特征、整体、步骤、操作、元素和/或组件的存在,但并不排除一个或多个其它特征、整体、步骤、操作、元素、组件和/或其集合的存在或添加。It is to be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described feature, integer, step, operation, element and/or component, but does not exclude one or more other The presence or addition of features, integers, steps, operations, elements, components and/or sets thereof.
还应当理解,在本申请说明书和所附权利要求书中使用的术语“和/或”是指相关联列出的项中的一个或多个的任何组合以及所有可能组合,并且包括这些组合。It will also be understood that, as used in this specification and the appended claims, the term "and/or" refers to and including any and all possible combinations of one or more of the associated listed items.
如在本申请说明书和所附权利要求书中所使用的那样,术语“如果”可以依据上下文被 解释为“当...时”或“一旦”或“响应于确定”或“响应于检测到”。类似地,短语“如果确定”或“如果检测到[所描述条件或事件]”可以依据上下文被解释为意指“一旦确定”或“响应于确定”或“一旦检测到[所描述条件或事件]”或“响应于检测到[所描述条件或事件]”。As used in the specification of this application and the appended claims, the term "if" may be contextually interpreted as "when" or "once" or "in response to determining" or "in response to detecting ". Similarly, the phrases "if it is determined" or "if the [described condition or event] is detected" may be interpreted, depending on the context, to mean "once it is determined" or "in response to the determination" or "once the [described condition or event] is detected. ]" or "in response to detection of the [described condition or event]".
另外,在本申请说明书和所附权利要求书的描述中,术语“第一”、“第二”、“第三”等仅用于区分描述,而不能理解为指示或暗示相对重要性。In addition, in the description of the specification of the present application and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the description, and should not be construed as indicating or implying relative importance.
在本申请说明书中描述的参考“一个实施例”或“一些实施例”等意味着在本申请的一个或多个实施例中包括结合该实施例描述的特定特征、结构或特点。由此,在本说明书中的不同之处出现的语句“在一个实施例中”、“在一些实施例中”、“在其他一些实施例中”、“在另外一些实施例中”等不是必然都参考相同的实施例,而是意味着“一个或多个但不是所有的实施例”,除非是以其他方式另外特别强调。术语“包括”、“包含”、“具有”及它们的变形都意味着“包括但不限于”,除非是以其他方式另外特别强调。References in this specification to "one embodiment" or "some embodiments" and the like mean that a particular feature, structure or characteristic described in connection with the embodiment is included in one or more embodiments of the present application. Thus, appearances of the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in other embodiments," etc. in various places in this specification are not necessarily All refer to the same embodiment, but mean "one or more but not all embodiments" unless specifically emphasized otherwise. The terms "including", "including", "having" and their variants mean "including but not limited to" unless specifically emphasized otherwise.
本申请实施例提供的通信方法可以应用于手机、平板电脑、可穿戴设备、车载设备、增强现实(augmented reality,AR)/虚拟现实(virtual reality,VR)设备、笔记本电脑、超级移动个人计算机(ultra-mobile personal computer,UMPC)、上网本、个人数字助理(personal digital assistant,PDA)、智能家居设备等支持无线保真(Wireless Fidelity,Wi-Fi)通信功能的电子设备上,本申请实施例对电子设备的具体类型不作任何限制。The communication method provided by the embodiments of the present application can be applied to mobile phones, tablet computers, wearable devices, in-vehicle devices, augmented reality (AR)/virtual reality (VR) devices, notebook computers, super mobile personal computers ( Ultra-mobile personal computer, UMPC), netbook, personal digital assistant (personal digital assistant, PDA), smart home equipment and other electronic devices supporting wireless fidelity (Wireless Fidelity, Wi-Fi) communication function, the embodiment of the present application There is no restriction on the specific type of electronic equipment.
作为示例而非限定,当上述电子设备为智能家居设备时,该智能家居设备可以是智能门锁、智能灯具、扫地机器人、智能窗帘、智能空调、智能音箱等支持Wi-Fi通信功能的智能家居设备。As an example and not a limitation, when the above electronic device is a smart home device, the smart home device can be a smart home that supports Wi-Fi communication functions, such as smart door locks, smart lamps, sweeping robots, smart curtains, smart air conditioners, and smart speakers. equipment.
在物联网(Internet-of-Things,IoT)场景中,信息传输的安全性和隐私性非常重要。In the Internet-of-Things (IoT) scenario, the security and privacy of information transmission are very important.
为此,物联网中的电子设备(即物联网设备)可以对拟传输的信息进行签名、加密,从而确保该信息在传输的过程中不会泄露,以及该信息的接收方可以通过签名验证该信息的来源,从而在物理链路可达的前提下实现可信通信。To this end, the electronic devices in the Internet of Things (ie, Internet of Things devices) can sign and encrypt the information to be transmitted, so as to ensure that the information will not be leaked during the transmission process, and the receiver of the information can verify the information through the signature. The source of information, so as to achieve trusted communication on the premise that the physical link is reachable.
但是,如果物理链路本身存在缺陷,则电子设备无法实现可信通信。However, if the physical link itself is defective, the electronic device cannot achieve trusted communication.
当前存在“路径攻击”(又称“路径歧视”)这一威胁可信通信的攻击方式。当发生“路径攻击”时,局域网中构成物理链路的关键中间节点不按照协议对数据包进行转发。该中间节点在物理层不转发,且有针对性地丢弃部分或全部来自特定节点的报文,从而实现针对性的拒绝服务(Denial of Service,DoS)攻击。There is currently a "path attack" (also known as "path discrimination"), an attack method that threatens trusted communications. When a "path attack" occurs, the key intermediate nodes constituting the physical link in the local area network do not forward the data packets according to the protocol. The intermediate node does not forward at the physical layer, and discards some or all of the packets from a specific node in a targeted manner, thereby realizing a targeted Denial of Service (DoS) attack.
与传统的信息威胁手段(如篡改报文、中间人攻击)相比,该攻击方式对通信链路的可用性进行攻击,实现针对性DoS,从而导致特定的电子设备无法对外传输信息,容易对用户的人身财产安全造成威胁,且会给用户的生活带来不便。Compared with traditional information threat methods (such as tampering with messages and man-in-the-middle attacks), this attack method attacks the availability of communication links and achieves targeted DoS, which makes specific electronic devices unable to transmit information externally, which is easy to damage to users. It poses a threat to personal and property safety and brings inconvenience to the user's life.
例如,假设监控设备遭受了“路径攻击”,此时,监控设备无法对外传递信息,即使该监控设备正常工作,检测到了小偷的非法侵入,该监控设备也无法将示警信息传递给用户,从而导致用户的财产损失;假设智能门锁的控制设备遭受了“路径攻击”,此时,该控制设备无法对外传递信息,无法控制智能门锁执行关门、开锁、断电、启动防护等措施。For example, assuming that the monitoring device has suffered a "path attack", at this time, the monitoring device cannot transmit information to the outside world. Even if the monitoring device works normally and detects the illegal intrusion of a thief, the monitoring device cannot transmit the warning information to the user, resulting in User's property loss; Assuming that the control device of the smart door lock has suffered a "path attack", at this time, the control device cannot transmit information to the outside world, and cannot control the smart door lock to perform measures such as closing, unlocking, powering off, and starting protection.
对此,当前提出了诸如构建端对端(Peer to Peer,P2P)全互联网络、构建备用路径、引入异构路径等方案。In this regard, solutions such as building a peer-to-peer (P2P) fully interconnected network, constructing alternate paths, and introducing heterogeneous paths have been proposed.
在构建端对端(Peer to Peer,P2P)全互联网络的方案中,物联网中的各个电子设备相互之间通过P2P的方式进行通信,通信的过程中,信息直达对端设备,无需经过转发,彻 底规避了“路径攻击”。In the scheme of building a peer-to-peer (P2P) fully interconnected network, each electronic device in the Internet of Things communicates with each other through P2P. During the communication process, the information goes directly to the peer device without forwarding. , completely avoiding the "path attack".
但是,如果各个电子设备都采用P2P的方式进行通信,则通信成本高,通信效率极低,网络复杂度极高。这种方式通常适用于构建军用自组网或构建工业大规模无线传感网。However, if each electronic device communicates in a P2P manner, the communication cost is high, the communication efficiency is extremely low, and the network complexity is extremely high. This method is usually suitable for building military ad hoc networks or building industrial large-scale wireless sensor networks.
在构建备用路径的方案中,物联网中部署有两个或两个以上完全隔离的路由(如果路由不隔离,依然存在路径攻击问题),从而在一定程度上缓解“路径攻击”。但是,如果部署两个或两个以上完全隔离的路由,会造成网络冗余,极大地增加网络部署成本。In the scheme of constructing alternate paths, two or more completely isolated routes are deployed in the IoT (if the routes are not isolated, there will still be a path attack problem), thereby mitigating the "path attack" to a certain extent. However, deploying two or more completely isolated routes will result in network redundancy and greatly increase network deployment costs.
在引入异构路径的方案中,物联网中的电子设备通过多种异构的无线通信模块(例如Wi-Fi模块、蓝牙模块、超声波模块等模块)规避“路径攻击”。但是,这种方案要求电子设备同时支持多种无线通信方式(例如支持Wi-Fi、蓝牙、超声波等通信方式),增加电子设备的硬件成本。并且,这些无线通信方式的通信距离通常都不如Wi-Fi通信方式,且节点之间的可达性更差。例如,假设电子设备在遭受“路径攻击”时依靠蓝牙通信方式恢复网络,蓝牙通信方式的传输距离远小于Wi-Fi通信方式,只有距离较为接近的节点可以通过蓝牙通信方式恢复通信,且蓝牙通信方式的可达性远小于Wi-Fi通信方式;假设电子设备在遭受“路径攻击”时依靠超声波通信方式恢复网络,超声波通信方式的性能甚至比蓝牙通信方式的性能更差。In the scheme of introducing heterogeneous paths, electronic devices in the Internet of Things avoid "path attacks" through a variety of heterogeneous wireless communication modules (such as Wi-Fi modules, Bluetooth modules, ultrasonic modules, etc.). However, this solution requires the electronic device to simultaneously support multiple wireless communication methods (for example, supports Wi-Fi, Bluetooth, ultrasonic and other communication methods), which increases the hardware cost of the electronic device. Moreover, the communication distance of these wireless communication methods is generally not as good as that of Wi-Fi communication methods, and the reachability between nodes is even worse. For example, suppose that an electronic device relies on Bluetooth communication to restore the network when it suffers a "path attack". The transmission distance of Bluetooth communication is much smaller than that of Wi-Fi communication. Only nodes that are closer in distance can restore communication through Bluetooth communication. The accessibility of the method is far less than that of the Wi-Fi communication method; assuming that the electronic device relies on the ultrasonic communication method to restore the network when it suffers a "path attack", the performance of the ultrasonic communication method is even worse than that of the Bluetooth communication method.
综上,这些方案虽然在一定程度上可以缓解“路径攻击”的威胁,但是这些方案会增加额外的成本,不利于推广与应用。To sum up, although these schemes can alleviate the threat of "path attack" to a certain extent, these schemes will increase additional costs, which is not conducive to promotion and application.
有鉴于此,本申请实施例提供了一种通信方法、电子设备以及计算机可读存储介质,可以在不增加额外成本的情况下缓解“路径攻击”的威胁,解决了当前的“路径攻击”解决方案成本高,不利于推广与应用的问题,具有较强的易用性和实用性。In view of this, the embodiments of the present application provide a communication method, an electronic device, and a computer-readable storage medium, which can mitigate the threat of "path attack" without increasing additional costs, and solve the current "path attack" solution. The cost of the scheme is high, which is not conducive to the problem of promotion and application, and has strong ease of use and practicability.
首先,以图1所示的通信系统为例,该通信系统是本申请实施例提供的通信方法适用的一种系统。First, taking the communication system shown in FIG. 1 as an example, the communication system is a system to which the communication method provided by the embodiment of the present application is applied.
如图1所示,该通信系统中包括至少两个电子设备101(图1中仅示出两个)和至少一个路由设备102(图1中仅示出一个)。As shown in FIG. 1 , the communication system includes at least two electronic devices 101 (only two are shown in FIG. 1 ) and at least one routing device 102 (only one is shown in FIG. 1 ).
在电子设备101和路由设备102中,均设置有Wi-Fi通信模块。Both the electronic device 101 and the routing device 102 are provided with a Wi-Fi communication module.
上述路由设备102用于通过本设备的Wi-Fi通信模块创建局域网,并开放热点。上述路由设备102可以是专用的网络设备,或者,上述路由设备102也可以是电子设备101。The above-mentioned routing device 102 is used to create a local area network and open a hotspot through the Wi-Fi communication module of the device. The above-mentioned routing device 102 may be a dedicated network device, or the above-mentioned routing device 102 may also be an electronic device 101 .
例如,上述路由设备102可以是路由器,专门用于创建局域网。或者,上述路由设备102也可以是台式电脑,台式电脑开放热点,允许其他电子设备101接入。For example, the above-mentioned routing device 102 may be a router dedicated to creating a local area network. Alternatively, the above-mentioned routing device 102 may also be a desktop computer, and the desktop computer opens a hotspot, allowing other electronic devices 101 to access.
上述电子设备101可以通过本设备的Wi-Fi通信模块接入路由设备102开放的热点,进入局域网,通过局域网与其他电子设备101进行信息交互。The above-mentioned electronic device 101 can access the hotspot opened by the routing device 102 through the Wi-Fi communication module of the device, enter the local area network, and exchange information with other electronic devices 101 through the local area network.
以下,将根据图1所示的通信系统并结合具体的应用场景,对本申请实施例提供的通信方法进行详细说明。Hereinafter, the communication method provided by the embodiment of the present application will be described in detail according to the communication system shown in FIG. 1 and in combination with a specific application scenario.
1、通信链路状态检测。1. Communication link status detection.
如图1所示,在一些通信系统中,设置有一个或多个路由设备。路由设备创建了局域网,并开放热点允许其他电子设备接入。As shown in FIG. 1, in some communication systems, one or more routing devices are provided. Routing devices create local area networks and open hotspots to allow other electronic devices to access.
在这些通信系统中,可以将任一电子设备定义为第一电子设备,将第一电子设备对端的电子设备定义为第二电子设备。In these communication systems, any electronic device may be defined as the first electronic device, and the electronic device at the opposite end of the first electronic device may be defined as the second electronic device.
当第一电子设备需要与第二电子设备进行信息交互时,第一电子设备可以直接与第二 电子设备通信连接。此时,第一电子设备与第二电子设备组成了一条端对端(Peer to Peer,P2P)的通信链路。When the first electronic device needs to perform information interaction with the second electronic device, the first electronic device may directly communicate with the second electronic device. At this time, the first electronic device and the second electronic device form a peer-to-peer (Peer to Peer, P2P) communication link.
或者,第一电子设备也可以不是直接与第二电子设备通信连接。第一电子设备和第二电子设备可以通过Wi-Fi通信模块接入路由设备开放的热点进入局域网,第一电子设备通过局域网与第二电子设备进行信息交互。此时,第一电子设备、路由设备以及第二电子设备组成一条通信链路,路由设备为第一电子设备以及第二电子设备的中间节点。Alternatively, the first electronic device may not be directly communicatively connected to the second electronic device. The first electronic device and the second electronic device can access the hotspot opened by the routing device through the Wi-Fi communication module to enter the local area network, and the first electronic device exchanges information with the second electronic device through the local area network. At this time, the first electronic device, the routing device, and the second electronic device form a communication link, and the routing device is an intermediate node between the first electronic device and the second electronic device.
例如,如图2所示,通信系统中包括电子设备A、电子设备B、电子设备C以及路由设备D。其中,电子设备A可以与电子设备B建立P2P的通信链路,电子设备A和电子设备B进行信息交互时,无需中间节点转发。For example, as shown in FIG. 2 , the communication system includes electronic device A, electronic device B, electronic device C, and routing device D. The electronic device A can establish a P2P communication link with the electronic device B, and when the electronic device A and the electronic device B exchange information, no intermediate node forwarding is required.
此外,电子设备A可以与路由设备D以及电子设备C组成一条通信链路。在该通信链路中,路由设备D为电子设备A与电子设备C的中间节点。当电子设备A与电子设备C进行信息交互时,电子设备A发送的信息需要由路由设备D转发至电子设备C,电子设备C发送的信息需要由路由设备D转发至电子设备A。In addition, the electronic device A can form a communication link with the routing device D and the electronic device C. In this communication link, the routing device D is an intermediate node between the electronic device A and the electronic device C. When electronic device A and electronic device C exchange information, the information sent by electronic device A needs to be forwarded by routing device D to electronic device C, and the information sent by electronic device C needs to be forwarded by routing device D to electronic device A.
可以理解的是,在一条通信链路中,可能存在一个或多个路由设备。当通信链路中存在多个路由设备时,这些路由设备均为该通信链路的中间节点。It will be appreciated that in a communication link, there may be one or more routing devices. When there are multiple routing devices in the communication link, these routing devices are all intermediate nodes of the communication link.
在一些情况下,通信链路的中间节点有可能遭受黑客入侵,被攻击的中间节点可能会有选择性的抛弃部分或全部来自特定电子设备的报文,从而导致该特定的电子设备无法将信息传递至其他电子设备。In some cases, the intermediate node of the communication link may be hacked, and the attacked intermediate node may selectively discard some or all of the packets from a specific electronic device, so that the specific electronic device cannot transmit the information. to other electronic devices.
对此,电子设备可以根据实际场景选用合适的方式检测本设备所在的通信链路是否遭受“路径攻击”。例如,第一电子设备和第二电子设备可以建立心跳互锁机制,通过心跳互锁机制检测通信链路是否遭受“路径攻击”。In this regard, the electronic device can select an appropriate method according to the actual scene to detect whether the communication link where the device is located is subject to a "path attack". For example, the first electronic device and the second electronic device may establish a heartbeat interlock mechanism, and detect whether the communication link suffers from a "path attack" through the heartbeat interlock mechanism.
在心跳互锁机制中,可以包括主动方和被动方。在每一个心跳周期内,如果主动方和被动方之间的通信链路未被攻击,则主动方可以将第一心跳信息发送至被动方,被动方可以返回响应的第二心跳信息至主动方。In the heartbeat interlocking mechanism, an active party and a passive party can be included. In each heartbeat cycle, if the communication link between the active party and the passive party is not attacked, the active party can send the first heartbeat information to the passive party, and the passive party can return the second heartbeat information in response to the active party. .
心跳周期的具体时长可以根据实际情况进行设置。例如,心跳周期的时长可以设置为100ms、120ms、150ms等时长。The specific duration of the heartbeat cycle can be set according to the actual situation. For example, the duration of the heartbeat cycle may be set to 100ms, 120ms, 150ms, or the like.
具体地,在设置心跳周期的时长时,应当结合实际需求选择合适的时长。如果心跳周期的时长过短,则心跳互锁检测过于频繁,传输大量的心跳信息会增大通信系统的网络开销。如果心跳周期的时长过长,则容易出现检测不及时的情况,失去检测的意义。Specifically, when setting the duration of the heartbeat cycle, an appropriate duration should be selected according to actual needs. If the duration of the heartbeat period is too short, the heartbeat interlock detection is too frequent, and the transmission of a large amount of heartbeat information will increase the network overhead of the communication system. If the duration of the heartbeat cycle is too long, the detection is likely to be untimely, and the significance of detection is lost.
主动方可以自行设置第一心跳信息的具体内容。例如,主动方可以将第一心跳信息的内容设置“0101”、“1234”、“4523”等。The active party can set the specific content of the first heartbeat information by itself. For example, the active party may set the content of the first heartbeat information to "0101", "1234", "4523" and so on.
并且,主动方可以自行设置第一心跳信息的内容的更换时机。例如,主动方可以每个预设心跳周期都更换第一心跳信息的内容;或者,主动方可以每隔预设心跳周期更换一次第一心跳信息内容;或者,主动方也可以始终不更换第一心跳信息的内容。Moreover, the active party can set the replacement timing of the content of the first heartbeat information by itself. For example, the active party can change the content of the first heartbeat information every preset heartbeat cycle; or, the active party can change the content of the first heartbeat information every preset heartbeat cycle; or, the active party can also never replace the first heartbeat information. The content of the heartbeat information.
主动方在发送第一心跳信息时,会使用主动方的私钥对第一心跳信息的内容(以下称为第一内容信息)进行签名。然后主动方将签名后的第一心跳信息发送至中间节点,由中间节点将第一心跳信息转发至被动方。When the active party sends the first heartbeat information, it will use the private key of the active party to sign the content of the first heartbeat information (hereinafter referred to as the first content information). Then the active party sends the signed first heartbeat information to the intermediate node, and the intermediate node forwards the first heartbeat information to the passive party.
当被动方接收到中间节点转发的第一心跳信息时,被动方使用主动方的公钥对第一心跳信息的签名进行验证,验证通过,则被动方获取到第二内容信息。When the passive party receives the first heartbeat information forwarded by the intermediate node, the passive party uses the public key of the active party to verify the signature of the first heartbeat information, and if the verification passes, the passive party obtains the second content information.
之后,被动方使用被动方的私钥对第二内容信息进行签名,得到第二心跳信息,并将第二心跳信息发送至中间节点,由中间节点将第二心跳信息转发至主动方。After that, the passive party signs the second content information using the passive party's private key to obtain second heartbeat information, and sends the second heartbeat information to the intermediate node, which forwards the second heartbeat information to the active party.
当主动方接收到第二心跳信息时,使用被动方的公钥对第二心跳信息的签名进行验证,验证通过,则主动方得到第三内容信息。When the active party receives the second heartbeat information, the passive party's public key is used to verify the signature of the second heartbeat information, and if the verification is passed, the active party obtains the third content information.
主动方将第三内容信息与第一内容信息进行比对,若第三内容信息与第一内容信息一致,则表示该第二心跳信息为被动方所发,且未被篡改。The active party compares the third content information with the first content information, and if the third content information is consistent with the first content information, it means that the second heartbeat information is sent by the passive party and has not been tampered with.
至此,主动方和被动方完成了本心跳周期的心跳互锁检测。So far, the active side and the passive side have completed the heartbeat interlock detection of this heartbeat cycle.
当主动方和被动方之间的通信链路遭受“路径攻击”时,中间节点会针对性地丢弃主动方和/或被动方的报文。此时,主动方接收不到被动方响应的第二心跳信息或被动方接收不到主动方发送的第一心跳信息,从而使主动方和被动方发现通信链路被攻击。When the communication link between the active party and the passive party suffers from a "path attack", the intermediate node will drop the packets of the active party and/or the passive party in a targeted manner. At this time, the active party cannot receive the second heartbeat information responded by the passive party or the passive party cannot receive the first heartbeat information sent by the active party, so that the active party and the passive party discover that the communication link is attacked.
具体地,当中间节点针对性地丢弃主动方的报文时,主动方会发送第一心跳信息至中间节点,但是中间节点不转发第一心跳信息。Specifically, when the intermediate node specifically discards the message of the active party, the active party will send the first heartbeat information to the intermediate node, but the intermediate node does not forward the first heartbeat information.
当被动方检测到在最近一次接收到第一心跳信息之后的第一预设时长内,未接收到新的第一心跳信息,则被动方判定通信链路遭受攻击。When the passive party detects that no new first heartbeat information has been received within the first preset time period after the last received first heartbeat information, the passive party determines that the communication link is under attack.
第一预设时长可以根据实际情况进行设置。通常,第一预设时长应当比心跳周期长。例如,假设心跳周期为100ms,则第一预设时长可以设置为120ms、130ms、150ms等时长。The first preset duration can be set according to actual conditions. Typically, the first preset duration should be longer than the heartbeat period. For example, assuming that the heartbeat period is 100ms, the first preset duration may be set to durations such as 120ms, 130ms, and 150ms.
并且,由于被动方未接收到第一心跳信息,所以被动方无法反馈第二心跳信息至中间节点。所以,主动方也无法接收到被动方反馈的第二心跳信息。Moreover, since the passive party does not receive the first heartbeat information, the passive party cannot feed back the second heartbeat information to the intermediate node. Therefore, the active party cannot receive the second heartbeat information fed back by the passive party.
当主动方检测到在发送第一心跳信息之后的第二预设时长内,未接收到被动方反馈的第二心跳信息,则主动方判定通信链路遭受攻击,并停止继续发送第一心跳信息。When the active party detects that it has not received the second heartbeat information fed back by the passive party within the second preset time period after sending the first heartbeat information, the active party determines that the communication link is under attack and stops sending the first heartbeat information. .
第二预设时长可以根据实际情况进行设置。例如,第一预设时长可以设置为20ms、30ms、50ms等时长。The second preset duration can be set according to actual conditions. For example, the first preset duration may be set to durations such as 20ms, 30ms, and 50ms.
当中间节点针对性的丢弃被动方的报文时,主动方发送第一心跳信息至中间节点,中间节点将第一心跳信息转发至被动方。When the intermediate node specifically discards the message of the passive party, the active party sends the first heartbeat information to the intermediate node, and the intermediate node forwards the first heartbeat information to the passive party.
当被动方接收到第一心跳信息时,返回第二心跳信息至中间节点。但是,中间节点不转发第二心跳信息。When the passive party receives the first heartbeat information, it returns the second heartbeat information to the intermediate node. However, the intermediate node does not forward the second heartbeat information.
当主动方检测到在发送第一心跳信息之后的第二预设时长内,未接收到被动方反馈的第二心跳信息,则主动方判定通信链路遭受攻击,并停止发送下一个心跳周期的第一心跳信息。When the active party detects that it has not received the second heartbeat information fed back by the passive party within the second preset time period after sending the first heartbeat information, the active party determines that the communication link is under attack and stops sending the next heartbeat cycle. First heartbeat information.
由于主动方停止发送下一个心跳周期的第一心跳信息,因此,被动方在下一个心跳周期无法接收到第一心跳信息。Since the active party stops sending the first heartbeat information in the next heartbeat cycle, the passive party cannot receive the first heartbeat information in the next heartbeat cycle.
当被动方检测到在最近一次接收到第一心跳信息之后的第一预设时长内,未接收到新的第一心跳信息,则被动方判定通信链路遭受攻击。When the passive party detects that no new first heartbeat information has been received within the first preset time period after the last received first heartbeat information, the passive party determines that the communication link is under attack.
因此,当主动方和被动方之间的通信链路遭受攻击时,无论中间节点是针对性丢弃主动方的报文还是丢弃被动方的报文,主动方和被动方都可以通过心跳互锁机制陆续检测到通信链路遭受攻击。Therefore, when the communication link between the active party and the passive party is attacked, no matter whether the intermediate node discards the packets of the active party or the packets of the passive party, both the active party and the passive party can use the heartbeat interlocking mechanism. Attacks on communication links were detected one after another.
此外,如果主动方接收到被动方返回的第二心跳信息,但是第三内容信息与第一内容信息不一致,则表示主动方和被动方之间的通信链路可能遭受了“路径攻击”以外的攻击。例如,中间节点被黑客控制,黑客控制中间节点篡改主动方或被动方的报文。In addition, if the active party receives the second heartbeat information returned by the passive party, but the third content information is inconsistent with the first content information, it means that the communication link between the active party and the passive party may have suffered a "path attack". attack. For example, the intermediate node is controlled by a hacker, and the hacker controls the intermediate node to tamper with the message of the active party or the passive party.
此时,主动方可以停止继续发送第一心跳信息,以使被动方得知通信链路被攻击。At this time, the active party may stop sending the first heartbeat information, so that the passive party knows that the communication link is attacked.
由上可知,当通信链路被攻击时,该通信链路上的电子设备可以通过心跳互锁机制陆续检测到通信链路被攻击。该通信链路上的各个电子设备检测到通信链路被攻击的时间可能不一样,各个电子设备检测到通信链路被攻击的时间与心跳周期、第一预设时长以及第二预设时长等因素相关联。It can be seen from the above that when a communication link is attacked, the electronic devices on the communication link can successively detect that the communication link is attacked through the heartbeat interlocking mechanism. The time when each electronic device on the communication link detects that the communication link is attacked may be different. The time when each electronic device detects that the communication link is attacked is related to the heartbeat cycle, the first preset duration, and the second preset duration, etc. factors are related.
以下将结合具体的应用场景对上述心跳互锁机制进行详细说明。The above-mentioned heartbeat interlocking mechanism will be described in detail below with reference to specific application scenarios.
应用场景一:Application Scenario 1:
如图3所示,电子设备11、路由设备12和电子设备13组成一条通信链路。As shown in FIG. 3 , the electronic device 11 , the routing device 12 and the electronic device 13 form a communication link.
电子设备11和电子设备13为建立了心跳互锁机制的电子设备,路由设备12为电子设备11和电子设备13的中间节点。The electronic device 11 and the electronic device 13 are electronic devices with a heartbeat interlock mechanism established, and the routing device 12 is an intermediate node between the electronic device 11 and the electronic device 13 .
假设起始时间为第0ms。此时,路由设备12遭受了攻击,路由设备将针对性地抛弃电子设备13的报文。心跳周期为100ms,第一预设时长为150ms,第二预设时长为50ms。Assume the start time is 0ms. At this time, the routing device 12 is attacked, and the routing device will discard the packets of the electronic device 13 in a targeted manner. The heartbeat period is 100ms, the first preset duration is 150ms, and the second preset duration is 50ms.
在第0ms,电子设备11使用电子设备11的私钥对第一内容信息“0101”进行签名,得到第一心跳信息,并将第一心跳信息发送至路由设备12。At the 0th ms, the electronic device 11 uses the private key of the electronic device 11 to sign the first content information "0101", obtains the first heartbeat information, and sends the first heartbeat information to the routing device 12 .
在第2ms,路由设备12接收到第一心跳信息,并将第一心跳信息转发至电子设备13。At the 2nd ms, the routing device 12 receives the first heartbeat information, and forwards the first heartbeat information to the electronic device 13 .
在第5ms,电子设备13接收到了路由设备12转发的第一心跳信息。电子设备13使用电子设备11的公钥对第一心跳信息的签名进行验证,验证通过,得到第二内容信息“0101”。At the 5th ms, the electronic device 13 receives the first heartbeat information forwarded by the routing device 12 . The electronic device 13 verifies the signature of the first heartbeat information by using the public key of the electronic device 11, and the verification is passed, and the second content information "0101" is obtained.
电子设备13使用电子设备13的私钥对第二内容信息进行签名,得到第二心跳信息,并将第二心跳信息发送至路由设备12。The electronic device 13 signs the second content information using the private key of the electronic device 13 to obtain second heartbeat information, and sends the second heartbeat information to the routing device 12 .
在第7ms,路由设备12接收到第二心跳信息。由于路由设备12会针对性抛弃电子设备13的报文,所以路由设备抛弃第二心跳信息,不转发第二心跳信息。At the 7th ms, the routing device 12 receives the second heartbeat information. Since the routing device 12 will discard the packets of the electronic device 13 in a targeted manner, the routing device discards the second heartbeat information and does not forward the second heartbeat information.
在第50ms,电子设备11等待了第二预设时长,且未检测到第二心跳信息。此时,电子设备11判定通信链路遭受了攻击,所以电子设备11停止心跳互锁机制,不发送下一心跳周期的第一心跳信息。At the 50th ms, the electronic device 11 waits for the second preset time period and does not detect the second heartbeat information. At this time, the electronic device 11 determines that the communication link is under attack, so the electronic device 11 stops the heartbeat interlocking mechanism and does not send the first heartbeat information of the next heartbeat cycle.
在第155ms,电子设备13等待了第一预设时长,且未检测到新的第一心跳信息。此时,电子设备13判定通信链路遭受了攻击。电子设备13停止心跳互锁机制。At the 155th ms, the electronic device 13 waits for the first preset time period and does not detect new first heartbeat information. At this point, the electronic device 13 determines that the communication link is under attack. The electronic device 13 stops the heartbeat interlock mechanism.
应用场景二:Application Scenario Two:
如图4所示,电子设备21、路由设备22和电子设备23组成一条通信链路。As shown in FIG. 4 , the electronic device 21 , the routing device 22 and the electronic device 23 form a communication link.
电子设备21和电子设备23为建立了心跳互锁机制的电子设备,路由设备22为电子设备21和电子设备23的中间节点。The electronic device 21 and the electronic device 23 are electronic devices with a heartbeat interlock mechanism established, and the routing device 22 is an intermediate node between the electronic device 21 and the electronic device 23 .
假设起始时间为第0ms。心跳周期为100ms,第一预设时长为150ms,第二预设时长为50ms。Assume the start time is 0ms. The heartbeat period is 100ms, the first preset duration is 150ms, and the second preset duration is 50ms.
在第0ms,电子设备21使用电子设备21的私钥对第一内容信息“0101”进行签名,得到第一心跳信息,并将第一心跳信息发送至路由设备22。At the 0th ms, the electronic device 21 uses the private key of the electronic device 21 to sign the first content information "0101", obtains the first heartbeat information, and sends the first heartbeat information to the routing device 22 .
在第2ms,路由设备22接收到第一心跳信息,并将第一心跳信息转发至电子设备23。At the second ms, the routing device 22 receives the first heartbeat information, and forwards the first heartbeat information to the electronic device 23 .
在第5ms,电子设备23接收到了路由设备22转发的第一心跳信息。电子设备23使用电子设备21的公钥对第一心跳信息的签名进行验证,验证通过,得到第二内容信息“0101”。电子设备23使用电子设备23的私钥对第二内容信息进行签名,得到第二心跳信息,并将第二心跳信息发送至路由设备22。At the 5th ms, the electronic device 23 receives the first heartbeat information forwarded by the routing device 22 . The electronic device 23 uses the public key of the electronic device 21 to verify the signature of the first heartbeat information, and the verification is passed, and the second content information "0101" is obtained. The electronic device 23 signs the second content information using the private key of the electronic device 23 to obtain second heartbeat information, and sends the second heartbeat information to the routing device 22 .
在第7ms,路由设备22接收到第二心跳信息,并将第二心跳信息转发至电子设备21。At the 7th ms, the routing device 22 receives the second heartbeat information, and forwards the second heartbeat information to the electronic device 21 .
在第10ms,电子设备21接收到路由设备22转发的第二心跳信息。电子设备21使用电子设备23的公钥对第二心跳信息的签名进行验证,验证通过,得到第三内容信息“0101”。第三内容信息和第一内容信息一致,则电子设备21和电子设备23完成了本周期的心跳互锁检测。At the 10th ms, the electronic device 21 receives the second heartbeat information forwarded by the routing device 22 . The electronic device 21 uses the public key of the electronic device 23 to verify the signature of the second heartbeat information, and the verification is passed, and the third content information "0101" is obtained. If the third content information is consistent with the first content information, the electronic device 21 and the electronic device 23 have completed the heartbeat interlock detection in this cycle.
在第67ms,路由设备22遭受了攻击,路由设备将针对性地抛弃电子设备21的报文。At the 67th ms, the routing device 22 is attacked, and the routing device will discard the packets of the electronic device 21 in a targeted manner.
如图5所示,在第100ms,电子设备21使用电子设备21的私钥对第一内容信息“1111”进行签名,得到第一心跳信息,并将第一心跳信息发送至路由设备22。As shown in FIG. 5 , at the 100th ms, the electronic device 21 uses the private key of the electronic device 21 to sign the first content information “1111”, obtains the first heartbeat information, and sends the first heartbeat information to the routing device 22 .
在第102ms,路由设备22接收到第一心跳信息。由于路由设备22会针对性抛弃电子设备21的报文,所以路由设备抛弃第一心跳信息,不转发第一心跳信息。At 102 ms, the routing device 22 receives the first heartbeat information. Since the routing device 22 will discard the packets of the electronic device 21 in a targeted manner, the routing device discards the first heartbeat information and does not forward the first heartbeat information.
在第150ms,电子设备21在等待了第二预设时长后,未检测到电子设备23反馈的第二心跳信息,则电子设备21判定通信链路遭受了攻击。电子设备21停止心跳互锁机制,不再发送第一心跳信息。At the 150th ms, the electronic device 21 does not detect the second heartbeat information fed back by the electronic device 23 after waiting for the second preset time period, and the electronic device 21 determines that the communication link is attacked. The electronic device 21 stops the heartbeat interlocking mechanism and no longer sends the first heartbeat information.
在第155ms,电子设备23在等待了第一预设时长后,未检测到新的第一心跳信息,则电子设备23判定通信链路遭受了攻击。电子设备23停止心跳互锁机制。At the 155th ms, the electronic device 23 does not detect new first heartbeat information after waiting for the first preset time period, and the electronic device 23 determines that the communication link is attacked. The electronic device 23 stops the heartbeat interlock mechanism.
综上,当通信链路遭受攻击时,该通信链路上的电子设备可以通过心跳互锁机制陆续检测到通信链路被攻击。To sum up, when the communication link is attacked, the electronic devices on the communication link can successively detect that the communication link is attacked through the heartbeat interlocking mechanism.
2、维持通信服务。2. To maintain communication services.
当电子设备检测到通信链路被攻击时,电子设备可以调整Wi-Fi通信模块,使Wi-Fi通信模块进入混杂模式(又称调试模式)。When the electronic device detects that the communication link is attacked, the electronic device can adjust the Wi-Fi communication module so that the Wi-Fi communication module enters a promiscuous mode (also called a debug mode).
当Wi-Fi通信模块处于非混杂模式时,电子设备的Wi-Fi通信模块只接收目的地址指向本设备的报文(包括广播报文),其他报文一律丢弃。When the Wi-Fi communication module is in the non-promiscuous mode, the Wi-Fi communication module of the electronic device only receives packets (including broadcast packets) whose destination address is directed to the device, and discards all other packets.
当Wi-Fi通信模块进入混杂模式时,电子设备的Wi-Fi通信模块可以接收所有经过该Wi-Fi通信模块的报文,不论报文的目的地址是否指向本设备。When the Wi-Fi communication module enters the promiscuous mode, the Wi-Fi communication module of the electronic device can receive all the messages passing through the Wi-Fi communication module, regardless of whether the destination address of the message points to the device.
当通信链路被攻击时,第一电子设备与第二电子设备将陆续进入混杂模式。When the communication link is attacked, the first electronic device and the second electronic device will successively enter the promiscuous mode.
在混杂模式下,电子设备可以将需要传输的信息封装成报文,通过广播机制对外进行广播该报文。当电子设备通过广播的形式对外发送报文时,如果其周围的电子设备的Wi-Fi通信模块处于混杂模式中,则其周围的电子设备可以监听到该电子设备广播的报文。In the promiscuous mode, the electronic device can encapsulate the information to be transmitted into a message, and broadcast the message to the outside world through a broadcast mechanism. When an electronic device sends a message in the form of broadcasting, if the Wi-Fi communication module of the surrounding electronic device is in the promiscuous mode, the surrounding electronic device can monitor the message broadcasted by the electronic device.
也即是说,当第一电子设备对外广播报文时,第二电子设备可以通过处于混杂模式的Wi-Fi通信模块获取第一电子设备广播的报文。此时,第一电子设备与第二电子设备通过广播机制建立了应急可信通道,以广播的形式传递报文,维持了通信服务,虽然通信服务降级,但是不会中断通信服务。That is to say, when the first electronic device broadcasts the message to the outside world, the second electronic device can obtain the message broadcasted by the first electronic device through the Wi-Fi communication module in the promiscuous mode. At this time, the first electronic device and the second electronic device establish an emergency trusted channel through the broadcast mechanism, transmit the message in the form of broadcast, and maintain the communication service. Although the communication service is degraded, the communication service will not be interrupted.
并且,电子设备在广播报文时,Wi-Fi通信模块可能因网络阻塞、信道噪声等因素,无法顺利广播报文。因此,若电子设备检测到在一段时间内,Wi-Fi通信模块因为网络阻塞、信道噪声等因素无法对外广播报文,则电子设备可以将需要传输的信息封装成注入报文,将注入报文注入(injection)Wi-Fi通信模块的空口(radio)中,以广播的形式对外发送该注入报文。Moreover, when an electronic device broadcasts a message, the Wi-Fi communication module may fail to broadcast the message smoothly due to factors such as network congestion and channel noise. Therefore, if the electronic device detects that within a period of time, the Wi-Fi communication module cannot broadcast the message due to network congestion, channel noise, etc., the electronic device can encapsulate the information to be transmitted into an injection message, and inject the message into the message. It is injected into the radio interface of the Wi-Fi communication module, and the injection message is sent to the outside in the form of broadcast.
电子设备将注入报文注入空口进行广播,可以不执行802.11协议规定的载波监听动作以及碰撞检测动作,确保Wi-Fi通信模块可以顺利广播上述注入报文。The electronic device injects the injected message into the air interface for broadcasting, and does not need to perform the carrier sense action and collision detection action specified in the 802.11 protocol, so as to ensure that the Wi-Fi communication module can smoothly broadcast the above-mentioned injected message.
以下将结合具体的应用场景对上述建立应急可信通道的过程进行详细说明。The above process of establishing an emergency trusted channel will be described in detail below with reference to specific application scenarios.
应用场景三:Application scenario three:
如图6所示,在图6所示的通信系统中,笔记本电脑31、笔记本电脑33、台式电脑34和智能电视35为物联网中的电子设备,路由器32为路由设备被攻击的中间节点。As shown in FIG. 6 , in the communication system shown in FIG. 6 , the notebook computer 31 , the notebook computer 33 , the desktop computer 34 and the smart TV 35 are electronic devices in the Internet of Things, and the router 32 is an intermediate node where the routing device is attacked.
当路由器32被攻击之后,笔记本电脑31、笔记本电脑33、台式电脑34和智能电视35通过心跳互锁机制发现通信链路被攻击,所以,笔记本电脑31、笔记本电脑33、台式电脑34和智能电视35均控制各自的Wi-Fi通信模块进入混杂模式。After the router 32 is attacked, the notebook computer 31, the notebook computer 33, the desktop computer 34 and the smart TV 35 discover that the communication link is attacked through the heartbeat interlocking mechanism. Therefore, the notebook computer 31, the notebook computer 33, the desktop computer 34 and the smart TV 35 control their respective Wi-Fi communication modules to enter promiscuous mode.
当笔记本电脑31想要传递信息至笔记本电脑33时,笔记本电脑可以将待传输的信息封装成注入报文,将注入报文注入本设备的Wi-Fi通信模块的空口,以广播的形式对外发送该注入报文。When the notebook computer 31 wants to transmit information to the notebook computer 33, the notebook computer can encapsulate the information to be transmitted into an injection message, inject the injection message into the air interface of the Wi-Fi communication module of the device, and send it in the form of broadcast. The injection message.
此时,由于笔记本电脑33、台式电脑34和智能电视35均进入了混杂模式,所以,笔记本电脑33、台式电脑34和智能电视35都可以监听到笔记本电脑31广播的注入报文。At this time, since the notebook computer 33 , the desktop computer 34 and the smart TV 35 all enter the promiscuous mode, the notebook computer 33 , the desktop computer 34 and the smart TV 35 can all monitor the injection message broadcast by the notebook computer 31 .
由上可知,当通信链路遭受攻击时,该通信链路上的电子设备可以通过广播机制建立应急可信通道,维持通信服务。虽然通过广播机制进行通信会导致通信服务降级,但是不会中断通信服务。As can be seen from the above, when the communication link is attacked, the electronic device on the communication link can establish an emergency trusted channel through the broadcast mechanism to maintain the communication service. Although communication through the broadcast mechanism will cause the communication service to be degraded, it will not interrupt the communication service.
此外,电子设备对外广播报文时,为了提高其对端的电子设备监听到该报文的可能性,电子设备可以在某一个广播信道中多次发送同一报文,和/或,电子设备可以在多个不同的广播信道中发送同一报文。In addition, when an electronic device broadcasts a message to the outside world, in order to increase the possibility that the electronic device at the opposite end can monitor the message, the electronic device may send the same message multiple times in a certain broadcast channel, and/or the electronic device may The same message is sent on multiple different broadcast channels.
例如,电子设备发送报文A时,可以在同一广播信道中,每隔一秒发送一次报文A,连续发送三次报文A。又比如,电子设备在发送报文A时,可以同时在广播信道1、广播信道2和广播信道3中发送报文A。For example, when the electronic device sends the message A, it may send the message A every one second and continuously send the message A three times in the same broadcast channel. For another example, when the electronic device sends the message A, it can send the message A in the broadcast channel 1, the broadcast channel 2, and the broadcast channel 3 at the same time.
由于通信系统中可能存在多个处于混杂模式的电子设备。当第一电子设备广播了报文之后,除了该报文指向的第二电子设备可以监听到报文以外,其他处于混杂模式的电子设备也可以监听到上述报文。As there may be multiple electronic devices in promiscuous mode in the communication system. After the first electronic device broadcasts the message, in addition to the second electronic device pointed to by the message can monitor the message, other electronic devices in the promiscuous mode can also monitor the above message.
因此,在一些不需要对传输内容保密的场景中,第一电子设备在广播待传输数据之前,可以不对待传输数据进行加密。Therefore, in some scenarios where the transmission content does not need to be kept secret, the first electronic device may not encrypt the data to be transmitted before broadcasting the data to be transmitted.
而在另一些需要对传输内容保密的场景中,第一电子设备在广播待传输数据之前,可以使用第二电子设备的公钥对传输内容进行加密,得到加密后的报文。In other scenarios where the transmission content needs to be kept secret, before broadcasting the data to be transmitted, the first electronic device may use the public key of the second electronic device to encrypt the transmission content to obtain an encrypted message.
第一电子设备使用第二电子设备的公钥进行加密后,只有第二电子设备可以使用本设备的私钥对上述加密后的报文进行解密,获取传输内容。After the first electronic device uses the public key of the second electronic device to encrypt, only the second electronic device can decrypt the encrypted message by using the private key of the device to obtain the transmission content.
其他电子设备即使监听到该加密后的报文,也无法对报文进行解密,从而确保其他处于混杂模式的电子设备无法直接获知待传输数据的内容。Even if other electronic devices monitor the encrypted message, they cannot decrypt the message, thereby ensuring that other electronic devices in the promiscuous mode cannot directly know the content of the data to be transmitted.
以下将结合具体的应用场景对上述报文加密传输的过程进行详细说明。The process of the above-mentioned packet encryption transmission will be described in detail below with reference to specific application scenarios.
应用场景四:Application scenario four:
如图7所示,在图7所示的通信系统中,笔记本电脑41、笔记本电脑43、台式电脑44和智能电视45为物联网中的电子设备,路由器42为路由设备,路由器42为笔记本电脑41、笔记本电脑43和智能电视45的中间节点。As shown in FIG. 7 , in the communication system shown in FIG. 7 , the notebook computer 41 , the notebook computer 43 , the desktop computer 44 and the smart TV 45 are electronic devices in the Internet of Things, the router 42 is a routing device, and the router 42 is a notebook computer 41. An intermediate node between the notebook computer 43 and the smart TV 45.
笔记本电脑41和笔记本电脑43建立了心跳互锁机制。The notebook computer 41 and the notebook computer 43 establish a heartbeat interlock mechanism.
当路由器42被攻击时,路由器将针对性地抛弃笔记本电脑43发送的报文,也即是说, 笔记本电脑43无法通过路由器42对外传输报文。When the router 42 is attacked, the router will discard the packets sent by the notebook computer 43 in a targeted manner, that is to say, the notebook computer 43 cannot transmit the packets through the router 42 to the outside.
由于笔记本电脑41和笔记本电脑43建立了心跳互锁机制,所以在路由器42被攻击之后,笔记本电脑41和笔记本电脑43陆续进入混杂模式。Since the notebook computer 41 and the notebook computer 43 establish a heartbeat interlock mechanism, after the router 42 is attacked, the notebook computer 41 and the notebook computer 43 enter the promiscuous mode one after another.
此时,笔记本电脑41和笔记本电脑43可以通过广播机制恢复通信。At this time, the notebook computer 41 and the notebook computer 43 can resume communication through the broadcast mechanism.
例如,假设笔记本电脑41有数据需要传递至笔记本电脑43,则笔记本电脑41可以使用笔记本电脑43的公钥对待传输数据进行加密,并将加密后的待传输数据封装为注入报文。然后,笔记本电脑43将注入报文注入本设备的Wi-Fi通信模块的空口对外广播。For example, assuming that the notebook computer 41 has data to be transmitted to the notebook computer 43, the notebook computer 41 can use the public key of the notebook computer 43 to encrypt the data to be transmitted, and encapsulate the encrypted data to be transmitted as an injection message. Then, the notebook computer 43 injects the injection message into the air interface of the Wi-Fi communication module of the device and broadcasts it to the outside.
当笔记本电脑41通过广播机制对外广播注入报文时,笔记本电脑41周围所有处于混杂模式下的电子设备都可以接收到注入报文。When the notebook computer 41 broadcasts the injection message to the outside through the broadcasting mechanism, all electronic devices in the promiscuous mode around the notebook computer 41 can receive the injection message.
如图7中的虚线所示,笔记本电脑41周围的笔记本电脑43和台式电脑44都处于混杂模式,所以笔记本电脑43和台式电脑44都可以接收到注入报文,并非只有笔记本电脑43可以接收到注入报文。As shown by the dotted line in FIG. 7 , the notebook computer 43 and the desktop computer 44 around the notebook computer 41 are in promiscuous mode, so both the notebook computer 43 and the desktop computer 44 can receive the injection message, not only the notebook computer 43 can receive the injection message Inject messages.
智能电视45未处于混杂模式,所以智能电视45无法接收到笔记本电脑41广播的注入报文。The smart TV 45 is not in the promiscuous mode, so the smart TV 45 cannot receive the injection message broadcast by the notebook computer 41 .
笔记本电脑43获取到注入报文后,可以使用笔记本电脑43的私钥对注入报文中的加密数据进行解密,得到待传输数据。After the laptop computer 43 obtains the injection message, it can use the private key of the laptop computer 43 to decrypt the encrypted data in the injection message to obtain the data to be transmitted.
台式电脑44获取到注入报文后,由于台式电脑44没有笔记本电脑43的私钥,所以台式电脑44无法对注入报文中的加密数据进行解密,无法得知待传输数据的内容。After the desktop computer 44 obtains the injection message, since the desktop computer 44 does not have the private key of the laptop computer 43, the desktop computer 44 cannot decrypt the encrypted data in the injection message, and cannot know the content of the data to be transmitted.
由上可知,电子设备在广播报文之前,可以使用接收方的公钥对报文的内容进行加密。此时,只有接收方可以使用私钥对报文进行解密,得到报文的内容。通信系统中其他处于混杂模式的电子设备在监听到报文之后,无法直接获取到报文的内容。It can be seen from the above that before broadcasting the message, the electronic device can use the public key of the receiver to encrypt the content of the message. At this point, only the receiver can decrypt the message with the private key to obtain the content of the message. Other electronic devices in the promiscuous mode in the communication system cannot directly obtain the content of the message after monitoring the message.
此外,为了避免通信系统中部分被攻击的节点伪造或篡改其他电子设备的报文,电子设备在广播报文时,可以使用本设备的私钥对报文的内容进行签名,通过签名的方式证明该报文的发送方身份。In addition, in order to prevent some attacked nodes in the communication system from forging or tampering with the messages of other electronic devices, the electronic device can use the private key of the device to sign the content of the message when broadcasting the message, and prove by means of signature. The identity of the sender of this message.
当电子设备监听到其他电子设备广播的报文之后,可以使用上述报文的发送方的公钥对报文的签名进行验证。After the electronic device monitors the messages broadcast by other electronic devices, it can use the public key of the sender of the message to verify the signature of the message.
如果验证通过,则表示该报文的发送方身份无误,电子设备可以使用本设备的私钥对上述报文进行签名并存储。If the verification is passed, it means that the identity of the sender of the message is correct, and the electronic device can use the private key of the device to sign and store the above message.
如果验证失败,则表示该报文的发送方身份是伪造的,或者,表示电子设备不认识该报文的发送方,电子设备未记录该报文的发送方的公钥。此时,电子设备可以对该报文执行第一预设操作。If the verification fails, it means that the identity of the sender of the message is forged, or the electronic device does not know the sender of the message, and the electronic device does not record the public key of the sender of the message. At this time, the electronic device may perform the first preset operation on the message.
第一预设操作的具体形式可以根据实际情况进行设置。例如,第一预设操作可以为电子设备抛弃该报文;或者,第一预设操作可以为电子设备将该报文记录为恶意报文并存储。The specific form of the first preset operation can be set according to the actual situation. For example, the first preset operation may be that the electronic device discards the message; or, the first preset operation may be that the electronic device records and stores the message as a malicious message.
此外,电子设备在监听到其他电子设备广播的报文之后,可以通过预设的传输协议向该报文的发送方反馈第一响应信息。In addition, after monitoring the message broadcast by other electronic devices, the electronic device can feed back the first response information to the sender of the message through a preset transmission protocol.
预设的传输协议可以根据实际需求进行设置。例如,预设的传输协议可以选择传输控制协议(Transmission Control Protocol,TCP),从而提高传输第一响应信息的可靠性。The preset transmission protocol can be set according to actual needs. For example, a transmission control protocol (Transmission Control Protocol, TCP) may be selected as the preset transmission protocol, so as to improve the reliability of transmitting the first response information.
当电子设备对外广播报文之后,如果电子设备接收到其他电子设备反馈的第一响应信息,则表示该报文已经被其他电子设备监听到。此时,电子设备可以反馈第二响应信息至 该第一响应信息的发送方。After the electronic device broadcasts the message, if the electronic device receives the first response information fed back by other electronic devices, it means that the message has been monitored by other electronic devices. At this time, the electronic device may feed back the second response information to the sender of the first response information.
可以理解的是,通信系统中可能存在一个或多个被攻击的节点。在本申请实施例中,可以将电子设备发送的报文称为“事实”。It is understood that there may be one or more attacked nodes in the communication system. In this embodiment of the present application, the message sent by the electronic device may be referred to as a "fact".
当上述报文仅仅被通信系统中的少量电子设备监听到时,如果这些监听到报文的电子设备中存在被攻击的节点,则这些被攻击的电子设备可能会伪造或篡改该报文,导致在进行事后审计时,真实的事实被虚假的事实所掩盖。When the above message is only monitored by a small number of electronic devices in the communication system, if there are attacked nodes in these electronic devices that monitor the message, the attacked electronic devices may forge or tamper with the message, resulting in When conducting an after-the-fact audit, true facts are overshadowed by false facts.
例如,假设通信系统中存在电子设备A、电子设备B、电子设备C和电子设备D。当电子设备A对外广播报文时,如果只有电子设备B监听到该报文,且电子设备B被攻击,则电子设备B可能伪造或篡改电子设备A广播的报文。在事后审计时,由于只有电子设备B监听到了电子设备A广播的报文,所以电子设备B可能会反馈虚假的事实,从而导致真实的事实被掩盖。For example, assume that electronic device A, electronic device B, electronic device C, and electronic device D exist in the communication system. When electronic device A broadcasts a message, if only electronic device B monitors the message and electronic device B is attacked, electronic device B may forge or tamper with the message broadcast by electronic device A. During the post-event audit, since only the electronic device B has listened to the message broadcast by the electronic device A, the electronic device B may feed back false facts, thus causing the real facts to be covered up.
但是,如果电子设备B、电子设备C以及电子设备D都监听到该报文,则即使电子设备B伪造或篡改电子设备A广播的报文,反馈虚假的事实,在事后审计的过程中,负责审计的电子设备(即管理设备)也可以通过电子设备C和电子设备D记录的事实确定真实的事实。However, if electronic device B, electronic device C, and electronic device D all listen to the message, even if electronic device B forges or tampers with the message broadcast by electronic device A and feeds back false facts, it will be responsible for the post-audit process. The audited electronic device (ie, the management device) can also determine the true facts from the facts recorded by electronic device C and electronic device D.
因此,电子设备可以设置第一响应阈值。电子设备在对外广播报文之后,电子设备可以根据在预设响应时长内接收到的第一响应信息的数量以及第一响应阈值判断该报文是否广播成功。Therefore, the electronic device can set the first response threshold. After the electronic device broadcasts the message to the outside world, the electronic device can determine whether the message is successfully broadcast according to the quantity of the first response information received within the preset response time period and the first response threshold.
如果电子设备接收到的第一响应信息的数量大于第一响应阈值,则表示通信系统中有较多的电子设备监听到了上述报文。此时,广播该报文的电子设备可以判定报文广播成功。If the quantity of the first response information received by the electronic device is greater than the first response threshold, it means that more electronic devices in the communication system have monitored the above-mentioned message. At this point, the electronic device that broadcasts the message can determine that the message is broadcast successfully.
如果电子设备接收到的第一响应信息的数量小于或等于第一响应阈值,则表示通信系统中监听到上述报文的电子设备较少,该报文容易被伪造或篡改。此时,广播该报文的电子设备可以判定报文广播失败。If the quantity of the first response information received by the electronic device is less than or equal to the first response threshold, it means that few electronic devices in the communication system have monitored the above-mentioned message, and the message is easily forged or tampered with. At this point, the electronic device that broadcasts the message may determine that the message broadcast fails.
第一阈值的具体数值可以根据物联网中电子设备的数量进行设置。例如,第一响应阈值可以设置为1、2、3、5、10等数值。The specific value of the first threshold can be set according to the number of electronic devices in the Internet of Things. For example, the first response threshold may be set to 1, 2, 3, 5, 10 and other values.
预设响应时长可以根据实际情况进行设置。例如,预设响应时长可以被设置为100ms、200ms、500ms、1s等时长。The preset response time can be set according to the actual situation. For example, the preset response duration can be set to 100ms, 200ms, 500ms, 1s, and the like.
当电子设备判定报文广播失败时,电子设备可以执行第二预设操作。例如,电子设备在判定报文广播失败之后,可以重新广播发送失败的报文,直至电子设备判定报文广播成功。When the electronic device determines that the message broadcast fails, the electronic device may perform a second preset operation. For example, after determining that the message broadcasting fails, the electronic device may re-broadcast the failed message until the electronic device determines that the message broadcasting is successful.
此外,电子设备在重新广播发送失败的报文时,可以选择在同一广播信道中广播该报文,或者,电子设备也可以更换广播信道,重新广播发送失败的报文。In addition, when rebroadcasting the failed message, the electronic device may choose to broadcast the message in the same broadcast channel, or the electronic device may change the broadcasting channel and rebroadcast the failed message.
例如,电子设备在广播信道1广播报文A,接收到的第一响应信息的数量小于第一响应阈值,则电子设备可以继续在广播信道1广播报文A,或者,电子设备也可以更换广播信道,在广播信道2广播报文A。For example, if the electronic device broadcasts message A on broadcast channel 1, and the number of received first response information is less than the first response threshold, the electronic device can continue to broadcast message A on broadcast channel 1, or the electronic device can also change the broadcast channel, broadcast message A on broadcast channel 2.
以下将结合具体的应用场景对上述报文响应的过程进行详细说明。The process of responding to the foregoing message will be described in detail below with reference to specific application scenarios.
应用场景五:Application Scenario Five:
如图8所示,在图8所示的通信系统中,包括笔记本电脑51、笔记本电脑52、台式电脑53和智能电视54为物联网中的电子设备。笔记本电脑51、笔记本电脑52、台式电 脑53和智能电视54均处于混杂模式。As shown in FIG. 8 , in the communication system shown in FIG. 8 , the notebook computer 51 , the notebook computer 52 , the desktop computer 53 and the smart TV 54 are electronic devices in the Internet of Things. Laptop 51, Laptop 52, Desktop 53 and Smart TV 54 are all in promiscuous mode.
在某一时刻,笔记本电脑51对外广播注入报文。此时,笔记本电脑51设置的第一响应阈值为3,预设响应时长为500ms。At a certain moment, the notebook computer 51 broadcasts the injection message to the outside world. At this time, the first response threshold set by the notebook computer 51 is 3, and the preset response duration is 500 ms.
如图9所示,在通信系统中,只有笔记本电脑52和智能电视54监听到了该注入报文。此时,笔记本电脑52和智能电视54反馈第一响应信息至笔记本电脑51。As shown in FIG. 9 , in the communication system, only the notebook computer 52 and the smart TV 54 have monitored the injection message. At this time, the notebook computer 52 and the smart TV 54 feed back the first response information to the notebook computer 51 .
笔记本电脑51在500ms内,只接收到笔记本电脑52和智能电视54反馈的第一响应信息,第一响应信息的数量为2,小于第一响应阈值3,则笔记本电脑51判定上述注入报文广播失败。The notebook computer 51 only receives the first response information fed back by the notebook computer 52 and the smart TV 54 within 500 ms. The number of first response information is 2, which is less than the first response threshold of 3. Then the notebook computer 51 determines that the above-mentioned injection message is broadcast. fail.
然后,笔记本电脑51重新广播上述注入报文。Then, the notebook computer 51 rebroadcasts the above injection message.
应用场景六:Application Scenario Six:
如图10所示,在图10所示的通信系统中,包括笔记本电脑61、笔记本电脑62、台式电脑63和智能电视64为物联网中的电子设备。笔记本电脑61、笔记本电脑62、台式电脑63和智能电视64均处于混杂模式。As shown in FIG. 10 , in the communication system shown in FIG. 10 , the notebook computer 61 , the notebook computer 62 , the desktop computer 63 and the smart TV 64 are electronic devices in the Internet of Things. Laptop 61, laptop 62, desktop 63 and smart TV 64 are all in promiscuous mode.
在某一时刻,笔记本电脑61对外广播注入报文。此时,笔记本电脑61设置的第一响应阈值为2,预设响应时长为600ms。At a certain moment, the notebook computer 61 broadcasts the injection message to the outside. At this time, the first response threshold set by the notebook computer 61 is 2, and the preset response duration is 600 ms.
如图11所示,在通信系统中,笔记本电脑62、台式电脑63和智能电视64均监听到了该注入报文。此时,笔记本电脑62、台式电脑63和智能电视64均反馈第一响应信息至笔记本电脑61。As shown in FIG. 11 , in the communication system, the notebook computer 62 , the desktop computer 63 and the smart TV 64 have all monitored the injection message. At this time, the notebook computer 62 , the desktop computer 63 and the smart TV 64 all feed back the first response information to the notebook computer 61 .
笔记本电脑61在600ms内,接收到笔记本电脑62、台式电脑63和智能电视64反馈的第一响应信息,第一响应信息的数量为3,大于第一响应阈2,则笔记本电脑61判定上述注入报文广播成功。The notebook computer 61 receives the first response information fed back by the notebook computer 62, the desktop computer 63 and the smart TV 64 within 600 ms, and the number of first response information is 3, which is greater than the first response threshold 2, then the notebook computer 61 determines that the above injection The message is broadcast successfully.
由上可知,电子设备在广播报文以后,可以通过接收到的其他电子设备反馈的第一响应信息判断该报文是否广播成功。如果电子设备在预设响应时长内监听到的第一响应信息大于预设响应阈值,则电子设备可以判定报文广播成功。如果电子设备在预设响应时长内接收到的第一响应信息小于或等于预设响应阈值,则电子设备可以判定报文广播失败,重新广播报文,避免该报文在事后审计的过程被其他节点伪造或篡改。It can be seen from the above that after the electronic device broadcasts the message, it can judge whether the message is successfully broadcasted through the received first response information fed back by other electronic devices. If the first response information monitored by the electronic device within the preset response time period is greater than the preset response threshold, the electronic device may determine that the message broadcast is successful. If the first response information received by the electronic device within the preset response time period is less than or equal to the preset response threshold, the electronic device can determine that the message broadcast failed and re-broadcast the message to prevent the message from being audited by others in the post-event auditing process. Node forgery or tampering.
在以上的描述中,当通信链路被攻击时,通信链路上的电子设备可以进入混杂模式,以广播的形式对外传输报文,以及,监听其他电子设备发送的报文,维持通信服务。In the above description, when the communication link is attacked, the electronic devices on the communication link can enter the promiscuous mode, transmit messages in the form of broadcast, and monitor messages sent by other electronic devices to maintain communication services.
此时,第一电子设备和第二电子设备可以一直通过广播的形式进行数据交互。At this time, the first electronic device and the second electronic device can always perform data interaction in the form of broadcasting.
或者,第一电子设备和第二电子设备也可以协商并确定新的路由设备。在确定了新的路由设备之后,新的路由设备可以创建新的局域网,并开放热点。其他电子设备接入新的路由设备开放的热点,通过新的局域网实现正常的通信服务。Alternatively, the first electronic device and the second electronic device may also negotiate and determine a new routing device. After the new routing device is determined, the new routing device can create a new local area network and open the hotspot. Other electronic devices are connected to the hotspot opened by the new routing device, and normal communication services are realized through the new local area network.
各个电子设备协商新的路由设备的方式可以根据实际情况进行选择。The manner in which each electronic device negotiates a new routing device can be selected according to the actual situation.
在一些可能的实现方式中,各个电子设备可以对外广播本设备的Wi-Fi通信能力参数。Wi-Fi通信能力参数的具体参数类型可以根据实际需求进行设置。例如,Wi-Fi通信能力参数可以设置为发射功率、接收灵敏度、吞吐量等参数中一种或多种。In some possible implementations, each electronic device may broadcast the Wi-Fi communication capability parameter of the device to the outside world. The specific parameter type of the Wi-Fi communication capability parameter can be set according to actual requirements. For example, the Wi-Fi communication capability parameter may be set as one or more of parameters such as transmit power, receive sensitivity, and throughput.
然后,将Wi-Fi通信能力参数最优的电子设备作为新的路由设备。新的路由设备创建局域网,对外开放热点,允许其他电子设备接入。其他电子设备接入该热点,通过新的路由设备创建的局域网恢复通信服务。Then, the electronic device with the optimal Wi-Fi communication capability parameter is used as a new routing device. The new routing device creates a local area network, opening hotspots to the outside world, allowing other electronic devices to access. Other electronic devices connect to the hotspot and restore communication services through the local area network created by the new routing device.
在另一些可能的实现方式中,可以由某一电子设备主动广播建网请求报文,其他电子设备监听到该建网请求报文之后,反馈第一响应信息至上述建网请求报文的发送方。In some other possible implementation manners, an electronic device may actively broadcast the network construction request message, and other electronic devices will feed back the first response information to the sending of the network construction request message after monitoring the network construction request message. square.
当建网请求报文的发送方接收到的第一响应信息大于第一响应阈值时,建网请求报文的发送方创建局域网,对外开放热点,允许其他电子设备接入。其他电子设备接入该热点,通过新的路由设备创建的局域网恢复通信服务。When the first response information received by the sender of the network establishment request message is greater than the first response threshold, the sender of the network establishment request message creates a local area network, opens the hotspot to the outside world, and allows other electronic devices to access. Other electronic devices connect to the hotspot and restore communication services through the local area network created by the new routing device.
3、事后审计。3. Post audit.
在第2节描述的内容中,将电子设备发送的报文称为事实。电子设备需要对外传递的事实可以包括两类事实。In what is described in Section 2, the message sent by the electronic device is referred to as a fact. The facts that electronic devices need to transmit externally can include two types of facts.
第一类事实是故障信息。故障信息可以包括故障时间、故障对象、故障类型等信息中的一项或多项。The first category of facts is fault information. The fault information may include one or more items of information such as fault time, fault object, and fault type.
例如,假设电子设备A在第一时刻未检测到电子设备B返回的第二心跳信息,则电子设备A判定通信链路被攻击,进入混杂模式。此时,电子设备A需要对外广播的事实可以包括第一时刻(故障时间)、电子设备B(故障对象)、信息不可达(故障类型)。For example, if the electronic device A does not detect the second heartbeat information returned by the electronic device B at the first moment, the electronic device A determines that the communication link is attacked and enters the promiscuous mode. At this time, the fact that electronic device A needs to broadcast to the outside may include the first moment (failure time), electronic device B (failure object), and information unreachable (failure type).
假设电子设备B在第二时刻未检测到电子设备A发送的第一心跳信息,则电子设备B判定通信链路被攻击,进入混杂模式。此时,电子设备B需要对外广播的事实可以包括第二时刻(故障时间)、电子设备A(故障对象)、信息不可达(故障类型)。Assuming that the electronic device B does not detect the first heartbeat information sent by the electronic device A at the second moment, the electronic device B determines that the communication link is attacked and enters the promiscuous mode. At this time, the fact that the electronic device B needs to broadcast to the outside may include the second moment (failure time), the electronic device A (the failure object), and the information unreachable (the failure type).
第二类事实是业务信息。在通信系统中,电子设备可能具备特定的业务功能。例如,摄像头可以采集图像信息,红外传感器可以采集红外信息。The second type of fact is business information. In a communication system, electronic equipment may have specific business functions. For example, a camera can collect image information, and an infrared sensor can collect infrared information.
当电子设备执行业务功能时,可能会产生需要对外传输的业务信息。When an electronic device performs a business function, it may generate business information that needs to be transmitted externally.
例如,当红外传感器检测到某个区域存在异常的红外信息,可以将该区域的位置信息传递至摄像头,摄像头根据接收到的位置信息调整镜头方向,拍摄上述区域的图像,完成红外传感器与摄像头的联动。此时,上述区域的位置信息就是红外传感器需要传递给摄像头的业务信息。For example, when the infrared sensor detects abnormal infrared information in a certain area, it can transmit the location information of the area to the camera, and the camera adjusts the direction of the lens according to the received location information, takes the image of the above area, and completes the connection between the infrared sensor and the camera. linkage. At this time, the location information of the above area is the business information that the infrared sensor needs to transmit to the camera.
又比如,智能家居的中控设备通过互联网接收到开门指令,然后,中控设备将发送开门指令至智能门锁,智能门锁接收到开门指令后执行开门操作。此时,上述开门指令就是中控设备需要传递给智能门锁的业务信息。For another example, the central control device of the smart home receives the door opening command through the Internet, and then the central control device will send the door opening command to the smart door lock, and the smart door lock will execute the door opening operation after receiving the door opening command. At this time, the above door opening instruction is the business information that the central control device needs to transmit to the smart door lock.
当其他电子设备监听到上述事实之后,可以对事实的签名进行验证,验证通过,则将事实存储在本地。When other electronic devices monitor the above facts, they can verify the signature of the facts, and if the verification passes, the facts are stored locally.
在进行事后审计时,管理设备可以响应于用户的操作,与各个电子设备通信连接,获取各个电子设备记录的事实。During the post-event audit, the management device may communicate with each electronic device in response to the user's operation, and obtain the facts recorded by each electronic device.
管理设备可以为当前通信系统中的任意电子设备,或者,管理设备也可以为当前通信系统以外的电子设备。管理设备可以通过有线通信连接和/或无线通信连接的方式与各个电子设备通信连接,本申请实施例对管理设备与电子设备的通信连接的方式不作任何限制。The management device may be any electronic device in the current communication system, or the management device may also be an electronic device outside the current communication system. The management device may be communicatively connected to each electronic device through wired communication connection and/or wireless communication connection, and the embodiment of the present application does not impose any limitation on the communication connection between the management device and the electronic device.
管理设备在获取到各个电子设备记录的事实之后。可以使用各个事实的发送方的公钥对各个事实中的签名进行验证,核实上述事实的发送方身份。然后管理设备可以将经过验证的事实展示给用户,以便用户了解通信链路被攻击的过程以及通信链路被攻击之后各个电子设备交互的业务信息。After the management device obtains the facts recorded by each electronic device. The signature in each fact can be verified using the public key of the sender of each fact, verifying the identity of the sender of the fact. Then the management device can show the verified facts to the user, so that the user can understand the process of the communication link being attacked and the service information exchanged by each electronic device after the communication link is attacked.
此外,由于各个电子设备进入混杂模式的时间不一致,所以电子设备监听到的报文,可能是残缺的。因此,管理设备从各个电子设备中获取到各个电子设备记录的事实之后, 如果发现残缺的事实,可以对各个电子设备监听到的事实进行拼接和还原,以得到完整的事实。In addition, since the time when each electronic device enters the promiscuous mode is inconsistent, the packets monitored by the electronic device may be incomplete. Therefore, after the management device obtains the facts recorded by each electronic device from each electronic device, if incomplete facts are found, the facts monitored by each electronic device can be spliced and restored to obtain complete facts.
以下将结合具体的应用场景对管理设备拼接事实的过程进行描述。The process of managing device splicing facts will be described below with reference to specific application scenarios.
应用场景七:Application Scenario Seven:
如图12所示,在图12所示的通信系统中,笔记本电脑71、智能电视72、笔记本电脑73、台式电脑74为物联网中的电子设备。笔记本电脑75为管理设备。As shown in FIG. 12 , in the communication system shown in FIG. 12 , the notebook computer 71 , the smart TV 72 , the notebook computer 73 , and the desktop computer 74 are electronic devices in the Internet of Things. The notebook computer 75 is a management device.
笔记本电脑71、智能电视72、笔记本电脑73和台式电脑74均处于混杂模式下。 Laptop 71, smart TV 72, laptop 73 and desktop 74 are all in promiscuous mode.
在某一时刻,笔记本电脑71对外广播了一条注入报文,智能电视72、笔记本电脑73、台式电脑74均监听了该注入报文。但是,因为智能电视72、笔记本电脑73、台式电脑74进入混杂模式的时间不一致,以及信道噪声等因素,智能电视72、笔记本电脑73、台式电脑74均只监听到了该注入报文的部分片段。At a certain moment, the notebook computer 71 broadcasts an injection message, and the smart TV 72, the notebook computer 73, and the desktop computer 74 all monitor the injection message. However, due to the inconsistent time when the smart TV 72 , the notebook computer 73 , and the desktop computer 74 enter the promiscuous mode, as well as the channel noise and other factors, the smart TV 72 , the notebook computer 73 , and the desktop computer 74 only listen to part of the injected message.
智能电视72监听到了报文片段A,台式电脑74监听到了报文片段B,笔记本电脑73监听到了报文片段C。The smart TV 72 has monitored the message segment A, the desktop computer 74 has monitored the message segment B, and the laptop computer 73 has monitored the message segment C.
当笔记本电脑75响应于用户的操作,分别与智能电视72、笔记本电脑73、台式电脑74通信连接时,笔记本电脑75可以从智能电视72、笔记本电脑73、台式电脑74中获取到报文片段A、报文片段B以及报文片段C。When the notebook computer 75 is communicatively connected to the smart TV 72 , the notebook computer 73 , and the desktop computer 74 in response to the user's operation, the notebook computer 75 can obtain the message segment A from the smart TV 72 , the notebook computer 73 , and the desktop computer 74 . , message fragment B, and message fragment C.
如图13所示,虽然报文片段A、报文片段B以及报文片段C都不完整,但是笔记本电脑75获取到报文片段A、报文片段B以及报文片段C之后,可以将报文片段A、报文片段B以及报文片段C拼接成完整的注入报文,从而获取到笔记本电脑71在上述时刻广播的报文。As shown in FIG. 13 , although the message fragment A, the message fragment B, and the message fragment C are not complete, after the notebook computer 75 obtains the message fragment A, the message fragment B, and the message fragment C, it can The message segment A, the message segment B, and the message segment C are spliced into a complete injected message, so as to obtain the message broadcast by the notebook computer 71 at the above-mentioned moment.
由上可知,管理设备可以从通信系统中的各个电子设备获取该电子设备记录的事实。当某些事实为残缺的报文片段时,管理设备可以根据多个电子设备记录的报文片段进行拼接和还原,从而得到完整的事实。As can be seen from the above, the management device can obtain the fact recorded by the electronic device from each electronic device in the communication system. When some facts are incomplete message fragments, the management device can splicing and restore the message fragments recorded by multiple electronic devices, so as to obtain complete facts.
此外,由于各个电子设备中,可能存在部分电子设备被控制。这些被控制的电子设备可能会发送错误的事实以混淆正确的事实。In addition, due to each electronic device, some electronic devices may be controlled. These controlled electronic devices may send false facts to obfuscate the correct facts.
因此,如果管理设备在拼接和还原事实之后,发现一条或多条事实存在多个版本,则管理设备可以将存在多个版本的事实定义为存疑事实,对存疑事实进行投票。Therefore, if the management device finds that there are multiple versions of one or more facts after splicing and restoring the facts, the management device can define the fact that there are multiple versions as a questionable fact, and vote on the questionable fact.
在大多数场景下,通信系统中只有少数节点被攻击。因此,在投票的过程中,管理设备可以根据少数服从多数的原则,将最多电子设备支持的版本确定为该存疑事实的真实版本。In most scenarios, only a few nodes in the communication system are attacked. Therefore, in the process of voting, the management device can determine the version supported by the most electronic devices as the real version of the questionable fact according to the principle of minority obeying the majority.
此外,管理设备还可以将投票过程展示给用户。例如,管理设备可以设置以时间为轴的条带,将完整的记录时间分成一个个的时间段,每个时间段对应一部分条带。若管理设备获取到某个时间段的事实不是存疑事实,且被多个电子设备监听到,则将该时间段对应的条带标记为绿色。若管理设备获取到某个时间段的事实不是存疑事实,但是仅被一个电子设备监听到,则表示该事实的真实性需要用户进一步确认,管理设备将该时间段对应的条带标记为黄色。若管理设备获取到的某个时间段的事实是存疑事实,则管理设备可以将该时间段对应的条带标记为红色,并展示各个电子设备的投票结果。管理设备在投票结束后,可能生成一条包括红黄蓝三种颜色的条带,用户可以通过条带直观地查看投票过程中各个电子设备的投票行为,以便用户查找被攻击的电子设备。比如,用户可以查看红色条 带部分每个电子设备的投票结果,假设某个电子设备每次投票都是少数的一方,则用户应当检查该电子设备是否被攻击。In addition, the management device can also show the voting process to the user. For example, the management device may set strips with time as the axis, and divide the complete recording time into time segments, each time segment corresponding to a part of the strip. If the fact that the management device acquires a certain time period is not a suspicious fact and is monitored by multiple electronic devices, the strip corresponding to the time period is marked green. If the fact that the management device acquires a certain time period is not a suspicious fact, but is only monitored by one electronic device, it means that the authenticity of the fact needs further confirmation by the user, and the management device marks the strip corresponding to the time period in yellow. If the fact obtained by the management device in a certain time period is a questionable fact, the management device can mark the strip corresponding to the time period in red, and display the voting results of each electronic device. After the voting is over, the management device may generate a strip with three colors of red, yellow and blue. The user can visually check the voting behavior of each electronic device during the voting process through the strip, so that the user can find the electronic device that was attacked. For example, the user can view the voting results of each electronic device in the red strip. If a certain electronic device is voted by a minority every time, the user should check whether the electronic device is attacked.
应用场景八:Application Scenario Eight:
如图14所示,在图13所示的通信系统中,笔记本电脑81、笔记本电脑83、台式电脑84、智能电视85为物联网中的电子设备。路由器82为路由设备。笔记本电脑86为管理设备。As shown in FIG. 14 , in the communication system shown in FIG. 13 , the notebook computer 81 , the notebook computer 83 , the desktop computer 84 , and the smart TV 85 are electronic devices in the Internet of Things. The router 82 is a routing device. The notebook computer 86 is the management device.
在第一时刻,笔记本电脑81、笔记本电脑83、台式电脑84、智能电视85均接入了路由器82开放的热点。At the first moment, the notebook computer 81 , the notebook computer 83 , the desktop computer 84 , and the smart TV 85 are all connected to the hotspot opened by the router 82 .
在第二时刻,路由器82和智能电视85被黑客攻击,路由器82将停止转发笔记本电脑81和台式电脑84的信息,通信链路遭受了“路径攻击”。At the second moment, the router 82 and the smart TV 85 are attacked by hackers, the router 82 will stop forwarding the information of the laptop computer 81 and the desktop computer 84, and the communication link suffers a "path attack".
笔记本电脑81、笔记本电脑83、台式电脑84、智能电视85在检测到通信链路被攻击之后,进入混杂模式。The notebook computer 81 , the notebook computer 83 , the desktop computer 84 , and the smart TV 85 enter the promiscuous mode after detecting that the communication link is attacked.
在第三时刻,笔记本电脑81对外广播注入报文A。At the third moment, the notebook computer 81 broadcasts the injection message A to the outside world.
如图14所示,笔记本电脑83、台式电脑84、智能电视85均监听到了注入报文A,并在验证了注入报文A的签名后,将注入报文A存储在本地。As shown in FIG. 14 , the notebook computer 83 , the desktop computer 84 , and the smart TV 85 all monitor the injection message A, and after verifying the signature of the injection message A, store the injection message A locally.
在第四时刻,笔记本电脑86分别与笔记本电脑83、台式电脑84、智能电视85通信连接,获取笔记本电脑83、台式电脑84、智能电视85记录的事实。At the fourth moment, the notebook computer 86 is respectively connected in communication with the notebook computer 83 , the desktop computer 84 , and the smart TV 85 to obtain the facts recorded by the notebook computer 83 , the desktop computer 84 , and the smart TV 85 .
笔记本电脑83监听到了注入报文A,但是笔记本电脑83只监听到了注入报文A的部分信息,即报文片段1。The notebook computer 83 monitors the injected packet A, but the notebook computer 83 only monitors part of the information of the injected packet A, that is, the packet fragment 1.
台式电脑84监听到了注入报文A,但是台式电脑84也只是监听到了注入报文A的部分信息,即注入报文2。The desktop computer 84 monitors the injected message A, but the desktop computer 84 only monitors part of the information of the injected message A, that is, the injected message 2 .
智能电视85监听到了完整的注入报文A,但是智能电视被黑客控制,篡改了注入报文A,得到注入报文B。The smart TV 85 has monitored the complete injection packet A, but the smart TV is controlled by a hacker, tampering with the injection packet A, and obtaining the injection packet B.
因此,笔记本电脑86分别与笔记本电脑83、台式电脑84、智能电视85通信连接之后,笔记本电脑83发送报文片段1至笔记本电脑86,台式电脑84发送报文片段2至笔记本电脑86,智能电视85发送注入报文B至笔记本电脑86。Therefore, after the notebook computer 86 is respectively connected to the notebook computer 83, the desktop computer 84 and the smart TV 85, the notebook computer 83 sends the message fragment 1 to the notebook computer 86, the desktop computer 84 sends the message fragment 2 to the notebook computer 86, and the smart TV 85 sends the injection message B to the laptop computer 86 .
如图15所示,笔记本电脑86接收到报文片段1和报文片段2后,将报文片段1和报文片段2拼接为注入报文A。As shown in FIG. 15 , after receiving the packet fragment 1 and the packet fragment 2, the notebook computer 86 splices the packet fragment 1 and the packet fragment 2 into the injected packet A.
此时,笔记本电脑86发现同一条报文存在注入报文A和注入报文B两个版本。因此,笔记本电脑86对注入报文A和注入报文B进行投票。At this time, the notebook computer 86 finds that there are two versions of the injected message A and the injected message B in the same message. Therefore, the notebook computer 86 votes for the injected message A and the injected message B.
由于笔记本电脑83的报文片段1和台式电脑84的报文片段2支持注入报文A,智能电视85支持注入报文B。Since the message segment 1 of the notebook computer 83 and the message segment 2 of the desktop computer 84 support the injection of the message A, the smart TV 85 supports the injection of the message B.
因此,注入报文A和注入报文B的投票结果为2:1,所以,笔记本电脑86判定注入报文A为真实的事实,注入报文B为虚假的事实。Therefore, the voting result of the injected message A and the injected message B is 2:1, so the notebook computer 86 determines that the injected message A is a true fact, and the injected message B is a false fact.
由上可知,管理设备在拼接和还原事实之后,如果发现一条或多条事实存在多个版本,则管理设备可以通过投票的方式,将最多电子设备支持的版本确定为该存疑事实的真实版本,从而识别真实的事实。As can be seen from the above, after the management device splices and restores the facts, if it finds that there are multiple versions of one or more facts, the management device can vote to determine the version supported by the most electronic devices as the real version of the questionable fact. thereby identifying the true facts.
应用场景九:Application scenario nine:
如图16所示,用户的家中设置有路由器91、笔记本电脑92、智能电视93、摄像头 94、红外探测仪95、报警器96、监控主机97。As shown in Fig. 16, a router 91, a notebook computer 92, a smart TV 93, a camera 94, an infrared detector 95, an alarm 96, and a monitoring host 97 are provided in the user's home.
路由器91、笔记本电脑92、智能电视93、摄像头94、红外探测仪95、报警器96、监控主机97均设置有Wi-Fi通信模块。The router 91 , the notebook computer 92 , the smart TV 93 , the camera 94 , the infrared detector 95 , the alarm 96 , and the monitoring host 97 are all provided with Wi-Fi communication modules.
在第五时刻,路由器91为路由设备,创建了局域网,并开放热点。At the fifth moment, the router 91 is a routing device, creates a local area network, and opens a hotspot.
笔记本电脑92、智能电视93、摄像头94、红外探测仪95、报警器96分别通过本设备的Wi-Fi通信模块接入了路由器91开放的热点。The notebook computer 92 , the smart TV 93 , the camera 94 , the infrared detector 95 , and the alarm 96 are respectively connected to the hotspot opened by the router 91 through the Wi-Fi communication module of the device.
并且,红外探测仪95和摄像头94建立了心跳互锁机制,摄像头94分别与笔记本电脑92和报警器96建立了心跳互锁机制。In addition, the infrared detector 95 and the camera 94 establish a heartbeat interlock mechanism, and the camera 94 establishes a heartbeat interlock mechanism with the notebook computer 92 and the alarm 96 respectively.
监控主机97的Wi-Fi通信模块始终处于混杂模式,监控主机97用于监听并存储所有经过该监控主机97的Wi-Fi通信模块的报文。The Wi-Fi communication module of the monitoring host 97 is always in the promiscuous mode, and the monitoring host 97 is used to monitor and store all messages passing through the Wi-Fi communication module of the monitoring host 97 .
如图17所示,在第六时刻,路由器91和笔记本电脑92被黑客攻击,此时路由器91针对性的丢弃红外探测仪95发送的报文。As shown in FIG. 17 , at the sixth moment, the router 91 and the laptop 92 are attacked by hackers. At this time, the router 91 discards the packets sent by the infrared detector 95 in a targeted manner.
因此,基于心跳互锁机制,红外探测仪95和摄像头94将陆续检测到通信链路被攻击,所以,红外探测仪95的Wi-Fi通信模块和摄像头94的Wi-Fi通信模块陆续进入混杂模式。Therefore, based on the heartbeat interlocking mechanism, the infrared detector 95 and the camera 94 will successively detect that the communication link is attacked. Therefore, the Wi-Fi communication module of the infrared detector 95 and the Wi-Fi communication module of the camera 94 will successively enter the promiscuous mode. .
由于摄像头94检测到通信链路被攻击,所以摄像头94停止发送第一心跳信息或响应第二心跳信息,所以笔记本电脑92的Wi-Fi通信模块和报警器96的Wi-Fi通信模块也陆续进入混杂模式。Since the camera 94 detects that the communication link is attacked, the camera 94 stops sending the first heartbeat information or responding to the second heartbeat information, so the Wi-Fi communication module of the notebook computer 92 and the Wi-Fi communication module of the alarm 96 also enter one after another. Promiscuous mode.
如图18所示,在第七时刻,红外探测仪95的Wi-Fi通信模块、摄像头94的Wi-Fi通信模块、笔记本电脑92的Wi-Fi通信模块、报警器96的Wi-Fi通信模块以及监控主机97的Wi-Fi通信模块均处于混杂模式,断开了与路由器91的连接。As shown in FIG. 18 , at the seventh moment, the Wi-Fi communication module of the infrared detector 95 , the Wi-Fi communication module of the camera 94 , the Wi-Fi communication module of the notebook computer 92 , and the Wi-Fi communication module of the alarm device 96 And the Wi-Fi communication module of the monitoring host 97 is in the promiscuous mode, and the connection with the router 91 is disconnected.
在第八时刻,黑客进入用户家中,并停留在区域1中。区域1在红外探测仪95的探测区域内,红外探测仪95检测到区域A存在异常红外信号,生成注入报文1。At the eighth moment, the hacker enters the user's home and stays in area 1. The area 1 is within the detection area of the infrared detector 95 , and the infrared detector 95 detects that an abnormal infrared signal exists in the area A, and generates an injection message 1 .
注入报文1包括探测时间、区域1的位置信息以及探测事件(即存在异常红外信号)。The injected message 1 includes the detection time, the location information of the area 1, and the detection event (ie, there is an abnormal infrared signal).
如图19所示,红外探测仪95使用本设备的私钥对注入报文1进行签名,将签名后的注入报文1注入本设备的Wi-Fi通信模块的空口中,对外广播注入报文1。As shown in Figure 19, the infrared detector 95 uses the private key of the device to sign the injection message 1, injects the signed injection message 1 into the air interface of the Wi-Fi communication module of the device, and broadcasts the injection message to the outside world. 1.
之后,笔记本电脑92监听到注入报文1,使用红外探测仪95的公钥对注入报文1的签名进行验证。验证通过,笔记本电脑92用本设备的私钥对注入报文1进行签名,存储在本地。After that, the notebook computer 92 monitors the injected message 1, and uses the public key of the infrared detector 95 to verify the signature of the injected message 1. If the verification is passed, the notebook computer 92 signs the injection message 1 with the private key of the device and stores it locally.
报警器96的监听到注入报文1,使用红外探测仪95的公钥对注入报文1的签名进行验证。验证通过,报警器96用本设备的私钥对注入报文1进行签名,存储在本地。The alarm 96 monitors the injected message 1, and uses the public key of the infrared detector 95 to verify the signature of the injected message 1. If the verification is passed, the alarm 96 signs the injection message 1 with the private key of the device and stores it locally.
监控主机97的监听到注入报文1,使用红外探测仪95的公钥对注入报文1的签名进行验证。验证通过,监控主机97用本设备的私钥对注入报文1进行签名,存储在本地。The monitoring host 97 monitors the injected message 1 and uses the public key of the infrared detector 95 to verify the signature of the injected message 1 . If the verification is passed, the monitoring host 97 signs the injection message 1 with the private key of the device and stores it locally.
摄像头94监听到注入报文1,使用红外探测仪95的公钥对注入报文1的签名进行验证。验证通过,摄像头94根据注入报文1的内容,调整摄像头94的拍摄角度,拍摄区域1的图像。并且,摄像头94用本设备的私钥对注入报文1进行签名,存储在本地。The camera 94 monitors the injected message 1, and uses the public key of the infrared detector 95 to verify the signature of the injected message 1. If the verification is passed, the camera 94 adjusts the shooting angle of the camera 94 according to the content of the injected message 1 to shoot the image of the area 1 . In addition, the camera 94 signs the injection message 1 with the private key of the device and stores it locally.
如图20所示,摄像头94采集到区域1的图像后,生成注入报文2。注入报文2包括拍摄时间以及拍摄图像。摄像头94使用本设备的私钥对注入报文2进行签名,并将签名后的注入报文2注入本设备的Wi-Fi通信模块的空口中,对外广播注入报文2。As shown in FIG. 20 , after the camera 94 captures the image of the area 1, an injection message 2 is generated. The injection message 2 includes the shooting time and the shooting image. The camera 94 signs the injection message 2 using the private key of the device, injects the signed injection message 2 into the air interface of the Wi-Fi communication module of the device, and broadcasts the injection message 2 to the outside.
笔记本电脑92监听到注入报文2,使用摄像头94的公钥对注入报文2的签名进行验 证。验证通过,笔记本电脑92用本设备的私钥对注入报文2进行签名,存储在本地。The notebook computer 92 monitors the injected message 2, and uses the public key of the camera 94 to verify the signature of the injected message 2. If the verification is passed, the notebook computer 92 signs the injection message 2 with the private key of the device and stores it locally.
报警器96的监听到注入报文2,使用摄像头94的公钥对注入报文2的签名进行验证。验证通过,报警器96用本设备的私钥对注入报文2进行签名,存储在本地。The alarm 96 monitors the injected message 2, and uses the public key of the camera 94 to verify the signature of the injected message 2. If the verification is passed, the alarm 96 signs the injection message 2 with the private key of the device and stores it locally.
监控主机97的监听到注入报文2,使用摄像头94的公钥对注入报文2的签名进行验证。验证通过,监控主机97用本设备的私钥对注入报文2进行签名,存储在本地。The monitoring host 97 monitors the injected message 2 and uses the public key of the camera 94 to verify the signature of the injected message 2 . If the verification is passed, the monitoring host 97 signs the injection message 2 with the private key of the device and stores it locally.
红外探测仪95的监听到注入报文2,使用摄像头94的公钥对注入报文2的签名进行验证。验证通过,红外探测仪95用本设备的私钥对注入报文2进行签名,存储在本地。The infrared detector 95 monitors the injected message 2 and uses the public key of the camera 94 to verify the signature of the injected message 2 . If the verification is passed, the infrared detector 95 signs the injection message 2 with the private key of the device and stores it locally.
在第九时刻,用户回到家之后,开启台式电脑98。如图21所示,台式电脑98响应于用户的操作,分别与笔记本电脑92、智能电视93、摄像头94、红外探测仪95、报警器96、监控主机97建立通信连接,获取各个电子设备记录的事实。At the ninth time, after the user returns home, the desktop computer 98 is turned on. As shown in FIG. 21, the desktop computer 98 establishes a communication connection with the notebook computer 92, the smart TV 93, the camera 94, the infrared detector 95, the alarm 96, and the monitoring host 97 in response to the user's operation, respectively, and obtains the data recorded by each electronic device. fact.
笔记本电脑92由于被黑客攻击了,因此,笔记本电脑92记录的注入报文1被篡改为注入报文3,注入报文2被篡改为注入报文4。Since the laptop computer 92 was attacked by a hacker, the injection packet 1 recorded by the laptop computer 92 was tampered with the injection packet 3, and the injection packet 2 was tampered with the injection packet 4.
智能电视93的Wi-Fi通信模块未进入混杂模式,所以智能电视93未记录事实。The Wi-Fi communication module of the smart TV 93 does not enter the promiscuous mode, so the smart TV 93 does not record the fact.
摄像头94记录有注入报文1。The camera 94 records the injection message 1 .
红外探测仪95记录有注入报文2的片段(报文片段2.1)。The infrared detector 95 records a fragment of the injected message 2 (message fragment 2.1).
报警器96记录有注入报文1的片段(报文片段1.1)以及注入报文2的片段(报文片段2.2)。The alarm 96 records the segment injected into message 1 (message segment 1.1) and the segment injected into message 2 (message segment 2.2).
监控主机97记录有注入报文1以及注入报文2的片段(报文片段2.3)。The monitoring host 97 records the injected packet 1 and the fragment of the injected packet 2 (the packet fragment 2.3).
因此,如图22所示,台式电脑98获取各个电子设备记录的事实之后,可以根据报文片段2.1、报文片段2.2以及报文片段2.3进行拼接,得到注入报文2。Therefore, as shown in FIG. 22 , after the desktop computer 98 obtains the facts recorded by each electronic device, it can splicing the message segment 2.1, the message segment 2.2 and the message segment 2.3 to obtain the injected message 2.
此时,存在两组存疑事实,第一组为注入报文1和注入报文3,第二组为注入报文2和注入报文4。At this time, there are two groups of dubious facts, the first group is injection packet 1 and injection packet 3, and the second group is injection packet 2 and injection packet 4.
台式电脑98分别对两组存疑事实进行投票。注入报文1和注入报文3的投票比例为3比1,注入报文2和注入报文4的投票比例为3:1。所以,台式电脑98将注入报文1和注入报文2确定为真实的事实。The desktop computer 98 voted on the two groups of questionable facts separately. The voting ratio of injected message 1 and injected message 3 is 3:1, and the voting ratio of injected message 2 and injected message 4 is 3:1. Therefore, the desktop computer 98 determines injected message 1 and injected message 2 as a real fact.
台式电脑98将真实的事实展示给用户。此时,用户可以通过注入报文1和注入报文2得知黑客曾传入用户家中,曾在区域1停留,并根据注入报文2中的拍摄图像确定黑客的外貌。The desktop computer 98 presents the real facts to the user. At this time, the user can learn that the hacker has entered the user's home and stayed in the area 1 through the injection message 1 and the injection message 2, and the appearance of the hacker can be determined according to the photographed image in the injection message 2.
综上所述,在本申请的实施例中,当电子设备检测到通信链路被攻击时,电子设备可以控制Wi-Fi通信模块进入混杂模式。此时,电子设备可以通过广播的形式对外广播报文。在混杂模式下,其对端的电子设备可以监听信道内的所有报文,从而获取到电子设备广播的报文。也即是说,当通信链路被攻击时,第一电子设备和第二电子设备可以通过广播机制建立应急可信通道,维持通信服务。虽然通过广播机制进行通信会导致通信服务降级,但是不会中断通信服务。To sum up, in the embodiments of the present application, when the electronic device detects that the communication link is attacked, the electronic device can control the Wi-Fi communication module to enter the promiscuous mode. At this time, the electronic device can broadcast the message to the outside in the form of broadcasting. In the promiscuous mode, the electronic device at the opposite end can monitor all the messages in the channel, so as to obtain the messages broadcast by the electronic device. That is to say, when the communication link is attacked, the first electronic device and the second electronic device can establish an emergency trusted channel through a broadcast mechanism to maintain the communication service. Although communication through the broadcast mechanism will cause the communication service to be degraded, it will not interrupt the communication service.
并且,电子设备在对外广播报文之前,可以对报文进行签名。当电子设备监听到报文之后,可以验证报文的签名。验证通过,则电子设备将该报文存储至本地。In addition, the electronic device can sign the message before broadcasting the message to the outside world. After the electronic device monitors the message, it can verify the signature of the message. If the verification is passed, the electronic device stores the message locally.
在进行事后审计时,管理设备可以从各个电子设备建立通信连接,获取各个电子设备记录的事实,即各个电子设备存储的报文。During the post-event audit, the management device can establish a communication connection from each electronic device, and obtain the facts recorded by each electronic device, that is, the messages stored by each electronic device.
管理设备对各个电子设备记录的事实进行拼接以及投票,确定真实的事实,以便用户 可以通过真实的事实了解通信链路被攻击的过程以及通信链路被攻击后各个电子设备交互的业务信息。The management device splices and votes the facts recorded by each electronic device to determine the real facts, so that users can understand the process of the communication link being attacked and the business information of each electronic device after the communication link is attacked through the real facts.
应理解,上述实施例中各步骤的序号的大小并不意味着执行顺序的先后,各过程的执行顺序应以其功能和内在逻辑确定,而不应对本申请实施例的实施过程构成任何限定。It should be understood that the size of the sequence numbers of the steps in the above embodiments does not mean the sequence of execution, and the execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.
以下,将从第一电子设备的角度,对本申请实施例提供的另一通信方法进行详细说明。请参阅图23,本实施例提供的通信方法包括:Hereinafter, another communication method provided by the embodiment of the present application will be described in detail from the perspective of the first electronic device. Referring to FIG. 23, the communication method provided by this embodiment includes:
S2301、第一电子设备对通信链路进行监测;S2301. The first electronic device monitors the communication link;
S2302、当通信链路发生故障时,第一电子设备控制第一电子设备的Wi-Fi通信模块进入混杂模式,并通过广播的形式发送第一报文。S2302. When the communication link fails, the first electronic device controls the Wi-Fi communication module of the first electronic device to enter the promiscuous mode, and sends the first message in the form of broadcasting.
应理解,上述实施例中各步骤的序号的大小并不意味着执行顺序的先后,各过程的执行顺序应以其功能和内在逻辑确定,而不应对本申请实施例的实施过程构成任何限定。It should be understood that the size of the sequence numbers of the steps in the above embodiments does not mean the sequence of execution, and the execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.
图24是本申请实施例提供的电子设备的示意图。电子设备2400可以包括处理器2410,外部存储器接口2420,内部存储器2421,通用串行总线(universal serial bus,USB)接口2430,充电管理模块2440,电源管理模块2441,电池2442,天线1,天线2,移动通信模块2450,无线通信模块2460,音频模块2470,扬声器2470A,受话器2470B,麦克风2470C,耳机接口2470D,传感器模块2480,按键2490,马达2491,指示器2492,摄像头2493,显示屏2494,以及用户标识模块(subscriber identification module,SIM)卡接口2495等。其中传感器模块2480可以包括压力传感器2480A,陀螺仪传感器2480B,气压传感器2480C,磁传感器2480D,加速度传感器2480E,距离传感器2480F,接近光传感器2480G,指纹传感器2480H,温度传感器2480J,触摸传感器2480K,环境光传感器2480L,骨传导传感器2480M等。FIG. 24 is a schematic diagram of an electronic device provided by an embodiment of the present application. The electronic device 2400 may include a processor 2410, an external memory interface 2420, an internal memory 2421, a universal serial bus (USB) interface 2430, a charge management module 2440, a power management module 2441, a battery 2442, an antenna 1, an antenna 2 , mobile communication module 2450, wireless communication module 2460, audio module 2470, speaker 2470A, receiver 2470B, microphone 2470C, headphone jack 2470D, sensor module 2480, key 2490, motor 2491, indicator 2492, camera 2493, display screen 2494, and Subscriber identification module (subscriber identification module, SIM) card interface 2495 and so on. The sensor module 2480 may include a pressure sensor 2480A, a gyroscope sensor 2480B, an air pressure sensor 2480C, a magnetic sensor 2480D, an acceleration sensor 2480E, a distance sensor 2480F, a proximity light sensor 2480G, a fingerprint sensor 2480H, a temperature sensor 2480J, a touch sensor 2480K, and ambient light. Sensor 2480L, Bone Conduction Sensor 2480M, etc.
可以理解的是,本发明实施例示意的结构并不构成对电子设备2400的具体限定。在本申请另一些实施例中,电子设备2400可以包括比图示更多或更少的部件,或者组合某些部件,或者拆分某些部件,或者不同的部件布置。图示的部件可以以硬件,软件或软件和硬件的组合实现。It can be understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on the electronic device 2400 . In other embodiments of the present application, the electronic device 2400 may include more or less components than shown, or combine some components, or separate some components, or arrange different components. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.
处理器2410可以包括一个或多个处理单元,例如:处理器2410可以包括应用处理器(application processor,AP),调制解调处理器,图形处理器(graphics processing unit,GPU),图像信号处理器(image signal processor,ISP),控制器,视频编解码器,数字信号处理器(digital signal processor,DSP),基带处理器,和/或神经网络处理器(neural-network processing unit,NPU)等。其中,不同的处理单元可以是独立的器件,也可以集成在一个或多个处理器中。The processor 2410 may include one or more processing units, for example, the processor 2410 may include an application processor (application processor, AP), a modem processor, a graphics processor (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), controller, video codec, digital signal processor (digital signal processor, DSP), baseband processor, and/or neural-network processing unit (neural-network processing unit, NPU), etc. Wherein, different processing units may be independent devices, or may be integrated in one or more processors.
控制器可以根据指令操作码和时序信号,产生操作控制信号,完成取指令和执行指令的控制。The controller can generate an operation control signal according to the instruction operation code and timing signal, and complete the control of fetching and executing instructions.
处理器2410中还可以设置存储器,用于存储指令和数据。在一些实施例中,处理器2410中的存储器为高速缓冲存储器。该存储器可以保存处理器2410刚用过或循环使用的指令或数据。如果处理器2410需要再次使用该指令或数据,可从所述存储器中直接调用。避免了重复存取,减少了处理器2410的等待时间,因而提高了系统的效率。A memory may also be provided in the processor 2410 for storing instructions and data. In some embodiments, the memory in processor 2410 is cache memory. This memory may hold instructions or data that have just been used or recycled by the processor 2410. If the processor 2410 needs to use the instruction or data again, it can be called directly from the memory. Repeated access is avoided and the waiting time of the processor 2410 is reduced, thereby improving the efficiency of the system.
在一些实施例中,处理器2410可以包括一个或多个接口。接口可以包括集成电路(inter-integrated circuit,I2C)接口,集成电路内置音频(inter-integrated circuit sound,I2S)接 口,脉冲编码调制(pulse code modulation,PCM)接口,通用异步收发传输器(universal asynchronous receiver/transmitter,UART)接口,移动产业处理器接口(mobile industry processor interface,MIPI),通用输入输出(general-purpose input/output,GPIO)接口,用户标识模块(subscriber identity module,SIM)接口,和/或通用串行总线(universal serial bus,USB)接口等。In some embodiments, the processor 2410 may include one or more interfaces. The interface may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, a universal asynchronous transceiver (universal asynchronous transmitter) receiver/transmitter, UART) interface, mobile industry processor interface (MIPI), general-purpose input/output (GPIO) interface, subscriber identity module (SIM) interface, and / or universal serial bus (universal serial bus, USB) interface, etc.
I2C接口是一种双向同步串行总线,包括一根串行数据线(serial data line,SDA)和一根串行时钟线(derail clock line,SCL)。在一些实施例中,处理器2410可以包含多组I2C总线。处理器2410可以通过不同的I2C总线接口分别耦合触摸传感器2480K,充电器,闪光灯,摄像头2493等。例如:处理器2410可以通过I2C接口耦合触摸传感器2480K,使处理器2410与触摸传感器2480K通过I2C总线接口通信,实现电子设备2400的触摸功能。The I2C interface is a bidirectional synchronous serial bus that includes a serial data line (SDA) and a serial clock line (SCL). In some embodiments, the processor 2410 may contain multiple sets of I2C buses. The processor 2410 can be respectively coupled to the touch sensor 2480K, charger, flash, camera 2493, etc. through different I2C bus interfaces. For example, the processor 2410 can couple the touch sensor 2480K through the I2C interface, so that the processor 2410 and the touch sensor 2480K communicate with each other through the I2C bus interface, so as to realize the touch function of the electronic device 2400.
I2S接口可以用于音频通信。在一些实施例中,处理器2410可以包含多组I2S总线。处理器2410可以通过I2S总线与音频模块2470耦合,实现处理器2410与音频模块2470之间的通信。在一些实施例中,音频模块2470可以通过I2S接口向无线通信模块2460传递音频信号,实现通过蓝牙耳机接听电话的功能。The I2S interface can be used for audio communication. In some embodiments, the processor 2410 may contain multiple sets of I2S buses. The processor 2410 may be coupled with the audio module 2470 through an I2S bus to implement communication between the processor 2410 and the audio module 2470. In some embodiments, the audio module 2470 can transmit audio signals to the wireless communication module 2460 through the I2S interface, so as to realize the function of answering calls through a Bluetooth headset.
PCM接口也可以用于音频通信,将模拟信号抽样,量化和编码。在一些实施例中,音频模块2470与无线通信模块2460可以通过PCM总线接口耦合。在一些实施例中,音频模块2470也可以通过PCM接口向无线通信模块2460传递音频信号,实现通过蓝牙耳机接听电话的功能。所述I2S接口和所述PCM接口都可以用于音频通信。The PCM interface can also be used for audio communications, sampling, quantizing and encoding analog signals. In some embodiments, the audio module 2470 and the wireless communication module 2460 may be coupled through a PCM bus interface. In some embodiments, the audio module 2470 can also transmit audio signals to the wireless communication module 2460 through the PCM interface, so as to realize the function of answering calls through the Bluetooth headset. Both the I2S interface and the PCM interface can be used for audio communication.
UART接口是一种通用串行数据总线,用于异步通信。该总线可以为双向通信总线。它将要传输的数据在串行通信与并行通信之间转换。在一些实施例中,UART接口通常被用于连接处理器2410与无线通信模块2460。例如:处理器2410通过UART接口与无线通信模块2460中的蓝牙模块通信,实现蓝牙功能。在一些实施例中,音频模块2470可以通过UART接口向无线通信模块2460传递音频信号,实现通过蓝牙耳机播放音乐的功能。The UART interface is a universal serial data bus used for asynchronous communication. The bus may be a bidirectional communication bus. It converts the data to be transmitted between serial communication and parallel communication. In some embodiments, a UART interface is typically used to connect the processor 2410 with the wireless communication module 2460. For example, the processor 2410 communicates with the Bluetooth module in the wireless communication module 2460 through the UART interface to implement the Bluetooth function. In some embodiments, the audio module 2470 can transmit audio signals to the wireless communication module 2460 through the UART interface, so as to realize the function of playing music through the Bluetooth headset.
MIPI接口可以被用于连接处理器2410与显示屏2494,摄像头2493等外围器件。MIPI接口包括摄像头串行接口(camera serial interface,CSI),显示屏串行接口(display serial interface,DSI)等。在一些实施例中,处理器2410和摄像头2493通过CSI接口通信,实现电子设备2400的拍摄功能。处理器2410和显示屏2494通过DSI接口通信,实现电子设备2400的显示功能。The MIPI interface can be used to connect the processor 2410 with the display screen 2494, the camera 2493 and other peripheral devices. MIPI interfaces include camera serial interface (CSI), display serial interface (DSI), etc. In some embodiments, the processor 2410 communicates with the camera 2493 through a CSI interface to implement the photographing function of the electronic device 2400 . The processor 2410 communicates with the display screen 2494 through the DSI interface to implement the display function of the electronic device 2400.
GPIO接口可以通过软件配置。GPIO接口可以被配置为控制信号,也可被配置为数据信号。在一些实施例中,GPIO接口可以用于连接处理器2410与摄像头2493,显示屏2494,无线通信模块2460,音频模块2470,传感器模块2480等。GPIO接口还可以被配置为I2C接口,I2S接口,UART接口,MIPI接口等。The GPIO interface can be configured by software. The GPIO interface can be configured as a control signal or as a data signal. In some embodiments, the GPIO interface can be used to connect the processor 2410 with the camera 2493, the display screen 2494, the wireless communication module 2460, the audio module 2470, the sensor module 2480, and the like. The GPIO interface can also be configured as I2C interface, I2S interface, UART interface, MIPI interface, etc.
USB接口2430是符合USB标准规范的接口,具体可以是Mini USB接口,Micro USB接口,USB Type C接口等。USB接口2430可以用于连接充电器为电子设备2400充电,也可以用于电子设备2400与外围设备之间传输数据。也可以用于连接耳机,通过耳机播放音频。该接口还可以用于连接其他电子设备,例如AR设备等。The USB interface 2430 is an interface that conforms to the USB standard specification, and can specifically be a Mini USB interface, a Micro USB interface, a USB Type C interface, and the like. The USB interface 2430 can be used to connect a charger to charge the electronic device 2400, and can also be used to transmit data between the electronic device 2400 and peripheral devices. It can also be used to connect headphones to play audio through the headphones. The interface can also be used to connect other electronic devices, such as AR devices.
可以理解的是,本发明实施例示意的各模块间的接口连接关系,只是示意性说明,并不构成对电子设备2400的结构限定。在本申请另一些实施例中,电子设备2400也可以采用上述实施例中不同的接口连接方式,或多种接口连接方式的组合。It can be understood that the interface connection relationship between the modules illustrated in the embodiment of the present invention is only a schematic illustration, and does not constitute a structural limitation of the electronic device 2400 . In other embodiments of the present application, the electronic device 2400 may also adopt different interface connection manners in the foregoing embodiments, or a combination of multiple interface connection manners.
充电管理模块2440用于从充电器接收充电输入。其中,充电器可以是无线充电器,也可以是有线充电器。在一些有线充电的实施例中,充电管理模块2440可以通过USB接口2430接收有线充电器的充电输入。在一些无线充电的实施例中,充电管理模块2440可以通过电子设备2400的无线充电线圈接收无线充电输入。充电管理模块2440为电池2442充电的同时,还可以通过电源管理模块2441为电子设备供电。The charging management module 2440 is used to receive charging input from the charger. The charger may be a wireless charger or a wired charger. In some wired charging embodiments, the charging management module 2440 may receive charging input from the wired charger through the USB interface 2430 . In some wireless charging embodiments, the charging management module 2440 may receive wireless charging input through the wireless charging coil of the electronic device 2400 . While the charging management module 2440 charges the battery 2442, it can also supply power to the electronic device through the power management module 2441.
电源管理模块2441用于连接电池2442,充电管理模块2440与处理器2410。电源管理模块2441接收电池2442和/或充电管理模块2440的输入,为处理器2410,内部存储器2421,显示屏2494,摄像头2493,和无线通信模块2460等供电。电源管理模块2441还可以用于监测电池容量,电池循环次数,电池健康状态(漏电,阻抗)等参数。在其他一些实施例中,电源管理模块2441也可以设置于处理器2410中。在另一些实施例中,电源管理模块2441和充电管理模块2440也可以设置于同一个器件中。The power management module 2441 is used to connect the battery 2442 , the charging management module 2440 and the processor 2410 . The power management module 2441 receives input from the battery 2442 and/or the charging management module 2440, and supplies power to the processor 2410, the internal memory 2421, the display screen 2494, the camera 2493, and the wireless communication module 2460. The power management module 2441 can also be used to monitor battery capacity, battery cycle times, battery health status (leakage, impedance) and other parameters. In some other embodiments, the power management module 2441 may also be provided in the processor 2410 . In other embodiments, the power management module 2441 and the charging management module 2440 may also be provided in the same device.
电子设备2400的无线通信功能可以通过天线1,天线2,移动通信模块2450,无线通信模块2460,调制解调处理器以及基带处理器等实现。The wireless communication function of the electronic device 2400 may be implemented by the antenna 1, the antenna 2, the mobile communication module 2450, the wireless communication module 2460, the modem processor, the baseband processor, and the like.
天线1和天线2用于发射和接收电磁波信号。电子设备2400中的每个天线可用于覆盖单个或多个通信频带。不同的天线还可以复用,以提高天线的利用率。例如:可以将天线1复用为无线局域网的分集天线。在另外一些实施例中,天线可以和调谐开关结合使用。Antenna 1 and Antenna 2 are used to transmit and receive electromagnetic wave signals. Each antenna in electronic device 2400 may be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization. For example, the antenna 1 can be multiplexed as a diversity antenna of the wireless local area network. In other embodiments, the antenna may be used in conjunction with a tuning switch.
移动通信模块2450可以提供应用在电子设备2400上的包括2G/3G/4G/5G等无线通信的解决方案。移动通信模块2450可以包括至少一个滤波器,开关,功率放大器,低噪声放大器(low noise amplifier,LNA)等。移动通信模块2450可以由天线1接收电磁波,并对接收的电磁波进行滤波,放大等处理,传送至调制解调处理器进行解调。移动通信模块2450还可以对经调制解调处理器调制后的信号放大,经天线1转为电磁波辐射出去。在一些实施例中,移动通信模块2450的至少部分功能模块可以被设置于处理器2410中。在一些实施例中,移动通信模块2450的至少部分功能模块可以与处理器2410的至少部分模块被设置在同一个器件中。The mobile communication module 2450 can provide wireless communication solutions including 2G/3G/4G/5G etc. applied on the electronic device 2400 . The mobile communication module 2450 may include at least one filter, switch, power amplifier, low noise amplifier (LNA), and the like. The mobile communication module 2450 can receive electromagnetic waves from the antenna 1, filter and amplify the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 2450 can also amplify the signal modulated by the modulation and demodulation processor, and then convert it into electromagnetic waves and radiate it out through the antenna 1 . In some embodiments, at least part of the functional modules of the mobile communication module 2450 may be provided in the processor 2410 . In some embodiments, at least part of the functional modules of the mobile communication module 2450 may be provided in the same device as at least part of the modules of the processor 2410 .
调制解调处理器可以包括调制器和解调器。其中,调制器用于将待发送的低频基带信号调制成中高频信号。解调器用于将接收的电磁波信号解调为低频基带信号。随后解调器将解调得到的低频基带信号传送至基带处理器处理。低频基带信号经基带处理器处理后,被传递给应用处理器。应用处理器通过音频设备(不限于扬声器2470A,受话器2470B等)输出声音信号,或通过显示屏2494显示图像或视频。在一些实施例中,调制解调处理器可以是独立的器件。在另一些实施例中,调制解调处理器可以独立于处理器2410,与移动通信模块2450或其他功能模块设置在同一个器件中。The modem processor may include a modulator and a demodulator. Wherein, the modulator is used to modulate the low frequency baseband signal to be sent into a medium and high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low frequency baseband signal. Then the demodulator transmits the demodulated low-frequency baseband signal to the baseband processor for processing. The low frequency baseband signal is processed by the baseband processor and passed to the application processor. The application processor outputs sound signals through audio devices (not limited to the speaker 2470A, the receiver 2470B, etc.), or displays images or videos through the display screen 2494. In some embodiments, the modem processor may be a separate device. In other embodiments, the modem processor may be independent of the processor 2410, and may be provided in the same device as the mobile communication module 2450 or other functional modules.
无线通信模块2460可以提供应用在电子设备2400上的包括无线局域网(wireless local area networks,WLAN)(如无线保真(wireless fidelity,Wi-Fi)网络),蓝牙(bluetooth,BT),全球导航卫星系统(global navigation satellite system,GNSS),调频(frequency modulation,FM),近距离无线通信技术(near field communication,NFC),红外技术(infrared,IR)等无线通信的解决方案。无线通信模块2460可以是集成至少一个通信处理模块的一个或多个器件。无线通信模块2460经由天线2接收电磁波,将电磁波信号调频以及滤波处理,将处理后的信号发送到处理器2410。无线通信模块2460还可以从处理器2410接收待发送的信号,对其进行调频,放大,经天线2转为电磁波辐射出去。The wireless communication module 2460 can provide applications on the electronic device 2400 including wireless local area networks (WLAN) (such as wireless fidelity (Wi-Fi) networks), bluetooth (BT), global navigation satellites Wireless communication solutions such as global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), and infrared technology (IR). The wireless communication module 2460 may be one or more devices integrating at least one communication processing module. The wireless communication module 2460 receives electromagnetic waves via the antenna 2 , frequency modulates and filters the electromagnetic wave signals, and sends the processed signals to the processor 2410 . The wireless communication module 2460 can also receive the signal to be sent from the processor 2410 , perform frequency modulation on it, amplify the signal, and then convert it into an electromagnetic wave for radiation through the antenna 2 .
在一些实施例中,电子设备2400的天线1和移动通信模块2450耦合,天线2和无线通信模块2460耦合,使得电子设备2400可以通过无线通信技术与网络以及其他设备通信。所述无线通信技术可以包括全球移动通讯系统(global system for mobile communications,GSM),通用分组无线服务(general packet radio service,GPRS),码分多址接入(code division multiple access,CDMA),宽带码分多址(wideband code division multiple access,WCDMA),时分码分多址(time-division code division multiple access,TD-SCDMA),长期演进(long term evolution,LTE),BT,GNSS,WLAN,NFC,FM,和/或IR技术等。所述GNSS可以包括全球卫星定位系统(global positioning system,GPS),全球导航卫星系统(global navigation satellite system,GLONASS),北斗卫星导航系统(beidou navigation satellite system,BDS),准天顶卫星系统(quasi-zenith satellite system,QZSS)和/或星基增强系统(satellite based augmentation systems,SBAS)。In some embodiments, the antenna 1 of the electronic device 2400 is coupled with the mobile communication module 2450, and the antenna 2 is coupled with the wireless communication module 2460, so that the electronic device 2400 can communicate with the network and other devices through wireless communication technology. The wireless communication technology may include global system for mobile communications (GSM), general packet radio service (GPRS), code division multiple access (CDMA), broadband Code Division Multiple Access (WCDMA), Time Division Code Division Multiple Access (TD-SCDMA), Long Term Evolution (LTE), BT, GNSS, WLAN, NFC , FM, and/or IR technology, etc. The GNSS may include global positioning system (global positioning system, GPS), global navigation satellite system (global navigation satellite system, GLONASS), Beidou navigation satellite system (beidou navigation satellite system, BDS), quasi-zenith satellite system (quasi -zenith satellite system, QZSS) and/or satellite based augmentation systems (SBAS).
电子设备2400通过GPU,显示屏2494,以及应用处理器等实现显示功能。GPU为图像处理的微处理器,连接显示屏2494和应用处理器。GPU用于执行数学和几何计算,用于图形渲染。处理器2410可包括一个或多个GPU,其执行程序指令以生成或改变显示信息。The electronic device 2400 implements a display function through a GPU, a display screen 2494, and an application processor. The GPU is a microprocessor for image processing, and connects the display screen 2494 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. Processor 2410 may include one or more GPUs that execute program instructions to generate or alter display information.
显示屏2494用于显示图像,视频等。显示屏2494包括显示面板。显示面板可以采用液晶显示屏(liquid crystal display,LCD),有机发光二极管(organic light-emitting diode,OLED),有源矩阵有机发光二极体或主动矩阵有机发光二极体(active-matri24 organic light emitting diode的,AMOLED),柔性发光二极管(fle24 light-emitting diode,FLED),Miniled,MicroLed,Micro-oLed,量子点发光二极管(quantum dot light emitting diodes,QLED)等。在一些实施例中,电子设备2400可以包括1个或N个显示屏2494,N为大于1的正整数。Display screen 2494 is used to display images, videos, and the like. Display screen 2494 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matri24 organic light-emitting diode (active-matri24 organic light). emitting diodes, AMOLED), flexible light-emitting diodes (fle24 light-emitting diodes, FLED), Miniled, MicroLed, Micro-oLed, quantum dot light-emitting diodes (quantum dot light emitting diodes, QLED), etc. In some embodiments, the electronic device 2400 may include 1 or N display screens 2494, where N is a positive integer greater than 1.
电子设备2400可以通过ISP,摄像头2493,视频编解码器,GPU,显示屏2494以及应用处理器等实现拍摄功能。The electronic device 2400 can realize the shooting function through the ISP, the camera 2493, the video codec, the GPU, the display screen 2494 and the application processor.
ISP用于处理摄像头2493反馈的数据。例如,拍照时,打开快门,光线通过镜头被传递到摄像头感光元件上,光信号转换为电信号,摄像头感光元件将所述电信号传递给ISP处理,转化为肉眼可见的图像。ISP还可以对图像的噪点,亮度,肤色进行算法优化。ISP还可以对拍摄场景的曝光,色温等参数优化。在一些实施例中,ISP可以设置在摄像头2493中。The ISP is used to process the data fed back by the camera 2493. For example, when taking a photo, the shutter is opened, the light is transmitted to the camera photosensitive element through the lens, the light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to the ISP for processing, and converts it into an image visible to the naked eye. ISP can also perform algorithm optimization on image noise, brightness, and skin tone. ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, the ISP may be located in the camera 2493.
摄像头2493用于捕获静态图像或视频。物体通过镜头生成光学图像投射到感光元件。感光元件可以是电荷耦合器件(charge coupled device,CCD)或互补金属氧化物半导体(complementary metal-o24ide-semiconductor,CMOS)光电晶体管。感光元件把光信号转换成电信号,之后将电信号传递给ISP转换成数字图像信号。ISP将数字图像信号输出到DSP加工处理。DSP将数字图像信号转换成标准的RGB,YUV等格式的图像信号。在一些实施例中,电子设备2400可以包括1个或N个摄像头2493,N为大于1的正整数。Camera 2493 is used to capture still images or video. The object is projected through the lens to generate an optical image onto the photosensitive element. The photosensitive element can be a charge coupled device (CCD) or a complementary metal oxide semiconductor (complementary metal-o24ide-semiconductor, CMOS) phototransistor. The photosensitive element converts the optical signal into an electrical signal, and then transmits the electrical signal to the ISP to convert it into a digital image signal. The ISP outputs the digital image signal to the DSP for processing. DSP converts digital image signals into standard RGB, YUV and other formats of image signals. In some embodiments, the electronic device 2400 may include 1 or N cameras 2493 , where N is a positive integer greater than 1.
数字信号处理器用于处理数字信号,除了可以处理数字图像信号,还可以处理其他数字信号。例如,当电子设备2400在频点选择时,数字信号处理器用于对频点能量进行傅里叶变换等。A digital signal processor is used to process digital signals, in addition to processing digital image signals, it can also process other digital signals. For example, when the electronic device 2400 selects a frequency point, the digital signal processor is used to perform Fourier transform on the frequency point energy, and the like.
视频编解码器用于对数字视频压缩或解压缩。电子设备2400可以支持一种或多种视频编解码器。这样,电子设备2400可以播放或录制多种编码格式的视频,例如:动态图 像专家组(moving picture e24perts group,MPEG)24,MPEG2,MPEG3,MPEG4等。Video codecs are used to compress or decompress digital video. Electronic device 2400 may support one or more video codecs. In this way, the electronic device 2400 can play or record videos in various encoding formats, such as: Moving Picture Experts Group (moving picture e24perts group, MPEG) 24, MPEG2, MPEG3, MPEG4 and so on.
NPU为神经网络(neural-network,NN)计算处理器,通过借鉴生物神经网络结构,例如借鉴人脑神经元之间传递模式,对输入信息快速处理,还可以不断的自学习。通过NPU可以实现电子设备2400的智能认知等应用,例如:图像识别,人脸识别,语音识别,文本理解等。The NPU is a neural-network (NN) computing processor. By drawing on the structure of biological neural networks, such as the transfer mode between neurons in the human brain, it can quickly process the input information, and can continuously learn by itself. Applications such as intelligent cognition of the electronic device 2400 can be implemented through the NPU, such as image recognition, face recognition, speech recognition, text understanding, and the like.
外部存储器接口2420可以用于连接外部存储卡,例如Micro SD卡,实现扩展电子设备2400的存储能力。外部存储卡通过外部存储器接口2420与处理器2410通信,实现数据存储功能。例如将音乐,视频等文件保存在外部存储卡中。The external memory interface 2420 can be used to connect an external memory card, such as a Micro SD card, to expand the storage capacity of the electronic device 2400. The external memory card communicates with the processor 2410 through the external memory interface 2420 to realize the data storage function. For example to save files like music, video etc in external memory card.
内部存储器2421可以用于存储计算机可执行程序代码,所述可执行程序代码包括指令。内部存储器2421可以包括存储程序区和存储数据区。其中,存储程序区可存储操作系统,至少一个功能所需的应用程序(比如声音播放功能,图像播放功能等)等。存储数据区可存储电子设备2400使用过程中所创建的数据(比如音频数据,电话本等)等。此外,内部存储器2421可以包括高速随机存取存储器,还可以包括非易失性存储器,例如至少一个磁盘存储器件,闪存器件,通用闪存存储器(universal flash storage,UFS)等。处理器2410通过运行存储在内部存储器2421的指令,和/或存储在设置于处理器中的存储器的指令,执行电子设备2400的各种功能应用以及数据处理。Internal memory 2421 may be used to store computer executable program code, which includes instructions. The internal memory 2421 may include a storage program area and a storage data area. The storage program area can store an operating system, an application program required for at least one function (such as a sound playback function, an image playback function, etc.), and the like. The storage data area may store data (such as audio data, phone book, etc.) created during the use of the electronic device 2400 and the like. In addition, the internal memory 2421 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, universal flash storage (UFS), and the like. The processor 2410 executes various functional applications and data processing of the electronic device 2400 by executing instructions stored in the internal memory 2421 and/or instructions stored in a memory provided in the processor.
电子设备2400可以通过音频模块2470,扬声器2470A,受话器2470B,麦克风2470C,耳机接口2470D,以及应用处理器等实现音频功能。例如音乐播放,录音等。The electronic device 2400 can implement audio functions through an audio module 2470, a speaker 2470A, a receiver 2470B, a microphone 2470C, an earphone interface 2470D, and an application processor. Such as music playback, recording, etc.
音频模块2470用于将数字音频信息转换成模拟音频信号输出,也用于将模拟音频输入转换为数字音频信号。音频模块2470还可以用于对音频信号编码和解码。在一些实施例中,音频模块2470可以设置于处理器2410中,或将音频模块2470的部分功能模块设置于处理器2410中。The audio module 2470 is used for converting digital audio information into analog audio signal output, and also for converting analog audio input into digital audio signal. Audio module 2470 may also be used to encode and decode audio signals. In some embodiments, the audio module 2470 may be provided in the processor 2410 , or some functional modules of the audio module 2470 may be provided in the processor 2410 .
扬声器2470A,也称“喇叭”,用于将音频电信号转换为声音信号。电子设备2400可以通过扬声器2470A收听音乐,或收听免提通话。Speakers 2470A, also known as "horns", are used to convert audio electrical signals into sound signals. Electronic device 2400 can listen to music through speaker 2470A, or listen to hands-free calls.
受话器2470B,也称“听筒”,用于将音频电信号转换成声音信号。当电子设备2400接听电话或语音信息时,可以通过将受话器2470B靠近人耳接听语音。The receiver 2470B, also referred to as the "earpiece", is used to convert audio electrical signals into sound signals. When the electronic device 2400 answers a call or a voice message, the voice can be answered by placing the receiver 2470B close to the human ear.
麦克风2470C,也称“话筒”,“传声器”,用于将声音信号转换为电信号。当拨打电话或发送语音信息时,用户可以通过人嘴靠近麦克风2470C发声,将声音信号输入到麦克风2470C。电子设备2400可以设置至少一个麦克风2470C。在另一些实施例中,电子设备2400可以设置两个麦克风2470C,除了采集声音信号,还可以实现降噪功能。在另一些实施例中,电子设备2400还可以设置三个,四个或更多麦克风2470C,实现采集声音信号,降噪,还可以识别声音来源,实现定向录音功能等。 Microphone 2470C, also known as "microphone", "microphone", is used to convert sound signals into electrical signals. When making a call or sending a voice message, the user can make a sound by approaching the microphone 2470C through the human mouth, and input the sound signal into the microphone 2470C. The electronic device 2400 may be provided with at least one microphone 2470C. In other embodiments, the electronic device 2400 can be provided with two microphones 2470C, which can implement a noise reduction function in addition to collecting sound signals. In other embodiments, the electronic device 2400 may also be provided with three, four or more microphones 2470C to collect sound signals, reduce noise, identify sound sources, and implement directional recording functions.
耳机接口2470D用于连接有线耳机。耳机接口2470D可以是USB接口2430,也可以是3.5mm的开放移动电子设备平台(open mobile terminal platform,OMTP)标准接口,美国蜂窝电信工业协会(cellular telecommunications industry association of the USA,CTIA)标准接口。The headphone jack 2470D is used to connect wired headphones. The earphone interface 2470D can be a USB interface 2430, or a 3.5mm open mobile terminal platform (OMTP) standard interface, a cellular telecommunications industry association of the USA (CTIA) standard interface.
压力传感器2480A用于感受压力信号,可以将压力信号转换成电信号。在一些实施例中,压力传感器2480A可以设置于显示屏2494。压力传感器2480A的种类很多,如电阻式压力传感器,电感式压力传感器,电容式压力传感器等。电容式压力传感器可以是包括 至少两个具有导电材料的平行板。当有力作用于压力传感器2480A,电极之间的电容改变。电子设备2400根据电容的变化确定压力的强度。当有触摸操作作用于显示屏2494,电子设备2400根据压力传感器2480A检测所述触摸操作强度。电子设备2400也可以根据压力传感器2480A的检测信号计算触摸的位置。在一些实施例中,作用于相同触摸位置,但不同触摸操作强度的触摸操作,可以对应不同的操作指令。例如:当有触摸操作强度小于第一压力阈值的触摸操作作用于短消息应用图标时,执行查看短消息的指令。当有触摸操作强度大于或等于第一压力阈值的触摸操作作用于短消息应用图标时,执行新建短消息的指令。The pressure sensor 2480A is used to sense pressure signals, and can convert the pressure signals into electrical signals. In some embodiments, the pressure sensor 2480A may be provided on the display screen 2494. There are many types of pressure sensor 2480A, such as resistive pressure sensor, inductive pressure sensor, capacitive pressure sensor and so on. The capacitive pressure sensor may be comprised of at least two parallel plates of conductive material. When a force is applied to pressure sensor 2480A, the capacitance between the electrodes changes. The electronic device 2400 determines the intensity of the pressure according to the change in capacitance. When a touch operation acts on the display screen 2494, the electronic device 2400 detects the intensity of the touch operation according to the pressure sensor 2480A. The electronic device 2400 can also calculate the touched position according to the detection signal of the pressure sensor 2480A. In some embodiments, touch operations acting on the same touch position but with different touch operation intensities may correspond to different operation instructions. For example, when a touch operation whose intensity is less than the first pressure threshold acts on the short message application icon, the instruction for viewing the short message is executed. When a touch operation with a touch operation intensity greater than or equal to the first pressure threshold acts on the short message application icon, the instruction to create a new short message is executed.
陀螺仪传感器2480B可以用于确定电子设备2400的运动姿态。在一些实施例中,可以通过陀螺仪传感器2480B确定电子设备2400围绕三个轴(即,24,y和z轴)的角速度。陀螺仪传感器2480B可以用于拍摄防抖。示例性的,当按下快门,陀螺仪传感器2480B检测电子设备2400抖动的角度,根据角度计算出镜头模组需要补偿的距离,让镜头通过反向运动抵消电子设备2400的抖动,实现防抖。陀螺仪传感器2480B还可以用于导航,体感游戏场景。The gyro sensor 2480B can be used to determine the motion attitude of the electronic device 2400 . In some embodiments, the angular velocity of electronic device 2400 about three axes (ie, 24, y and z axes) may be determined by gyro sensor 2480B. Gyro sensor 2480B can be used for image stabilization. Exemplarily, when the shutter is pressed, the gyroscope sensor 2480B detects the shaking angle of the electronic device 2400, calculates the distance to be compensated by the lens module according to the angle, and allows the lens to counteract the shaking of the electronic device 2400 through reverse motion to achieve anti-shake. The gyroscope sensor 2480B can also be used for navigation and somatosensory game scenarios.
气压传感器2480C用于测量气压。在一些实施例中,电子设备2400通过气压传感器2480C测得的气压值计算海拔高度,辅助定位和导航。Air pressure sensor 2480C is used to measure air pressure. In some embodiments, the electronic device 2400 calculates the altitude from the air pressure value measured by the air pressure sensor 2480C to assist in positioning and navigation.
磁传感器2480D包括霍尔传感器。电子设备2400可以利用磁传感器2480D检测翻盖皮套的开合。在一些实施例中,当电子设备2400是翻盖机时,电子设备2400可以根据磁传感器2480D检测翻盖的开合。进而根据检测到的皮套的开合状态或翻盖的开合状态,设置翻盖自动解锁等特性。Magnetic sensor 2480D includes a Hall sensor. The electronic device 2400 can detect the opening and closing of the flip holster using the magnetic sensor 2480D. In some embodiments, when the electronic device 2400 is a flip machine, the electronic device 2400 can detect the opening and closing of the flip according to the magnetic sensor 2480D. Further, according to the detected opening and closing state of the leather case or the opening and closing state of the flip cover, characteristics such as automatic unlocking of the flip cover are set.
加速度传感器2480E可检测电子设备2400在各个方向上(一般为三轴)加速度的大小。当电子设备2400静止时可检测出重力的大小及方向。还可以用于识别电子设备姿态,应用于横竖屏切换,计步器等应用。The acceleration sensor 2480E can detect the magnitude of the acceleration of the electronic device 2400 in various directions (generally three axes). The magnitude and direction of gravity can be detected when the electronic device 2400 is stationary. It can also be used to identify the posture of electronic devices, and can be used in applications such as horizontal and vertical screen switching, pedometers, etc.
距离传感器2480F,用于测量距离。电子设备2400可以通过红外或激光测量距离。在一些实施例中,拍摄场景,电子设备2400可以利用距离传感器2480F测距以实现快速对焦。Distance sensor 2480F for measuring distance. The electronic device 2400 can measure distance by infrared or laser. In some embodiments, when shooting a scene, the electronic device 2400 can use the distance sensor 2480F to measure the distance to achieve fast focusing.
接近光传感器2480G可以包括例如发光二极管(LED)和光检测器,例如光电二极管。发光二极管可以是红外发光二极管。电子设备2400通过发光二极管向外发射红外光。电子设备2400使用光电二极管检测来自附近物体的红外反射光。当检测到充分的反射光时,可以确定电子设备2400附近有物体。当检测到不充分的反射光时,电子设备2400可以确定电子设备2400附近没有物体。电子设备2400可以利用接近光传感器2480G检测用户手持电子设备2400贴近耳朵通话,以便自动熄灭屏幕达到省电的目的。接近光传感器2480G也可用于皮套模式,口袋模式自动解锁与锁屏。Proximity light sensor 2480G may include, for example, light emitting diodes (LEDs) and light detectors, such as photodiodes. The light emitting diodes may be infrared light emitting diodes. The electronic device 2400 emits infrared light to the outside through light emitting diodes. Electronic device 2400 uses photodiodes to detect infrared reflected light from nearby objects. When sufficient reflected light is detected, it may be determined that there is an object near the electronic device 2400 . When insufficient reflected light is detected, the electronic device 2400 may determine that there is no object near the electronic device 2400 . The electronic device 2400 can use the proximity light sensor 2480G to detect that the user holds the electronic device 2400 close to the ear to talk, so as to automatically turn off the screen to save power. Proximity light sensor 2480G can also be used in holster mode, pocket mode automatically unlock and lock screen.
环境光传感器2480L用于感知环境光亮度。电子设备2400可以根据感知的环境光亮度自适应调节显示屏2494亮度。环境光传感器2480L也可用于拍照时自动调节白平衡。环境光传感器2480L还可以与接近光传感器2480G配合,检测电子设备2400是否在口袋里,以防误触。The ambient light sensor 2480L is used to sense ambient light brightness. The electronic device 2400 can adaptively adjust the brightness of the display screen 2494 according to the perceived ambient light brightness. The ambient light sensor 2480L can also be used to automatically adjust the white balance when taking pictures. The ambient light sensor 2480L can also cooperate with the proximity light sensor 2480G to detect whether the electronic device 2400 is in the pocket to prevent accidental touch.
指纹传感器2480H用于采集指纹。电子设备2400可以利用采集的指纹特性实现指纹解锁,访问应用锁,指纹拍照,指纹接听来电等。The fingerprint sensor 2480H is used to collect fingerprints. The electronic device 2400 can use the collected fingerprint characteristics to unlock fingerprints, access application locks, take photos with fingerprints, answer incoming calls with fingerprints, and the like.
温度传感器2480J用于检测温度。在一些实施例中,电子设备2400利用温度传感器2480J检测的温度,执行温度处理策略。例如,当温度传感器2480J上报的温度超过阈值,电子设备2400执行降低位于温度传感器2480J附近的处理器的性能,以便降低功耗实施热保护。在另一些实施例中,当温度低于另一阈值时,电子设备2400对电池2442加热,以避免低温导致电子设备2400异常关机。在其他一些实施例中,当温度低于又一阈值时,电子设备2400对电池2442的输出电压执行升压,以避免低温导致的异常关机。Temperature sensor 2480J is used to detect temperature. In some embodiments, the electronic device 2400 utilizes the temperature detected by the temperature sensor 2480J to execute a temperature processing strategy. For example, when the temperature reported by the temperature sensor 2480J exceeds a threshold, the electronic device 2400 performs a performance reduction of the processor located near the temperature sensor 2480J in order to reduce power consumption and implement thermal protection. In other embodiments, when the temperature is lower than another threshold, the electronic device 2400 heats the battery 2442 to avoid abnormal shutdown of the electronic device 2400 due to low temperature. In some other embodiments, when the temperature is lower than another threshold, the electronic device 2400 boosts the output voltage of the battery 2442 to avoid abnormal shutdown caused by low temperature.
触摸传感器2480K,也称“触控器件”。触摸传感器2480K可以设置于显示屏2494,由触摸传感器2480K与显示屏2494组成触摸屏,也称“触控屏”。触摸传感器2480K用于检测作用于其上或附近的触摸操作。触摸传感器可以将检测到的触摸操作传递给应用处理器,以确定触摸事件类型。可以通过显示屏2494提供与触摸操作相关的视觉输出。在另一些实施例中,触摸传感器2480K也可以设置于电子设备2400的表面,与显示屏2494所处的位置不同。Touch sensor 2480K, also known as "touch device". The touch sensor 2480K may be disposed on the display screen 2494, and the touch sensor 2480K and the display screen 2494 form a touch screen, also called "touch screen". The touch sensor 2480K is used to detect touch operations on or near it. The touch sensor can pass the detected touch operation to the application processor to determine the type of touch event. Visual output related to touch operations may be provided through display screen 2494 . In other embodiments, the touch sensor 2480K can also be disposed on the surface of the electronic device 2400, which is different from the location where the display screen 2494 is located.
骨传导传感器2480M可以获取振动信号。在一些实施例中,骨传导传感器2480M可以获取人体声部振动骨块的振动信号。骨传导传感器2480M也可以接触人体脉搏,接收血压跳动信号。在一些实施例中,骨传导传感器2480M也可以设置于耳机中,结合成骨传导耳机。音频模块2470可以基于所述骨传导传感器2480M获取的声部振动骨块的振动信号,解析出语音信号,实现语音功能。应用处理器可以基于所述骨传导传感器2480M获取的血压跳动信号解析心率信息,实现心率检测功能。The bone conduction sensor 2480M can acquire vibration signals. In some embodiments, the bone conduction sensor 2480M can acquire the vibration signal of the vibrating bone mass of the human voice. The bone conduction sensor 2480M can also contact the human pulse and receive the blood pressure beating signal. In some embodiments, the bone conduction sensor 2480M can also be disposed in the earphone, combined with the bone conduction earphone. The audio module 2470 can analyze the voice signal based on the vibration signal of the vocal vibration bone block obtained by the bone conduction sensor 2480M, so as to realize the voice function. The application processor can analyze the heart rate information based on the blood pressure beat signal obtained by the bone conduction sensor 2480M, and realize the function of heart rate detection.
按键2490包括开机键,音量键等。按键2490可以是机械按键。也可以是触摸式按键。电子设备2400可以接收按键输入,产生与电子设备2400的用户设置以及功能控制有关的键信号输入。The keys 2490 include a power-on key, a volume key, and the like. Keys 2490 may be mechanical keys. It can also be a touch key. The electronic device 2400 may receive key inputs and generate key signal inputs related to user settings and function control of the electronic device 2400 .
马达2491可以产生振动提示。马达2491可以用于来电振动提示,也可以用于触摸振动反馈。例如,作用于不同应用(例如拍照,音频播放等)的触摸操作,可以对应不同的振动反馈效果。作用于显示屏2494不同区域的触摸操作,马达2491也可对应不同的振动反馈效果。不同的应用场景(例如:时间提醒,接收信息,闹钟,游戏等)也可以对应不同的振动反馈效果。触摸振动反馈效果还可以支持自定义。Motor 2491 can generate vibration alerts. The motor 2491 can be used for incoming call vibration alerts, and can also be used for touch vibration feedback. For example, touch operations acting on different applications (such as taking pictures, playing audio, etc.) can correspond to different vibration feedback effects. The motor 2491 can also correspond to different vibration feedback effects for touch operations on different areas of the display screen 2494 . Different application scenarios (for example: time reminder, receiving information, alarm clock, games, etc.) can also correspond to different vibration feedback effects. The touch vibration feedback effect can also support customization.
指示器2492可以是指示灯,可以用于指示充电状态,电量变化,也可以用于指示消息,未接来电,通知等。The indicator 2492 can be an indicator light, which can be used to indicate the charging status, the change of power, and can also be used to indicate messages, missed calls, notifications, and the like.
SIM卡接口2495用于连接SIM卡。SIM卡可以通过插入SIM卡接口2495,或从SIM卡接口2495拔出,实现和电子设备2400的接触和分离。电子设备2400可以支持1个或N个SIM卡接口,N为大于24的正整数。SIM卡接口2495可以支持Nano SIM卡,Micro SIM卡,SIM卡等。同一个SIM卡接口2495可以同时插入多张卡。所述多张卡的类型可以相同,也可以不同。SIM卡接口2495也可以兼容不同类型的SIM卡。SIM卡接口2495也可以兼容外部存储卡。电子设备2400通过SIM卡和网络交互,实现通话以及数据通信等功能。在一些实施例中,电子设备2400采用eSIM,即:嵌入式SIM卡。eSIM卡可以嵌在电子设备2400中,不能和电子设备2400分离。The SIM card interface 2495 is used to connect a SIM card. The SIM card can be inserted into the SIM card interface 2495 or pulled out from the SIM card interface 2495 to achieve contact and separation with the electronic device 2400 . The electronic device 2400 may support 1 or N SIM card interfaces, where N is a positive integer greater than 24. The SIM card interface 2495 can support Nano SIM card, Micro SIM card, SIM card, etc. The same SIM card interface 2495 can insert multiple cards at the same time. The types of the plurality of cards may be the same or different. The SIM card interface 2495 can also be compatible with different types of SIM cards. The SIM card interface 2495 is also compatible with external memory cards. The electronic device 2400 interacts with the network through the SIM card to realize functions such as call and data communication. In some embodiments, the electronic device 2400 employs an eSIM, ie: an embedded SIM card. The eSIM card can be embedded in the electronic device 2400 and cannot be separated from the electronic device 2400 .
所属领域的技术人员可以清楚地了解到,为了描述的方便和简洁,仅以上述各功能单元、模块的划分进行举例说明,实际应用中,可以根据需要而将上述功能分配由不同的功能单元、模块完成,即将所述装置的内部结构划分成不同的功能单元或模块,以完成以上 描述的全部或者部分功能。实施例中的各功能单元、模块可以集成在一个处理单元中,也可以是各个单元单独物理存在,也可以两个或两个以上单元集成在一个单元中,上述集成的单元既可以采用硬件的形式实现,也可以采用软件功能单元的形式实现。另外,各功能单元、模块的具体名称也只是为了便于相互区分,并不用于限制本申请的保护范围。上述系统中单元、模块的具体工作过程,可以参考前述方法实施例中的对应过程,在此不再赘述。Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. Module completion, that is, dividing the internal structure of the device into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment may be integrated in one processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit, and the above-mentioned integrated units may adopt hardware. It can also be realized in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing from each other, and are not used to limit the protection scope of the present application. For the specific working processes of the units and modules in the above-mentioned system, reference may be made to the corresponding processes in the foregoing method embodiments, which will not be repeated here.
在上述实施例中,对各个实施例的描述都各有侧重,某个实施例中没有详述或记载的部分,可以参见其它实施例的相关描述。In the foregoing embodiments, the description of each embodiment has its own emphasis. For parts that are not described or described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.
本领域普通技术人员可以意识到,结合本文中所公开的实施例描述的各示例的单元及算法步骤,能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行,取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能,但是这种实现不应认为超出本申请的范围。Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this application.
在本申请所提供的实施例中,应该理解到,所揭露的装置/电子设备和方法,可以通过其它的方式实现。例如,以上所描述的装置/电子设备实施例仅仅是示意性的,例如,所述模块或单元的划分,仅仅为一种逻辑功能划分,实际实现时可以有另外的划分方式,例如多个单元或组件可以结合或者可以集成到另一个系统,或一些特征可以忽略,或不执行。另一点,所显示或讨论的相互之间的耦合或直接耦合或通讯连接可以是通过一些接口,装置或单元的间接耦合或通讯连接,可以是电性,机械或其它的形式。In the embodiments provided in this application, it should be understood that the disclosed apparatus/electronic device and method may be implemented in other manners. For example, the above-described embodiments of the apparatus/electronic device are only illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units. Or components may be combined or may be integrated into another system, or some features may be omitted, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的,作为单元显示的部件可以是或者也可以不是物理单元,即可以位于一个地方,或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
另外,在本申请各个实施例中的各功能单元可以集成在一个处理单元中,也可以是各个单元单独物理存在,也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现,也可以采用软件功能单元的形式实现。In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
所述集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时,可以存储在一个计算机可读取存储介质中。基于这样的理解,本申请实现上述实施例方法中的全部或部分流程,也可以通过计算机程序来指令相关的硬件来完成,所述的计算机程序可存储于一计算机可读存储介质中,该计算机程序在被处理器执行时,可实现上述各个方法实施例的步骤。其中,所述计算机程序包括计算机程序代码,所述计算机程序代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读存储介质可以包括:能够携带所述计算机程序代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器(ROM,Read-Only Memory)、随机存取存储器(RAM,Random Access Memory)、电载波信号、电信信号以及软件分发介质等。需要说明的是,所述计算机可读存储介质包含的内容可以根据司法管辖区内立法和专利实践的要求进行适当的增减,例如在某些司法管辖区,根据立法和专利实践,计算机可读存储介质不包括电载波信号和电信信号。The integrated modules/units, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium. Based on this understanding, the present application can implement all or part of the processes in the methods of the above embodiments, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer When the program is executed by the processor, the steps of the foregoing method embodiments can be implemented. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file or some intermediate form, and the like. The computer-readable storage medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM, Read-Only Memory) ), random access memory (RAM, Random Access Memory), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content contained in the computer-readable storage medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, computer-readable Storage media exclude electrical carrier signals and telecommunications signals.
最后应说明的是:以上所述,仅为本申请的具体实施方式,但本申请的保护范围并不局限于此,任何在本申请揭露的技术范围内的变化或替换,都应涵盖在本申请的保护范围 之内。因此,本申请的保护范围应以所述权利要求的保护范围为准。Finally, it should be noted that: the above are only specific embodiments of the present application, but the protection scope of the present application is not limited to this, and any changes or replacements within the technical scope disclosed in the present application should be covered by the present application. within the scope of protection of the application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims (16)

  1. 一种通信方法,其特征在于,包括:A communication method, comprising:
    第一电子设备对通信链路进行监测;the first electronic device monitors the communication link;
    当所述通信链路发生故障时,所述第一电子设备控制所述第一电子设备的Wi-Fi通信模块进入混杂模式,并通过广播的形式发送第一报文。When the communication link fails, the first electronic device controls the Wi-Fi communication module of the first electronic device to enter the promiscuous mode, and sends the first message in the form of broadcasting.
  2. 根据权利要求1所述的方法,其特征在于,所述第一电子设备对通信链路进行监测,包括:The method according to claim 1, wherein the monitoring of the communication link by the first electronic device comprises:
    所述第一电子设备通过心跳互锁机制对通信链路进行监测。The first electronic device monitors the communication link through a heartbeat interlock mechanism.
  3. 根据权利要求1所述的方法,其特征在于,所述第一报文为注入报文,所述通过广播的形式发送第一报文,包括:The method according to claim 1, wherein the first packet is an injection packet, and the sending of the first packet by broadcasting comprises:
    所述第一电子设备将注入报文注入所述Wi-Fi通信模块的空口,以广播的形式发送所述注入报文。The first electronic device injects the injection message into the air interface of the Wi-Fi communication module, and sends the injection message in the form of broadcast.
  4. 根据权利要求1所述的方法,其特征在于,所述第一报文包括故障报文,所述故障报文中包括所述通信链路的故障信息。The method according to claim 1, wherein the first message includes a failure message, and the failure message includes failure information of the communication link.
  5. 根据权利要求1所述的方法,其特征在于,所述第一报文包括业务报文,所述业务报文包括所述第一电子设备的业务信息。The method according to claim 1, wherein the first packet includes a service packet, and the service packet includes service information of the first electronic device.
  6. 根据权利要求1所述的方法,其特征在于,在所述通过广播的形式发送第一报文之后,还包括:The method according to claim 1, characterized in that, after the sending the first packet in the form of broadcasting, further comprising:
    所述第一电子设备统计在预设响应时长内接收到的第一响应信息的数量,所述第一响应信息为第二电子设备接收到所述第一报文后反馈的信息,所述第一电子设备和所述第二电子设备处于同一局域网中;The first electronic device counts the number of first response information received within a preset response time period, where the first response information is information fed back by the second electronic device after receiving the first message, and the first response information is the information fed back by the second electronic device after receiving the first message. An electronic device and the second electronic device are in the same local area network;
    若所述第一响应信息的数量小于或等于预设的第一响应阈值,则所述第一电子设备重新广播所述第一报文。If the quantity of the first response information is less than or equal to a preset first response threshold, the first electronic device rebroadcasts the first message.
  7. 根据权利要求1所述的方法,其特征在于,在所述第一电子设备控制所述第一电子设备的Wi-Fi通信模块进入混杂模式之后,还包括:The method according to claim 1, wherein after the first electronic device controls the Wi-Fi communication module of the first electronic device to enter the promiscuous mode, further comprising:
    当所述第一电子设备接收到第二电子设备广播的第二报文时,所述第一电子设备对所述第二报文的签名进行验证;When the first electronic device receives the second message broadcast by the second electronic device, the first electronic device verifies the signature of the second message;
    若所述第二报文的签名验证通过,则所述第一电子设备保存所述第二报文。If the signature verification of the second message passes, the first electronic device saves the second message.
  8. 根据权利要求7所述的方法,其特征在于,在所述第二报文的签名验证通过之后,还包括:The method according to claim 7, wherein after the signature verification of the second packet is passed, the method further comprises:
    所述第一电子设备向所述第二电子设备发送第一响应信息。The first electronic device sends first response information to the second electronic device.
  9. 根据权利要求7所述的方法,其特征在于,在所述第一电子设备保存所述第二报文之后,还包括:The method according to claim 7, wherein after the first electronic device saves the second message, the method further comprises:
    当所述第一电子设备接收到管理设备发送的审计请求时,所述第一电子设备将本地保存的第二报文发送至所述管理设备。When the first electronic device receives the audit request sent by the management device, the first electronic device sends the locally stored second message to the management device.
  10. 根据权利要求1所述方法,其特征在于,所述方法还包括:The method according to claim 1, wherein the method further comprises:
    所述第一电子设备向各个第二电子设备发送审计请求,所述第一电子设备和所述第二电子设备处于同一局域网中;The first electronic device sends an audit request to each second electronic device, and the first electronic device and the second electronic device are in the same local area network;
    所述第一电子设备接收各个所述第二电子设备返回的第三报文,所述第三报文为所述 第二电子设备接收并保存的第一报文和/或第二报文;the first electronic device receives a third message returned by each of the second electronic devices, where the third message is the first message and/or the second message received and saved by the second electronic device;
    所述第一电子设备根据各个所述第二电子设备返回的第三报文以及预设处理规则,确定各个所述第三报文对应的目标报文。The first electronic device determines a target packet corresponding to each of the third packets according to the third packets returned by each of the second electronic devices and a preset processing rule.
  11. 根据权利要求10所述方法,其特征在于,所述第一电子设备根据各个所述第二电子设备返回的第三报文以及预设处理规则,确定各个所述第三报文对应的目标报文,包括:The method according to claim 10, wherein the first electronic device determines the target message corresponding to each third message according to the third message returned by each of the second electronic devices and a preset processing rule text, including:
    所述第一电子设备对各个所述第三报文执行拼接还原操作,得到各个所述第三报文对应的目标报文。The first electronic device performs a splicing and restoration operation on each of the third packets to obtain a target packet corresponding to each of the third packets.
  12. 根据权利要求10所述方法,其特征在于,所述第一电子设备根据各个所述第二电子设备返回的第三报文以及预设处理规则,确定各个所述第三报文对应的目标报文,包括:The method according to claim 10, wherein the first electronic device determines the target message corresponding to each third message according to the third message returned by each of the second electronic devices and a preset processing rule text, including:
    当任一所述第三报文存在至少两个版本时,所述第一电子设备对存在至少两个版本的第三报文执行投票操作,将票数最高的版本作为所述存在至少两个版本的第三报文对应的目标报文。When there are at least two versions of any third message, the first electronic device performs a voting operation on the third message with the at least two versions, and takes the version with the highest number of votes as the version with the at least two versions. The target packet corresponding to the third packet of .
  13. 根据权利要求1所述的方法,其特征在于,所述故障为路径攻击。The method of claim 1, wherein the failure is a path attack.
  14. 一种电子设备,包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机程序,其特征在于,所述处理器执行所述计算机程序时实现如权利要求1至13任一项所述的方法。An electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, when the processor executes the computer program, the computer program according to claim 1 to 13 The method of any one.
  15. 一种计算机可读存储介质,所述计算机可读存储介质存储有计算机程序,其特征在于,所述计算机程序被处理器执行时实现如权利要求1至13任一项所述的方法。A computer-readable storage medium storing a computer program, characterized in that, when the computer program is executed by a processor, the method according to any one of claims 1 to 13 is implemented.
  16. 一种芯片系统,其特征在于,所述芯片系统包括存储器和处理器,所述处理器执行所述存储器中存储的计算机程序,以实现如权利要求1至13任一项所述的方法。A chip system, characterized in that the chip system includes a memory and a processor, and the processor executes a computer program stored in the memory to implement the method according to any one of claims 1 to 13.
PCT/CN2021/116982 2020-10-30 2021-09-07 Communication method, electronic device and computer-readable storage medium WO2022089012A1 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011198292.6A CN114531378B (en) 2020-10-30 2020-10-30 Communication method, electronic device, and computer-readable storage medium
CN202011198292.6 2020-10-30

Publications (1)

Publication Number Publication Date
WO2022089012A1 true WO2022089012A1 (en) 2022-05-05

Family

ID=81383570

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/116982 WO2022089012A1 (en) 2020-10-30 2021-09-07 Communication method, electronic device and computer-readable storage medium

Country Status (2)

Country Link
CN (1) CN114531378B (en)
WO (1) WO2022089012A1 (en)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115022058A (en) * 2022-06-13 2022-09-06 恒大恒驰新能源汽车研究院(上海)有限公司 Safety detection method and device for controller local area network and electronic equipment
CN115811773A (en) * 2022-11-07 2023-03-17 航天行云科技有限公司 High-reliability data transmission method of wireless ad hoc network
CN116849724A (en) * 2023-06-19 2023-10-10 北京纳通医用机器人科技有限公司 Communication method, device, equipment and storage medium based on surgical robot

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110307574A1 (en) * 2009-12-17 2011-12-15 Justin Lipman Method and system for facilitating one-to-many data transmissions to a plurality of computing devices
US20130332621A1 (en) * 2012-06-08 2013-12-12 Ecole Polytechnique Federale De Lausanne (Epfl) System and method for cooperative data streaming
WO2016189362A1 (en) * 2015-05-22 2016-12-01 Telefonaktiebolaget Lm Ericsson (Publ) Method and system for sharing radiofrequency spectrum following a contention based protocol with determination of transmission time duration
CN108111523A (en) * 2017-12-28 2018-06-01 网易(杭州)网络有限公司 Data transmission method and device
CN108964959A (en) * 2017-05-27 2018-12-07 阿里巴巴集团控股有限公司 A kind of network interface card direct communication system and data packet monitoring and managing method for virtual platform
CN112511609A (en) * 2020-11-19 2021-03-16 航天银山电气有限公司 Data transmission method, device and storage medium

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2008092389A (en) * 2006-10-04 2008-04-17 Seiko Epson Corp Radio communication apparatus

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110307574A1 (en) * 2009-12-17 2011-12-15 Justin Lipman Method and system for facilitating one-to-many data transmissions to a plurality of computing devices
US20130332621A1 (en) * 2012-06-08 2013-12-12 Ecole Polytechnique Federale De Lausanne (Epfl) System and method for cooperative data streaming
WO2016189362A1 (en) * 2015-05-22 2016-12-01 Telefonaktiebolaget Lm Ericsson (Publ) Method and system for sharing radiofrequency spectrum following a contention based protocol with determination of transmission time duration
CN108964959A (en) * 2017-05-27 2018-12-07 阿里巴巴集团控股有限公司 A kind of network interface card direct communication system and data packet monitoring and managing method for virtual platform
CN108111523A (en) * 2017-12-28 2018-06-01 网易(杭州)网络有限公司 Data transmission method and device
CN112511609A (en) * 2020-11-19 2021-03-16 航天银山电气有限公司 Data transmission method, device and storage medium

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115022058A (en) * 2022-06-13 2022-09-06 恒大恒驰新能源汽车研究院(上海)有限公司 Safety detection method and device for controller local area network and electronic equipment
CN115811773A (en) * 2022-11-07 2023-03-17 航天行云科技有限公司 High-reliability data transmission method of wireless ad hoc network
CN116849724A (en) * 2023-06-19 2023-10-10 北京纳通医用机器人科技有限公司 Communication method, device, equipment and storage medium based on surgical robot
CN116849724B (en) * 2023-06-19 2024-05-14 北京纳通医用机器人科技有限公司 Communication method, device, equipment and storage medium based on surgical robot

Also Published As

Publication number Publication date
CN114531378B (en) 2024-04-12
CN114531378A (en) 2022-05-24

Similar Documents

Publication Publication Date Title
EP3934292B1 (en) Bluetooth connection method, device and system
WO2022089012A1 (en) Communication method, electronic device and computer-readable storage medium
US20230041669A1 (en) Bluetooth connection method, system, and electronic device
WO2021052178A1 (en) Wi-fi connection method and device
CN111373713B (en) Message transmission method and device
EP4213512A1 (en) Screen projection method and system, and electronic device
WO2021043219A1 (en) Bluetooth reconnection method and related apparatus
WO2021169698A1 (en) Connection management method and related device
US11844119B2 (en) Bluetooth pairing method and related apparatus
WO2021147660A1 (en) Data transmission method, and device
WO2021175266A1 (en) Identity verification method and apparatus, and electronic devices
WO2021104448A1 (en) Method for synchronizing key information, system and device
WO2023011376A1 (en) Key updating method in beidou communication system, and system and related apparatus
WO2022143156A1 (en) Encrypted call method and apparatus, terminal, and storage medium
EP4247030A1 (en) Device network distribution method, and mobile terminal and storage medium
WO2021184264A1 (en) Data saving method, data access method, and related apparatus and device
WO2022042264A1 (en) Method, apparatus and system for switching access point
EP4290360A1 (en) Screen projection method, electronic device, and system
CN113950048A (en) Connection establishing method, electronic device and storage medium
WO2024113865A1 (en) Secure transmission method and apparatus for video stream
WO2024037040A9 (en) Data processing method and electronic device
WO2021051964A1 (en) Pairing method and device
WO2022179243A1 (en) Wi-fi access method and related device
CN114077732A (en) Resource access control method, terminal device and computer readable storage medium
CN115550919A (en) Equipment pairing authentication method and device, sender equipment and receiver equipment

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21884742

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 21884742

Country of ref document: EP

Kind code of ref document: A1