WO2022105809A1 - 密钥更新方法、装置、电子设备和存储介质 - Google Patents

密钥更新方法、装置、电子设备和存储介质 Download PDF

Info

Publication number
WO2022105809A1
WO2022105809A1 PCT/CN2021/131294 CN2021131294W WO2022105809A1 WO 2022105809 A1 WO2022105809 A1 WO 2022105809A1 CN 2021131294 W CN2021131294 W CN 2021131294W WO 2022105809 A1 WO2022105809 A1 WO 2022105809A1
Authority
WO
WIPO (PCT)
Prior art keywords
state machine
operation mode
key update
operating mode
machine operation
Prior art date
Application number
PCT/CN2021/131294
Other languages
English (en)
French (fr)
Inventor
王月明
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2022105809A1 publication Critical patent/WO2022105809A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0891—Revocation or update of secret information, e.g. encryption key update or rekeying
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords

Definitions

  • the present application relates to the field of data communication, and in particular, to a key update method, apparatus, electronic device and storage medium.
  • MACsec Media Access Control security
  • IEEE802.1AE defines a security infrastructure that provides confidentiality and integrity of data.
  • SAK Media Access Control security
  • MKA MACsec Key Agreement protocol
  • CA Connectivity Association
  • SecY MAC security entities
  • MKA is responsible for the discovery, authentication and authorization of SecY.
  • CA members with a CA password elect one of them according to the rules.
  • Key server the key server generates keys and distributes them to all members in the CA, and each CA member can use the same key to complete secure communication with each other.
  • the CP state machine plays a crucial role in the system.
  • the state machine defines the different states of the MKA protocol when the system is running for too long and the corresponding processing methods, including INIT, CHANGE before protection communication , ALLOWED, AUTHENTICATED, SECURED states and RECEIVE, RECEIVING, READY, TRANSMIT, ABANDON, TRANSMITTING and RETIRE states after entering communication protection.
  • the key server when the key server is ready to negotiate a new key, the key server enters the RECEIVE state, generates a new key with the latest key identifier (LKI), and distributes it to other CAs. member.
  • LKI latest key identifier
  • the embodiments of the present application provide a key update method, apparatus, electronic device, and storage medium.
  • An embodiment of the present application provides a key update method, which is applied to a master node.
  • the method includes: selecting a state machine operation mode according to a preset rule;
  • the state machine operation mode configures a state machine; and the key update is performed according to the state machine operation mode.
  • the embodiment of the present application also provides a key update method, which is applied to a slave node.
  • the method includes: acquiring a state machine operation mode notified by a master node; configuring a state machine according to the state machine operation mode, and reporting to the master node. Feedback configuration completion information; perform key update according to the state machine operating mode.
  • the embodiment of the present application also provides a key update device, the device is applied to the master node, and the device includes: a mode determination module, which is set to select a state machine operation mode according to a preset rule; a mode synchronization module, which is set to The state machine operation mode is notified to the slave node so that the slave node configures the state machine according to the state machine operation mode; the key update module is configured to perform key update according to the state machine operation mode.
  • the embodiment of the present application also provides a key update device, the device is applied to a slave node, the device includes: a mode acquisition module, set to obtain the state machine operation mode notified by the master node; information feedback module, set to according to The state machine operation mode configures the state machine, and feeds back configuration completion information to the master node; the key update module is configured to perform key update according to the state machine operation mode.
  • the embodiment of the present application further provides an electronic device, the electronic device includes: one or more processors; a memory for storing one or more programs, when the one or more programs are processed by the one or more programs The processor executes, so that the one or more processors implement the key update method described in any one of the embodiments of the present application.
  • the embodiments of the present application further provide a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, implements the key update method described in any one of the embodiments of the present application.
  • FIG. 3 is a schematic structural diagram of a communication message provided by an embodiment of the present application.
  • FIG. 4 is a flowchart of a method for updating a key provided by an embodiment of the present application.
  • FIG. 5 is an exemplary diagram of a key update method provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a key update device provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a key update device provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • FIG. 1 is a flowchart of a key update method provided by an embodiment of the present application.
  • the embodiment of the present application can be applied to the case of performing key update between master and slave nodes, for example, connecting a key server and a MAC entity in a consortium.
  • the method can be performed by a key update device, which can be implemented in software and/or hardware, and can generally be integrated in the master node, for example, to connect to a key server in the consortium, see Fig. 1, the method that the embodiment of the present application provides specifically comprises the following steps:
  • Step 110 Select a state machine operation mode according to a preset rule.
  • the preset rule may be the way that the master node selects the state machine operation mode, including determining according to the device performance of the master node and the slave node, or determining according to pre-stored configuration parameters, etc.
  • the state machine operation mode may be the master node and/or Or the process of processing the key update from the node, for example, keep OKI in RETIRE state, clear LKI; or, keep LKI in RETIRE state, clear OKI, etc.
  • the master node can select the operating mode of the state machine to be used according to a preset rule.
  • the operating mode of the state machine can be set by configuring in advance.
  • Step 120 informing the slave node of the operation mode of the state machine, so that the slave node configures the state machine according to the operation mode of the state machine.
  • the master node after the master node determines the state machine operation mode used in the key update process, it can send the state machine operation mode to the slave node, and the slave node can configure the state machine operation mode according to the received state machine operation mode, Make the state machine of the slave node run according to the state machine operation mode selected by the master node.
  • Step 130 Perform key update according to the operating mode of the state machine.
  • the slave node after the slave node is configured according to the state machine operation mode selected by the master node, it can update the key according to the processing rules of the corresponding state machine operation module. For example, when the state machine operation mode is state 1, it can be reserved in the RETIRE state. OKI, clear LKI, when the operating mode of the state machine is state 2, LKI can be retained and PKI can be cleared in the RETIRE state.
  • the state machine operation mode is selected and sent to the slave node, so that the slave node is configured according to the state machine operation mode, and the key is updated according to the selected state machine operation mode, so as to realize the encryption between the master node and the slave node.
  • Communication unifies the state machine operation mode between different nodes, prevents device connection failure, and improves the stability of communication between master and slave nodes.
  • FIG. 2 is a flowchart of another key update method provided by an embodiment of the present application.
  • the embodiment of the present application is a specificization based on the above-mentioned embodiment. Referring to FIG. 2 , the method provided by the embodiment of the present application specifically includes the following steps :
  • Step 210 Acquire locally pre-stored state machine configuration parameters as state machine operation mode parameters.
  • the state machine configuration parameter may be configuration information stored locally by the master node, and the state configuration parameter may indicate the state machine operation mode used by the master node and the slave node when the key is updated.
  • the master node when it performs key update, it can obtain locally pre-stored state configuration parameters, and can use the state configuration parameters as state machine operation mode parameters. After selecting the state machine operation mode parameters, the master node can This parameter configures the local state machine so that the master node can handle key update in a corresponding way.
  • Step 220 Encapsulate the state machine operation mode into a communication message according to a preset format, wherein the communication message at least includes a current state machine operation mode field and a state machine operation mode field.
  • the communication message can be used for the data exchange message between the master node and the slave node, the communication message can be encapsulated according to the preset format, and the current state machine operation mode field and the state machine operation mode field in the communication message can be used. It consists of parameter fields.
  • the current state machine operation mode field can store the state machine operation mode of the current node. Different identifiers can be used in the current state machine operation mode field to represent different state machine operation modes.
  • the state machine operation mode parameter field The state machine operating mode that needs to be configured can be stored.
  • FIG. 3 is a schematic structural diagram of a communication message provided by an embodiment of the present application. Referring to FIG.
  • a message for sending a state machine operating mode may include a parameter set type field, a status field, a parameter set length field, and a state machine operating mode field , wherein the parameter set type field can occupy 8 bits, and the value of the parameter set type field shown in the figure is 12, indicating the corresponding parameter set type, for example, the CP run mode type.
  • the status field may indicate the current operating mode of the state machine, occupying 1 bit, a value of 0 indicates that the state machine mode is not used, and a value of 1 indicates that the state machine mode is used.
  • the length of the parameter set, occupying 12 bits indicates the length of the parameter set in this communication message, and may not include the length of the parameter header.
  • the state machine operation mode field can indicate the operation mode of the state machine, occupying 8 bits, and different values can correspond to different state machine operation modes.
  • the value of the state machine operation mode field is 1, indicating that the state machine operation mode is: The RETIRE state retains OKI and clears LKI; the value of the state machine operating mode field is 0, indicating that the state machine operating mode is: RETIRE state retains LKI and clears OKI.
  • Step 230 Send a communication message to the slave node, so that the slave node configures the state machine according to the state machine operation mode in the communication message.
  • the master node can send the communication message to the slave node, and the slave node can advance the state machine operation mode in the communication message, and configure the slave node according to the state machine mode, so that the slave node can process the encrypted data according to the state machine operation mode. key update.
  • Step 240 Extract the current state machine operation mode from the communication message fed back from the node.
  • the slave node may feed back information to the master node through a communication message to notify itself to complete the configuration of the operating mode of the state machine.
  • the current state machine operating mode can be extracted from the communication message, the message format of the communication message can be the same as the message format sent by the master node to the slave node, and the current state machine operating mode can be located in the current state machine operating mode field, Different state machine operating modes are represented by different identification information.
  • Step 250 It is determined that the current state machine operation mode is the same as the state machine operation mode, and the key is updated according to the state machine operation mode.
  • the master node can compare the selected state machine operation mode with the current state machine operation mode to determine whether they are consistent. If so, it is determined that the state machine operation mode configuration of the slave node is completed, and the master node and the slave node can follow the same state. If not, it is determined that the state machine operation mode of the slave node is not configured, and the key update is not performed on the slave node.
  • Step 260 Do not perform key update on slave nodes that have not fed back configuration completion information within a preset time.
  • the preset time may be the longest waiting time for the master node to control the slave node to configure the state machine operation mode.
  • a timer when the master node notifies the state machine operation mode of the slave node, a timer may be set, and the timing length of the timer may be a preset time. If the slave node is not received within the time range of the timer When the feedback information is received, it can be determined that the slave node has not completed the configuration of the operating mode of the state machine, and when the key update is performed, a new key may not be sent to the slave node to complete the key update.
  • the state machine operation mode parameters are selected through locally pre-stored state machine configuration parameters, the state machine operation mode parameters are encapsulated into a communication message, and the communication message is sent to the slave node to complete the corresponding state machine configuration , in the current state machine operation mode field in the communication message fed back from the node, it is determined that the parameters of the current state machine operation mode field are the same as the state machine operation mode, then the key update is performed according to the state machine operation mode, and the preset time Slave nodes that do not feed back configuration completion information do not perform key update, realize the unification of the state machine operation mode of the master node and the slave node, realize encrypted communication between the master node and the slave node, prevent the failure of device connection, and improve the master-slave The stability of communication between nodes.
  • the state machine operation mode parameter field expands the value according to the newly added state machine operation mode.
  • a new identifier may be determined for marking through negotiation.
  • a new identifier may be added to the state machine operation mode parameter field. The new identifier implements the extension of the value range.
  • a new value can be defined in the state machine operation mode parameter field of the communication packet to indicate that the problem occurs.
  • the newly added negotiation mode realizes the scalability of communication packets.
  • FIG. 4 is a flowchart of a key update method provided by an embodiment of the present application.
  • the embodiment of the present application can be applied to the case of performing key update between master and slave nodes, for example, connecting a key server and a MAC entity in a consortium.
  • the method can be performed by a key update device, which can be implemented in software and/or hardware, and can generally be integrated in the slave node, for example, to connect the MAC entity in the consortium, see eg 4
  • the method provided by the embodiment of the present application specifically includes the following steps:
  • Step 310 Obtain the state machine running mode notified by the master node.
  • the slave node may receive the state machine operation mode notified by the master node, and the state machine operation mode may be transmitted in the form of a message.
  • Step 320 Configure the state machine according to the operation mode of the state machine, and feed back configuration completion information to the master node.
  • the local state machine can be configured to the state machine operation mode notified by the master node, so that the processing flow of the slave node when processing the key update is the same as that of the master node, reducing the need for device connection. probability of failure.
  • the configuration completion information may be fed back to the master node, wherein the configuration completion information may include the current state machine operation mode of the slave node, and is used to notify the master node to complete the configuration of the state machine operation mode.
  • Step 330 Perform key update according to the state machine operating mode.
  • the slave node performs key update according to the current state machine operation mode, and different state machine operation modes may correspond to different key update processes.
  • the state machine operation mode is state 1
  • the slave node keeps OKI in the RETIRE state and clears the LKI.
  • the state machine operation mode is state 2
  • the slave node retains the LKI in the RETIRE state and clears the OKI.
  • the configuration completion information is fed back to the master node, and the key update is implemented based on the process corresponding to the state machine operation mode,
  • the key update of the master and slave nodes is realized.
  • configuring a state machine according to the state machine operating mode includes:
  • the configured operation mode of the slave node can be compared with the state machine operation mode notified by the master node. If they are the same, it is determined that the state machine operation mode of the slave node does not need to be changed. The operation mode of the state machine of the node is changed to the operation mode of the state machine notified by the master node.
  • the feeding back configuration completion information to the master node includes:
  • the configuration completion information is fed back to the master node through a communication message; wherein, the communication message includes at least a current state machine operation mode field and a state machine operation mode parameter field.
  • the slave node can feed back configuration completion information to the master node through a communication message, and the communication message can at least include a current state machine operating mode field and a state machine operating mode parameter field, which can be identified by identifying the current state machine operating mode field.
  • the mode is used as the configuration completion information.
  • the current state machine operation mode field is set so that the identifier value represents the state machine operation mode notified by the master node, and the set communication message can be used as the configuration completion information.
  • the performing key update according to the state machine operation mode includes: receiving a new key of the master node, and processing the local key according to the state machine operation mode the old key.
  • the slave node has different processing procedures for key update under different state machine operation modes, and can process the new key sent by the master node and the local old key according to the state machine operation mode currently used by the slave node. Key, in some examples, if the state machine operation mode of the slave node is state 1, the old key is deleted in the RETIRE state, and the new key is retained, if the state machine operation mode of the slave node is state 2, in the RETIRE state Delete the new key and keep the old key.
  • FIG. 5 is an example diagram of a key update method provided by an embodiment of the present application. Referring to FIG. 5 , all CA members enter the SECURED state after completing the key server election, wherein the key server starts to run the CP state machine running mode negotiation. Flowchart, including the following steps:
  • Step 410 the key server selects the operating mode of the CP state machine to be used through certain rules, for example, it can be selected by pre-configured or default mode. Send protocol packets to notify other members in the CA. At the same time, the key server starts a timeout timer of "CP state machine operation mode", which is used to judge whether other members in the CA have uniformly completed the setting of the CP state machine operation mode within the specified time.
  • CP state machine operation mode "CP state machine operation mode"
  • Step 420 other members in the CA receive the message carrying the "CP state machine operating mode" parameter sent from the key server, and parse out whether the parameter is consistent with the local CP state machine operating mode, if not, modify the local
  • the CP state machine operates in the same mode as that used by the key server.
  • After completing the setting send a message carrying the "CP state machine operating mode" parameter to the key server, and set the status bit to 1, indicating that the CP state machine operating mode setting is complete.
  • Step 430 the key server receives the message carrying the parameter "CP state machine operation mode" sent by other members in the CA, and determines whether the CP state machine operation modes of the members in the CA are consistent.
  • Step 440 if the CP state machine running modes of all members in the CA have been set to be the same, then continue to run the subsequent CP state machine processing flow according to the key agreement processing description in the MKA protocol.
  • Step 450 if there is a member in the CA that has not reported the CP state machine running mode after the "CP state machine running mode" timer expires, the key server considers that all members have completed the setting of the CP state machine running mode. , still continue to run the subsequent CP state machine processing flow according to the key agreement processing of the MKA protocol.
  • FIG. 6 is a schematic structural diagram of a key update apparatus provided by an embodiment of the present application, which can execute the key update method provided by any embodiment of the present application, and specifically execute the corresponding functional modules and beneficial effects of the method.
  • the device can be implemented by software and/or hardware, and is generally integrated in the master node, for example, connected to a key server in the consortium, and specifically includes: a mode determination module 501 , a mode synchronization module 502 and a key update module 503 .
  • the mode determination module 501 is configured to select the operation mode of the state machine according to a preset rule.
  • the mode synchronization module 502 is configured to notify the slave node of the state machine operation mode, so that the slave node configures the state machine according to the state machine operation mode.
  • the key update module 503 is configured to perform key update according to the operating mode of the state machine.
  • the mode determination module selects the state machine operation mode and sends it to the slave node
  • the mode synchronization module makes the slave node configure according to the state machine operation mode
  • the key update module updates the key according to the selected state machine operation mode
  • the mode determination module 501 is specifically configured to: acquire locally pre-stored state machine configuration parameters as state machine operation mode parameters.
  • the mode synchronization module 502 includes:
  • the communication message unit is configured to encapsulate the state machine operation mode into a communication message according to a preset format, wherein the communication message at least includes a current state machine operation mode field and a state machine operation mode field.
  • a message sending unit configured to send the communication message to the slave node so that the slave node configures the state machine according to the state machine operating mode in the communication message.
  • the state machine operation mode parameter field in the mode synchronization module 502 extends the value according to the newly added state machine operation mode.
  • the method further includes: an exception handling module configured to not perform key update on the slave nodes that have not fed back configuration completion information within a preset time.
  • the key update module 503 includes:
  • the information extraction unit is configured to extract the current state machine operation mode from the communication message fed back by the slave node.
  • the update execution unit is configured to determine that the current state machine operation mode is the same as the state machine operation mode, and then perform key update according to the state machine operation mode.
  • FIG. 7 is a schematic structural diagram of a key update apparatus provided by an embodiment of the present application, which can execute the key update method provided by any embodiment of the present application, and specifically execute the corresponding functional modules and beneficial effects of the method.
  • the apparatus can be implemented by software and/or hardware, and is generally integrated in a slave node, for example, a MAC entity in a connection alliance, and specifically includes: a mode acquisition module 601 , an information feedback module 602 and a key update module 603 .
  • the mode acquisition module 601 is configured to acquire the state machine running mode notified by the master node.
  • the information feedback module 602 is configured to configure the state machine according to the operation mode of the state machine, and feed back configuration completion information to the master node.
  • the key update module 603 is configured to perform key update according to the state machine operating mode.
  • the state machine operation mode notified by the master node is obtained by the mode acquisition module, the information feedback module configures according to the state machine operation mode, and after the configuration is completed, the configuration completion information is fed back to the master node, and the key update module operates based on the state machine
  • the process corresponding to the mode realizes the key update, and realizes the key update of the master and slave nodes.
  • the mode acquisition module 601 is specifically set to: determine whether the configured operation mode of the state machine is the same as the operation mode of the state machine, and if not, set the state machine The operating mode of the state machine, if so, does not change the operating mode of the state machine.
  • the information feedback module 602 includes:
  • the feedback unit is configured to feed back the configuration completion information to the master node through a communication message; wherein the communication message includes at least a current state machine operation mode field and a state machine operation mode parameter field.
  • the key update module 603 is specifically configured to: receive the new key of the master node, and process the local old key according to the state machine operating mode.
  • FIG. 8 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
  • the device includes a processor 70, a memory 71, an input device 72, and an output device 73; the number of processors 70 in the device may be One or more, a processor 70 is taken as an example in FIG. 8 ; the device processor 70 , memory 71 , input device 72 and output device 73 can be connected by a bus or other means, and the connection by a bus is taken as an example in FIG. 8 .
  • the memory 71 can be used to store software programs, computer-executable programs, and modules, such as the modules corresponding to the key update device in the embodiments of the present application (the mode determination module 501, the mode synchronization module 502, and the encryption module 502).
  • the processor 70 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 71 , that is, to implement the above key update method.
  • the memory 71 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function; the storage data area may store data created according to the use of the terminal, and the like.
  • the memory 71 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other non-volatile solid-state storage device.
  • memory 71 may further include memory located remotely from processor 70, which may be connected to the device through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.
  • the input device 72 may be used to receive input numerical or character information, and to generate key signal input related to user settings and function control of the device.
  • the output device 73 may include a display device such as a display screen.
  • Embodiments of the present application further provide a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the key update method provided by any embodiment of the present application, and the method includes:
  • Selecting a state machine operation mode according to a preset rule informing the slave node of the state machine operation mode so that the slave node configures the state machine according to the state machine operation mode; and performing key update according to the state machine operation mode.
  • a storage medium containing computer-executable instructions provided by the embodiments of the present application, the computer-executable instructions of which are not limited to the above-mentioned method operations, and can also execute the key update method provided by any embodiment of the present application. related operations.
  • the present application can be implemented by means of software and necessary general-purpose hardware, and of course can also be implemented by hardware, but in many cases the former is a better implementation manner .
  • the technical solutions of the present application can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in a computer-readable storage medium, such as a floppy disk of a computer , read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including several instructions to make a computer device (which can be a personal computer , server, or network device, etc.) to execute the methods described in the various embodiments of this application.
  • a computer-readable storage medium such as a floppy disk of a computer , read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc.
  • the units and modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be realized; in addition, The specific names of the functional units are only for the convenience of distinguishing from each other, and are not used to limit the protection scope of the present application.
  • the slave node by selecting the state machine operation mode and sending it to the slave node, the slave node is configured according to the state machine operation mode, and the key is updated according to the selected state machine operation mode, so as to realize the encryption between the master node and the slave node.
  • Communication unifies the state machine operation mode between different nodes, prevents device connection failure, and improves the stability of communication between master and slave nodes.
  • the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components Components execute cooperatively.
  • Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application specific integrated circuit .
  • Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • Computer storage media includes both volatile and nonvolatile implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules or other data flexible, removable and non-removable media.
  • Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, or may Any other medium used to store desired information and which can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery media, as is well known to those of ordinary skill in the art .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

一种密钥更新方法、装置、电子设备和存储介质，其中，该方法包括：根据预设规则选择状态机运行模式(110)；将所述状态机运行模式通知给从节点以使所述从节点根据所述状态机运行模式配置状态机(120)；根据所述状态机运行模式进行密钥更新(130)。

Description

密钥更新方法、装置、电子设备和存储介质
相关申请的交叉引用
本申请基于申请号为202011307313.3、申请日为2020年11月19日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此引入本申请作为参考。
技术领域
本申请涉及数据通信领域，尤其涉及一种密钥更新方法、装置、电子设备和存储介质。
背景技术
媒体接入控制安全(Media Access Control security,MACsec)是IEEE802.1AE中定义的安全标准，该标准定义了一个安全基础架构，该架构提供了数据的机密性和完整性，通过应用MACsec协议标准，可以满足二层通信数据安全的需求，由于MACsec协议只提供了对数据进行封装和加密的框架，该标准所需的密钥(SAK)则是由IEEE 802.1X-2010标准协议中的MKA协议来协商生成。由于MACsecx协议只提供了对数据进行封装和加密的框架，该标准所需的密钥(SAK)则是由IEEE 802.1X-2010标准协议中的MACsec密钥协商协议(MACsec Key Agreement protocol,MKA)来协商生成。连接联盟(Connectivity Association,CA)由多个实现MACsec功能的MAC安全实体(Security Entity,SecY)构成，MKA负责SecY的发现、认证和授权，拥有用一个CA密码的CA成员根据规则选举其中一个作为密钥服务器，由密钥服务器生成密钥并分发至CA内所有成员，各CA成员则可使用相同密钥完成彼此之间的安全通信。
在MKA协议中，CP状态机在***中起着至关重要的作用，该状态机定义了MKA协议在***运行过长中的所处的不同状态及相应处理方法，包括保护通信前INIT、CHANGE、ALLOWED、AUTHENTICATED、SECURED状态和进入通信保护后的RECEIVE、RECEIVING、READY、TRANSMIT、ABANDON、TRANSMITTING和RETIRE状态。按照MKA协议说明，当密钥服务器准备协商一个新密钥时，密钥服务器进入RECEIVE状态，生成一个最新密钥标识符(Latest Key Identifier,LKI)的新密钥，并分发至CA内的其他成员。当CA内所有成员都安装了新密钥后，CA内所有的成员包括密钥服务器都进入RETIRE状态，并将LKI标识的新密钥赋给老密钥标识符(Old Key Identifier,OKI)的旧密钥,同时LKI被清除，整个CA内均使用OKI标识的密钥对通信数据进学校加解密，以实现数据的保护。
现有的对MKA的CP状态实现的方案中，由于对该状态机的RETIRE状态理解不同，因此导致各方案在处理RETIRE状态时采用的操作并不完全一致，有些方案采用保留LKI而清除OKI的方式来处理准备使用的密钥，由于MKA协议报文分发使用密钥的协议参数集3中携带并处理了LKI和OKI这两个状态机参数，因而这对于不同设备间或终端与设备间的对接造成了一定的影响，有很大可能导致设备对接失败。
发明内容
本申请实施例提出一种密钥更新方法、装置、电子设备和存储介质。
本申请实施例提供了一种密钥更新方法，应用于主节点，该方法包括：根据预设规则选择状态机运行模式；将所述状态机运行模式通知给从节点以使所述从节点根据所述状态机运 行模式配置状态机；根据所述状态机运行模式进行密钥更新。
本申请实施例还提供了一种密钥更新方法，应用于从节点，该方法包括：获取主节点通知的状态机运行模式；根据所述状态机运行模式配置状态机，并向所述主节点反馈配置完成信息；根据所述状态机运行模式进行密钥更新。
本申请实施例还提供了一种密钥更新装置，该装置应用于主节点，该装置包括：模式确定模块，被设置成根据预设规则选择状态机运行模式；模式同步模块，被设置成将所述状态机运行模式通知给从节点以使所述从节点根据所述状态机运行模式配置状态机；密钥更新模块，被设置成根据所述状态机运行模式进行密钥更新。
本申请实施例还提供了一种密钥更新装置，该装置应用于从节点，该装置包括：模式获取模块，被设置成获取主节点通知的状态机运行模式；信息反馈模块，被设置成根据所述状态机运行模式配置状态机，并向所述主节点反馈配置完成信息；密钥更新模块，被设置成根据所述状态机运行模式进行密钥更新。
本申请实施例还提供了一种电子设备，该电子设备包括：一个或多个处理器；存储器，用于存储一个或多个程序，当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如本申请实施例中任一所述的密钥更新方法。
本申请实施例还提供了一种计算机可读存储介质，其上存储有计算机程序，该计算机程序被处理器执行时实现如本申请实施例中任一所述的密钥更新方法。
附图说明
图1是本申请实施例提供的一种密钥更新方法的流程图；
图2是本申请实施例提供的另一种密钥更新方法的流程图；
图3是本申请实施例提供的一种通信报文的结构示意图；
图4是本申请实施例提供的一种密钥更新方法的流程图；
图5是本申请实施例提供的一种密钥更新方法的示例图；
图6是本申请实施例提供的一种密钥更新装置的结构示意图；
图7是本申请实施例提供的一种密钥更新装置的结构示意图；
图8是本申请实施例提供的一种电子设备的结构示意图。
具体实施方式
应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
在后续的描述中，使用用于表示元件的诸如“模块”、“部件”或“单元”的后缀仅为了有利于本申请的说明，其本身没有特有的意义。因此，“模块”、“部件”或“单元”可以混合地使用。
图1是本申请实施例提供的一种密钥更新方法的流程图，本申请实施例可适用于主从节点之间进行密钥更新的情况，例如，连接联盟中密钥服务器和MAC实体之间的密钥更新，该方法可以由密钥更新装置来执行，该装置可以由软件和/或硬件的方式来实现，一般可以集成在主节点中，例如，连接联盟中的密钥服务器，参见图1，本申请实施例提供的方法具体包括如下步骤：
步骤110、根据预设规则选择状态机运行模式。
其中，预设规则可以是主节点选择状态机运行模式的方式，包括根据主节点和从节点的设备性能确定，或者，按照预先存储的配置参数确定等，状态机运行模式可以是主节点和/ 或从节点处理密钥更新的流程，例如，在RETIRE状态下保留OKI，清除LKI；或者，在RETIRE状态下保留LKI，清除OKI等。
具体的，主节点可以根据预先设定规则选择使用的状态机运行模式，例如，可以通过提前配置的方式设定状态机运行模式。
步骤120、将状态机运行模式通知给从节点以使从节点根据状态机运行模式配置状态机。
在本申请实施例中，主节点确定密钥更新过程中使用的状态机运行模式后，可以将将该状态机运行模式发送给从节点，从节点可以根据接收到的状态机运行模式进行配置，使得从节点的状态机按照主节点选择的状态机运行模式进行运行。
步骤130、根据所述状态机运行模式进行密钥更新。
具体的，从节点根据主节点选择的状态机运行模式配置后，可以按照对应状态机运行模块的处理规则进行密钥更新，例如，当状态机运行模式为状态1时，可以在RETIRE状态下保留OKI，清除LKI，当状态机运行模式为状态2时，可以在RETIRE状态下保留LKI，清除PKI。
本申请实施例，通过择状态机运行模式并发送到从节点，使得从节点根据该状态机运行模式进行配置，根据选择的状态机运行模式密钥更新，实现主节点和从节点之间的加密通信，统一不同节点间的状态机运行模式，防止设备对接失败，提高了主从节点间通信的稳定性。
图2是本申请实施例提供的另一种密钥更新方法的流程图，本申请实施例是在上述实施例基础上的具体化，参见图2，本申请实施例提供的方法具体包括如下步骤：
步骤210、获取本地预先存储的状态机配置参数作为状态机运行模式参数。
其中，状态机配置参数可以是主节点本地存储的配置信息，该状态配置参数可以指示进行密钥更新时主节点和从节点使用的状态机运行模式。
在本申请实施例中，当主节点进行密钥更新时，可以获取本地预先存储的状态配置参数，可以将状态配置参数作为状态机运行模式参数，主节点在选择状态机运行模式参数后，可以根据该参数对本地的状态机进行配置，使得主节点可以按照对应的方式处理密钥更新。
步骤220、将状态机运行模式按照预设格式封装为通信报文，其中，通信报文至少包括当前状态机运行模式字段、状态机运行模式字段。
其中，通信报文可以用于主节点和从节点之间进行数据交互的报文，通信报文可以按照预设格式进行封装，通信报文中可以由当前状态机运行模式字段和状态机运行模式参数字段组成，其中，当前状态机运行模式字段可以存储当前节点的状态机运行的模式，当前状态机运行模式字段中可以使用不同的标识符代表不同的状态机运行模式，状态机运行模式参数字段可以存储需要配置的状态机运行模式。
具体的，主节点在选择出状态机运行模式，可以将状态机运行模式封装到通信报文中，可以在通信报文中的固定字段以不同的数值表示不同的状态机运行模式，该通信报文中可以至少包括当前状态机运行模式字段和状态机运行模式字段，可以通过主节点当前的状态机运行模式以及选择的状态继续运行模式分别对通信报文中的当前状态机运行模式字段和状态机运行模式字段进行标记。图3是本申请实施例提供的一种通信报文的结构示意图，参见图3，发送状态机运行模式的报文可以包括参数集类型字段、状态字段、参数集长度字段和状态机运行模式字段，其中，参数集类型字段，可以占8比特，图中示出的参数集类型字段的取值为12，表明对应的参数集类型，例如，CP run mode类型。状态字段可以表示当前使用的状态机运行模式，占1比特，取值为0表示未使用状态机模式，取值为1表示使用状态机模式。 参数集长度，占12比特，表明本通信报文中参数集的长度，可以不包括参数头长度。状态机运行模式字段可以表示状态机运行的模式，占8比特，不同的取值可以对应不同的状态机运行模式，例如，状态机运行模式字段的取值为1，表示状态机运行模式为：RETIRE状态保留OKI，清除LKI；状态机运行模式字段的取值为0，表示状态机运行模式为:RETIRE状态保留LKI，清除OKI。
步骤230、发送通信报文到从节点以使从节点根据通信报文内的状态机运行模式配置状态机。
具体的，主节点可以将通信报文发送到从节点，从节点可以提前通信报文中的状态机运行模式，并根据该状态机模式配置从节点，使得从节点按照该状态机运行模式处理密钥更新。
步骤240、在从节点反馈的通信报文中提取当前状态机运行模式。
在本申请实施例中，从节点可以通过通信报文向主节点反馈信息，通知自身完成状态机运行模式的配置。可以从该通信报文中提取当前状态机运行模式，该通信报文的报文格式可以与主节点发送到从节点的报文格式相同，当前状态机运行模式可以位于当前状态机运行模式字段，使用不同的标识信息表示不同的状态机运行模式。
步骤250、确定当前状态机运行模式与状态机运行模式相同，则按照状态机运行模式进行密钥更新。
具体的，主节点可以将选择的状态机运行模式与当前状态机运行模式进行对比，判断是否一致，若是，则确定从节点的状态机运行模式配置完成，主节点和从节点可以按照相同的状态机运行模式进行密钥更新，防止设备对接失败，若否，则确定从节点的状态机运行模式未配置完成，不对该从节点进行密钥更新。
步骤260、不对预设时间内未反馈配置完成信息的从节点进行密钥更新。
其中，预设时间可以是主节点控制从节点配置状态机运行模式的最长等待时间，当预设时间内未确定从节点完成状态机运行模式的配置时，可以认为该从节点故障，不对该从节点进行密钥更新。
在本申请实施例中，主节点通知从节点的状态机运行模式时，可以设置一个定时器，该定时器的定时长度可以为预设时间，若在定时器的时间范围内未接收到从节点反馈的信息时，可以确定该从节点未完成状态机运行模式的配置，在进行密钥更新时，可以不向从节点发送新的密钥以完成密钥更新。
本申请实施例中，通过本地预先存储的状态机配置参数选择状态机运行模式参数，封装该状态机运行模式参数为通信报文，并将该通信报文发送到从节点完成对应的状态机配置，在从节点反馈的通信报文中的当前状态机运行模式字段，确定当前状态机运行模式字段的参数与状态机运行模式相同，则根据该状态机运行模式进行密钥更新，对预设时间内未反馈配置完成信息的从节点不进行密钥更新，实现主节点与从节点的状态机运行模式的统一，实现主节点和从节点之间的加密通信，防止设备对接失败，提高了主从节点间通信的稳定性。
在一些示例中，在上述申请实施例的基础上，所述状态机运行模式参数字段根据新增状态机运行模式拓展取值。
在本申请实施例中，当主节点和从节点的状态机的状态运行模式进行更新时，可以通过协商的方式确定出新的标识符进行标记，相应的，可以在状态机运行模式参数字段中增加新的标识符实现取值范围的拓展。
在一些示例中，针对协议应用中出现除RETORE状态外的其他CP状态机对接过程中出现的问题，可以在通信报文的状态机运行模式参数字段定义新的取值以表示为解决出现的问题新增的协商方式，实现通信报文的可拓展性。
图4是本申请实施例提供的一种密钥更新方法的流程图，本申请实施例可适用于主从节点之间进行密钥更新的情况，例如，连接联盟中密钥服务器和MAC实体之间的密钥更新，该方法可以由密钥更新装置来执行，该装置可以由软件和/或硬件的方式实现，一般可以集成在从节点中，例如，连接联盟中的MAC实体，参见如4，本申请实施例提供的方法具体包括如下步骤：
步骤310、获取主节点通知的状态机运行模式。
在本申请实施例中，从节点可以接收主节点通知的状态机运行模式，该状态机运行模式可以通过报文的方式进行传输。
步骤320、根据状态机运行模式配置状态机，并向主节点反馈配置完成信息。
具体的，从节点接收到状态机运行模式后，可以将本地的状态机配置为主节点通知的状态机运行模式，使得从节点在处理密钥更新时的处理流程与主节点一致，降低设备对接的失败机率。从节点完成配置后可以向主节点反馈配置完成信息，其中，配置完成信息可以包括从节点当前的状态机运行模式，用于通知主节点完成状态机运行模式的配置。
步骤330、根据状态机运行模式进行密钥更新。
在本申请实施例中，从节点根据当前的状态机运行模式进行密钥更新，不同的状态机运行模式可以对应不同的密钥更新流程，在一些示例中，当状态机运行模式为状态1时，从节点在RETIRE状态保留OKI，清除LKI，若当状态机运行模式为状态2时，从节点在RETIRE状态保留LKI，清除OKI。
本申请实施例，通过获取主节点通知的状态机运行模式，并按照该状态机运行模式进行配置，配置完成后向主节点反馈配置完成信息，基于状态机运行模式对应的流程实现密钥更新，实现了主从节点的密钥更新，通过统一主节点和从节点的状态机运行模式，防止设备间对接失败，提高了设备间信息交互的安全性和稳定性。
在一些示例中，在上述申请实施例的基础上，根据所述状态机运行模式配置状态机，包括：
判断状态机已配置的运行模式是否与所述状态机运行模式相同，若不是，则将所述状态机的运行模式，若是，则不更改所述状态机的运行模式。
本申请实施例中，可以将从节点已配置的运行模式与主节点通知的状态机运行模式进行对比，若相同，则确定无需对从节点的状态机运行模式进行更改，若不同，则将从节点的状态机的运行模式更改为主节点通知的状态机运行模式。
在一些示例中，在上述申请实施例的基础上，所述向所述主节点反馈配置完成信息，包括：
将所述配置完成信息通过通信报文反馈至所述主节点；其中，所述通信报文至少包括当前状态机运行模式字段、状态机运行模式参数字段。
具体的，从节点可以通过通信报文向主节点反馈配置完成信息，通信报文可以至少包括当前状态机运行模式字段和状态机运行模式参数字段，可以通过对当前状态机运行模式字段进行标识的方式作为配置完成信息，例如，将当前状态机运行模式字段进行置位，使得该标 识值代表主节点通知的状态机运行模式，可以将被置位后的通信报文作为配置完成信息。
在一些示例中，在上述申请实施例的基础上，所述根据所述状态机运行模式进行密钥更新，包括：接收所述主节点的新密钥，并根据所述状态机运行模式处理本地的旧密钥。
在本申请实施例中，从节点在不同的状态机运行模式下对密钥更新具有不同的处理流程，可以根据从节点当前使用的状态机运行模式处理主节点发送的新密钥和本地的旧密钥，在一些示例中，若从节点的状态机运行模式为状态1，在RETIRE状态下将旧密钥删除，保留新密钥，若从节点的状态机运行模式为状态2，在RETIRE状态下将新密钥删除，保留旧密钥。
图5是本申请实施例提供的一种密钥更新方法的示例图，参见图5，所有CA成员完成密钥服务器选举后均进入SECURED状态，其中密钥服务器开始运行CP状态机运行模式协商的流程图，包括以下步骤：
步骤410，密钥服务器通过一定的规则选择将要使用的CP状态机运行模式，比如可以通过提前配置或默认的方式来选择，在确定了CP状态机运行模式后，密钥服务器向CA内其它成员发送协议报文，通知CA内其它成员。同时密钥服务器启动一个“CP状态机运行模式”的超时定时器，用于判断CA内其它成员在规定时间内是否均统一完成CP状态机运行模式的设置。
步骤420，CA内其它成员接收从密钥服务器发送的携带“CP状态机运行模式”参数的报文，解析出该参数后与本地的CP状态机运行模式比较是否一致，若不一致，则修改本地的CP状态机运行模式为与密钥服务器使用的模式相同。完成设置后向密钥服务器发送携带“CP状态机运行模式”参数的报文，并置状态位为1，表示CP状态机运行模式设置完成。
步骤430，密钥服务器收到CA内其它成员发送的携带“CP状态机运行模式”参数的报文，判断CA内成员的CP状态机运行模式是否都一致。
步骤440，若CA内所有成员的CP状态机运行模式均已经设置一致，则按照MKA协议中密钥协商处理说明，继续运行后续的CP状态机处理流程。
步骤450，若CA内有成员在“CP状态机运行模式”定时器超时后仍未反馈其CP状态机运行模式的情况，则密钥服务器认为所有成员均已完成了CP状态机运行模式的设置，仍然继续按MKA协议的密钥协议处理运行后续的CP状态机处理流程。
图6是本申请实施例提供的一种密钥更新装置的结构示意图，可执行本申请任意实施例提供的密钥更新方法，具体执行方法相应的功能模块和有益效果。该装置可以由软件和/或硬件实现，一般集成在主节点中，例如，连接联盟中的密钥服务器,具体包括：模式确定模块501、模式同步模块502和密钥更新模块503。
模式确定模块501，被设置成根据预设规则选择状态机运行模式。
模式同步模块502，被设置成将所述状态机运行模式通知给从节点以使所述从节点根据所述状态机运行模式配置状态机。
密钥更新模块503，被设置成根据所述状态机运行模式进行密钥更新。
本申请实施例，通过模式确定模块择状态机运行模式并发送到从节点，模式同步模块使得从节点根据该状态机运行模式进行配置，密钥更新模块根据选择的状态机运行模式密钥更新，实现主节点和从节点之间的加密通信，统一不同节点间的状态机运行模式，防止设备对接失败，提高了主从节点间通信的稳定性。
在一些示例中，在上述申请实施例的基础上，所述模式确定模块501具体被设置成：获 取本地预先存储的状态机配置参数作为状态机运行模式参数。
在一些示例中，在上述申请实施例的基础上，所述模式同步模块502包括：
通信报文单元，被设置成将状态机运行模式按照预设格式封装为通信报文，其中，通信报文至少包括当前状态机运行模式字段、状态机运行模式字段。
报文发送单元，被设置成发送所述通信报文到从节点以使从节点根据所述通信报文内的状态机运行模式配置状态机。
在一些示例中，在上述申请实施例的基础上，所述模式同步模块502中的状态机运行模式参数字段根据新增状态机运行模式拓展取值。
在一些示例中，在上述申请实施例的基础上，还包括：异常处理模块，被设置成不对预设时间内未反馈配置完成信息的从节点进行密钥更新。
在一些示例中，在上述申请实施例的基础上，所述密钥更新模块503包括：
信息提取单元，被设置成在所述从节点反馈的通信报文中提取当前状态机运行模式。
更新执行单元，被设置成确定所述当前状态机运行模式与所述状态机运行模式相同，则按照所述状态机运行模式进行密钥更新。
图7是本申请实施例提供的一种密钥更新装置的结构示意图，，可执行本申请任意实施例提供的密钥更新方法，具体执行方法相应的功能模块和有益效果。该装置可以由软件和/或硬件实现，一般集成在从节点中，例如，连接联盟中的MAC实体,具体包括：模式获取模块601、信息反馈模块602和密钥更新模块603。
模式获取模块601，被设置成获取主节点通知的状态机运行模式。
信息反馈模块602，被设置成根据所述状态机运行模式配置状态机，并向所述主节点反馈配置完成信息。
密钥更新模块603，被设置成根据所述状态机运行模式进行密钥更新。
本申请实施例，通过模式获取模块获取主节点通知的状态机运行模式，信息反馈模块按照该状态机运行模式进行配置，配置完成后向主节点反馈配置完成信息，密钥更新模块基于状态机运行模式对应的流程实现密钥更新，实现了主从节点的密钥更新，通过统一主节点和从节点的状态机运行模式，防止设备间对接失败，提高了设备间信息交互的安全性和稳定性。
在一些示例中，在上述申请实施例的基础上，模式获取模块601具体被设置成：判断状态机已配置的运行模式是否与所述状态机运行模式相同，若不是，则将所述状态机的运行模式，若是，则不更改所述状态机的运行模式。
在一些示例中，在上述申请实施例的基础上，信息反馈模块602包括：
反馈单元，被设置成将所述配置完成信息通过通信报文反馈至所述主节点；其中，所述通信报文至少包括当前状态机运行模式字段、状态机运行模式参数字段。
在一些示例中，在上述申请实施例的基础上，密钥更新模块603具体被设置成：接收所述主节点的新密钥，并根据所述状态机运行模式处理本地的旧密钥。
图8是本申请实施例提供的一种电子设备的结构示意图，如图8所示，该设备包括处理器70、存储器71、输入装置72和输出装置73；设备中处理器70的数量可以是一个或多个，图8中以一个处理器70为例；设备处理器70、存储器71、输入装置72和输出装置73可以通过总线或其他方式连接，图8中以通过总线连接为例。
存储器71作为一种计算机可读存储介质，可用于存储软件程序、计算机可执行程序以及 模块，如本申请实施例中的密钥更新装置对应的模块(模式确定模块501、模式同步模块502和密钥更新模块503，或者，模式获取模块601、信息反馈模块602和密钥更新模块603)。处理器70通过运行存储在存储器71中的软件程序、指令以及模块，从而执行设备的各种功能应用以及数据处理，即实现上述的密钥更新方法。
存储器71可主要包括存储程序区和存储数据区，其中，存储程序区可存储操作***、至少一个功能所需的应用程序；存储数据区可存储根据终端的使用所创建的数据等。此外，存储器71可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他非易失性固态存储器件。在一些实例中，存储器71可进一步包括相对于处理器70远程设置的存储器，这些远程存储器可以通过网络连接至设备。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
输入装置72可用于接收输入的数字或字符信息，以及产生与设备的用户设置以及功能控制有关的键信号输入。输出装置73可包括显示屏等显示设备。
本申请实施例还提供了一种计算机可读存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现如本申请任意实施例提供的密钥更新方法，该方法包括：
根据预设规则选择状态机运行模式；将所述状态机运行模式通知给从节点以使所述从节点根据所述状态机运行模式配置状态机；根据所述状态机运行模式进行密钥更新。
或者，
获取主节点通知的状态机运行模式；根据所述状态机运行模式配置状态机，并向所述主节点反馈配置完成信息；根据所述状态机运行模式进行密钥更新。
当然,本申请实施例所提供的一种包含计算机可执行指令的存储介质,其计算机可执行指令不限于如上所述的方法操作，还可以执行本申请任意实施例所提供的密钥更新方法中的相关操作。
通过以上关于实施方式的描述，所属领域的技术人员可以清楚地了解到，本申请可借助软件及必需的通用硬件来实现，当然也可以通过硬件实现，但很多情况下前者是更佳的实施方式。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在计算机可读存储介质中，如计算机的软盘、只读存储器(Read-Only Memory,ROM)、随机存取存储器(Random Access Memory,RAM)、闪存(FLASH)、硬盘或光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述的方法。
值得注意的是，上述密钥更新装置的实施例中，所包括的各个单元和模块只是按照功能逻辑进行划分的，但并不局限于上述的划分，只要能够实现相应的功能即可；另外，各功能单元的具体名称也只是为了便于相互区分，并不用于限制本申请的保护范围。
本申请实施例，通过选择状态机运行模式并发送到从节点，使得从节点根据该状态机运行模式进行配置，根据选择的状态机运行模式密钥更新，实现主节点和从节点之间的加密通信，统一不同节点间的状态机运行模式，防止设备对接失败，提高了主从节点间通信的稳定性。
本领域普通技术人员可以理解，上文中所公开方法中的全部或某些步骤、***、设备中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。
在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组 件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器，如中央处理器、数字信号处理器或微处理器执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
以上参照附图说明了本申请的一些实施例，并非因此局限本申请的权利范围。本领域技术人员不脱离本申请的范围和实质内所作的任何修改、等同替换和改进，均应在本申请的权利范围之内。

Claims (14)

  1. 一种密钥更新方法，应用于主节点，该方法包括：
    根据预设规则选择状态机运行模式；
    将所述状态机运行模式通知给从节点以使所述从节点根据所述状态机运行模式配置状态机；
    根据所述状态机运行模式进行密钥更新。
  2. 根据权利要求1所述的方法，其中，所述根据预设规则选择状态机运行模式，包括：
    获取本地预先存储的状态机配置参数作为状态机运行模式参数。
  3. 根据权利要求1所述的方法，其中，所述将所述状态机运行模式通知给从节点，包括：
    将状态机运行模式按照预设格式封装为通信报文，其中，通信报文至少包括当前状态机运行模式字段、状态机运行模式字段；
    发送所述通信报文到从节点以使从节点根据所述通信报文内的状态机运行模式配置状态机。
  4. 根据权利要求3所述的方法，其中，所述状态机运行模式参数字段根据新增状态机运行模式拓展取值。
  5. 根据权利要求1所述的方法，还包括：
    不对预设时间内未反馈配置完成信息的从节点进行密钥更新。
  6. 根据权利要求1所述的方法，其中，所述根据所述状态机运行模式进行密钥更新，包括：
    在所述从节点反馈的通信报文中提取当前状态机运行模式；
    确定所述当前状态机运行模式与所述状态机运行模式相同，则按照所述状态机运行模式进行密钥更新。
  7. 一种密钥更新方法，应用于从节点，该方法包括：
    获取主节点通知的状态机运行模式；
    根据所述状态机运行模式配置状态机，并向所述主节点反馈配置完成信息；
    根据所述状态机运行模式进行密钥更新。
  8. 根据权利要求7所述的方法，其中，所述根据所述状态机运行模式配置状态机，包括：
    判断状态机已配置的运行模式是否与所述状态机运行模式相同，若不是，则将所述状态机的运行模式，若是，则不更改所述状态机的运行模式。
  9. 根据权利要求7所述的方法，其中，所述向所述主节点反馈配置完成信息，包括：
    将所述配置完成信息通过通信报文反馈至所述主节点；
    其中，所述通信报文至少包括当前状态机运行模式字段、状态机运行模式参数字段。
  10. 根据权利要求7所述的方法，其中，所述根据所述状态机运行模式进行密钥更新，包括：
    接收所述主节点的新密钥，并根据所述状态机运行模式处理本地的旧密钥。
  11. 一种密钥更新装置，应用于主节点，该装置包括：
    模式确定模块，被设置成根据预设规则选择状态机运行模式；
    模式同步模块，被设置成将所述状态机运行模式通知给从节点以使所述从节点根据所述 状态机运行模式配置状态机；
    密钥更新模块，被设置成根据所述状态机运行模式进行密钥更新。
  12. 一种密钥更新装置，应用于从节点，该装置包括：
    模式获取模块，被设置成获取主节点通知的状态机运行模式；
    信息反馈模块，被设置成根据所述状态机运行模式配置状态机，并向所述主节点反馈配置完成信息；
    密钥更新模块，被设置成根据所述状态机运行模式进行密钥更新。
  13. 一种电子设备，包括：
    一个或多个处理器；
    存储器，用于存储一个或多个程序，其中，
    当所述一个或多个程序被所述一个或多个处理器执行，使得所述一个或多个处理器实现如权利要求1-6或7-10中任一所述的密钥更新方法。
  14. 一种计算机可读存储介质，其上存储有计算机程序，其中，所述计算机程序被处理器执行时实现如权利要求1-6或者7-10中任一所述的密钥更新方法。
PCT/CN2021/131294 2020-11-19 2021-11-17 密钥更新方法、装置、电子设备和存储介质 WO2022105809A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011307313.3 2020-11-19
CN202011307313.3A CN114598453A (zh) 2020-11-19 2020-11-19 密钥更新方法、装置、电子设备和存储介质

Publications (1)

Publication Number Publication Date
WO2022105809A1 true WO2022105809A1 (zh) 2022-05-27

Family

ID=81708375

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/131294 WO2022105809A1 (zh) 2020-11-19 2021-11-17 密钥更新方法、装置、电子设备和存储介质

Country Status (2)

Country Link
CN (1) CN114598453A (zh)
WO (1) WO2022105809A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070217611A1 (en) * 2006-03-17 2007-09-20 Cisco Technology, Inc. Techniques for managing keys using a key server in a network segment
CN103209072A (zh) * 2013-04-27 2013-07-17 杭州华三通信技术有限公司 一种MACsec密钥更新方法及设备
CN107580768A (zh) * 2015-07-17 2018-01-12 华为技术有限公司 报文传输的方法、装置和***
US20200127987A1 (en) * 2018-10-22 2020-04-23 Cisco Technology, Inc. Upstream approach for secure cryptography key distribution and management for multi-site data centers

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070217611A1 (en) * 2006-03-17 2007-09-20 Cisco Technology, Inc. Techniques for managing keys using a key server in a network segment
CN103209072A (zh) * 2013-04-27 2013-07-17 杭州华三通信技术有限公司 一种MACsec密钥更新方法及设备
CN107580768A (zh) * 2015-07-17 2018-01-12 华为技术有限公司 报文传输的方法、装置和***
US20200127987A1 (en) * 2018-10-22 2020-04-23 Cisco Technology, Inc. Upstream approach for secure cryptography key distribution and management for multi-site data centers

Also Published As

Publication number Publication date
CN114598453A (zh) 2022-06-07

Similar Documents

Publication Publication Date Title
US10885198B2 (en) Bootstrapping without transferring private key
US8572700B2 (en) Method and system for exchanging setup configuration protocol information in beacon frames in a WLAN
US10880817B2 (en) Wi-fi configuration method, Wi-Fi mobile terminal, and Wi-Fi device
CN107580768B (zh) 报文传输的方法、装置和***
US20080123852A1 (en) Method and system for managing a wireless network
CN101288063B (zh) 无线设备发现和配置
US20160080340A1 (en) Communication control device
US20160066354A1 (en) Communication system
CN104022867A (zh) 一种issu软重启预处理方法及设备
WO2023005410A1 (zh) 信息同步方法及***、存储介质、电子装置
EP3932044B1 (en) Automatic distribution of dynamic host configuration protocol (dhcp) keys via link layer discovery protocol (lldp)
JP2017028457A (ja) 通信装置、通信方法及びプログラム
KR20100044199A (ko) 트러스트 센터 링크 키를 초기화하는 네트워크 및 방법
WO2022105809A1 (zh) 密钥更新方法、装置、电子设备和存储介质
CN111031012B (zh) 一种实现dds域参与者安全认证的方法
JP6537115B2 (ja) ネットワーク装置、コンフィグ交換方法、保守交換方法、コンフィグ交換プログラム、および保守交換プログラム
JP2018174550A (ja) 通信システム
CN113709069B (zh) 一种数据传输的无损切换方法及装置
CN112787803A (zh) 一种安全通信的方法和设备
US20220255911A1 (en) Method for Secure Communication and Device
CN114760093B (zh) 通信方法及装置
CN115037504A (zh) 通信方法及装置
WO2023152059A1 (en) Early indication for changing cryptographic strength during configuration
EP4144113A1 (en) Random mac configuring
KR20240000161A (ko) Dds 통신 방법, 장치 및 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21893956

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 27.09.2023)

122 Ep: pct application non-entry in european phase

Ref document number: 21893956

Country of ref document: EP

Kind code of ref document: A1