WO2023000318A1 - 一种地址验证方法及相应的装置 - Google Patents

一种地址验证方法及相应的装置 Download PDF

Info

Publication number
WO2023000318A1
WO2023000318A1 PCT/CN2021/108201 CN2021108201W WO2023000318A1 WO 2023000318 A1 WO2023000318 A1 WO 2023000318A1 CN 2021108201 W CN2021108201 W CN 2021108201W WO 2023000318 A1 WO2023000318 A1 WO 2023000318A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
address
resolution
information
key
Prior art date
Application number
PCT/CN2021/108201
Other languages
English (en)
French (fr)
Inventor
王勇
陈璟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2021/108201 priority Critical patent/WO2023000318A1/zh
Priority to CN202180100798.5A priority patent/CN117730555A/zh
Priority to KR1020247006038A priority patent/KR20240033081A/ko
Priority to EP21950567.4A priority patent/EP4366353A1/en
Publication of WO2023000318A1 publication Critical patent/WO2023000318A1/zh
Priority to US18/419,777 priority patent/US20240163262A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/10—Mapping addresses of different types
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5038—Address allocation for local use, e.g. in LAN or USB networks, or in a controller area network [CAN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5092—Address allocation by self-assignment, e.g. picking addresses at random and testing if they are already in use
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/047—Key management, e.g. using generic bootstrapping architecture [GBA] without using a trusted network node as an anchor
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/60—Context-dependent security
    • H04W12/69—Identity-dependent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/80—Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/604—Address structures or formats
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/681—Types of network addresses using addresses for wireless personal area networks or wireless sensor networks, e.g. Zigbee addresses

Definitions

  • the embodiments of the present application relate to the field of communication technologies, and in particular, relate to short-distance communication technologies. Specifically, the present application provides an address verification method and a corresponding device.
  • the embodiment of the present application discloses an address verification method and a corresponding device, which can realize secure communication between communication nodes, reduce the risk of privacy leakage, and ensure communication efficiency and performance.
  • an address verification method is provided, which can be executed by a communication node or a chip configured in the communication node.
  • the method may be executed by the second node or a chip configured in the second node.
  • the method includes: receiving first information from a first node, the first information including a first resolution address of the first node and a first resolution key index, the first resolution key index is used to indicate the first A resolution key; according to the first resolution key index and the first resolution address, determine the identity address of the first node, and the identity address uniquely identifies the first node; wherein, the first The resolution address includes verification information for verifying the first resolution key, and the first resolution key corresponds to the first identity address.
  • the security of data transmission between communication nodes can be guaranteed by address resolution. Since the resolution address can only be correctly resolved by communication nodes with the same resolution key, the address verification method provided by this application can ensure that the identity address of the first node is difficult to obtain and ensure the security of data transmission between communication nodes.
  • determining the identity address of the first node according to the first resolution key index and the first resolution address includes: according to the first The resolution key index determines the first resolution key, and determines the identity address of the first node according to the first resolution key and the first resolution address.
  • the second node can determine the corresponding first resolution key according to the first resolution key index, and then determine the identity address of the first node according to the first resolution key and the first resolution address without traversing All peer node resolution keys stored locally determine the identity address of the first node, or only need to traverse peer node resolution keys corresponding to the first resolution key index to determine the identity address of the first node. Therefore, calculation time required for address verification can be reduced, ensuring communication efficiency and performance.
  • determining the identity address of the first node according to the first resolution key index and the first resolution address includes: determining The local verification information obtained by parsing the key is the same as the verification information included in the first resolved address, and the first identity address is determined to be the identity address of the first node.
  • the first identity address corresponding to the first resolution key is the identity address of the first node, which ensures that the The verification of the authenticity of a node address ensures the security of data transmission between communication nodes.
  • the first resolution address includes a random number, and according to the first resolution key index and the first resolution address, determine the address of the first node An identity address, including: determining that the local verification information obtained based on the first parsing key and the random number is the same as the verification information contained in the first parsing address, and determining that the first identity address is the first node identity address.
  • the local verification information is determined based on the random number contained in the first resolution address and the first resolution key, which can ensure that the identity address of the first node is difficult to obtain, thereby ensuring the security of data transmission between communication nodes.
  • the local verification information is obtained based on a hash operation of the first parsing key and the random number. Since the hash operation is irreversible, the hash operation can further ensure that only trusted communication nodes can resolve the received resolution address, thereby ensuring the security of data transmission between communication nodes.
  • the first resolution key there is a predefined or configured correspondence between the first resolution key, the first resolution key index, and the first identity address.
  • the first resolution key corresponding to the first resolution key index can be determined, and the received first resolution address can be resolved by using the first resolution key to determine whether the identity address of the first node is the first A resolution key index or a first identity address corresponding to the first resolution key.
  • the first resolution key or the first identity address is determined according to a predefined or configured relationship, which prevents the second node from receiving the resolution sent by the first node every time it verifies the authenticity of the address of the first node.
  • Key indexing, parsing keys, and identity address information reduce the time required for connections between communication nodes and ensure communication efficiency and performance.
  • the method before receiving the first information from the first node, the method further includes: receiving second information from the first node, the first The second information includes the first resolution key and the first identity address; defining or configuring the correspondence between the first resolution key, the first resolution key index, and the first identity address relation.
  • the second information further includes the first parsing key index
  • the second node may include the first parsing key, the first parsing key index, and The first identity address defines or configures the corresponding relationship.
  • the first parsing key index, the first parsing key, and the first identity address all come from the first node, which is simple to implement.
  • the first parsing key index comes from a control node, and the control node is used to configure the parsing key index of the first node (that is, the first parsing key index) and the parsing key index of the second node ( i.e. the second parse key index).
  • the control node may be, for example, a master node or an access point, and the control node may also be, for example, a first node or a second node.
  • the second node may define or configure the corresponding relationship according to the received second information and the first resolved key index from the control node.
  • the resolution key indexes corresponding to different communication nodes come from the same communication node, which is helpful for the unified management of the resolution key indexes, and can avoid the conflict of the resolution key indexes of the peer nodes on the local node side.
  • the time required for authenticity verification of the address of the peer node can be reduced, ensuring communication efficiency and performance.
  • the method further includes: sending the first parsing key index to the first node.
  • the second node may define or configure the corresponding relationship according to the second information and the locally generated first parsing key index.
  • the parsing key index of the first node comes from the second node, thereby avoiding the conflict of the parsing key index of the first node on the side of the second node, that is, in the second node On the node side, it is avoided that the same parsing key index corresponds to different peer nodes, thereby reducing the time required for authenticity verification of peer node addresses and ensuring communication efficiency and performance.
  • the method before receiving the first information from the first node, the method further includes: receiving third information from the first node, the first The third information is used to indicate to determine the identity address of the first node according to the resolution key index and the resolution address.
  • the resolution key information includes a resolution key and a resolution key index, or the resolution key information includes a resolution key.
  • the identity address information includes a public device address and/or a static device address.
  • the second node can determine the identity address of the first node by analyzing the key information, ensuring the security of data transmission between communication nodes; on the other hand, it can also increase the second node to determine the identity of the first node
  • the flexibility of the address reduces the calculation time required for address credibility verification and ensures communication efficiency and performance.
  • the third information is included in the pairing request information from the first node.
  • the pairing request information includes security information distribution information, and the security information distribution information is used to indicate whether to send resolution key information and/or identity address information.
  • the third information is implemented through the pairing request information, which can save signaling overhead and is easy to implement.
  • the method further includes: sending fourth information to the first node, where the fourth information is used to indicate whether to resolve the address according to the resolution key index and , to determine the identity address of the second node.
  • the first node can determine the identity address of the peer node by analyzing the key information, ensuring the security of data transmission between communication nodes; on the other hand, it can also increase the flexibility of determining the identity address of the peer node Responsibility, reduce the calculation time required for identity address verification, and ensure communication efficiency and performance.
  • the fourth information is included in the pairing response information sent to the first node.
  • the pairing response information includes security information distribution information, and the security information distribution information is used to indicate whether to send parsing key information and/or identity address information.
  • the fourth information is implemented through the pairing response information, which can save signaling overhead and is easy to implement.
  • an address verification method is provided, which can be executed by a communication node or a chip configured in the communication node.
  • the method may be executed by the first node or a chip configured in the first node.
  • the method includes: determining a first resolution address of a first node; sending first information to a second node, the first information including the first resolution address and a first resolution key index, the first resolution key The index is used to indicate the first resolution key; wherein, the first resolution address includes verification information for verifying the first resolution key, and the first resolution key corresponds to the identity address of the first node, The identity address uniquely identifies the first node.
  • data transmission between communication nodes can be realized by resolving addresses. Since the resolution address can only be correctly resolved by communication nodes with the same resolution key, the address verification method provided by this application can ensure that the identity address of the first node is difficult to obtain and ensure the security of data transmission between communication nodes.
  • the determining the first resolution address of the first node includes: determining the first resolution address according to the first resolution key and the identity address of the first node Verification information of the first parsing key.
  • the first node performs a cryptographic operation on the first resolution key and the identity address of the first node to obtain an output value of the cryptographic operation, and the output value of the cryptographic operation is the verification information, or a part of the verification information .
  • the verification information is determined based on the first resolution key and the identity address of the first node, which can ensure that the first resolution address can only be correctly resolved by communication nodes with the same resolution key, thereby ensuring the accuracy of data transmission between communication nodes safety.
  • the first resolved address includes a random number
  • the determining the first resolved address of the first node includes: determining the first resolved address based on the first resolved key and The verification information obtained by the random number.
  • the verification information in the first resolved address is determined based on the random number contained in the first resolved address, which can ensure that the identity address of the first node is difficult to obtain, thereby ensuring the security of data transmission between communication nodes.
  • the verification information is obtained based on a hash operation of the first resolution key and the random number. Since the hash operation is irreversible, the hash operation can further ensure that only trusted communication nodes can resolve the received resolution address, thereby ensuring the security of data transmission between communication nodes.
  • the method before sending the first information to the second node, the method further includes: sending second information to the second node, the second information Include the first resolution key and the identity address.
  • the second information further includes the first parsing key index.
  • the configuration or definition of the corresponding relationship between the first resolution key index, the first resolution key and the identity address can be realized, avoiding the second node verifying the address credibility of the first node each time
  • all receive the analysis key index, analysis key and identity address information sent by the first node which reduces the time required for connection between communication nodes and ensures communication efficiency and performance.
  • the first parsing key index, the first parsing key, and the first identity address all come from the first node, which is simple to implement.
  • the first parsing key index is from the control node.
  • the control node is used to configure the resolution key index of the first node (ie, the first resolution key index) and the resolution key index of the second node (ie, the second resolution key index).
  • the control node may be, for example, a master node or an access point, and the control node may also be, for example, a first node or a second node.
  • the second node may define or configure the corresponding relationship according to the received second information and the first resolved key index from the control node.
  • the resolution key indexes corresponding to different communication nodes come from the same communication node, which is helpful for the unified management of the resolution key indexes, and can avoid the conflict of the resolution key indexes of the peer nodes on the local node side.
  • the time required for authenticity verification of the address of the peer node can be reduced, ensuring communication efficiency and performance.
  • the first parsing key index comes from the second node.
  • the configuration or definition of the corresponding relationship between the first resolution key index, the first resolution key and the identity address can be realized, avoiding the second node verifying the address credibility of the first node each time
  • all receive the analysis key index, analysis key and identity address information sent by the first node which reduces the time required for connection between communication nodes and ensures communication efficiency and performance.
  • the analysis key index comes from the second node, which can avoid the conflict of the analysis key index of the first node on the second node side, that is, on the second node side, it is avoided that the same analysis key index corresponds to different nodes, thus The time required for authenticity verification of the peer node address can be reduced, further ensuring communication efficiency and performance.
  • the method before sending the first information to the second node, the method further includes: sending third information to the second node, the third information It is used to indicate to determine the identity address of the first node according to the resolution key index and resolution address.
  • the resolution key information includes a resolution key and a resolution key index, or the resolution key information includes a resolution key.
  • the identity address information includes a public device address and/or a static device address.
  • the second node can determine the identity address of the first node by analyzing the key information, ensuring the security of data transmission between communication nodes; on the other hand, it can also increase the second node to determine the identity of the first node
  • the flexibility of the address reduces the calculation time required for address credibility verification and ensures communication efficiency and performance.
  • the third information is included in the pairing request information sent by the first node.
  • the pairing request information includes security information distribution information, and the security information distribution information is used to indicate whether to send resolution key information and/or identity address information.
  • the third information is implemented through the pairing request information, which can save signaling overhead and is easy to implement.
  • the method further includes: receiving fourth information from the second node, where the fourth information is used to indicate whether to index and parse according to the parsing key address, to determine the identity address of the second node.
  • the first node can determine the identity address of the second node by analyzing the key information, ensuring the security of data transmission between communication nodes; The flexibility of the address reduces the calculation time required for address credibility verification and ensures communication efficiency and performance.
  • the fourth information is included in the pairing response information from the second node.
  • the pairing response information includes security information distribution information, and the security information distribution information is used to indicate whether to send parsing key information and/or identity address information.
  • the fourth information is implemented through the pairing response information, which can save signaling overhead and is easy to implement.
  • a communication device including a processing unit and a transceiver unit, so as to execute the method in the above first aspect or any possible implementation of the first aspect, or to execute the above second aspect or the method of the second aspect A method in any possible implementation.
  • a communication device including at least one processor and a transceiver, and the at least one processor is used to call at least one computer program stored in a memory to implement the above-mentioned first aspect or any possibility of the first aspect.
  • the transceiver is used to perform functions related to sending and receiving.
  • the transceiver includes a receiver and a transmitter, or is a transmitter and a receiver.
  • the communication device is a communication chip
  • the transceiver may be an input-output circuit or port of the communication chip.
  • the communication device further includes a memory, the memory is coupled to a processor included in the communication device, and the processor can be used to execute instructions in the memory, so that the device Execute the method in the above first aspect or any possible implementation manner of the first aspect, or execute the method in the above second aspect or any possible implementation manner of the second aspect.
  • the device may further include an interface circuit, and the processing module is coupled to the interface circuit.
  • a communication device which is characterized in that it includes a communication device for performing the method in the first aspect or any possible implementation of the first aspect, or for performing the method in the second aspect or the first aspect The communication device of the method in any possible implementation manner of the second aspect.
  • a chip in a sixth aspect, includes one or more processors and an interface circuit, and the chip is used to execute the method in the above-mentioned first aspect or any possible implementation of the first aspect, or to execute The above second aspect or the method in any possible implementation manner of the second aspect.
  • a communication system in a seventh aspect, includes a communication device for performing the method in the above-mentioned first aspect or any possible implementation manner of the first aspect, and a communication device for performing the above-mentioned second aspect or the second The communication device of the method in any possible implementation manner of the aspect.
  • a computer-readable storage medium stores computer programs or instructions.
  • the communication device executes the above-mentioned first aspect or the first aspect.
  • the method in any possible implementation manner of the first aspect, or causing the communication device to execute the above second aspect or the method in any possible implementation manner of the second aspect.
  • a computer program product includes a computer program or an instruction, and when the computer program or instruction is executed by a communication device, the communication device executes the first aspect or any possibility of the first aspect The method in the implementation manner of the second aspect, or make the communication device execute the method in the second aspect or any possible implementation manner of the second aspect.
  • FIG. 1 is a schematic structural diagram of a communication system provided by an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a usage scenario of a communication method provided in an embodiment of the present application
  • FIG. 3 is a schematic flowchart of a communication method provided in an embodiment of the present application.
  • FIG. 4 is a schematic diagram of a public device address provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a static device address provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of address resolution provided by an embodiment of the present application.
  • FIG. 7 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 8 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 9 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 10 is a schematic flowchart of another communication method provided by an embodiment of the present application.
  • FIG. 11 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 12 is a schematic flowchart of another communication method provided by the embodiment of the present application.
  • FIG. 13 is a schematic diagram of pairing request information provided by an embodiment of the present application.
  • FIG. 14 is a schematic diagram of pairing confirmation information provided by an embodiment of the present application.
  • Fig. 15 is a schematic diagram of a pairing initial information provided by an embodiment of the present application.
  • FIG. 16 is a schematic diagram of a communication device provided by an embodiment of the present application.
  • Fig. 17 is a schematic diagram of another communication device provided by an embodiment of the present application.
  • FIG. 18 is a schematic diagram of a chip structure provided by an embodiment of the present application.
  • At least one (unit) refers to one (unit) or multiple (units), and “multiple (units)” refers to two (units) or two (units) above.
  • At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items.
  • at least one item (piece) of a, b, or c may represent: a, b, c, (a and b), (a and c), (b and c), or (a and b and c), where a, b, c can be single or multiple.
  • the embodiments of the present application use ordinal numerals such as "first" and "second" to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects degree.
  • first information and the second information are only for distinguishing different information, and do not indicate the difference in content, priority, sending order, or degree of importance of the two kinds of information.
  • a node is an electronic device or a device (such as a chip, or an integrated circuit) in an electronic device capable of transmitting and receiving data, and the above-mentioned electronic device may include a terminal device or a network-side device.
  • a node can be a car cockpit domain device, or a module in a car cockpit device (such as a cockpit domain controller (CDC), camera, screen, microphone, audio, electronic key, keyless entry or Start one or more of the modules such as the system controller).
  • CDC cockpit domain controller
  • a node can also be a data transfer device, such as a base station, router, repeater, bridge or switch; it can also be a terminal device, such as various types of user equipment (user equipment, UE), mobile phone (mobile phone), tablet computer (pad), desktop computer, headset, stereo, etc.; it can also include machine intelligence devices, such as self-driving (self-driving) equipment, transportation safety (transportation safety) equipment, smart home equipment (such as One or more of audio and video equipment, security equipment, intelligent lighting equipment, environmental monitoring equipment, etc.), virtual reality (virtual reality, VR) terminal equipment, augmented reality (augmented reality, AR) terminal equipment, machine type communication ( machine type communication (MTC) equipment, industrial control (industrial control) equipment, remote medical (remote medical) equipment, smart grid (smart grid) equipment, smart city (smart city) equipment; can also include wearable devices (such as smart watches , smart bracelets, pedometers, etc.) and so on.
  • machine intelligence devices such as self-driving (self
  • the names of devices with similar data sending and receiving capabilities may not be called nodes, but for the convenience of description, electronic devices with data sending and receiving capabilities are collectively referred to as nodes in this embodiment of the application.
  • a node can have at least one of two types of addresses: a public device address and a random device address. Further, the random device address can be divided into static device address (static device address) and private device address (private device address), and the private device address can be divided into non-resolvable private address (non-resolvable private address) and Resolvable private address. Each address is described below.
  • the public device address is used to uniquely identify a physical device.
  • the public device address of the device is fixedly assigned, for example, consists of a 24-bit company identifier (company_id) and a 24-bit company assigned value (company_assigned).
  • the random device address is not fixedly assigned, but randomly generated after the device is started. According to different purposes, random device addresses are divided into static device addresses and private device addresses.
  • a static device address is an address randomly generated by a node when it is powered on. In one design, the static device address remains unchanged during a power-on cycle, and the static device address can be changed or remain unchanged at the next power-on. If the static device address changes at the next power-on, the connection and other information saved last time will no longer be valid.
  • the private device address improves the reliability and security of the node address through regular update and address encryption. According to whether the node address is encrypted or not, the private device address is divided into two types, non-resolvable private address and resolvable private address.
  • the non-resolvable private address is similar to the static device address. The difference is that the non-resolvable private address will be updated every certain period.
  • the update cycle of the non-resolvable private address can be specified by the protocol, for example, X minutes, where X is an integer.
  • Non-resolvable private addresses can be updated every other update cycle.
  • a resolvable private address is generated by at least a random number and a secret key.
  • the resolvable private address is generated by a random number and a key called an identify resolving key (IRK).
  • IRK identify resolving key
  • the resolvable private address consists of two parts: one part is the random number part , and the other part is the hash value calculated by the random number and IRK through hash (hash).
  • the resolvable private address can only be scanned by devices with the same IRK, which can prevent it from being obtained by unknown devices. Since IRK can be used for encryption, IRK can also be called an encryption key.
  • the identity address may include one or both of the following: a public device address and a static device address.
  • the node address may include one or both of a public device address and a static device address, and one or more of a private device address.
  • IRK address and encryption key
  • peer peer
  • Each entry in the resolving list stores the key/address information of a pair of nodes, and its format can be: Local IRK
  • the Local IRK is the local IRK, which is used to generate the resolvable private address of the local node. For example, when the node sends a data packet, it first judges whether there is a non-zero Local IRK in the parsing list, and if so, uses the Local IRK Generate a resolvable private address, otherwise, directly use the identity address as the local address; Peer IRK is the IRK of the peer node, which is used to resolve the resolvable private address of the peer node into an identity address.
  • the node receives the data After the packet, if the data packet includes the identity address, then directly do the follow-up processing of the data, if the data packet includes the resolvable private address, use the Peer IRK included in the resolution list to resolve the received resolvable private address .
  • Peer Device Identity Address and Address Type are the identification address and address type of the peer node, respectively, which are used to uniquely identify the peer node during the connection and/or pairing process between nodes.
  • the identification address may be one of the following addresses: a public device address, a static device address, a non-resolvable private address, and a resolvable private address.
  • a cryptographic algorithm may be a mathematical function for one or more of encryption, decryption, key generation, or password derivation, and may also be called a cryptographic function.
  • Commonly used cryptographic algorithms include hash algorithms, encryption algorithms, authentication algorithms, key derivation function (KDF) or authentication algorithms, etc.
  • the hash algorithm is also called the hash (Hash) function, hash algorithm, and the hash algorithm can convert information of any length into an identifier, and it is difficult to find the reverse law.
  • Encryption algorithms include symmetric encryption algorithms and asymmetric encryption algorithms.
  • the encryption key of the symmetric encryption algorithm is the same as the decryption key, and the encryption key of the asymmetric encryption algorithm is different from the decryption key.
  • hash algorithm there is a type of hash algorithm that does not require a key.
  • Common symmetric encryption algorithms mainly include Data Encryption Standard (DES), Triple Data Encryption Algorithm (3DES), Advanced Encryption Standard (AES), etc.
  • Common asymmetric algorithms mainly include RSA encryption algorithm, data structure analysis algorithm (data structure analysis, DSA), etc.
  • hash algorithm mainly includes secure hash algorithm (secure hash algorithm 1, SHA-1), message digest (message digest, MD) algorithm (such as MD2, MD4 or MD5, etc.), etc.
  • the integrity protection algorithm is an algorithm used to protect message integrity, and may also be called a MAC (message authentication code, MAC) algorithm or a complete protection algorithm.
  • MAC messages authentication code
  • MAC message authentication code
  • the integrity protection algorithm implemented by the hash algorithm is called a hash-based message authentication code (hash-based message authentication code, HMAC) algorithm, wherein the hash algorithm can be MD5, SHA-1, SHA-256 Among other things, these different HMAC implementations are usually labeled: HMAC-MD5, HMAC-SHA1, HMAC-SHA256, and so on.
  • the authenticated encryption algorithm can be used to encrypt data or generate a message authentication code for a given original text, so the authenticated encryption algorithm can be used as an encryption algorithm or a complete security algorithm.
  • AES algorithm based on Galois message authentication code mode (GMAC) and counting encryption mode (AES-Galois/counter mode, AES-GCM) and based on message authentication code (Cipher-based Message Authentication Code, CMAC) and the AES algorithm of count encryption mode (AES-CMAC/counter Mode, AES-CCM) can perform authentication and encryption on messages, and MAC can be generated in the process of authentication and encryption to protect the integrity of messages.
  • a key derivation algorithm is used to derive one or more secret values from a secret value, also known as a key derivation algorithm.
  • key derivation algorithms include password-based key derivation function (password-based key derivation function, PBKDF), Scrypt (scrypt) algorithm, etc., among which the PBKDF algorithm includes the first generation PBKDF1 and the second generation PBKDF2.
  • PBKDF password-based key derivation function
  • Scrypt scrypt
  • KDF algorithm uses a hash algorithm to hash the input secret value during the key derivation process, so the KDF function can also receive an algorithm identifier as an input, which is used to indicate which hash algorithm to use.
  • the white list includes one or more node addresses, and the nodes corresponding to the node addresses included in the white list can be understood as nodes trusted by the local node.
  • the white list only nodes included in the white list can be allowed to scan (scan), connect (connect) to the local node, and/or, through the white list, the local node can only scan and connect to specific nodes (white list listed).
  • the node addresses stored in the whitelist may be one or more of the following addresses: public device addresses and static device addresses.
  • FIG. 1 is a schematic structural diagram of a possible communication system provided by an embodiment of the present application.
  • the communication system includes a first node 101 and a second node 102 . in:
  • the first node 101 and the second node 102 may establish an association. It should be noted that, in this embodiment of the present application, “association”, “connection”, and “pairing” may indicate a process of establishing a connection between the first node and the second node. After the first node 101 and the second node 102 are successfully associated, the first node 101 can communicate with the second node 102 .
  • the communication link between the first node 101 and the second node 102 may include various types of connection media, including a wired link (such as an optical fiber), a wireless link, or a combination of a wired link and a wireless link, etc. .
  • the first node 101 and the second node 102 can realize communication through various connection technologies, such as short-distance connection technologies including 802.11b/g, bluetooth (blue tooth), Zigbee (Zigbee), radio frequency identification technology (radio frequency) identification, RFID), ultra wideband (UWB) technology, other possible wireless short-range communication technologies (such as vehicle wireless short-range communication technology), etc.
  • 5G or 5G technology fifth-generation mobile communication technology
  • GSM global System for mobile communications
  • GPRS general packet radio service
  • UMTS universal mobile telecommunications system
  • the first node 101 and the second node 102 may be devices of the same type, or devices of different types.
  • FIG. 2 is a schematic diagram of a possible communication scenario provided by an embodiment of the present application.
  • the CDC 201 of the vehicle is the control center in the smart cockpit equipment of the vehicle, and can be regarded as the first node 101.
  • the smart phone 202 is a device capable of sending and receiving data, and can be regarded as the second node 102 .
  • CDC201 can be associated with other devices through various types of connection technologies, and smart phone 202 supports corresponding communication functions, so smart phone 202 can establish a connection with CDC201 through corresponding communication technologies.
  • the first node may also be called a G node, a control node, or an access point (access point), and the second node may also be called a T node or a terminal.
  • the communication link from the G node to the T node may be called a G link, and the communication link from the T node to the G node may be called a T link.
  • the two nodes respectively add the device address of the other party to their own white list to indicate that the other party is a device they trust.
  • the device addresses stored in the whitelist are fixed to a certain extent, it may be obtained by an attacker to obtain the device address when the node is broadcasting (advertising).
  • two nodes can exchange their own resolvable private device addresses.
  • a node scans the resolvable private device address of other nodes, it will use the local IRK and the random number in the scanned resolvable private device address to perform hash operation, and compare the hash operation result with the resolvable
  • the hash fields in the private device address are compared. When the fields are the same, it can indicate that the resolvable private device address has been successfully resolved, or that the verification of the device address that sent the resolvable private device address has passed. At this time, the node performs subsequent operations.
  • the resolvable private device address is randomly generated, it is difficult to obtain the device that sends the resolvable private device address, and because the resolvable private device address can only be scanned by devices with the same IRK, so the device without IRK cannot obtain the Can resolve private device addresses.
  • each saved IRK needs to be used to resolve the scanned resolvable private device address until all IRKs have been tried or one of the IRKs is used to resolve the scanned resolvable private device address.
  • Parse Private device address parsing is successful. Since it takes a long time to resolve the scanned private device address using IRK, it takes a long time to verify the authenticity of the device address, which reduces communication efficiency and performance.
  • an embodiment of the present application provides a communication method, in which the second node receives first information from the first node, and the first information includes the first resolution address and the first resolution key of the first node index, and according to the first parsing key index and the first parsing address, determine the identity address of the first node, and the identity address uniquely identifies the first node.
  • the first node and the second node can ensure the security of information transmission between the communication nodes by analyzing the address communication.
  • the second node can determine the first resolution key index according to the first resolution key index. Key, there is no need to traverse all the locally saved resolution keys to resolve the received first resolution address, which reduces the time required for device address authenticity verification and ensures communication efficiency and performance.
  • FIG. 3 is a schematic flowchart corresponding to a communication method provided in an embodiment of the present application. Further, the method can be implemented based on the architecture shown in FIG. 1 . The method can include:
  • the first node determines a first resolved address.
  • the first resolved address includes an address generated by encrypting the identity address of the first node using a key.
  • the encryption here can be implemented by the cryptographic algorithm described above, or by other encryption algorithms, which is not specifically limited.
  • the identity address of the first node can uniquely identify the first node.
  • the identity address of the first node is fixed to a certain extent.
  • the identity address of the first node may be a public device address, and the public device address is fixedly allocated, and the public device address remains unchanged during different power-on periods of the first node. Referring to Fig. 4, Fig.
  • FIG. 4 is a schematic diagram of a possible public device address provided by the embodiment of the present application, the company_id (24 bits) and the least significant bit (least significant bit) of the public device address most significant bit (most significant bit, MSB) bit, LSB) of company_assigned (24 bits); for another example, the identity address of the first node can be a static device address, which is randomly generated and remains unchanged in one power-on cycle, and will remain unchanged in the next power-on cycle. It can remain the same or change during the electrical cycle.
  • Figure 5 is a schematic diagram of a possible static device address provided by the embodiment of this application. The static device address consists of 48 bits, of which the highest two bits are "11", and the remaining 46 bits are a random The number cannot be all 0, nor can it be all 1.
  • the first resolution address includes verification information for verifying the first resolution key, and the first resolution key corresponds to the identity address of the first node.
  • the first resolution key may be an identity resolution key IRK, or may be a key generated through a key derivation algorithm, or may be in another form, which is not specifically limited.
  • IRK identity resolution key
  • the identity address of the first node reference may be made to the foregoing description, and details are not repeated here.
  • the first node determines verification information for verifying the first resolution key according to the first resolution key and the identity address of the first node. For example, the first node performs a cryptographic operation on the first resolution key and the identity address of the first node to obtain an output value of the cryptographic operation, and the output value of the cryptographic operation is the verification information, or is a part of the verification information.
  • the hash algorithm can be, for example, MD5, SHA -1, one of SHA-256, SM3, or other implementation methods, not specifically limited.
  • the identity address of the first node can also be replaced with other addresses, for example, an address generated by the first node according to certain rules, which is not specifically limited.
  • the first resolution address further includes a random number
  • the first node obtains verification information based on the first resolution key and the random number.
  • the first node performs a cryptographic operation on the first analysis key and the random number to obtain an output value of the cryptographic operation, and the output value of the cryptographic operation is the verification information.
  • the first node encrypts the first resolution key and the random number, and the specific encryption algorithm may be, for example, the encryption algorithm described above, which will not be repeated here.
  • the random number can be composed of 24 bits, and the upper two bits of the MSB can represent the address type of the first resolved address, for example, the value is 10, and each of the other 22 bits One bit is a randomly generated number, which takes a value of 0 or 1.
  • Figure 6 is a schematic diagram of a possible resolution address provided by the embodiment of the present application.
  • the resolution address consists of 48 bits, including a 24-bit random number prand and a 24-bit hash value hash, further , the highest and second highest bits in prand are 0 and 1 respectively, each of the remaining 22 bits is a randomly generated number, and the hash value can correspond to the verification information described above, that is, according to the analysis key and the random The number prand is calculated, and the specific calculation method is as described above, and will not be repeated here.
  • the first resolved address may be a resolvable private address.
  • the first node sends first information to the second node, where the first information includes a first resolution address and a first resolution key index, where the first resolution key index is used to indicate the first resolution key.
  • the second node receives the first information.
  • the first node may send the first information in a broadcast manner, and correspondingly, the second node receives the first information broadcast by the first node.
  • the first resolution address contained in the first information and the first resolution key index contained in the first information may be sent in the same message or in different messages.
  • the first node sends the first resolution address and the first resolution key index through message A; for another example, the first node sends the first resolution address through message A, and sends the first resolution key index through message B.
  • the first information may further include address type information of the first resolved address, for example, the address type information of the first resolved address is used to indicate that the address type of the first resolved address is a resolvable private address.
  • the second node determines the identity address of the first node according to the first resolution key index and the first resolution address.
  • the second node determines the first resolution key indicated by the first resolution key index according to the first resolution key index, and the first resolution key corresponds to the first identity address.
  • the second node can determine the The first parsing key for .
  • the corresponding relationship may be presented in a table, for example.
  • Table 1 is a possible correspondence table provided in the embodiment of the present application.
  • the Peer IRK ID represents the resolution key index of the peer node
  • the Peer IRK in the same row as the Peer IRK ID represents the resolution key of the peer node corresponding to the Peer IRK ID
  • the Peer IRK ID and Peer IRK in the The identity address of the peer node in the same row represents the identity address corresponding to one or more of Peer IRK ID and Peer IRK.
  • the first resolution key index is an example of Peer IRK ID
  • the first resolution key is an example of Peer IRK
  • the first identity address is the peer node identity address. an example.
  • the Peer IRK ID, Peer IRK, and Peer Device Identity Address contained in the second row of Table 1 respectively represent the resolution key index, resolution key and identity address of the first node
  • the third row of Table 1 contains Peer IRK ID, Peer IRK, and Peer Device Identity Address represent the resolution key index, resolution key, and identity address of nodes other than the first node and the second node, such as the third node, respectively.
  • the corresponding relationship can refer to Table 2.
  • Table 2 is another possible corresponding relationship table provided by the embodiment of the present application.
  • the local node resolution key index indicates the resolution key of the second node index
  • the local node resolution key indicates the resolution key of the second node
  • "local node resolution key index” is optional in Table 2.
  • the table containing the parsing key index, the corresponding relationship between the parsing key and the identity address can also have other forms, for example, based on Table 1, it can also contain the local node parsing key index, the local node parsing key and One or two of the peer node identity address types, not specifically limited.
  • the table containing the corresponding relationship may be a parsing list.
  • the same peer node resolution key index may also correspond to multiple different peer node resolution keys.
  • the Peer IRK ID contained in the second row in Table 1 is the same as the Peer IRK ID contained in the third row, but the Peer IRK contained in the second row in Table 1 is different from the Peer IRK contained in the third row.
  • Table 1 An implementation of the correspondence between the parsing key index, parsing key, and identity address
  • Table 2 Another implementation of the corresponding relationship between the parsing key index, parsing key, and identity address
  • the second node determines the identity address of the first node based on the first resolution key index and the first resolution address. It should be noted that, in the implementation of this application, the second node determines the first Analyzing the key index and the first resolved address to determine the identity address of the first node may also have other implementation methods, which are not specifically limited.
  • the second node determines the first resolution key according to the received first resolution key index, and uses the first resolution key to decrypt the first resolution address, and then determines the identity address of the first node .
  • the second node determines the first parsing key according to the received first parsing key index and the corresponding relationship between the first parsing key index and the first parsing key, and then uses the first parsing key
  • the key decrypts the received first resolution address, and compares the decryption result with the peer node identity address stored locally.
  • the peer node identity address here corresponds to the first resolution key, and is stored in The identity address of the second node side.
  • the second node determines that the first node is a trusted device node or determines that the identity address of the peer node is the identity address of the first node. Further, the second node may perform subsequent operations.
  • the second node determines the identity address of the first node, it can initiate a connection to the first node; for another example, the second node compares the determined identity address of the first node with the device address in the locally saved white list , if the device address in the locally saved whitelist includes the identity address of the first node, it can be explained that the first node is a node trusted by the second node, and then the second node can perform subsequent data transmission with the first node; For example, the second node compares the identity address of the first node with the device address in the locally saved whitelist.
  • the second node can first compare the The identity address of a node is added to the whitelist, and then subsequent data transmission is performed with the first node; on the other hand, if the decryption result is not the same as the identity address of the peer node, the second node determines that the first node It is not a trusted device node, or it is determined that the identity address of the peer node corresponding to the first resolution key is not the identity address of the first node.
  • Subsequent operations of the second node may include one or more of the following: not establishing a connection with the first node, sending a connection establishment failure message to the first node; sending an address resolution failure message to the first node, and requesting to obtain the first node’s identity address.
  • the second node determines the first resolution key according to the received first resolution key index, and then calculates the local verification information, and compares the local verification information with the verification information contained in the first resolution address Comparison, the comparison results include the following two situations:
  • the second node may determine that the first identity address corresponding to the first resolution key is the identity address of the first node. Taking Table 2 as an example, if the second node determines that the local verification information is the same as the verification information contained in the first resolution address, the identity of the peer node corresponding to the first resolution address (that is, the peer node resolution key) in Table 2 The address (ie, the first identity address) is the identity address of the first node. Further, in this case, the second node may perform subsequent operations. For specific follow-up operations, reference may be made to the follow-up operations when the decryption result is the same as the identity address of the peer node in the above implementation manner, and will not be repeated here.
  • the second node may determine that the first identity address corresponding to the first resolution key is not the identity address of the first node.
  • the subsequent operations of the second node reference may be made to the subsequent operations when the decryption result is different from the identity address of the peer node in the above implementation manner, and will not be repeated here.
  • this embodiment of the present application lists the following two implementations of the second node calculating the local verification information:
  • the second node determines the first resolution key and the first identity address corresponding to the first resolution key index, and calculates local verification information based on the first resolution key and the first identity address.
  • the second node finds the peer node resolution key index corresponding to the first resolution key index in Table 2 according to the received first resolution key index, for example, the second The first resolution key index received by the node is 2, and the peer node resolution key index corresponding to the first resolution key index in Table 2 is also 2. Then the second node calculates local verification information according to the peer node resolution key corresponding to the peer node resolution key index and the peer node identity address.
  • the second node performs an irreversible encryption operation, such as a hash operation, on the peer node resolution key and the peer node identity address to obtain local verification information.
  • an irreversible encryption operation such as a hash operation
  • the first resolved address contains a random number.
  • the second node determines the first resolution key corresponding to the first resolution key index, and calculates local verification information based on the first resolution key and the random number. For the process of the second node determining the first parsing key corresponding to the first parsing key index, reference may be made to the relevant content in the first method, which will not be repeated here.
  • the second node calculates local verification information based on the peer node resolution key corresponding to the peer node resolution key index and the random number contained in the first resolution address.
  • the second node performs an irreversible encryption operation on the resolution key of the peer node and the random number, such as a hash operation, to obtain local verification information. For details, please refer to relevant content in step S301 , which will not be repeated here.
  • the second node when the peer node resolution key index corresponding to the received first resolution key index corresponds to N peer node resolution keys, where N is an integer greater than 1, the second The second node needs to repeat the above-mentioned process of determining the identity address of the first node for the N peer node resolution keys until one of the N peer node resolution keys is used to determine the first node The identity address of or N peer node resolution keys have been tried to use.
  • the second node side there are three peer node resolution keys corresponding to the peer node resolution key index with index 1, namely Key1, Key2, and Key3, and the corresponding peer node identities The addresses are Address1, Address2, Address3.
  • the second node needs to use Key1, Key2, Key3, and the received first resolved address to calculate the local verification information respectively, and compare the The node parses the verification information obtained by key calculation and the verification information included in the first resolution address to determine whether the received first resolution address is associated with the stored resolution key. Specifically, for example, the second node first tries to use Key1 and the random number contained in the first resolved address to calculate the local verification information, and if the obtained local verification information is the same as the received first resolved address.
  • the corresponding peer node identity address (Address1) is the identity address of the first node; on the contrary, if the obtained local verification information is different from the verification information contained in the received first resolved address, the second node continues to try Use Key2, Key3 and the random number contained in the received first resolved address to calculate local verification information until the identity address of the first node is determined or Key2 and Key3 are used up. It can be understood that, in this embodiment of the application, if the verification information calculated according to the stored resolution key and the received first resolution address is the same as the verification information contained in the first resolution address, it means that the received A resolution address is associated with the stored resolution key.
  • the second node can determine the first resolution key indicated by the first resolution key index through the first resolution key index sent by the first node, and then determine the identity address of the first node without traversing the local storage All peer node resolution keys determine the identity address of the first node.
  • the first resolution key index corresponds to multiple peer node resolution keys
  • the second node only needs to traverse the locally saved
  • the peer node resolution key corresponding to the key index does not need to traverse all the peer node resolution keys stored locally to determine the identity address of the first node. Therefore, by adopting the above method, the calculation time for address resolution is reduced, the time required for device address authenticity verification is reduced, and communication efficiency and performance are guaranteed.
  • the resolution address can be randomly generated and hashed using the first resolution key, thus ensuring that the identity address of the first node is difficult to be obtained, thereby ensuring the security and reliability of data transmission between the first node and the second node.
  • the second node can determine the first resolution key corresponding to the first resolution key index, and use the first resolution key to resolve the received first resolution address, so as to determine the identity address of the first node Whether it is the first resolution key index or the first identity address corresponding to the first resolution key. For example, the second node determines local verification information based on the first resolution key determined according to the corresponding relationship, and compares the local verification information with verification information contained in the first resolution address to determine the first identity address.
  • the first node can determine the second resolution key corresponding to the second resolution key index, and use the second resolution key to resolve the received second resolution address, so as to determine the identity address of the second node Whether it is the second resolution key index or the second identity address corresponding to the second resolution key. For example, the first node determines local verification information based on the second resolution key determined according to the corresponding relationship, and compares the local verification information with the verification information included in the second resolution address to determine the second identity address.
  • the communication method described in the embodiment of this application may also include one or more steps in step S701-step S704 shown in FIG.
  • the scene can be a must.
  • Step S701-step S704 are specifically as follows:
  • the first node sends second information to the second node, where the second information includes the first resolution key and the identity address of the first node.
  • the second node receives the second information.
  • the first resolution key and the identity address of the first node included in the second information may be sent in the same message or in different messages.
  • the first node sends the first resolution key through the message C1, and sends the identity address of the first node through the message D1.
  • the message C1 is a message carrying identity authentication key information
  • the message D1 is a message carrying identity address information.
  • the message D1 may also include the address type corresponding to the identity address of the first node, for example, the address type is a public device address type or a static device address type; for another example, the first node sends the first resolution key through the message E1 and the identity address of the first node.
  • the second node defines or configures a correspondence between the first parsing key, the first parsing key index, and the identity address of the first node.
  • first parsing key index a correspondence between the first parsing key, the first parsing key index, and the identity address of the first node.
  • the second node saves or writes the first parsing key, the first parsing key index, and the identity address of the first node in the same row in the table.
  • the table refer to the description in step S303. I won't repeat them here.
  • the "save” and "write” mentioned in the embodiment of this application can represent the corresponding relationship between the resolution key, resolution key index and identity address reflected in the table, and other descriptions can also be used method, not specifically limited.
  • the second node sends fifth information to the first node, where the fifth information includes the second resolution key of the second node and the identity address of the second node.
  • the second resolution key and the identity address of the second node can refer to the foregoing description of the first resolution key and the identity address of the first node.
  • the identity address of the second node can uniquely identify the Two nodes.
  • the first node receives the fifth information.
  • the second resolution key and the identity address of the second node included in the fifth information may be sent in the same message or in different messages.
  • the second node sends the second resolution key through the message C2, and sends the identity address of the first node through the message D2.
  • message C2 is a message carrying identity authentication key information
  • message D2 is a message carrying identity address information.
  • the message D2 may also include the address type corresponding to the identity address of the second node, for example, the address type is a public device address or a static device address; for another example, the second node sends the second resolution key and the second The identity address of the second node.
  • the first node defines or configures a correspondence between the second resolution key, the second resolution key index, and the identity address of the second node.
  • the definition or configuration means that the first node can maintain the above corresponding relationship, but the specific storage method is not specifically limited.
  • the first node saves or writes the second parsing key, the second parsing key index, and the identity address of the second node in the same row in the table.
  • the description in step S303 refer to the description in step S303. I won't repeat them here.
  • the method in the embodiment shown in FIG. 7 may be a previous step of the method in the embodiment shown in FIG. 3 .
  • the local node can pre-configure the corresponding relationship between the resolution key index of the peer node, the resolution key and the identity address, and then confirm the identity of the peer node based on the received resolution key index of the peer node address, without the need for the local node to interact with the peer node to resolve each other's resolution key index, resolution key and identity address every time it verifies the authenticity of the device address of the peer node, reducing the time required for the connection between nodes , ensuring communication efficiency and performance.
  • the node Before the node configures the resolution key index, the node's identity address and the resolution key index, it can obtain the resolution key index first.
  • a node can obtain the parsing key index in one of the following three ways:
  • Method 1 The parsing key index of the peer node saved by the local node comes from the peer node.
  • the second information further includes the first parsing key index
  • the fifth information further includes the second parsing key index.
  • the analysis key index (for example, the first analysis key index and the second analysis key index) may be randomly generated, or assigned by a fixed algorithm, or It is pre-configured, for example, the first resolution key index of the first node is configured when the first node leaves the factory. It should be noted that the generation methods of the resolution key indexes corresponding to different nodes may be different, for example, the first resolution key index may be assigned by a fixed algorithm, and the second resolution key index may be randomly generated.
  • the communication method described in the embodiment of the present application may further include one or more steps in steps S801-S804 shown in FIG. 8 before the method in the embodiment shown in FIG. One or more steps may be necessary for some specific scenarios.
  • the communication method shown in FIG. 8 may be a possible implementation based on the communication method shown in FIG. 7 .
  • the second information in FIG. 7 includes but not limited to the first identity authentication key information and the first identity address information
  • the fifth information in FIG. 7 includes but not limited to the second Identity authentication key information and second identity address information.
  • Step S801-step S804 are specifically as follows:
  • the first node sends first identity authentication key information to the second node, where the first identity authentication key information includes a first parsing key and a first parsing key index.
  • the second node receives the first identity authentication key information.
  • the second node sends second identity authentication key information to the first node, where the second identity authentication key information includes a second parsing key and a second parsing key index.
  • the first node receives the second identity authentication key information.
  • the first node sends first identity address information to the second node, where the first identity address information includes the identity address of the first node and the address type of the identity address;
  • the second node receives the first identity address information.
  • the second node sends second identity address information to the first node, where the second identity address information includes the identity address of the second node and the address type of the identity address.
  • the first node receives the second identity address information.
  • the second identity address information For specific implementation, reference may be made to the detailed description in the embodiment shown in FIG. 6 , which will not be repeated here.
  • Method 2 The parsing key index of the peer node saved by the local node comes from the local node.
  • the first parsing key index is determined by the second node, and is sent to the first node by the second node; the second parsing key index is determined by the first node, and is sent by the first node to second node.
  • the method for determining the parsing key index can refer to the description in Solution 1, which will not be repeated here.
  • the communication method described in the embodiment of the present application may further include one or more steps in steps S901-S906 shown in FIG. 9 before the method in the embodiment shown in FIG. One or more steps may be necessary for some specific scenarios.
  • the communication method shown in FIG. 9 may be another possible implementation based on the communication method shown in FIG. 7 .
  • the second information in FIG. 7 includes but not limited to the first identity authentication key information, the second identity authentication key response information, and the first identity address information. All the information in FIG. 7
  • the fifth information includes but is not limited to first identity authentication key response information, second identity authentication key information, and second identity address information.
  • Step S901-step S906 are specifically as follows:
  • the first node sends first identity authentication key information to the second node, where the first identity authentication key information includes a first parsing key.
  • the second node receives the first identity authentication key information.
  • the second node sends first identity authentication key response information to the first node, where the second identity authentication key response information includes a first parsing key index corresponding to the first parsing key.
  • the first node receives the first identity authentication key response information. S903.
  • the second node sends second identity authentication key information to the first node, where the second identity authentication key information includes a second parsing key.
  • the first node receives the second identity authentication key information.
  • the first node sends second identity authentication key response information to the second node, where the second identity authentication key response information includes a second parsing key index corresponding to the second parsing key.
  • the second node receives the second identity authentication key response information.
  • the first node sends the first identity address information to the second node, the first identity address information includes the identity address of the first node and the address type of the identity address; correspondingly, the second node receives the first identity address information .
  • the second node sends second identity address information to the first node, where the second identity address information includes the identity address of the second node and the address type of the identity address.
  • the first node receives the second identity address information.
  • the parsing key index of the peer node saved by the local node comes from the local node, which can better avoid the conflict of the parsing key index of the peer node on the local node side, that is, on the local node side, avoid the occurrence of the same
  • the parsing key index corresponds to different peer nodes, which can reduce the time required for peer node address authenticity verification and ensure communication efficiency and performance.
  • Mode 3 The parsing key indexes of different nodes come from the same node.
  • both the first parsing key index and the second parsing key are derived from the first node.
  • the second information also includes the first parsing key index
  • the second parsing key index also comes from the first node.
  • the first node determines the second resolution key index by means of random number generation or fixed algorithm distribution, and sends the second resolution key index to the second node.
  • the second node can use the second resolution key index to perform data transmission with the first node.
  • the first node may be an initiator of communication, and may be called a master node or an access point (access point, AP).
  • AP access point
  • the communication method described in the embodiment of the present application may further include one or more steps in steps S1001-S1005 shown in FIG. 10 before the method in the embodiment shown in FIG. One or more steps may be necessary for some specific scenarios.
  • the communication method shown in FIG. 10 may be another possible implementation based on the communication method shown in FIG. 7 .
  • the second information in FIG. 7 includes but not limited to the first identity authentication key information, the second identity authentication key response information, and the first identity address information. All the information in FIG. 7
  • the fifth information includes but not limited to the second identity authentication key information and the second identity address information.
  • Step S1001-step S1005 are specifically as follows:
  • the first node sends first identity authentication key information to the second node, where the first identity authentication key information includes a first parsing key and a first parsing key index.
  • the second node receives the first identity authentication key information.
  • the second node sends second identity authentication key information to the first node, where the second identity authentication key information includes a second parsing key.
  • the first node receives the second identity authentication key information.
  • the first node sends second identity authentication key response information to the second node, where the second identity authentication key response information includes a second parsing key index corresponding to the second parsing key.
  • the second node receives the second identity authentication key response information.
  • the first node sends first identity address information to the second node, where the first identity address information includes the identity address of the first node and the address type of the identity address;
  • the second node receives the first identity address information.
  • the second node sends second identity address information to the first node, where the second identity address information includes the identity address of the second node and the address type of the identity address.
  • the first node receives the second identity address information.
  • the resolution key indexes of different nodes come from the same node, which is convenient for the management of the resolution key indexes, and can better avoid the conflict of the resolution key indexes of the peer nodes on the local node side, thereby reducing the The time it takes to verify the authenticity of node addresses ensures communication efficiency and performance.
  • the communication method described in the embodiment of this application may also include step S1101, or step S1101 and step S1102 described in FIG. It's required.
  • Step S1101 and step S1102 are specifically as follows:
  • the first node sends third information to the second node, where the third information is used to indicate to determine the identity address of the first node according to the resolution key index and the resolution address.
  • the second node receives the third information.
  • the third information is used to instruct to send the parsing key information and the identity address information. That is, the third information is used to indicate that the identity address of the first node is determined according to the resolution key index and the resolution address. It can be understood that the third information is used to indicate to send the resolution key information and the identity address information. For clarity of description, the third information is used to indicate that the identity address of the first node is determined according to the resolution key index and the resolution address as an example.
  • the third information is used to indicate that the identity address of the first node is determined according to the resolution key index and resolution address, then in the subsequent data transmission between the first node and the second node, the first node sends the first resolution to the second node address and the first identity address; or in the subsequent data transmission between the first node and the second node, the second node determines the resolution key through the first resolution key index, and then parses the received first resolution key based on the first resolution key A resolution address; or, in the subsequent data transmission between the first node and the second node, the second node communicates with the first node through the first resolution address.
  • the parsing key information includes a parsing key and a parsing key index, or the parsing key information includes a parsing key.
  • the resolution key may be IRK.
  • the third information may also be used to indicate not to send the resolution key information and the identity address information, or the third information may be used to indicate not to determine the identity address of the first node according to the resolution key index and the resolution address.
  • the third information indicates that the identity address of the first node is not determined according to the resolution key index and the resolution address, or the third information indicates that the resolution key information and the identity address information are not sent
  • the first node and the In the subsequent data transmission process of the second node the second node does not communicate with the first node through the first resolved address, for example, directly communicates with the first node through the identity address of the first node; or, the second node traverses the locally saved
  • the parsing key parses the first parsing address, and then determines the identity address of the first node.
  • the second node sends fourth information to the first node.
  • the fourth information is used to indicate whether to send the resolution key information and the identity address information, or the fourth information is used to indicate whether to determine according to the resolution key index and the resolution address.
  • the identity address of the second node is used to indicate whether to send the resolution key information and the identity address information.
  • the first node receives the fourth information.
  • the first node can determine the identity address of the second node through the second resolution key index and the second resolution address of the second node.
  • the fourth information is used to indicate that the identity address of the second node is not determined according to the resolution key index and resolution address, or The fourth information is used to indicate that when the resolution key information and identity address information are not sent, during the subsequent data transmission process between the first node and the second node, the first node does not communicate with the second node through the second resolution address, for example, through The identity address of the second node communicates with the second node; or, the first node resolves the second resolution address by traversing a locally saved resolution key index, and then determines the identity address of the second node.
  • the method in the embodiment shown in FIG. 11 may be a previous step of the method in the embodiment shown in FIG. 7 .
  • data transmission between nodes can be realized by resolving addresses. Since the resolution address can only be resolved by nodes with the same resolution key, the security of data transmission between nodes is guaranteed. Furthermore, the flexibility for the local node to determine the identity address of the peer node can also be increased.
  • the third information sent by the first node to the second node can be used to indicate that the identity address of the first node is not determined according to the resolution key index and the resolution address, so that the second node can reduce the cost of determining the resolution key according to the resolution key index in the process of resolving the identity address of the peer node.
  • the third information can indicate that according to the parsing key index and parsing address, The identity address of the first node is determined, thereby reducing the calculation time required for the second node to resolve the identity address of the peer node, and improving the efficiency of data transmission between communication nodes.
  • the number of parsing keys can be judged by the configured threshold. If it is lower than the threshold (or lower than or equal to the threshold), it can be considered that the number of parsing keys is small; otherwise, it is considered that the number of parsing keys is large .
  • the third information may be included in the pairing request information, and the fourth information may be included in the pairing response information.
  • the communication method described in the embodiment of the present application may further include steps S1201 - S1202 shown in FIG. 12 before the method in the embodiment shown in FIG. 7 .
  • the communication method shown in FIG. 12 may be an implementation manner of the communication method shown in FIG. 11 .
  • the third information in FIG. 11 includes but not limited to the security information distribution information included in the pairing request information
  • the fourth information in FIG. 11 includes but not limited to the security information distribution information included in the pairing response information.
  • Step S1201-step S1202 are specifically as follows:
  • the first node sends pairing request information to the second node.
  • the pairing request information includes security information distribution information, and the security information distribution information indicates that the analysis key information and identity address information are sent; The key index and resolution address determine the identity address of the first node; or, the security information distribution information indicates that after the nodes are paired, the local node will distribute the resolution key of the local node and the identity address of the local node to the peer node.
  • the security information distribution information indicates whether the first node will distribute the resolution key of the first node and the identity address of the first node to the second node after the first node and the second node are paired.
  • the definition of the security information distribution information can refer to Table 3, where the meanings of other bits except bit 0 and bit 1 are not limited in this embodiment of the present application.
  • the security information distribution information may also indicate not to send the analysis key information and identity address information; or, the security information distribution information indicates not to determine the identity address of the first node according to the analysis key index and the analysis address; Alternatively, the security information distribution information indicates that after the nodes are paired, the local node will not distribute the parsing key of the local node and the identity address of the local node to the peer node.
  • Safety Information Distribution Information meaning No. 0 After pairing, whether to distribute the parsing key information to the peer node,
  • the local node when the 0th bit of the security information distribution information is 1, it means that after the local node and the peer node are paired, the local node will distribute the parsing key information to the peer node; when the 0th bit of the security information distribution information When the value of the bit is 0, it means that after the local node and the peer node are paired, the local node will not distribute the parsing key information to the peer node. It should be noted that the corresponding relationship between the value of bit 0 of the security information distribution information and whether to send the parsing key information to the peer node may also have other expressions, which are not specifically limited.
  • the local node when the value of the first bit of the security information distribution information is 1, it means that after the local node and the peer node are paired, the local node will distribute the identity address of the local node to the peer node; when the first bit of the security information distribution information When the value of bit 1 is 0, it means that after the local node and the peer node are paired, the local node will not distribute the identity address of the local node to the peer node. It should be noted that the corresponding relationship between the value of the first bit of the security information distribution information and whether to send the identity address of the local node to the peer node may also have other expressions, which are not specifically limited.
  • the local node when the 0th bit and the 1st bit of the security information distribution information are both 1, it can mean that after the local node and the peer node are paired, the local node needs to send a parsing message to the peer node.
  • the key information and the identity address of the local node or it can be understood that in the subsequent data transmission process, the peer node can determine the identity address of the local node according to the resolved key index and resolved address.
  • the peer node can ignore the value of the first bit of the security information distribution information, and only determine whether the local node sends the parsing key to itself according to the value of the 0th bit of the security information distribution information . For example, when the 0th bit in the security information distribution information sent by the local node is 1, no matter whether the 1st bit in the security information distribution information is 0 or 1, the local node will send a local The resolution key information of the node. For example, in the scenario where the resolution key is updated, since the local node has already sent the identity address of the local node to the peer node in the previous data transmission, it only needs to send the updated resolution key to the peer node. In this case, the peer node can only determine whether the local node sends the parsing key to itself according to the value of bit 0 of the security information distribution information.
  • the security information distribution information may also indicate how to obtain the resolution key index, that is, it may indicate one of the following three acquisition methods: the resolution key index of the peer node saved by the local node comes from the The end node; the parsing key index of the peer node saved by the local node comes from the local node; the parsing key index of different nodes comes from the same node.
  • the resolution key index of the peer node saved by the local node comes from the The end node
  • the parsing key index of the peer node saved by the local node comes from the local node
  • the parsing key index of different nodes comes from the same node.
  • the pairing request information may also include command code (Code), input and output capability IOC, out-of-band-data identifier (out of band data) flag, OOB data flag), authentication request (AuthReq), maximum encryption key size (maximum encryption key size), and one or more of cryptographic algorithm types.
  • code command code
  • IOC input and output capability
  • OOB data flag out-of-band-data identifier
  • AuthReq authentication request
  • maximum encryption key size maximum encryption key size
  • cryptographic algorithm types one or more of cryptographic algorithm types.
  • Code is used to indicate the type of message, for example, 0x02 represents a pairing request message, 0x03 represents a pairing response message, 0x04 represents a pairing confirmation message, 0x05 represents a pairing initial information;
  • IOC represents a node (such as the first node) that sends the pairing request message
  • Table 4 is a possible implementation of the IOC field provided by the implementation of this application;
  • the OOB data identifier represents whether the node that sends the OOB data identifier supports the OOB pairing method, wherein the OOB media may be any Other wireless communication standards that can transmit corresponding information, such as near field communication (near field communication, NFC) or two-dimensional code;
  • AuthReq can include binding flags (bonding_flags, BF), man-in-the-middle protection (man-in-the- middle, MITM), secure connection sign (secure connections, SC), key input sign (keypress) identification of one or more;
  • the maximum encryption key length indicates the device that sends
  • the second node sends pairing response information to the first node.
  • the pairing response information includes security information distribution information.
  • security information distribution information For a specific implementation manner of the security information distribution information, reference may be made to relevant content in step S1201, which will not be repeated here.
  • the pairing response information may also include a command code (Code), an input and output capability IOC, an out-of-band device data identifier OOB data flag, an authentication request (AuthReq), and a maximum encryption key size (maximum encryption key size) , one or more types of cryptographic algorithm, the specific description of the above information can refer to the relevant content in step S1201, and will not be repeated here.
  • code command code
  • IOC input and output capability
  • OOB data flag an out-of-band device data identifier
  • AuthReq authentication request
  • maximum encryption key size maximum encryption key size
  • the security information distribution information contained in the pairing request information can also indicate the way to obtain the resolution key index, that is, it can indicate one of the following three acquisition schemes: the peer stored by the local node The resolution key index of the node comes from the peer node; the resolution key index of the peer node saved by the local node comes from the local node; the resolution key index of different nodes comes from the same node.
  • the three acquisition schemes reference may be made to relevant content in the above-mentioned application embodiments, and details are not repeated here.
  • the communication method shown in FIG. 12 further includes step S1203 and step S1204, and the details of step S1203 and step S1204 are as follows:
  • the first node sends pairing confirmation information to the second node.
  • the second node receives the pairing confirmation information.
  • the pairing confirmation information is the IOC of the local node (such as the first node) combined with the peer node (such as the second node), and according to the cryptographic algorithm type that the peer node can support, select a pairing method and cryptographic algorithm type, and notify the peer The end node does the subsequent pairing and encryption.
  • the pairing confirmation information may include a first random number N1 used for subsequent generation of a communication link key between nodes and a public key used for key negotiation.
  • FIG. 14 is a schematic diagram of possible pairing confirmation information provided by an embodiment of the present application.
  • the pairing confirmation information includes one or more items of Code, key length, authentication type, cryptographic algorithm type, public key, and first random number N1.
  • the key length may be, for example, the key length finally determined by the node that initiates the pairing confirmation information
  • the authentication type for example, may refer to Table 5, which is a possible implementation of the authentication type field provided by the implementation of this application.
  • Table 5 is a possible implementation of the authentication type field provided by the implementation of this application.
  • the second node sends pairing initial information to the first node.
  • the first node receives the pairing initial information.
  • the pairing initial information includes the second random number N2 and the public key used for subsequent generation of communication link keys between nodes.
  • FIG. 15 is a schematic diagram of possible pairing initial information provided by an embodiment of the present application.
  • the pairing initial information includes a Code, a public key, and a second random number N2.
  • the first node and the second node send the parsing key (which can also be understood as an identity authentication key) and identity address information to each other can be determined by the communication method described in FIG. 12
  • the pairing request information and pairing response information included in is determined.
  • the security information distribution protocol can be started, that is, the first node and the second node can Interact each other's resolution key and identity address, and save the resolution key, the resolution key index corresponding to the resolution key, and the corresponding relationship between the identity address in the local resolution table.
  • the communication method shown in FIG. 3 can be referred to, thereby reducing the calculation time for parsing the received parsing address, and ensuring communication efficiency and performance.
  • Fig. 16 is a schematic block diagram of a communication device provided by an embodiment of the present application.
  • the communication device may include a processor and a transceiver, so as to execute the method in any possible implementation manner above.
  • the processor may be used to perform internal processing of the device, for example, according to the first resolution key index and the first resolution address, determine the identity address of the first node; another example, determine based on the first The local verification information obtained by parsing the key and the random number is the same as the verification information contained in the first parsing address, and determining that the first identity address is the identity address of the first node; for another example, determining the first node The first resolved address of .
  • Transceivers are used to perform functions related to transmission and reception, such as sending information to or receiving information from other devices.
  • the transceiver included in the communication device may be a transmitter and a receiver, or a transmitter and a receiver.
  • the communication device is a communication chip
  • the transceiver may be an input-output circuit or a port of the communication chip.
  • the above-mentioned communication device may be a device of the first node or a chip configured in the first node, and the communication device may be used to execute the method in any possible implementation performed by the first node above.
  • the above-mentioned communication device may be a device of the second node or a chip configured in the second node, and the communication device may be used to execute the method in any possible implementation manner performed by the second node above.
  • the communication device further includes various modules configured to execute the methods in any possible implementation manners above.
  • the communication device may further include a memory, as shown by a dashed box in FIG. 17 .
  • Fig. 17 is a schematic block diagram of a communication device provided by an embodiment of the present application.
  • the memory is coupled with the processor and the transceiver included in the communication device. It can be understood that the memory, the processor, and the transceiver communicate with each other through an internal connection path.
  • the processor may be used to execute instructions in the memory, so that the apparatus executes the method in any possible implementation manner above.
  • FIG. 18 shows a schematic structural diagram of a chip.
  • the chip includes one or more processors and interface circuits, configured to execute the methods in any possible implementation manners above.
  • the chip may also include a bus. in:
  • the processor is an integrated circuit chip with signal processing capability.
  • the processor can be a field programmable gate array (field programmable gate array, FPGA), a general processor, a digital signal processor (digital signal processor, DSP), an application specific integrated circuit (application specific integrated circuit, ASIC) Or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, system on chip (SoC), central processor unit (CPU), or network processing
  • SoC system on chip
  • CPU central processor unit
  • a network processor network processor
  • NP network processor
  • MCU microcontroller
  • programmable logic device programmable logic device
  • PLD programmable logic device
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • the interface circuit can be used for sending or receiving data, instructions or information, and the processor can process the data, instructions or other information received by the interface circuit, and can send the processing completion information through the interface circuit.
  • the chip also includes memory, which may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • double data rate SDRAM double data rate SDRAM
  • DDR SDRAM enhanced synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • serial link DRAM SLDRAM
  • direct memory bus random access memory direct rambus RAM, DR RAM
  • processors and the interface circuit can be realized through hardware design, software design, or a combination of software and hardware, which is not limited here.
  • the embodiment of the present application also provides a processing device, including a processor and an interface; the processor is used to execute the method in any possible implementation performed by the first node above, or to execute the second node above A method in any possible implementation that is executed.
  • An embodiment of the present application also provides a communication system, the communication system includes a communication device for performing the method in any possible implementation manner performed by the first node above and a communication device for performing the method performed by the second node above The communication device of the method in any possible implementation manner of .
  • memory of the systems and methods described herein is intended to include, but not be limited to, these and any other suitable types of memory.
  • the embodiment of the present application also provides a computer program product, the computer program product includes: computer program code, when the computer program code runs on the computer, the computer executes any possible implementation performed by the first node above The method in the manner, or execute the method in any possible implementation manner performed by the second node above.
  • the present application also provides a computer-readable medium, the computer-readable medium stores program code, and when the program code is run on the computer, the computer is made to perform any of the possible implementations performed by the first node above. method, or execute the method in any possible implementation manner executed by the second node above.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server, a data center, etc. integrated with one or more available media.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a high-density digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, a solid state disk (solid state disc, SSD)) etc.
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a high-density digital video disc (digital video disc, DVD)
  • a semiconductor medium for example, a solid state disk (solid state disc, SSD)
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请实施例提供一种地址验证方法及相应的装置，应用于通信技术领域，尤其涉及短距通信技术。具体应用中，第二节点接收来自第一节点的第一信息，该第一信息包含第一节点的第一解析地址和第一解析密钥索引，该第一解析密钥索引用于指示第一解析密钥；进而第二节点可以根据第一解析密钥索引和第一解析地址，确定第一节点的身份地址，该身份地址唯一标识第一节点。其中，第一解析地址包含用于验证第一解析密钥的验证信息，第一解析密钥对应第一身份地址。采用该方式，可以保证通信节点之间的安全通信，保证通信效率和性能。

Description

一种地址验证方法及相应的装置 技术领域
本申请实施例涉及通信技术领域，尤其涉及短距离通信技术。具体的，本申请提供一种地址验证方法及相应的装置。
背景技术
在信息化飞速发展的今天，移动终端，不管是手机、平板还是其他可携带式智能终端，都是生活中不可缺少的个人智能工具，与传统的计算机相比，尤其是台式工作站、服务器相比，这些工具使用更为便利。但我们在享受通信便利的同时，也会面临隐私泄露的风险。为降低隐私泄露的风险，两个通信节点进行无线通信时，如何进行身份验证，保证通信效率和性能是亟需解决的技术问题。
发明内容
本申请实施例公开了一种地址验证方法及相应的装置，可以实现通信节点之间的安全通信，降低隐私泄露的风险，保证通信效率和性能。
第一方面，提供了一种地址验证方法，该方法可以由通信节点或配置于通信节点中的芯片执行。示例性地，该方法可以由第二节点或者配置于第二节点中的芯片执行。该方法包括：接收来自第一节点的第一信息，所述第一信息包含所述第一节点的第一解析地址和第一解析密钥索引，所述第一解析密钥索引用于指示第一解析密钥；根据所述第一解析密钥索引和所述第一解析地址，确定所述第一节点的身份地址，所述身份地址唯一标识所述第一节点；其中，所述第一解析地址包含用于验证所述第一解析密钥的验证信息，所述第一解析密钥对应第一身份地址。
该方案中，通信节点之间的数据传输安全可以通过解析地址保证。由于解析地址只能被拥有相同解析密钥的通信节点正确解析，因此通过本申请提供的地址验证方法，可以保证第一节点的身份地址难以被获取，保证通信节点之间数据传输的安全性。
结合第一方面，在第一方面的某些实现方式中，根据所述第一解析密钥索引和所述第一解析地址，确定所述第一节点的身份地址，包括：根据所述第一解析密钥索引确定所述第一解析密钥，根据所述第一解析密钥和所述第一解析地址，确定第一节点的身份地址。
该方案中，第二节点可以根据第一解析密钥索引确定与其对应的第一解析密钥，进而根据第一解析密钥和第一解析地址，确定第一节点的身份地址，而无需通过遍历本地保存的所有对端节点解析密钥确定第一节点的身份地址，或者只需遍历与该第一解析密钥索引对应的对端节点解析密钥确定第一节点的身份地址。因此，可以降低地址验证所需的计算时间，保证通信效率和性能。
结合第一方面，在第一方面的某些实现方式中，根据所述第一解析密钥索引和所述第一解析地址，确定所述第一节点的身份地址，包括：确定基于所述第一解析密钥得到的本地验证信息与所述第一解析地址包含的验证信息相同，确定所述第一身份地址为所述第一节点的身份地址。
该方案中，基于本地验证信息与接收到的第一解析地址中包括的验证信息的比较结果， 确定第一解析密钥对应的第一身份地址是否为第一节点的身份地址，保证了对第一节点地址可信性的验证，进而保证了通信节点之间数据传输的安全性。
结合第一方面，在第一方面的某些实现方式中，所述第一解析地址包含随机数，根据所述第一解析密钥索引和所述第一解析地址，确定所述第一节点的身份地址，包括：确定基于所述第一解析密钥和所述随机数得到的本地验证信息与所述第一解析地址包含的验证信息相同，确定所述第一身份地址为所述第一节点的身份地址。
该方案中，基于第一解析地址中包含的随机数和第一解析密钥确定本地验证信息，可以保证第一节点的身份地址难以被获取，进而保证通信节点之间数据传输的安全性。
示例性地，所述本地验证信息是基于所述第一解析密钥和所述随机数的哈希运算得到的。由于哈希运算是不可逆的，因此通过哈希运算，可以进一步保证只有被信任的通信节点能够解析接收到的解析地址，进而保证通信节点之间数据传输的安全性。
结合第一方面，在第一方面的某些实现方式中，所述第一解析密钥、所述第一解析密钥索引以及所述第一身份地址之间存在预先定义或者配置的对应关系。
基于该对应关系，可以确定第一解析密钥索引对应的第一解析密钥，并通过该第一解析密钥解析接收到的第一解析地址，以此确定第一节点的身份地址是否为第一解析密钥索引或第一解析密钥对应的第一身份地址。通过该方案，根据预先定义或者配置的关系确定第一解析密钥或第一身份地址，避免了第二节点在每次验证第一节点的地址可信性时，都接收第一节点发送的解析密钥索引、解析密钥以及身份地址信息，减少了通信节点之间连接所需要的时间，保证了通信效率和性能。
结合第一方面，在第一方面的某些实现方式中，所述接收来自第一节点的第一信息之前，所述方法还包括：接收来自所述第一节点的第二信息，所述第二信息包含所述第一解析密钥和所述第一身份地址；定义或配置所述第一解析密钥、所述第一解析密钥索引以及所述第一身份地址之间存在所述对应关系。
示例性地，所述第二信息还包含所述第一解析密钥索引，第二节点可以根据接收到的第二信息包含的所述第一解析密钥、所述第一解析密钥索引以及所述第一身份地址，定义或配置所述对应关系。该方案中，所述第一解析密钥索引、所述第一解析密钥以及所述第一身份地址均来自第一节点，实现简单。
示例性地，所述第一解析密钥索引来自控制节点，所述控制节点用于配置第一节点的解析密钥索引(即第一解析密钥索引)和第二节点的解析密钥索引(即第二解析密钥索引)。其中，所述控制节点例如可以为主节点或接入点，所述控制节点例如也可以为第一节点或第二节点。第二节点可以根据接收到的第二信息和来自所述控制节点的第一解析密钥索引，定义或配置所述对应关系。该方案中，不同的通信节点各自对应的解析密钥索引均来自相同的通信节点，有助于解析密钥索引的统一管理，可以避免对端节点的解析密钥索引在本地节点侧的冲突，进而可以减少对端节点地址可信性验证所需的时间，保证了通信效率和性能。
示例性地，结合第一方面，在第一方面的某些实现方式中，所述方法还包括：向所述第一节点发送所述第一解析密钥索引。第二节点可以根据所述第二信息和本地生成的所述第一解析密钥索引，定义或配置所述对应关系。该方案中，第一节点的解析密钥索引(即 第一解析密钥索引)来自于第二节点，进而可以避免第一节点的解析密钥索引在第二节点侧的冲突，即在第二节点侧，避免出现相同的解析密钥索引对应不同的对端节点，从而可以减少对端节点地址可信性验证所需的时间，保证了通信效率和性能。
结合第一方面，在第一方面的某些实现方式中，所述接收来自第一节点的第一信息之前，所述方法还包括：接收来自所述第一节点的第三信息，所述第三信息用于指示根据解析密钥索引和解析地址，确定该第一节点的身份地址。
示例性地，所述解析密钥信息包括解析密钥和解析密钥索引，或者所述解析密钥信息包括解析密钥。
示例性地，所述身份地址信息包括公共设备地址和/或静态设备地址。
通过该方案，一方面可以使能第二节点通过解析密钥信息确定第一节点的身份地址，保证通信节点之间数据传输的安全性，另一方面还可以增加第二节点确定第一节点身份地址的灵活性，降低地址可信性验证所需的计算时间，保证通信效率和性能。
示例性地，所述第三信息包含于来自所述第一节点的配对请求信息中。例如，所述配对请求信息包含安全信息分发信息，所述安全信息分发信息用于指示是否发送解析密钥信息和/或身份地址信息。该方案中，通过配对请求信息实现第三信息，可以节省信令开销，实现简单。
结合第一方面，在第一方面的某些实现方式中，所述方法还包括：向所述第一节点发送第四信息，所述第四信息用于指示是否根据解析密钥索引和解析地址，确定该第二节点的身份地址。通过该方案，一方面可以使能第一节点通过解析密钥信息确定对端节点的身份地址，保证通信节点之间数据传输的安全性，另一方面还可以增加确定对端节点身份地址的灵活性，降低身份地址验证所需的计算时间，保证通信效率和性能。
示例性地，所述第四信息包含于向所述第一节点发送的配对响应信息中。例如，所述配对响应信息包含安全信息分发信息，所述安全信息分发信息用于指示是否发送解析密钥信息和/或身份地址信息。该方案中，通过配对响应信息实现第四信息，可以节省信令开销，实现简单。
第二方面，提供了一种地址验证方法，该方法可以由通信节点或配置于通信节点中的芯片执行。示例性地，该方法可以由第一节点或者配置于第一节点中的芯片执行。该方法包括：确定第一节点的第一解析地址；向第二节点发送第一信息，所述第一信息包含所述第一解析地址和第一解析密钥索引，所述第一解析密钥索引用于指示第一解析密钥；其中，所述第一解析地址包含用于验证所述第一解析密钥的验证信息，所述第一解析密钥对应所述第一节点的身份地址，所述身份地址唯一标识所述第一节点。
该方案中，通信节点之间的数据传输可以通过解析地址实现。由于解析地址只能被拥有相同解析密钥的通信节点正确解析，因此通过本申请提供的地址验证方法，可以保证第一节点的身份地址难以被获取，保证通信节点之间数据传输的安全性。
结合第二方面，在第二方面的某些实现方式中，所述确定第一节点的第一解析地址，包括：根据所述第一解析密钥和所述第一节点的身份地址确定所述第一解析密钥的验证信息。
示例性地，第一节点对第一解析密钥和第一节点的身份地址进行密码运算，得到密码 运算输出值，该密码运算输出值即为所述验证信息，或者为所述验证信息的一部分。
该方案中，基于第一解析密钥和第一节点的身份地址确定验证信息，可以保证第一解析地址只能被拥有相同解析密钥的通信节点正确解析，进而保证通信节点之间数据传输的安全性。
结合第二方面，在第二方面的某些实现方式中，所述第一解析地址包含随机数，所述确定第一节点的第一解析地址，包括：确定基于所述第一解析密钥和所述随机数得到的验证信息。
该方案中，基于第一解析地址中包含的随机数确定第一解析地址中的验证信息，可以保证第一节点的身份地址难以被获取，进而保证通信节点之间数据传输的安全性。
示例性地，所述验证信息是基于所述第一解析密钥和所述随机数的哈希运算得到的。由于哈希运算是不可逆的，因此通过哈希运算，可以进一步保证只有被信任的通信节点能够解析接收到的解析地址，进而保证通信节点之间数据传输的安全性。
结合第二方面，在第二方面的某些实现方式中，所述向第二节点发送第一信息之前，所述方法还包括：向所述第二节点发送第二信息，所述第二信息包含所述第一解析密钥和所述身份地址。
示例性地，所述第二信息还包括所述第一解析密钥索引。通过该方案，可以实现第一解析密钥索引、第一解析密钥以及所述身份地址之间的对应关系的配置或定义，避免了第二节点在每次验证第一节点的地址可信性时，都接收第一节点发送的解析密钥索引、解析密钥以及身份地址信息，减少了通信节点之间连接所需要的时间，保证了通信效率和性能。此外，该方案中，所述第一解析密钥索引、所述第一解析密钥以及所述第一身份地址均来自第一节点，实现简单。
示例性地，所述第一解析密钥索引来自控制节点。所述控制节点用于配置第一节点的解析密钥索引(即第一解析密钥索引)和第二节点的解析密钥索引(即第二解析密钥索引)。其中，所述控制节点例如可以为主节点或接入点，所述控制节点例如也可以为第一节点或第二节点。第二节点可以根据接收到的第二信息和来自所述控制节点的第一解析密钥索引，定义或配置所述对应关系。该方案中，不同的通信节点各自对应的解析密钥索引均来自相同的通信节点，有助于解析密钥索引的统一管理，可以避免对端节点的解析密钥索引在本地节点侧的冲突，进而可以减少对端节点地址可信性验证所需的时间，保证了通信效率和性能。
示例性地，所述第一解析密钥索引来自所述第二节点。通过该方案，可以实现第一解析密钥索引、第一解析密钥以及所述身份地址之间的对应关系的配置或定义，避免了第二节点在每次验证第一节点的地址可信性时，都接收第一节点发送的解析密钥索引、解析密钥以及身份地址信息，减少了通信节点之间连接所需要的时间，保证了通信效率和性能。此外，解析密钥索引来自第二节点，可以避免第一节点的解析密钥索引在第二节点侧的冲突，即在第二节点侧，避免出现相同的解析密钥索引对应不同的节点，从而可以减少对端节点地址可信性验证所需的时间，进一步保证了通信效率和性能。
结合第二方面，在第二方面的某些实现方式中，所述向第二节点发送第一信息之前，所述方法还包括：向所述第二节点发送第三信息，所述第三信息用于指示根据解析密钥索 引和解析地址，确定该第一节点的身份地址。
示例性地，所述解析密钥信息包括解析密钥和解析密钥索引，或者所述解析密钥信息包括解析密钥。
示例性地，所述身份地址信息包括公共设备地址和/或静态设备地址。
通过该方案，一方面可以使能第二节点通过解析密钥信息确定第一节点的身份地址，保证通信节点之间数据传输的安全性，另一方面还可以增加第二节点确定第一节点身份地址的灵活性，降低地址可信性验证所需的计算时间，保证通信效率和性能。
示例性地，所述第三信息包含于所述第一节点发送的配对请求信息中。例如，所述配对请求信息包含安全信息分发信息，所述安全信息分发信息用于指示是否发送解析密钥信息和/或身份地址信息。该方案中，通过配对请求信息实现第三信息，可以节省信令开销，实现简单。
结合第二方面，在第二方面的某些实现方式中，所述方法还包括：接收来自所述第二节点的第四信息，所述第四信息用于指示是否根据解析密钥索引和解析地址，确定该第二节点的身份地址。通过该方案，一方面可以使能第一节点通过解析密钥信息确定第二节点的身份地址，保证通信节点之间数据传输的安全性，另一方面还可以增加第一节点确定第二节点身份地址的灵活性，降低地址可信性验证所需的计算时间，保证通信效率和性能。
示例性地，所述第四信息包含于来自所述第二节点的配对响应信息中。例如，所述配对响应信息包含安全信息分发信息，所述安全信息分发信息用于指示是否发送解析密钥信息和/或身份地址信息。该方案中，通过配对响应信息实现第四信息，可以节省信令开销，实现简单。
第三方面，提供了一种通信装置，包括处理单元和收发单元，以执行上述第一方面或第一方面的任意可能的实现方式中的方法，或者以执行上述第二方面或第二方面的任意可能的实现方式中的方法。
第四方面，提供了一种通信装置，包括至少一个处理器和收发器，所述至少一个处理器用于调用至少一个存储器中存储的计算机程序，以执行上述第一方面或第一方面的任意可能的实现方式中的方法，或者以执行上述第二方面或第二方面的任意可能的实现方式中的方法。其中，收发器用于执行与发送和接收相关的功能。可选地，该收发器包括接收器和发射器，或者为发射机和接收机。
结合第四方面，在第四方面的某些实现方式中，该通信装置为通信芯片，该收发器可以为该通信芯片的输入输出电路或者端口。
结合第四方面，在第四方面的某些实现方式中，该通信装置还包括存储器，该存储器与该通信装置包括的处理器耦合，该处理器可用于执行存储器中的指令，以使得该装置执行上述第一方面或第一方面的任意可能的实现方式中的方法，或者执行上述第二方面或第二方面的任意可能的实现方式中的方法。可选地，该装置还可以包括接口电路，处理模块与接口电路耦合。
第五方面，提供了一种通信设备，其特征在于，包括用于执行述第一方面或第一方面的任意可能的实现方式中的方法的通信装置，或用于执行上述第二方面或第二方面的任意可能的实现方式中的方法的通信装置。
第六方面，提供了一种芯片，该芯片包括一个或多个处理器和接口电路，该芯片用于执行上述第一方面或第一方面的任意可能的实现方式中的方法，或者用于执行上述第二方面或第二方面的任意可能的实现方式中的方法。
第七方面，提供了一种通信系统，该通信系统包括用于执行上述第一方面或第一方面的任意可能的实现方式中的方法的通信装置、以及用于执行上述第二方面或第二方面的任意可能的实现方式中的方法的通信装置。
第八方面，提供了一种计算机可读存储介质，该计算机可读存储介质中存储有计算机程序或指令，当计算机程序或指令被通信装置执行时，使得该通信装置执行上述第一方面或第一方面的任意可能的实现方式中的方法，或者使得该通信装置执行上述第二方面或第二方面的任意可能的实现方式中的方法。
第九方面，提供了一种计算机程序产品，该计算机程序产品包括计算机程序或指令，当该计算机程序或指令被通信装置执行时，使得该通信装置执行上述第一方面或第一方面的任意可能的实现方式中的方法，或者使得该通信装置执行上述第二方面或第二方面的任意可能的实现方式中的方法。
附图说明
以下对本申请实施例用到的附图进行介绍。
图1是本申请实施例提供的一种通信系统的架构示意图；
图2是本申请实施例提供的一种通信方法的使用场景示意图；
图3是本申请实施例提供的一种通信方法的流程示意图；
图4是本申请实施例提供的一种公共设备地址的示意图；
图5是本申请实施例提供的一种静态设备地址的示意图；
图6是本申请实施例提供的一种解析地址的示意图；
图7是本申请实施例提供的又一种通信方法的流程示意图；
图8是本申请实施例提供的又一种通信方法的流程示意图；
图9是本申请实施例提供的又一种通信方法的流程示意图；
图10是本申请实施例提供的又一种通信方法的流程示意图；
图11是本申请实施例提供的又一种通信方法的流程示意图；
图12是本申请实施例提供的又一种通信方法的流程示意图；
图13是本申请实施例提供的一种配对请求信息的示意图；
图14是本申请实施例提供的一种配对确认信息的示意图；
图15是本申请实施例提供的一种配对初始信息的示意图；
图16是本申请实施例提供的一种通信装置的示意图；
图17是本申请实施例提供的另一种通信装置的示意图；
图18是本申请实施例提供的一种芯片结构的示意图。
具体实施方式
下面结合本申请实施例中的附图对本申请实施例进行描述。需要说明的是，本申请中， “示例性地”或者“例如”等词用于表示作例子、例证或说明。本申请中被描述为“示例性地”或者“例如”的任何实施例或设计方案不应被解释为比其他实施例或设计方案更优选或更具优势。确切而言，使用“示例性地”或者“例如”等词旨在以具体方式呈现相关概念。
本申请中实施例提到的“至少一项(个)”是指一项(个)或者多项(个)，“多项(个)”是指两项(个)或两项(个)以上。“以下至少一项(个)”或其类似表达，是指的这些项中的任意组合，包括单项(个)或复数项(个)的任意组合。例如，a、b、或c中的至少一项(个)，可以表示：a、b、c、(a和b)、(a和c)、(b和c)、或(a和b和c)，其中a、b、c可以是单个，也可以是多个。“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A、同时存在A和B、单独存在B这三种情况，其中A、B可以是单数或者复数。字符“/”一般表示前后关联对象是一种“或”的关系。
以及，除非有相反的说明，本申请实施例使用“第一”、“第二”等序数词是用于对多个对象进行区分，不用于限定多个对象的顺序、时序、优先级或者重要程度。例如，第一信息和第二信息，只是为了区分不同的信息，而并不是表示这两种信息的内容、优先级、发送顺序或者重要程度等的不同。
下面先对本申请实施例中涉及的技术术语进行描述。
一、节点(node)
节点是具有数据处理收发能力的电子设备或者电子设备中的器件(例如芯片、或集成电路等)，上述电子设备可以包括终端设备或网络侧设备。例如，节点可以为汽车座舱(cockpit domain)设备，或者汽车座舱设备中的一个模块(例如座舱域控制器(cockpit domain controller，CDC)、摄像头、屏幕、麦克风、音响、电子钥匙、无钥匙进入或启动系统控制器等模块中的一个或者多个)。在具体实施过程中，节点还可以是数据中转设备，例如基站、路由器、中继器、桥接器或交换机；也可以是一个终端设备，例如各种类型的用户设备(user equipment，UE)、手机(mobile phone)、平板电脑(pad)、台式电脑、耳机、音响等；还可以包括机器智能设备，如无人驾驶(self-driving)设备、运输安全(transportation safety)设备、智能家居设备(例如音视频设备、安防设备、智能照明设备、环境监测设备等等中的一个或者多个)、虚拟现实(virtual reality，VR)终端设备、增强现实(augmented reality，AR)终端设备、机器类型通信(machine type communication，MTC)设备、工业控制(industrial control)设备、远程医疗(remote medical)设备、智能电网(smart grid)设备、智慧城市(smart city)设备；还可以包括可穿戴设备(如智能手表，智能手环，计步器等)等等。
在某些技术场景中，具备相类似数据收发能力的设备的名称也可能不称为节点，但是为了方便描述，本申请实施例中将具有数据收发能力的电子设备统称为节点。
二、节点地址。
节点可以具备两种地址中的至少一个：公共设备地址(public device address)和随机设备地址(random device address)。进一步的，随机设备地址又可以分为静态设备地址(static device address)和私有设备地址(private device address)两类，其中私有设备地址又可以分为不可解析私有地址(non-resolvable private address)和可解析私有地址(resolvable private address)。下面对每种地址进行描述。
1.公共设备地址
在通信系统中，公共设备地址是用来唯一标识一个物理设备的。一种设计中，设备的公共设备地址是固定分配的，例如由24比特的公司标识(company_id)和24比特的公司赋值(company_assigned)组成。
2.随机设备地址
随机设备地址不是固定分配的，而是在设备启动后随机生成的。根据不同的目的，随机设备地址分为静态设备地址和私有设备地址。
(1)静态设备地址
静态设备地址是节点在上电时随机生成的地址。一种设计中，在一个上电周期内静态设备地址保持不变，下一次上电时，静态设备地址可以改变，也可以保持不变。如果下一次上电时，静态设备地址发生改变，则上次保存的连接等信息，将不再有效。
(2)私有设备地址
私有设备地址，通过定时更新和地址加密两种方式，提高了节点地址的可靠性和安全性。根据节点地址是否加密，私有设备地址又分为两类，不可解析私有地址和可解析私有地址。
(2-1)不可解析私有地址
不可解析私有地址和静态设备地址类似，不同之处在于，不可解析私有地址会每隔一定周期进行更新，一种设计中，不可解析私有地址的更新周期可以是协议规定的，例如为X分钟，其中X为整数。不可解析私有地址可以每隔一个更新周期更新一次。
(2-2)可解析私有地址
可解析私有地址至少通过一个随机数和一个密钥生成。一种设计中，可解析私有地址通过一个随机数和称作身份解析密钥(identify resolving key，IRK)的密钥生成，示例性地，可解析私有地址由两部分组成：一部分是随机数部分，另一部分是由随机数和IRK经过哈希(hash)计算得到的hash值。可解析私有地址只能被拥有相同IRK的设备扫描到，可以防止被未知设备获取。由于IRK可以用于加密，所以IRK也可以称为加密密钥。
在本申请实施例中，示例性地，身份地址可以包括以下一项或两项：公共设备地址，静态设备地址。节点地址可以包括公共设备地址和静态设备地址中的一项或两项，以及私有设备地址中的一项或多项。
三、解析列表
节点要保护自己(以及对方)的地址不被获取，＝可以将本地(local)和对端(peer)的地址和加密密钥(IRK)保存在一个解析列表(resolving list)中。resolving list的每一个条目，都保存了一对节点的密钥/地址信息，其格式可以为：Local IRK|Peer IRK|Peer Device Identity Address|Address Type。
其中，Local IRK为本地的IRK，用于生成本地节点的可解析私有地址，示例性地，节点发送数据包时，先判断解析列表中是否有非0的Local IRK，如果有，则使用Local IRK生成可解析私有地址，否则，直接使用身份地址作为本地的地址；Peer IRK为对端节点的IRK，用于将对端节点的可解析私有地址解析为身份地址，示例性地，节点接收到数据包后，如果数据包中包括的是身份地址，则直接做数据的后续处理，如果数据包中包括的是 可解析私有地址，则使用解析列表中包括的Peer IRK解析接收到的可解析私有地址。Peer Device Identity Address和Address Type分别为对端节点的标识地址和地址类型，用于在节点之间连接和/或配对的过程中，起到唯一识别对端节点的作用。示例性地，标识地址可以为以下地址中的一种地址：公共设备地址，静态设备地址，不可解析私有地址，可解析私有地址。
四、密码算法
密码算法可以是用于加密、或者解密、或者生成密钥、或者导出密码等等中的一项或者多项的数学函数，也可以称为密码函数。常用的密码算法包括散列算法、加密算法、认证算法、密钥派生算法(Key derivation function，KDF)或者认证算法等。
(1)散列算法
其中，散列算法又称为哈希(Hash)函数、哈希算法，散列算法可以将任意长度的信息转换为一个标识，且很难找到逆向规律。
(2)加密(encryption)算法
加密算法包括对称加密算法和非对称加密算法。通常来说，对称加密算法的加密密钥与解密密钥相同，非对称加密算法的加密密钥与解密密钥不同，此外，还有一类不需要密钥的散列算法。常见的对称加密算法主要有数据加密标准(data encryption standard，DES)、三重数据加密算法(triple data encryption algorithm，3DES)、高级加密标准(advanced encryption standard，AES)等，常见的非对称算法主要有RSA加密算法、数据结构分析算法(data structure analysis，DSA)等，散列算法主要有安全散列算法(secure hash algorithm 1，SHA-1)、信息摘要(message digest，MD)算法(如MD2、MD4或MD5等)等。
(3)完整性保护算法
完整性保护算法是用于保护消息完整性的算法，也可以称为MAC(message authentication code，MAC)算法或者完保算法。例如，通过哈希算法来实现的完整性保护算法称为基于哈希的消息认证码(hash-based message authentication code，HMAC)算法，其中的哈希算法可以为MD5、SHA-1、SHA-256等等中的一个，这些不同的HMAC实现通常标记为：HMAC-MD5，HMAC-SHA1，HMAC-SHA256等等。
在一些具体场景中，通过认证加密算法，对与给定的原文既可以加密数据也可以生成消息认证码，因此认证加密算法既可以作为加密算法也可以作为完保算法。例如，基于伽罗瓦消息验证码(Galois message authentication code mode，GMAC)和计数加密模式的AES算法(AES-Galois/counter mode，AES-GCM)和基于消息认证码(Cipher-based Message Authentication Code，CMAC)和计数加密模式的AES算法(AES-CMAC/counter Mode，AES-CCM)等可以对消息进行认证加密，而进行认证加密的过程中能够生成MAC来保护消息的完整性。
(4)密钥派生算法
密钥派生算法用于从一个秘密值中派生出一个或多个秘密值，又称为密钥导出算法。例如，通过秘密值Key派生的新的秘密值可以表示为：DK＝KDF(Key)。常用的密钥派生算法有基于密码的密钥派生函数(password-based key derivation function，PBKDF)、斯克里普特(scrypt)算法等，其中PBKDF算法又包括第一代PBKDF1和第二代PBKDF2。可选 地，一些KDF算法在派生密钥过程中，使用哈希算法对输入的秘密值进行哈希变化，因此KDF函数还可以接收算法标识作为输入，用于指示使用何种哈希算法。
五、白名单
在本申请实施例中，白名单中包括一个或多个节点地址，被白名单所包括的节点地址所对应的节点可以理解为本地节点所信任的节点。例如，通过白名单，可以只允许白名单中包括的节点扫描(scan)、连接(connect)到本地节点，和/或，通过白名单，本地节点也只能扫描、连接特定的节点(白名单列出的)。示例性地，白名单中保存的节点地址可以为以下地址中的一项或多项：公共设备地址，静态设备地址。
下面对本申请实施例的系统架构和业务场景进行描述。需要说明的是，本申请描述的系统架构及业务场景是为了更加清楚的说明本申请的技术方案，并不构成对于本申请提供的技术方案的限定，本领域普通技术人员可知，随着系统架构的演变和新业务场景的出现，本申请提供的技术方案对于类似的技术问题，同样适用。
请参见图1，图1是本申请实施例提供的一种可能的通信系统的架构示意图，该通信系统包括第一节点101和第二节点102。其中：
第一节点101和第二节点102可以建立关联。需要说明的是，在本申请实施例中，“关联”、“连接”、“配对”均可以表明第一节点和第二节点建立连接的过程。第一节点101和第二节点102关联成功后，第一节点101可以与第二节点102进行通信。
其中，第一节点101与第二节点102之间通信的链路可以包括各种类型的连接介质，包括有线链路(例如光纤)、无线链路、或者有线链路和无线链路的组合等。第一节点101和第二节点102可以通过各种连接技术实现通信，例如可以为近距离连接技术包括802.11b/g、蓝牙(blue tooth)、紫蜂(Zigbee)、无线射频识别技术(radio frequency identification，RFID)、超宽带(ultra wideband，UWB)技术、其他可能的无线短距通信技术(例如车载无线短距通信技术)等，再如还可以为远距离连接技术包括基于长期演进(Long Term Evolution，长期演进)的通信技术、第五代移动通信技术(5th generation mobile networks或5th generation wireless systems、5th-Generation，简称5G或5G技术)、全球移动通信系统(global System for mobile communications，GSM)、通用分组无线业务(general packet radio Service，GPRS)、通用移动通信系统(universal mobile telecommunications system，UMTS)等无线接入类型技术。当然，还有其他无线通信技术可以用于支撑第一节点与第二节点进行通信，本申请实施例不做具体限定。
其中，第一节点101和第二节点102可以是相同类型的设备，也可以是不同类型的设备。例如，请参见图2，图2是本申请实施例提供的一种可能的通信场景的示意图。车辆的CDC 201是车辆的智能座舱设备中的控制中心，可以看作为第一节点101。智能手机202是具有数据收发能力的设备，可以看作为第二节点102。其中，CDC201可以通过各种类型的连接技术被其他设备关联，智能手机202支持相应的通信功能，因此智能手机202可以通过相应的通信技术与CDC201建立连接。示例性地，在一些具体的实施场景中，第一节点也可以称为G节点、控制节点或者接入点(access point)，第二节点也可以称为T节点或者终端。G节点向T节点的通信链路可以称为G链路，T节点向G节点的通信链路可以称为T链路。
基于图1所示意的通信系统，在一种可能的两个节点建立连接的流程中，两个节点分别将对方的设备地址加入到自己的白名单中，以表示对方为自己信任的设备。但由于保存在白名单的设备地址在一定程度上是固定的，因此会导致节点在广播(advertising)时，可能会被攻击者获取进而得到设备地址。
为解决这一问题，提出了两个节点可以交互各自的可解析私有设备地址。当一个节点扫描到其他节点的可解析私有设备地址后，会使用保存在本机的IRK和扫描到的可解析私有设备地址中的随机数进行哈希运算，并且将哈希运算结果与可解析私有设备地址中的哈希字段比较，当字段比对相同时，可以说明成功解析该可解析私有设备地址，或者说明对发送该可解析私有设备地址的设备地址验证通过，此时该节点才进行后续的操作。由于可解析私有设备地址是随机产生的，因此发送可解析私有设备地址的设备难以被获取，又因为可解析私有设备地址只能被拥有相同IRK的设备扫描到，因此没有IRK的设备无法获得该可解析私有设备地址。
然而，采用该种方式，当设备保存多个IRK时，需要使用每个保存的IRK对扫描到的可解析私有设备地址进行解析，直到所有IRK都已经尝试或者使用其中一个IRK对扫描到的可解析私有设备地址解析成功。由于使用IRK解析扫描到的可解析私有设备地址会花费较长的时间，导致设备地址可信性验证会花费较长时间，降低了通信效率和性能。
鉴于此，本申请实施例提供一种通信方法，在该方法中，第二节点接收来自第一节点的第一信息，该第一信息包含第一节点的第一解析地址和第一解析密钥索引，并根据第一解析密钥索引和第一解析地址，确定第一节点的身份地址，该身份地址唯一标识第一节点。采用该种方式，第一节点和第二节点之间通过解析地址通信，可以保证通信节点之间信息传输的安全性，进一步地，第二节点可以根据第一解析密钥索引确定第一解析密钥，无需遍历本地保存的所有解析密钥解析接收到的第一解析地址，减少了设备地址可信性验证所需要的时间，保证了通信效率和性能。
下面结合具体实施例对本申请实施例提供的通信方法进行介绍。
请参见图3，图3是本申请实施例提供的一种通信方法所对应的流程示意图。进一步的，该方法可以基于图1所示的架构来实现。该方法可以包括：
S301，第一节点确定第一解析地址。
作为一种可能的实现方式，第一解析地址包含使用密钥对第一节点的身份地址加密生成的地址。进一步的，这里的加密可以通过上述描述的密码算法实现，或者通过其他加密算法实现，不做具体限定。第一节点的身份地址可以唯一标识第一节点。示例性地，第一节点的身份地址在一定程度上是固定不变的。例如，第一节点的身份地址可以为公共设备地址，该公共设备地址是固定分配的，在第一节点不同的上电期间，该公共设备地址都保持不变。参见图4，图4是本申请实施例提供的一种可能的公共设备地址的示意图，公共设备地址最高有效位(most significant bit，MSB)的company_id(24个比特)和最低有效位(least significant bit，LSB)的company_assigned(24个比特)组成；又例如，第一节点的身份地址可以为静态设备地址，该静态设备地址是随机生成的，在一个上电周期内保持不变，在下一个上电周期内可以保持不变，也可以改变。参加图5，图5是本申请实施例提供的一种可能的静态设备地址的示意图，静态设备地址由48个比特组成，其中最高两个 bit为“11”，剩余的46个比特是一个随机数，不能全部为0，也不能全部为1。
作为另一种可能的实现方式，第一解析地址中包含用于验证第一解析密钥的验证信息，第一解析密钥对应第一节点的身份地址。其中，第一解析密钥可以为身份解析密钥IRK，或者，可以为通过密钥派生算法生成的密钥，或者也可以为其他形式，具体不做限定。第一节点的身份地址可以参考上述描述，此处不再赘述。
例如第一节点根据第一解析密钥和第一节点的身份地址确定用于验证第一解析密钥的验证信息。比如，第一节点对第一解析密钥和第一节点的身份地址进行密码运算，得到密码运算输出值，该密码运算输出值即为验证信息，或者为所述验证信息的一部分。又比如，第一节点对第一解析密钥和第一节点的身份地址进行不可逆加密运算，例如进行哈希(hash)运算，得到验证信息，验证信息满足：验证信息＝ah(IRK，第一节点的身份地址)，其中ah(IRK，第一节点的身份地址)表示通过加密密钥IRK对第一节点的身份地址做哈希运算，具体的，其中的哈希算法例如可以为MD5、SHA-1、SHA-256、SM3中的一个，或者为其他实现方式，不做具体限定。需要说明的是，在这种实现方式下，第一节点的身份地址还可以替换为其他地址，例如第一节点按照一定规则生成的地址，具体不做限定。
又例如，第一解析地址中还包含随机数，第一节点基于第一解析密钥和该随机数得到验证信息。示例性地，第一节点对第一解析密钥和该随机数进行密码运算，得到密码运算输出值，该密码运算输出值即为验证信息。比如，第一节点对第一解析密钥和该随机数进行不可逆加密运算，例如进行哈希(hash)运算，得到验证信息，验证信息满足：验证信息＝ah(IRK，随机数)，其中ah(IRK，随机数)表示通过加密密钥IRK对随机数做哈希运算，其中的哈希算法可以为MD5、SHA-1、SHA-256、SM3中的一个，或者为其他实现方式，不做具体限定；又比如，第一节点对第一解析密钥和该随机数进行加密，具体加密算法例如可以为上述描述的加密算法，此处不再赘述。在这种实现方式下，可选地，随机数可以由24个比特组成，其中的MSB的高两位可以表示第一解析地址的地址类型，取值例如为10，其他22个比特位的每一位比特为随机生成的数，取值为0或者为1。参加图6，图6是本申请实施例提供的一种可能的解析地址的示意图，解析地址由48个比特组成，包括24个比特的随机数prand和24个比特的哈希值hash，进一步地，prand中的最高位和第二高位取值分别为0和1，剩余22个比特的每一个比特为随机生成的数，哈希值可以对应上述描述的验证信息，即根据解析密钥和随机数prand计算得到，具体计算方式如上描述，在此不做赘述。
示例性地，第一解析地址可以为可解析私有地址。
S302，第一节点向第二节点发送第一信息，第一信息包含第一解析地址和第一解析密钥索引，该第一解析密钥索引用于指示第一解析密钥。
相应的，第二节点接收第一信息。
作为一种可能的实现，第一节点可以以广播的方式发送第一信息，相应的，第二节点接收第一节点广播的第一信息。
其中，第一信息包含的第一解析地址和第一信息包含的第一解析密钥索引可以通过相同的消息发送，或者通过不同的消息发送。例如，第一节点通过消息A发送第一解析地址和第一解析密钥索引；又例如，第一节点通过消息A发送第一解析地址，通过消息B发送 第一解析密钥索引。
可选地，第一信息中还可以包含第一解析地址的地址类型信息，例如，第一解析地址的地址类型信息用于指示第一解析地址的地址类型为可解析私有地址。
S303，第二节点根据第一解析密钥索引和第一解析地址，确定第一节点的身份地址。
具体的，第二节点根据第一解析密钥索引，确定该第一解析密钥索引所指示的第一解析密钥，该第一解析密钥对应第一身份地址。
示例性地，第一解析密钥索引、第一解析密钥和第一身份地址之间存在预先定义或者配置的对应关系，第二节点根据该对应关系，可以确定第一解析密钥索引所指示的第一解析密钥。进一步可选地，该对应关系例如可以通过表格呈现。比如参照表1，表1为本申请实施例提供的一种可能的对应关系表。表1中Peer IRK ID表示对端节点的解析密钥索引，与Peer IRK ID在相同行的Peer IRK表示与该Peer IRK ID对应的对端节点的解析密钥，与Peer IRK ID以及Peer IRK在相同行的对端节点的身份地址表示与Peer IRK ID和Peer IRK中的一项或多项对应的身份地址。需要说明的是，在本申请实施例中，第一解析密钥索引为Peer IRK ID中的一例，第一解析密钥为Peer IRK中的一例，第一身份地址为对端节点身份地址中的一例。具体的，比如，表1中第二行包含的Peer IRK ID、Peer IRK以及Peer Device Identity Address分别表示第一节点的解析密钥索引、解析密钥和身份地址，表1中第三行包含的Peer IRK ID、Peer IRK以及Peer Device Identity Address分别表示第一节点和第二节点之外的其他节点例如第三节点的解析密钥索引、解析密钥和身份地址。又比如，该对应关系可以参照表2，表2为本申请实施例提供的另一种可能的对应关系表，以第二节点为例，本地节点解析密钥索引表示第二节点的解析密钥索引，本地节点解析密钥表示第二节点的解析密钥，其中“本地节点解析密钥索引”在表2中是可选地。需要说明的是，包含解析密钥索引、解析密钥和身份地址之间对应关系的表格还可以具有其他形式，例如基于表1，还可以包含本地节点解析密钥索引、本地节点解析密钥以及对端节点身份地址类型中的一项或两项，具体不做限定。可选地，在本申请实施例中，包含该对应关系的表格可以为解析列表。
需要说明的是，在本申请实施例中，相同的对端节点解析密钥索引还可以对应多个不同的对端节点解析密钥。例如，表1中第二行包含的Peer IRK ID与第三行包含的Peer IRK ID相同，但表1中第二行包含的Peer IRK与第三行包含的Peer IRK不同。
表1 解析密钥索引、解析密钥、身份地址之间的对应关系的一种实现方式
Figure PCTCN2021108201-appb-000001
表2 解析密钥索引、解析密钥、身份地址之间的对应关系的又一种实现方式
Figure PCTCN2021108201-appb-000002
Figure PCTCN2021108201-appb-000003
下面描述第二节点根据第一解析密钥索引和第一解析地址，确定第一节点的身份地址的几种可能的实现方式，需要说明的是，在本申请实施中，第二节点根据第一解析密钥索引和第一解析地址，确定第一节点的身份地址还可以有其他实现方式，不做具体限定。
作为一种可能的实现，第二节点根据接收到的第一解析密钥索引，确定第一解析密钥，并利用该第一解析密钥解密第一解析地址，进而确定第一节点的身份地址。示例性地，第二节点根据接收到的第一解析密钥索引、以及第一解析密钥索引与第一解析密钥之间的对应关系，确定第一解析密钥，进而使用该第一解析密钥解密接收到的第一解析地址，并比较该解密结果与本地保存的对端节点身份地址，需要说明的是，这里的对端节点身份地址对应于第一解析密钥，并且为保存在第二节点侧的身份地址。一方面，如果该解密结果与该对端节点身份地址相同，则第二节点确定第一节点为可信任的设备节点或者确定该对端节点身份地址为第一节点的身份地址。进一步的，第二节点可以进行后续的操作。例如，第二节点确定第一节点的身份地址之后，可以向第一节点发起连接；又例如，第二节点将确定的第一节点的身份地址与本地保存的白名单列表中的设备地址比对，如果本地保存的白名单列表中的设备地址包括第一节点的身份地址，则可以说明第一节点为第二节点信任的节点，进而第二节点可以与第一节点进行后续的数据传输；再例如，第二节点将第一节点的身份地址与本地保存的白名单列表中的设备地址比对，如果本地保存的白名单列表中没有第一节点的身份地址，则第二节点可以先将第一节点的身份地址添加到白名单列表中，然后再与第一节点进行后续的数据传输；另一方面，如果该解密结果与该对端节点身份地址不相同，则第二节点确定第一节点不是可信任的设备节点，或者确定该第一解析密钥对应的对端节点身份地址不是第一节点的身份地址。第二节点的后续操作可以包括如下一项或多项：与第一节点不建立连接，向第一节点发送连接建立失败消息；向第一节点发送地址解析失败消息，并请求获取第一节点的身份地址。
作为另一种可能的实现，第二节点根据接收到的第一解析密钥索引，确定第一解析密钥，进而计算本地验证信息，并将本地验证信息与第一解析地址中包含的验证信息比较，比较结果包括以下两种情形：
情形一：本地验证信息与第一解析地址中包含的验证信息相同。
在这种情形下，第二节点可以确定第一解析密钥对应的第一身份地址为第一节点的身份地址。以表2为例，如果第二节点确定本地验证信息与第一解析地址中包含的验证信息相同，则表2中与第一解析地址(即对端节点解析密钥)对应的对端节点身份地址(即第一身份地址)即为第一节点的身份地址。进一步的，在这种情形下，第二节点可以进行后续的操作。具体的后续操作可以参考上述实现方式中当解密结果与该对端节点身份地址相同时的后续操作，此处不再赘述。
情形二：本地验证信息与第一解析地址中包含的验证信息不相同。
在这种情形下，第二节点可以确定第一解析密钥对应的第一身份地址不为所述第一节 点的身份地址。第二节点的后续操作可以参考上述实现方式中当解密结果与该对端节点身份地址不相同时的后续操作，此处不再赘述。
进一步地，对应于前述第一节点确定用于验证第一解析密钥的验证信息的实现方式，本申请实施例列举以下两种第二节点计算本地验证信息的实现方式：
方式一：第二节点确定第一解析密钥索引对应的第一解析密钥以及第一身份地址，并基于第一解析密钥和第一身份地址计算本地验证信息。示例性地，以表2为例，第二节点根据接收到的第一解析密钥索引，在表2中找到与第一解析密钥索引对应的对端节点解析密钥索引，例如，第二节点接收到的第一解析密钥索引为2，则表2中与第一解析密钥索引对应的对端节点解析密钥索引也为2。然后第二节点根据对端节点解析密钥索引对应的对端节点解析密钥以及对端节点身份地址，计算本地验证信息。进一步的，例如第二节点对该对端节点解析密钥以及对端节点身份地址进行不可逆加密运算，比如hash运算，得到本地验证信息，具体可参考步骤S301中的相关内容，此处不再赘述。
方式二：第一解析地址中包含随机数。第二节点确定第一解析密钥索引对应的第一解析密钥，并基于第一解析密钥和该随机数计算本地验证信息。其中，第二节点确定第一解析密钥索引对应的第一解析密钥的过程，可以参考方式一中的相关内容，此处不再赘述。然后，第二节点基于对端节点解析密钥索引对应的对端节点解析密钥以及第一解析地址中包含的随机数，计算本地验证信息。示例性地，第二节点对该对端节点解析密钥以及该随机数进行不可逆加密运算，例如进行hash运算，得到本地验证信息，具体可参考步骤S301中的相关内容，此处不再赘述。
需要说明的是，在第二节点侧，当接收到的第一解析密钥索引对应的对端节点解析密钥索引对应N个对端节点解析密钥时，其中N为大于1的整数，第二节点需要对这N个对端节点解析密钥重复上述的确定第一节点的身份地址的过程，直到使用N个对端节点解析密钥中的一个对端节点解析密钥确定出第一节点的身份地址或者N个对端节点解析密钥都已尝试使用。示例性地，在第二节点侧，索引为1的对端节点解析密钥索引所对应的对端节点解析密钥有3个，分别为Key1、Key2、Key3，且分别对应的对端节点身份地址为Address1、Address2、Address3。如果第二节点接收到的第一解析密钥索引为1，则第二节点需要使用Key1、Key2、Key3，以及接收到的第一解析地址，分别计算本地验证信息，并比较根据不同的对端节点解析密钥计算得到的验证信息和第一解析地址中包含的验证信息，以确定接收到的第一解析地址是否与存储的解析密钥相关联。具体的，例如第二节点首先尝试使用Key1与第一解析地址中包含的随机数计算本地验证信息，如果得到的本地验证信息与接收到的第一解析地址中包含的验证信息相同，则可以确定对应的对端节点身份地址(Address1)即为第一节点的身份地址；相反地，如果得到的本地验证信息与接收到的第一解析地址中包含的验证信息不相同，则第二节点继续尝试使用Key2、Key3与接收到的第一解析地址中包含的随机数计算本地验证信息，直至确定出第一节点的身份地址或者遍历使用完Key2、Key3。可以理解的是，在本申请实施例中，如果根据存储的解析密钥和接收到的第一解析地址计算得到的验证信息与第一解析地址中包含的验证信息相同，则说明接收到的第一解析地址与存储的解析密钥相关联。采用上述方式，第二节点可以通过第一节点发送的第一解析密钥索引，确定第一解析密钥索引指示的第一解析密钥，进而确 定第一节点的身份地址，无需通过遍历本地保存的所有对端节点解析密钥确定第一节点的身份地址，当第一解析密钥索引对应多个对端节点解析密钥时，第二节点也只需要遍历本地保存的与该第一解析密钥索引对应的对端节点解析密钥，而无需遍历本地保存的所有对端节点解析密钥来确定第一节点的身份地址。因此，采用上述方式，降低了解析地址的计算时间，减少了设备地址可信性验证所需要的时间，保证了通信效率和性能。此外，由于第二节点接收到的是第一节点的第一解析地址，该解析地址可以随机产生并且使用第一解析密钥对其进行哈希运算，因此保证了第一节点的身份地址难以被获取，进而保证了第一节点与第二节点之间的数据传输安全性和可靠性。
在本申请实施例中，第一解析密钥、第一解析密钥索引以及第一身份地址之间存在预先定义或者配置的对应关系。第二节点基于该对应关系，可以确定第一解析密钥索引对应的第一解析密钥，并通过该第一解析密钥解析接收到的第一解析地址，以此确定第一节点的身份地址是否为第一解析密钥索引或第一解析密钥对应的第一身份地址。例如，第二节点基于根据该对应关系确定的第一解析密钥，确定本地验证信息，并比较该本地验证信息与第一解析地址包含的验证信息，确定第一身份地址。
可以理解的是，第二解析密钥、第二解析密钥索引以及第二身份地址之间也存在预先定义或配置的对应关系。第一节点基于该对应关系，可以确定第二解析密钥索引对应的第二解析密钥，并通过该第二解析密钥解析接收到的第二解析地址，以此确定第二节点的身份地址是否为第二解析密钥索引或第二解析密钥对应的第二身份地址。例如，第一节点基于根据该对应关系确定的第二解析密钥，确定本地验证信息，并比较该本地验证信息与第二解析地址包含的验证信息，确定第二身份地址。
作为一种可能的实现方式，本申请实施例中所述的通信方法，还可以包括图7所示的步骤S701-步骤S704中的一个或多个步骤，该一个或多个步骤对于某些具体的场景可以是必须的。步骤S701-步骤S704具体如下：
S701，第一节点向第二节点发送第二信息，该第二信息包含第一解析密钥和第一节点的身份地址。
相应的，第二节点接收该第二信息。
在本申请实施例中，第二信息包含的第一解析密钥和第一节点的身份地址可以通过相同的消息发送，或者通过不同的消息发送。例如，第一节点通过消息C1发送第一解析密钥，通过消息D1发送第一节点的身份地址。进一步可选地，消息C1为承载身份鉴权密钥信息的消息，消息D1为承载身份地址信息的消息。示例性地，消息D1中还可以包含第一节点的身份地址对应的地址类型，例如地址类型为公共设备地址类型或静态设备地址类型；又例如，第一节点通过消息E1发送第一解析密钥和第一节点的身份地址。
S702，第二节点定义或者配置第一解析密钥、第一解析密钥索引以及第一节点的身份地址之间的对应关系。其中，获取第一解析密钥索引的具体方式可以参考下述描述。这里的定义或者配置是指第二节点可以维护上述对应关系，但是具体的存储方式不做具体限定。
示例性地，第二节点在表格中的同一行保存或写入第一解析密钥、第一解析密钥索引以及第一节点的身份地址，表格的具体实现方式可以参考步骤S303中的描述，此处不再赘述。需要说明的是，本申请实施例中提到的“保存”、“写入”，可以表征在表格中体现解析 密钥、解析密钥索引以及身份地址之间的对应关系，也可以采用其他描述方式，不做具体限定。
S703，第二节点向第一节点发送第五信息，该第五信息包含第二节点的第二解析密钥和第二节点的身份地址。
在本申请实施例中，第二解析密钥、第二节点的身份地址可以参考前述对第一解析密钥、第一节点的身份地址的描述，例如，第二节点的身份地址可以唯一标识第二节点。
相应的，第一节点接收该第五信息。
在本申请实施例中，第五信息包含的第二解析密钥和第二节点的身份地址可以通过相同的消息发送，或者通过不同的消息发送。例如，第二节点通过消息C2发送第二解析密钥，通过消息D2发送第一节点的身份地址。进一步可选地，消息C2为承载身份鉴权密钥信息的消息，消息D2为承载身份地址信息的消息。示例性地，消息D2中还可以包含第二节点的身份地址对应的地址类型，例如地址类型为公共设备地址或静态设备地址；又例如，第二节点通过消息E2发送第二解析密钥和第二节点的身份地址。
S704，第一节点定义或者配置第二解析密钥、第二解析密钥索引以及第二节点的身份地址之间的对应关系。其中，获取第二解析密钥索引的具体方式可以参考下述描述。这里的定义或者配置是指第一节点可以维护上述对应关系，但是具体的存储方式不做具体限定。
示例性地，第一节点在表格中的同一行保存或写入第二解析密钥、第二解析密钥索引以及第二节点的身份地址，表格的具体实现方式可以参考步骤S303中的描述，此处不再赘述。
可选地，图7所示的实施例中的方法可以为图3所示的实施例中的方法的先前步骤。
采用上述方式，本地节点可以预先配置对端节点的解析密钥索引、解析密钥以及身份地址之间的对应关系，然后基于接收到的对端节点的解析密钥索引，确认对端节点的身份地址，而无需本地节点在每次验证对端节点设备地址可信性时，都与对端节点交互彼此的解析密钥索引、解析密钥以及身份地址，减少了节点之间连接所需要的时间，保证了通信效率和性能。
进一步的，节点在配置解析密钥索引、节点的身份地址和解析密钥索引之前，可以先获取解析密钥索引。示例性地，节点可以通过如下三种方式中的其中一种方式获取解析密钥索引：
方式一：本地节点保存的对端节点的解析密钥索引来自于对端节点。示例性地，第二信息中还包含第一解析密钥索引，第五信息中还包含第二解析密钥索引。
需要说明的是，在本申请实施例中，解析密钥索引(例如第一解析密钥索引、第二解析密钥索引)可以是随机产生的，或者是通过固定的算法分配的，或者是出厂时预配置的，例如第一节点出厂时该第一节点的第一解析密钥索引就配置完成。需要说明的是，不同节点对应的解析密钥索引的生成方式可以不同，例如第一解析密钥索引可以是通过固定算法分配的，第二解析密钥索引可以是随机产生的。
示例性地，本申请实施例中所述的通信方法，在图3所示的实施例中的方法之前，还可以包括图8所示的步骤S801-S804中的一个或多个步骤，该一个或多个步骤对于某些具体的场景可以是必须的。可以理解的是，图8所示的通信方法可以为基于图7所示的通信 方法的一种可能的实现方式。在该种实现方式下，图7中的所述第二信息包含但不限于第一身份鉴权密钥信息和第一身份地址信息，图7中的所述第五信息包含但不限于第二身份鉴权密钥信息和第二身份地址信息。步骤S801-步骤S804具体如下：
S801，第一节点向第二节点发送第一身份鉴权密钥信息，该第一身份鉴权密钥信息中包含第一解析密钥和第一解析密钥索引。
相应地，第二节点接收该第一身份鉴权密钥信息。
S802，第二节点向第一节点发送第二身份鉴权密钥信息，该第二身份鉴权密钥信息中包含第二解析密钥和第二解析密钥索引。
相应地，第一节点接收该第二身份鉴权密钥信息。
S803，第一节点向第二节点发送第一身份地址信息，该第一身份地址信息中包含第一节点的身份地址和该身份地址的地址类型；
相应地，第二节点接收第一身份地址信息。
S804，第二节点向第一节点发送第二身份地址信息，该第二身份地址信息中包含第二节点的身份地址和该身份地址的地址类型。
相应地，第一节点接收第二身份地址信息。具体实现可以参考图6所示的实施例中的详细描述，此处不再赘述。
方式二：本地节点保存的对端节点的解析密钥索引来自于本地节点。示例性地，第一解析密钥索引是由第二节点确定的，且由第二节点发送给第一节点；第二解析密钥索引是由第一节点确定的，且由第一节点发送给第二节点。其中，解析密钥索引的确定方式可以参考方案一中描述，此处不再赘述。
示例性地，本申请实施例中所述的通信方法，在图3所示的实施例中的方法之前，还可以包括图9所示的步骤S901–S906中的一个或多个步骤，该一个或多个步骤对于某些具体的场景可以是必须的。可以理解的是，图9所示的通信方法可以为基于图7所示的通信方法的另一种可能的实现方式。在该种实现方式下，图7中的所述第二信息包含但不限于第一身份鉴权密钥信息、第二身份鉴权密钥响应信息和第一身份地址信息，图7中的所述第五信息包含但不限于第一身份鉴权密钥响应信息、第二身份鉴权密钥信息和第二身份地址信息。步骤S901-步骤S906具体如下：
S901，第一节点向第二节点发送第一身份鉴权密钥信息，该第一身份鉴权密钥信息中包含第一解析密钥。
相应地，第二节点接收该第一身份鉴权密钥信息。
S902，第二节点向第一节点发送第一身份鉴权密钥响应信息，该第二身份鉴权密钥响应信息中包含对应于第一解析密钥的第一解析密钥索引。
相应地，第一节点接收该第一身份鉴权密钥响应信息。S903，第二节点向第一节点发送第二身份鉴权密钥信息，该第二身份鉴权密钥信息中包含第二解析密钥。
相应地，第一节点接收该第二身份鉴权密钥信息。
S904，第一节点向第二节点发送第二身份鉴权密钥响应信息，该第二身份鉴权密钥响应信息中包含对应于第二解析密钥的第二解析密钥索引。
相应地，第二节点接收该第二身份鉴权密钥响应信息。
S905，第一节点向第二节点发送第一身份地址信息，该第一身份地址信息中包含第一节点的身份地址和该身份地址的地址类型；相应地，第二节点接收第一身份地址信息。
S906，第二节点向第一节点发送第二身份地址信息，该第二身份地址信息中包含第二节点的身份地址和该身份地址的地址类型。
相应地，第一节点接收第二身份地址信息。
具体实现可以参考图6所示的实施例中的详细描述，此处不再赘述。
采用上述方案，本地节点保存的对端节点的解析密钥索引来自于本地节点，可以更好地避免对端节点的解析密钥索引在本地节点侧的冲突，即在本地节点侧，避免出现相同的解析密钥索引对应不同的对端节点，进而可以减少对端节点地址可信性验证所需花费的时间，保证了通信效率和性能。
方式三：不同节点的解析密钥索引来源于相同的节点。示例性地，第一解析密钥索引和第二解析密钥均来源于第一节点。例如，第二信息中还包含第一解析密钥索引，且第二解析密钥索引也来源于第一节点。比如，第一节点通过随机数生成或者固定算法分配的方式，确定第二解析密钥索引，且将第二解析密钥索引发送给第二节点。相应的，在后续的数据传输过程中，第二节点可以使用该第二解析密钥索引，与第一节点进行数据传输。
可选地，在该方案下，第一节点可以是通信的发起方，可以称为主节点或者接入点(access point，AP)。
示例性地，本申请实施例中所述的通信方法，在图3所示的实施例中的方法之前，还可以包括图10所示的步骤S1001–S1005中的一个或多个步骤，该一个或多个步骤对于某些具体的场景可以是必须的。可以理解的是，图10所示的通信方法可以为基于图7所示的通信方法的又一种可能的实现方式。在该种实现方式下，图7中的所述第二信息包含但不限于第一身份鉴权密钥信息、第二身份鉴权密钥响应信息和第一身份地址信息，图7中的所述第五信息包含但不限于第二身份鉴权密钥信息和第二身份地址信息。步骤S1001-步骤S1005具体如下：
S1001，第一节点向第二节点发送第一身份鉴权密钥信息，该第一身份鉴权密钥信息中包含第一解析密钥和第一解析密钥索引。
相应的，第二节点接收该第一身份鉴权密钥信息。
S1002，第二节点向第一节点发送第二身份鉴权密钥信息，该第二身份鉴权密钥信息中包含第二解析密钥。
相应的，第一节点接收该第二身份鉴权密钥信息。
S1003，第一节点向第二节点发送第二身份鉴权密钥响应信息，该第二身份鉴权密钥响应信息包含对应于第二解析密钥的第二解析密钥索引。
相应的，第二节点接收该第二身份鉴权密钥响应信息。
S1004，第一节点向第二节点发送第一身份地址信息，该第一身份地址信息中包含第一节点的身份地址和该身份地址的地址类型；
相应的，第二节点接收该第一身份地址信息。
S1005，第二节点向第一节点发送第二身份地址信息，该第二身份地址信息中包含第二节点的身份地址和该身份地址的地址类型。
相应的，第一节点接收该第二身份地址信息。
具体实现可以参考图6所示的实施例中的详细描述，此处不再赘述。
采用上述方案，不同节点的解析密钥索引来源于相同的节点，便于解析密钥索引的管理，可以更好地避免对端节点的解析密钥索引在本地节点侧的冲突，进而可以减少对端节点地址可信性验证所需花费的时间，保证了通信效率和性能。
作为一种可能的实现方式，本申请实施例中所述的通信方法，还可以包括图11所述的步骤S1101，或者步骤S1101和步骤S1102，该一个或多个步骤对于某些具体的场景可以是必须的。步骤S1101和步骤S1102具体如下：
S1101，第一节点向第二节点发送第三信息，该第三信息用于指示根据解析密钥索引和解析地址，确定该第一节点的身份地址。
相应地，第二节点接收第三信息。
需要说明的是，可替换地，第三信息用于指示发送解析密钥信息和身份地址信息。即第三信息用于指示根据解析密钥索引和解析地址，确定该第一节点的身份地址，可以理解为，第三信息用于指示发送解析密钥信息和身份地址信息。为了描述清楚，以第三信息用于指示根据解析密钥索引和解析地址，确定该第一节点的身份地址为例描述。第三信息用于指示根据解析密钥索引和解析地址，确定该第一节点的身份地址，则在第一节点和第二节点的后续数据传输中，第一节点向第二节点发送第一解析地址和第一身份地址；或者在第一节点和第二节点的后续数据传输中，第二节点通过第一解析密钥索引确定解析密钥，进而基于该第一解析密钥解析接收到的第一解析地址；或者，在第一节点和第二节点的后续数据传输中，第二节点通过第一解析地址实现和第一节点的通信。
其中，解析密钥信息包括解析密钥和解析密钥索引，或者解析密钥信息包括解析密钥。示例性地，解析密钥可以为IRK。
此外，第三信息还可以用于指示不发送解析密钥信息和身份地址信息，或者第三信息还可以用于指示不根据解析密钥索引和解析地址，确定第一节点的身份地址。示例性地，当第三信息指示不根据解析密钥索引和解析地址，确定第一节点的身份地址时，或者第三信息指示不发送解析密钥信息和身份地址信息时，在第一节点和第二节点后续的数据传输过程中，第二节点不通过第一解析地址和第一节点通信，例如直接通过第一节点的身份地址和第一节点通信；或者，第二节点通过遍历本地保存的解析密钥解析第一解析地址，进而确定第一节点的身份地址。
S1102，第二节点向第一节点发送第四信息，该第四信息用于指示是否发送解析密钥信息和身份地址信息，或者第四信息用于指示是否根据解析密钥索引和解析地址，确定第二节点的身份地址。
相应的，第一节点接收该第四信息。
例如，当第四信息用于指示根据解析密钥索引和解析地址，确定第二节点的身份地址时，或者当第四信息用于指示发送解析密钥信息和身份地址信息时，在第一节点和第二节点后续的数据传输过程中，第一节点可以通过第二节点的第二解析密钥索引和第二解析地址，确定第二节点的身份地址。具体实现可以参考本申请其他实施例中的详细描述，此处不再赘述；又例如，当第四信息用于指示不根据解析密钥索引和解析地址，确定第二节点 的身份地址时，或者第四信息用于指示不发送解析密钥信息和身份地址信息时，在第一节点和第二节点后续的数据传输过程中，第一节点不通过第二解析地址和第二节点通信，例如通过第二节点的身份地址和第二节点通信；或者，第一节点通过遍历本地保存的解析密钥索引解析第二解析地址，进而确定第二节点的身份地址。
可选地，图11所示的实施例中的方法可以为图7所示的实施例中的方法的先前步骤。
采用上述方式，在第一节点和第二节点的数据传输过程中，可以通过解析地址实现节点之间的数据传输。由于解析地址只能被拥有相同解析密钥的节点解析，因此保证了节点之间数据传输的安全性。进一步的，还可以增加本地节点确定对端节点身份地址的灵活性。例如，以第一节点向第二节点发送的第三信息为例，如果第一节点获取到第二节点本地保存的对端节点的解析密钥个数少，比如，只有1个，则第三信息可以用于指示不根据解析密钥索引和解析地址，确定第一节点的身份地址，这样第二节点在解析对端节点身份地址的过程中，可以降低根据解析密钥索引确定解析密钥的计算时间；又如果第一节点获取到第二节点本地保存的对端节点的解析密钥个数较多，比如不少于2个，则第三信息可以指示根据解析密钥索引和解析地址，确定第一节点的身份地址，进而降低第二节点解析对端节点的身份地址所需要的计算时间，提高了通信节点之间的数据传输效率。可选地，解析密钥个数的多少可以通过配置的阈值来判断，低于阈值(或者低于或者等于阈值)则可以认为解析密钥个数少，否则，认为解析密钥的个数多。
作为一种可能的实现方式，第三信息可以包含于配对请求信息中，第四信息可以包含于配对响应信息中，通过这样的实现方式，可以节省信令开销，实现简单。示例性地，本申请实施例中所述的通信方法，在图7所示的实施例中的方法之前，还可以包括图12所示的步骤S1201–S1202。可以理解的是，图12所示的通信方法可以为图11所示的通信方法的一种实现方式。在该种实现方式下，图11中的所述第三信息包含但不限于配对请求信息中包含的安全信息分发信息，图11中的所述第四信息包含但不限于配对响应信息中包含的安全信息分发信息。步骤S1201-步骤S1202具体如下：
S1201，第一节点向第二节点发送配对请求信息，该配对请求信息包含安全信息分发信息，该安全信息分发信息指示发送解析密钥信息和身份地址信息；或者，该安全信息分发信息指示根据解析密钥索引和解析地址，确定第一节点的身份地址；又或者，该安全信息分发信息指示在节点配对之后，本地节点会向对端节点分发本地节点的解析密钥和本地节点的身份地址。例如在该步骤中，该安全信息分发信息指示在第一节点和第二节点配对之后，第一节点是否会向第二节点分发第一节点的解析密钥和第一节点的身份地址。示例性地，该安全信息分发信息的定义可以参照表3，其中对于除第0位和第1位的其他位含义，在本申请实施例中不做限定。需要说明的是，该安全信息分发信息还可以指示不发送解析密钥信息和身份地址信息；或者，该安全信息分发信息指示不根据解析密钥索引和解析地址，确定第一节点的身份地址；又或者，该安全信息分发信息指示在节点配对之后，本地节点不会向对端节点分发本地节点的解析密钥和本地节点的身份地址。
表3 安全信息分发信息定义
安全信息分发信息 含义
第0位 配对之后，是否会向对端节点分发解析密钥信息，
第1位 配对之后，是否会向对端节点分发本地节点的身份地址。
其他位 保留
示例性地，当安全信息分发信息的第0位取值为1时，表示本地节点和对端节点配对之后，本地节点会向对端节点分发解析密钥信息；当安全信息分发信息的第0位取值为0时，表示本地节点和对端节点配对之后,本地节点不会向对端节点分发解析密钥信息。需要说明的是，安全信息分发信息的第0位取值与是否向对端节点发送解析密钥信息之间的对应关系，也可以有其他表现形式，不做具体限定。
示例性地，当安全信息分发信息的第1位取值为1时，表示本地节点和对端节点配对之后，本地节点会向对端节点分发本地节点的身份地址；当安全信息分发信息的第1位取值为0时，表示本地节点和对端节点配对之后,本地节点不会向对端节点分发本地节点的身份地址。需要说明的是，安全信息分发信息的第1位取值与是否向对端节点发送本地节点的身份地址之间的对应关系，也可以有其他表现形式，不做具体限定。作为一种可能的实现方式，当安全信息分发信息的第0位和第1位取值均为1时，则可以表示在本地节点和对端节点配对之后，本地节点需要向对端节点发送解析密钥信息和本地节点的身份地址，或者可以理解为，在后续的数据传输过程中，对端节点可以根据解析密钥索引和解析地址，确定该本地节点的身份地址。
作为又一种可能的实现方式，对端节点可以忽略安全信息分发信息的第1位的取值，只根据该安全信息分发信息的第0位取值确定在本地节点是否向自己发送解析密钥。例如，当本地节点发送的安全信息分发信息中的第0位取值为1时，无论该安全信息分发信息中的第1位取值为0或者为1，本地节点都会向对端节点发送本地节点的解析密钥信息。比如针对解析密钥更新的场景，由于在先前的数据传输中，本地节点已经将本地节点的身份地址发送给对端节点，所以只需要将更新后的解析密钥发送给对端节点。在这种情况下，对端节点可以只根据安全信息分发信息的第0位取值，确定本地节点是否向自己发送解析密钥。
进一步可选地，该安全信息分发信息还可以指示解析密钥索引的获取方式，即可以指示如下三种获取方式中的其中一种：本地节点保存的对端节点的解析密钥索引来自于对端节点；本地节点保存的对端节点的解析密钥索引来自于本地节点；不同节点的解析密钥索引来源于相同的节点。三种获取解析密钥索引的方式的具体描述可以参考上述申请实施例的相关内容，此处不做赘述。需要说明的是，在本申请实施例中，该配对请求信息中除了包括安全信息分发信息之外，还可以包括命令码(Code)、输入输出能力IOC、带外设备数据标识(out of band data flag，OOB data flag)、鉴权请求(AuthReq)、最大加密密钥长度(maximum encryption key size)、密码算法类型中的一项或多项。例如，参加图13，图13是本申请实施例提供的一种可能的配对请求信息的示意图。其中，Code用于指示消息的类型，例如0x02表示配对请求消息，0x03表示配对响应消息，0x04表示配对确认信息，0x05表示配对初始信息；IOC表示发送该配对请求信息的节点(例如第一节点)具有的输入输出能力，表4是本申请实施提供的一种可能的IOC字段的实现方式；OOB数据标识代表发送该OOB数据标识的节点是否支持OOB配对方式，其中，OOB媒体可能是任何一种能够 传输相应信息的其他无线通信标准，如近距离无线通信标准(near field communication，NFC)或二维码；AuthReq中可以包括绑定标志(bonding_flags，BF)、中间人保护(man-in-the-middle，MITM)、安全连接标志(secure connections，SC)、密钥输入标志(keypress)标识中的一项或多项；最大加密密钥长度指示发送该最大加密密钥长度的设备所能支持的密钥的最大长度，例如，限定密钥的最小长度可以为7字节；密码算法类型又可以包含加密算法、完整性保护算法、密钥产生算法、密钥协商算法中的一项或多项。命令码(Code)、输入输出能力IOC、带外设备数据标识OOB data flag、鉴权请求(AuthReq)、最大加密密钥长度(maximum encryption key size)、密码算法类型还可以有其他表现显示，不做具体限定。
表4 IOC的值与该值对应的描述
值(Value) 描述(Description)
0x00 只能显示(DisplayOnly)
0x01 可以显示及输入是否(DisplayYesNo)
0x02 只能输入(KeyboardOnly)
0x03 不能输入不能输出(NoInputNoOutput)
0x04 可以输入可以显示(KeyboardDisplay)
0x05 具有PSK(Pre-shared key)配对能力
0x06-0xFF 保留值(Reserved for future use)
S1202，第二节点向第一节点发送配对响应信息，该配对响应信息中包含安全信息分发信息，该安全信息分发信息的具体实施方式可以参考步骤S1201中的相关内容，此处不再赘述。
可选地，该配对响应信息中还可以包括命令码(Code)、输入输出能力IOC、带外设备数据标识OOB data flag、鉴权请求(AuthReq)、最大加密密钥长度(maximum encryption key size)、密码算法类型中的一项或多项，上述信息的具体描述可以参考步骤S1201中的相关内容，此处不再赘述。
作为一种可能的实现方式，该配对请求信息中包含的安全信息分发信息还可以指示解析密钥索引的获取方式，即可以指示如下三种获取方案中的其中一种：本地节点保存的对端节点的解析密钥索引来自于对端节点；本地节点保存的对端节点的解析密钥索引来自于本地节点；不同节点的解析密钥索引来源于相同的节点。三种获取方案的具体描述可以参考上述申请实施例的相关内容，此处不做赘述。
可选地，图12所示的通信方法还包括步骤S1203和步骤S1204，步骤S1203和步骤S1204具体如下：
S1203，第一节点向第二节点发送配对确认信息。
相应的，第二节点接收该配对确认信息。
配对确认信息是本地节点(例如第一节点)结合对端节点(例如第二节点)的IOC，并根据对端节点所能支持的密码算法类型，选择一种配对方式和密码算法类型，通知对端节点进行后续的配对和加密。示例性地，该配对确认信息中可以包含用于后续生成节点之间通信链路密钥所用的第一随机数N1以及用于密钥协商的公钥。例如，参见图14，图14是本申请实施例提供的一种可能的配对确认信息的示意图。其中，该配对确认信息包含Code、密钥长度、鉴权类型，密码算法类型、公钥、第一随机数N1中的一项或多项。其中，密钥长度例如可以为发起配对确认信息的节点最终确定的密钥长度，鉴权类型例如可以参见表5，表5是本申请实施提供的一种可能的鉴权类型字段的实现方式。其他参数可以参考步骤S1201–S1202中的相关描述，此处不做赘述。
表5 鉴权类型的值与该值对应的描述
值(Value) 描述(Description)
0x00 口令输入鉴权
0x01 数字比较鉴权
0x02 通行码输入鉴权
0x03 OOB方式(带外方式)鉴权
0x04 免输入方式鉴权
S1204，第二节点向第一节点发送配对初始信息。
相应的，第一节点接收该配对初始信息。
该配对初始信息包含用于后续生成节点之间通信链路密钥所用的第二随机数N2以及所使用的公钥。例如，参见图15，图15是本申请实施例提供的一种可能的配对初始信息的示意图。其中，该配对初始信息包含Code、公钥、第二随机数N2。
示例性地，在本申请实施例中，第一节点和第二节点是否向对方发送解析密钥(也可以理解为身份鉴权密钥)和身份地址信息，可以由图12所述的通信方法中包括的配对请求信息和配对回应信息确定。一旦确定第一节点和第二节点需要向对方发送解析密钥和身份地址信息，在第一节点和第二节点在配对完成之后，可以开始安全信息分发协议，即第一节点和第二节点可以交互彼此的解析密钥和身份地址，并在本地的解析表中保存解析密钥、对应该解析密钥的解析密钥索引以及身份地址之间的对应关系，其中获取解析密钥索引的方式可参考其他实施例中的相关内容，此处不再赘述。之后，在第一节点和第二节点的数据传输过程中，可以参考图3所示的通信方法，进而减少解析接收到的解析地址的计算时间，保证了通信效率和性能。
需要说明的是，本申请方法实施例中的步骤可以根据实际需要进行顺序调整、合并和删减。上述详细阐述了本申请实施例的方法，下面结合图16至图18详细说明本申请实施例提供的装置。
图16是本申请实施例提供的通信装置的示意性框图。如图16所示，该通信装置可以 包括处理器和收发器，以执行上文中任意可能的实现方式中的方法。其中，处理器可以用于进行装置的内部处理，例如根据所述第一解析密钥索引和所述第一解析地址，确定所述第一节点的身份地址；又例如，确定基于所述第一解析密钥和所述随机数得到的本地验证信息与所述第一解析地址包含的验证信息相同，确定所述第一身份地址为所述第一节点的身份地址；再例如，确定第一节点的第一解析地址。收发器用于执行与发送和接收相关的功能，例如向其他装置发送信息或从其他装置接收信息。
示例性地，该通信装置包括的收发器可以为发射器和接收器，或者为发射机和接收机。
在一种实现方式中，该通信装置为通信芯片，该收发器可以为该通信芯片的输入输出电路或者端口。
在本申请实施例中，上述通信装置可以是第一节点的装置或配置于第一节点中的芯片，该通信装置可以用于执行上文中第一节点所执行的任意可能的实现方式中的方法。或者上述通信装置可以是第二节点的装置或配置于第二节点中的芯片，该通信装置可以用于执行上文中第二节点所执行的任意可能的实现方式中的方法。
在又一种实现方式中，该通信装置还包括用于执行上文中任意可能的实现方式中的方法的各个模块。
在又一种实现方式中，该通信装置还可以包括存储器，如图17中虚框所示。图17是本申请实施例提供的通信装置的示意性框图。其中，该存储器与该通信装置包括的处理器、收发器耦合，可以理解的是，该存储器、该处理器和该收发器通过内部连接通路互相通信。具体地，该处理器可用于执行存储器中的指令，以使得该装置执行上文中任意可能的实现方式中的方法。
另外，本申请实施例中还提供了一种芯片，如图18所示。图18示出了一种芯片的结构示意图。芯片包括一个或多个处理器以及接口电路，用于执行上文中任意可能的实现方式中的方法。可选地，该芯片还可以包括总线。其中：
示例性地，处理器是一种集成电路芯片，具有信号的处理能力。例如，该处理器可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是通用处理器、数字信号处理器(digital signal processor，DSP)、专用集成电路(application specific integrated circuit，ASIC)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
接口电路可以用于数据、指令或者信息的发送或者接收，处理器可以利用接口电路接收的数据、指令或者其它信息，进行加工，可以将加工完成信息通过接口电路发送出去。
可选地，芯片还包括存储器，可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。
需要说明的是，处理器、接口电路各自对应的功能既可以通过硬件设计实现，也可以通过软件设计来实现，还可以通过软硬件结合的方式来实现，这里不作限制。
本申请实施例还提供了一种处理装置，包括处理器和接口；所述处理器用于执行上文中第一节点所执行的任意可能的实现方式中的方法，或用于执行上文中第二节点所执行的任意可能的实现方式中的方法。
本申请实施例中还提供了一种通信系统，该通信系统包括用于执行上文中第一节点所执行的任意可能的实现方式中的方法的通信装置和用于执行上文中第二节点所执行的任意可能的实现方式中的方法的通信装置。
需要说明的是，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本申请实施例还提供了一种计算机程序产品，该计算机程序产品包括：计算机程序代码，当该计算机程序代码在计算机上运行时，使得该计算机执行上文中第一节点所执行的任意可能的实现方式中的方法，或者执行上文中第二节点所执行的任意可能的实现方式中的方法。
本申请还提供一种计算机可读介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行上文中第一节点所执行的任意可能的实现方式中的方法，或者执行上文中第二节点所执行的任意可能的实现方式中的方法。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数 据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disc，SSD))等。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (30)

  1. 一种通信方法，其特征在于，所述方法包括：
    接收来自第一节点的第一信息，所述第一信息包含所述第一节点的第一解析地址和第一解析密钥索引，所述第一解析密钥索引用于指示第一解析密钥；
    根据所述第一解析密钥索引和所述第一解析地址，确定所述第一节点的身份地址，所述身份地址唯一标识所述第一节点；
    其中，所述第一解析地址包含用于验证所述第一解析密钥的验证信息，所述第一解析密钥对应第一身份地址。
  2. 根据权利要求1所述的方法，其特征在于，所述第一解析地址包含随机数，所述根据所述第一解析密钥索引和所述第一解析地址，确定所述第一节点的身份地址，包括：
    确定基于所述第一解析密钥和所述随机数得到的本地验证信息与所述第一解析地址包含的验证信息相同；
    确定所述第一身份地址为所述第一节点的身份地址。
  3. 根据权利要求2所述的方法，其特征在于，所述本地验证信息是基于所述第一解析密钥和所述随机数的哈希运算得到的。
  4. 根据权利要求1至3任一项所述的方法，其特征在于，所述第一解析密钥、所述第一解析密钥索引以及所述第一身份地址之间存在预先定义或者配置的对应关系。
  5. 根据权利要求4所述的方法，其特征在于，所述接收来自第一节点的第一信息之前，所述方法还包括：
    接收来自所述第一节点的第二信息，所述第二信息包含所述第一解析密钥和所述第一身份地址；
    定义或配置所述第一解析密钥、所述第一解析密钥索引以及所述第一身份地址之间存在所述对应关系。
  6. 根据权利要求5所述的方法，其特征在于，所述第二信息还包含所述第一解析密钥索引。
  7. 根据权利要求5所述的方法，其特征在于，所述方法还包括：
    向所述第一节点发送所述第一解析密钥索引。
  8. 根据权利要求1至7任一项所述的方法，其特征在于，所述接收来自第一节点的第一信息之前，所述方法还包括：
    接收来自所述第一节点的第三信息，所述第三信息用于指示根据解析密钥索引和解析地址，确定所述第一节点的身份地址。
  9. 一种通信方法，其特征在于，所述方法包括：
    确定第一节点的第一解析地址；
    向第二节点发送第一信息，所述第一信息包含所述第一解析地址和第一解析密钥索引，所述第一解析密钥索引用于指示第一解析密钥；
    其中，所述第一解析地址包含用于验证所述第一解析密钥的验证信息，所述第一解析密钥对应所述第一节点的身份地址，所述身份地址唯一标识所述第一节点。
  10. 根据权利要求9所述的方法，其特征在于，所述第一解析地址包含随机数，所述确 定第一节点的第一解析地址，包括：
    确定基于所述第一解析密钥和所述随机数得到的验证信息。
  11. 根据权利要求10所述的方法，其特征在于，所述验证信息是基于所述第一解析密钥和所述随机数的哈希运算得到的。
  12. 根据权利要求9至11任一项所述的方法，其特征在于，所述向第二节点发送第一信息之前，所述方法还包括：
    向所述第二节点发送第二信息，所述第二信息包含所述第一解析密钥和所述身份地址。
  13. 根据权利要求12所述的方法，其特征在于，所述第二信息还包含所述第一解析密钥索引。
  14. 根据权利要求12所述的方法，其特征在于，所述方法还包括：
    接收来自所述第二节点的所述第一解析密钥索引。
  15. 根据权利要求9至14任一项所述的方法，其特征在于，所述向第二节点发送第一信息之前，所述方法还包括：
    向所述第二节点发送第三信息，所述第三信息用于指示根据解析密钥索引和解析地址，确定所述第一节点的身份地址。
  16. 根据权利要求9至15任一项所述的方法，其特征在于，所述第一解析密钥、所述第一解析密钥索引以及所述身份地址之间存在预先定义或者配置的对应关系。
  17. 一种通信装置，其特征在于，包括：
    收发单元，用于接收来自第一节点的第一信息，所述第一信息包含所述第一节点的第一解析地址和第一解析密钥索引，所述第一解析密钥索引用于指示第一解析密钥；
    处理单元，用于根据所述第一解析密钥索引和所述第一解析地址，确定所述第一节点的身份地址，所述身份地址唯一标识所述第一节点；
    其中，所述第一解析地址包含用于验证所述第一解析密钥的验证信息，所述第一解析密钥对应第一身份地址。
  18. 根据权利要求17所述的装置，其特征在于，所述第一解析地址包含随机数，所述处理单元还用于：
    确定基于所述第一解析密钥和所述随机数得到的本地验证信息与所述第一解析地址包含的验证信息相同；
    确定所述第一身份地址为所述第一节点的身份地址。
  19. 根据权利要求17或18所述的装置，其特征在于，所述第一解析密钥、所述第一解析密钥索引以及所述第一身份地址之间存在预先定义或者配置的对应关系。
  20. 根据权利要求19所述的装置，其特征在于，
    所述收发器还用于接收来自所述第一节点的第二信息，所述第二信息包含所述第一解析密钥和所述第一身份地址；
    所述处理器还用于定义或配置所述第一解析密钥、所述第一解析密钥索引以及所述第一身份地址之间存在所述对应关系。
  21. 一种通信装置，其特征在于，包括：
    处理单元，用于确定第一节点的第一解析地址；
    收发单元，用于向第二节点发送第一信息，所述第一信息包含所述第一解析地址和第一解析密钥索引，所述第一解析密钥索引用于指示第一解析密钥；
    其中，所述第一解析地址包含用于验证所述第一解析密钥的验证信息，所述第一解析密钥对应所述第一节点的身份地址，所述身份地址唯一标识所述第一节点。
  22. 根据权利要求21所述的装置，其特征在于，所述第一解析地址包含随机数，所述处理器还用于：
    确定基于所述第一解析密钥和所述随机数得到的验证信息。
  23. 根据权利要求21或22所述的装置，其特征在于，所述向第二节点发送第一信息之前，所述收发单元还用于：
    向所述第二节点发送第二信息，所述第二信息包含所述第一解析密钥和所述身份地址。
  24. 根据权利要求23所述的装置，其特征在于，所述收发器还用于：
    接收来自所述第二节点的所述第一解析密钥索引。
  25. 一种通信装置，其特征在于，所述通信装置包括至少一个处理器和收发器，所述至少一个处理器用于调用至少一个存储器中存储的计算机程序，以执行如权利要求1至9中任一项、或权利要求10至18中的任一项所述的方法。
  26. 一种通信设备，其特征在于，包括用于执行如权利要求1至9中任一项、或权利要求10至18中的任一项所述方法的通信装置。
  27. 一种芯片，其特征在于，包括一个或多个处理器和接口电路，所述接口电路用于为所述一个或多个处理器提供信息输入和/或输出，所述芯片用于执行如权利要求1至9中任一项、或权利要求10至18中的任一项所述的方法。
  28. 一种通信系统，其特征在于，包括用于执行权利要求1至9任一项所述的方法的通信装置、以及用于执行权利要求10至18任一项所述的方法的通信装置。
  29. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有计算机程序或指令，当所述计算机程序或指令被通信装置执行时，实现如权利要求1至9中任一项、或权利要求10至18中任一项所述的方法。
  30. 一种计算机程序产品，其特征在于，所述计算机程序产品在一个或多个处理器上运行时，实现如权利要求1至9中任一项、或权利要求10至18中任一项所述的方法。
PCT/CN2021/108201 2021-07-23 2021-07-23 一种地址验证方法及相应的装置 WO2023000318A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
PCT/CN2021/108201 WO2023000318A1 (zh) 2021-07-23 2021-07-23 一种地址验证方法及相应的装置
CN202180100798.5A CN117730555A (zh) 2021-07-23 2021-07-23 一种地址验证方法及相应的装置
KR1020247006038A KR20240033081A (ko) 2021-07-23 2021-07-23 주소 검증 방법 및 대응 장치
EP21950567.4A EP4366353A1 (en) 2021-07-23 2021-07-23 Address verification method and corresponding device
US18/419,777 US20240163262A1 (en) 2021-07-23 2024-01-23 Address Verification Method and Corresponding Apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/108201 WO2023000318A1 (zh) 2021-07-23 2021-07-23 一种地址验证方法及相应的装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/419,777 Continuation US20240163262A1 (en) 2021-07-23 2024-01-23 Address Verification Method and Corresponding Apparatus

Publications (1)

Publication Number Publication Date
WO2023000318A1 true WO2023000318A1 (zh) 2023-01-26

Family

ID=84980552

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/108201 WO2023000318A1 (zh) 2021-07-23 2021-07-23 一种地址验证方法及相应的装置

Country Status (5)

Country Link
US (1) US20240163262A1 (zh)
EP (1) EP4366353A1 (zh)
KR (1) KR20240033081A (zh)
CN (1) CN117730555A (zh)
WO (1) WO2023000318A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160157078A1 (en) * 2014-12-01 2016-06-02 Nokia Corporation Method, apparatus, and computer program product for device discovery
CN107707346A (zh) * 2017-04-10 2018-02-16 浙江九州量子信息技术股份有限公司 一种基于数据库的密钥存储、获取方法
CN110213759A (zh) * 2019-06-11 2019-09-06 桃芯科技(苏州)有限公司 基于广播的防丢检测方法、存储介质和电子设备
CN111066335A (zh) * 2017-09-29 2020-04-24 苹果公司 用于与访问控制系统通信和测距以实现自动功能的移动设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160157078A1 (en) * 2014-12-01 2016-06-02 Nokia Corporation Method, apparatus, and computer program product for device discovery
CN107707346A (zh) * 2017-04-10 2018-02-16 浙江九州量子信息技术股份有限公司 一种基于数据库的密钥存储、获取方法
CN111066335A (zh) * 2017-09-29 2020-04-24 苹果公司 用于与访问控制系统通信和测距以实现自动功能的移动设备
CN110213759A (zh) * 2019-06-11 2019-09-06 桃芯科技(苏州)有限公司 基于广播的防丢检测方法、存储介质和电子设备

Also Published As

Publication number Publication date
KR20240033081A (ko) 2024-03-12
US20240163262A1 (en) 2024-05-16
EP4366353A1 (en) 2024-05-08
CN117730555A (zh) 2024-03-19

Similar Documents

Publication Publication Date Title
CN108293185B (zh) 无线设备认证方法和装置
US11765577B2 (en) Identity obscuration for a wireless station
US11824892B2 (en) Terminal matching method and apparatus
JP6406681B2 (ja) プレアソシエーションサービスディスカバリのためのシステムおよび方法
US8924716B2 (en) Communication device and communication method
US20190089532A1 (en) Methods and Apparatus for Secure Device Authentication
US20070055877A1 (en) Security in a communication network
WO2022133949A1 (zh) 一种安全接入方法及装置
WO2019034014A1 (zh) 接入认证的方法和装置
KR20160078475A (ko) 키 구성 방법, 시스템, 및 장치
US20230344626A1 (en) Network connection management method and apparatus, readable medium, program product, and electronic device
WO2018219181A1 (zh) 确定终端设备的标识的方法和装置
WO2023283789A1 (zh) 一种安全通信方法及装置、终端设备、网络设备
WO2019019853A1 (zh) 处理数据的方法、终端设备和网络设备
WO2017026930A1 (en) Methods and devices for privacy enhancement in networks
CN112449323A (zh) 一种通信方法、装置和系统
US20210243599A1 (en) User authentication method through bluetooth device and device therefor
JP7464337B2 (ja) 安全な通信方法、装置、端末デバイス、コンピュータプログラム、コンピュータ記憶媒体、チップ、および通信システム
WO2023000318A1 (zh) 一种地址验证方法及相应的装置
WO2022267723A1 (zh) 一种会话密钥生成的方法及装置
JP2013247533A (ja) 無線ｌａｎ通信システム、無線ｌａｎ親機、無線ｌａｎ子機、通信接続確立方法、及びプログラム
US20220174490A1 (en) System, method, storage medium and equipment for mobile network access
WO2023050373A1 (zh) 一种通信方法、装置及系统
WO2017118269A1 (zh) 一种空口标识的保护方法及装置
CN116963054B (zh) Wlan多链路tdls密钥导出

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21950567

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 202180100798.5

Country of ref document: CN

WWE Wipo information: entry into national phase

Ref document number: 2021950567

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2021950567

Country of ref document: EP

Effective date: 20240201

ENP Entry into the national phase

Ref document number: 20247006038

Country of ref document: KR

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 1020247006038

Country of ref document: KR

NENP Non-entry into the national phase

Ref country code: DE