CN111600903A - A communication method, system, device and readable storage medium - Google Patents

Abstract

The application discloses a communication method, a system, a device and a readable storage medium. In the application, the first equipment and the second equipment in the data center are both authenticated by the equipment identity authentication center and issue a public key certificate and a corresponding identity key certificate for the equipment identity authentication center, so that the safety of the data center is improved. Before the first device and the second device communicate, the first device and the second device perform mutual identity authentication, so that the identity security of the devices of the two parties which are about to communicate can be ensured. After the first device and the second device mutually perform identity authentication, the first device and the second device exchange communication keys, so that the communication key of the other side can be used for encrypting transmission information to be sent, the data can be kept in an encrypted state in the transmission process, and the safety of the communication data is improved. Accordingly, the communication system, the device and the readable storage medium provided by the application also have the technical effects.

Description

A communication method, system, device and readable storage medium

technical field

The present application relates to the field of computer technology, and in particular, to a communication method, system, device, and readable storage medium.

Background technique

With the rise of cloud computing, core computing resources are developing from decentralized to centralized, that is, core computing tasks are completed in one or more data centers (such as public clouds), for example: tenants leasing computing resources and storage resources in public clouds and network resources to run business systems and store business data. Therefore, the security of the data center is very important.

Most of the resources in the data center are managed in a pooled manner, such as computing pools and storage pools. This means that the resources (such as virtual storage, virtual network card, virtual CPU, etc.) required for a virtual machine to run can run in different devices, so there is frequent data interaction between various devices in the data center.

In order to ensure the security of communication between various devices in the data center, the encryption of both communication channels can be implemented at the software level, for example, using the open source Openssl implementation. However, since the communication channel encryption at the software level has nothing to do with the device identity, the communication channel encryption mechanism at the software level cannot guarantee the identity security of each device in the data center, thus reducing the security of the data center and the security of communication data .

Therefore, how to improve the security of the data center and the security of the communication data is a problem to be solved by those skilled in the art.

SUMMARY OF THE INVENTION

In view of this, the purpose of the present application is to provide a communication method, system, device and readable storage medium, so as to improve the security of the data center and the security of the communication data. Its specific plan is as follows:

In a first aspect, the present application provides a communication method, including:

The first device in the data center sends an authentication request to the second device, so that the second device sends its own second identity key certificate to the first device; the second device is other devices in the data center except the first device;

After the first device uses the pre-stored public key certificate to verify that the second identity key certificate passes, it stores the second identity key certificate, and sends its own first identity key certificate to the second device, so that the second device can use the pre-stored public key certificate. After the stored public key certificate has passed the verification of the first identity key certificate, the first identity key certificate is stored;

The first device and the second device obtain each other's communication key;

The first device or the second device encrypts the target information with the communication key of the other party, obtains the information ciphertext, and sends the information ciphertext to the other party, so that the other party uses its own communication key to decrypt the information ciphertext and obtain the target information;

The public key certificate, the first identity key certificate and the second identity key certificate are issued to the first device and the second device by the device identity authentication center.

Preferably, the first device and the second device obtain each other's communication key, including:

The second device uses the root of trust in itself to create and store the second communication key, and sends the second ciphertext to the first device, where the second ciphertext is the ciphertext of the second public key in the second communication key;

The first device decrypts the second ciphertext, obtains and stores the second public key, uses the root of trust in itself to create and stores the first communication key, and sends the first ciphertext to the second device, so that the second device decrypts the first ciphertext. A ciphertext, the first public key is obtained and stored; the first ciphertext is the ciphertext of the first public key in the first communication key.

Preferably, the first device and the second device obtain each other's communication key, including:

The second device uses the root of trust in itself to create and store the second key parameter, and sends the second ciphertext of the second key parameter to the first device;

The first device decrypts the second ciphertext, obtains and stores the second key parameter, uses the root of trust in itself to create the first key parameter and stores it, and sends the first ciphertext of the first key parameter to the second device, so that the second device decrypts the first ciphertext, obtains the first key parameter and stores it;

The first device or the second device generates the second communication key and the first communication key according to the first key parameter and the second key parameter.

Preferably, it also includes:

The first device processes the target information, obtains the processing result, encrypts the processing result with the second communication key, obtains the resulting ciphertext, and sends the resulting ciphertext to the second device, so that the second device uses the second communication key to decrypt the result ciphertext. text, get the processing result;

or

The second device processes the target information, obtains the processing result, encrypts the processing result with the first communication key, obtains the resulting ciphertext, and sends the resulting ciphertext to the first device, so that the first device or the second device can use the first communication key to encrypt the processing result. Decrypt the resulting ciphertext with the key to obtain the processing result.

Preferably, the second device uses the root of trust in itself to create and store the second key parameter, and sends the second ciphertext of the second key parameter to the first device, including:

The second device uses the trusted root in itself to generate and store the second key parameter. The second key parameter includes: the second random number, the prime number, the original root of the prime number, and the second target parameter. Using the public key in the public key certificate encrypt the second key parameter with the key, obtain the second ciphertext, and send the second ciphertext to the first device;

Among them, the relationship between the second random number, the prime number, the original root and the second target parameter is: Y _a =g ^a modp, Y _a is the second target parameter, g is the original root, a is the second random number, p is a prime number.

Preferably, the first device uses the root of trust in itself to create and store the first key parameter, and sends the first ciphertext of the first key parameter to the second device, including:

The first device uses the trusted root in itself to create a first key parameter, the first key parameter includes: a first random number and a first target parameter, encrypts the first key parameter with the public key in the public key certificate, and obtains the first ciphertext, sending the first ciphertext to the second device;

Among them, the relationship between the first random number, the first target parameter, the prime number and the original root is: Y _b =g ^b modp, Y _b is the first target parameter, b is the first random number, g is the original root, p is a prime number.

Preferably, the first device or the second device generates the first communication key and the second communication key according to the target formula; the target formula is:

Wherein, K _b is the first communication key, Ka is the second communication key, Y _b is the first target parameter, Y _a is the second target parameter, _b is the first random number, a is the second random number, g is the primitive root and p is the prime number.

Preferably, it also includes:

If the communication between the first device and the second device ends, the first device and the second device delete each other's communication key and identity key certificate.

Preferably, the device identity authentication center issues all the devices in the data center with the public key certificate and the identity key certificate corresponding to the device identity key.

In a second aspect, the present application provides a communication system, including: a first device and a second device in a data center, where the second device is other devices in the data center except the first device, wherein:

the first device, configured to send an authentication request to the second device, so that the second device sends its own second identity key certificate to the first device;

The first device is configured to use the pre-stored public key certificate to verify that the second identity key certificate passes, store the second identity key certificate, and send its own first identity key certificate to the second device, so that the second identity key certificate is passed. After the device uses the pre-stored public key certificate to verify that the first identity key certificate is passed, the device stores the first identity key certificate;

The first device and the second device obtain each other's communication key;

The first device or the second device is used to encrypt the target information with the communication key of the other party, obtain the information ciphertext, and send the information ciphertext to the other party, so that the other party can use its own communication key to decrypt the information ciphertext and obtain the target information. information;

The public key certificate, the first identity key certificate and the second identity key certificate are issued to the first device and the second device by the device identity authentication center.

In a third aspect, the present application provides a communication device, comprising:

memory for storing computer programs;

A processor for executing a computer program to implement the communication method disclosed above.

In a fourth aspect, the present application provides a readable storage medium for storing a computer program, wherein the computer program implements the aforementioned communication method when executed by a processor.

As can be seen from the above solutions, the present application provides a communication method, including: a first device in a data center sends an authentication request to a second device, so that the second device sends its own second identity key certificate to the first device; The second device is other than the first device in the data center; after the first device uses the pre-stored public key certificate to verify that the second identity key certificate passes, it stores the second identity key certificate, and sends its own first The identity key certificate is sent to the second device, so that the second device uses the pre-stored public key certificate to verify that the first identity key certificate passes, and then stores the first identity key certificate; the first device and the second device mutually obtain each other's Communication key; the first device or the second device encrypts the target information with the communication key of the other party, obtains the information ciphertext, and sends the information ciphertext to the other party, so that the other party can use its own communication key to decrypt the information ciphertext, and obtain Target information; wherein the public key certificate, the first identity key certificate and the second identity key certificate are issued to the first device and the second device by the device identity authentication center.

It can be seen that in the communication method provided by this application, the identity authentication of the first device and the second device in the data center is performed by the device identity authentication center, and a public key certificate and a corresponding identity key certificate are issued for them. Therefore, The identity security of the first device and the second device is guaranteed, and the security of the data center is also improved. Before the first device and the second device communicate, they perform mutual identity authentication, that is, the first device uses the pre-stored public key certificate to verify the second identity key certificate, and the second device uses the pre-stored public key certificate to verify The first identity key certificate, so the identity security of the first device and the second device to be communicated can be ensured again. After the first device and the second device pass the mutual authentication, the two exchange communication keys, so the communication key of the other party can be used to encrypt the transmission information for transmission, so that the data is kept encrypted during the transmission process, and the communication is improved. Data security.

Correspondingly, a communication system, a device and a readable storage medium provided by the present application also have the above technical effects.

Description of drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only It is an embodiment of the present application. For those of ordinary skill in the art, other drawings can also be obtained according to the provided drawings without any creative effort.

1 is a flowchart of a first communication method disclosed in the application;

Fig. 2 is the flow chart of the second communication method disclosed by the application;

Fig. 3 is the flow chart of CA authentication equipment identity disclosed by the present application;

FIG. 4 is a structural diagram of the equipment disclosed in the application;

5 is a structural diagram of a CA authentication device disclosed in the present application;

FIG. 6 is a flowchart of mutual authentication of devices disclosed in the present application;

FIG. 7 is a structural diagram of mutual authentication of devices disclosed in the application;

FIG. 8 is a flow chart of exchanging communication keys disclosed in the present application;

FIG. 9 is a structural diagram of exchanging communication keys disclosed by the application;

FIG. 10 is a schematic diagram of a communication device disclosed in this application.

Detailed ways

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

At present, the communication channel encryption mechanism at the software level cannot guarantee the identity security of each device in the data center, thus reducing the security of the data center and the security of communication data. Therefore, the present application provides a communication solution, which can improve the security of the data center and the security of the communication data.

Referring to FIG. 1 , an embodiment of the present application discloses a first communication method, including:

S101. The first device in the data center sends an authentication request to the second device, so that the second device sends its own second identity key certificate to the first device; the second device is other than the first device in the data center equipment.

S102: After the first device verifies that the second identity key certificate passes the pre-stored public key certificate, it stores the second identity key certificate, and sends its own first identity key certificate to the second device, so that the second device After the first identity key certificate is verified by using the pre-stored public key certificate, the first identity key certificate is stored.

S103. The first device and the second device obtain each other's communication key.

After the first device and the second device complete the mutual authentication, an encrypted channel is established between the two. Among them, the key used in the encrypted channel can be in two forms, one is a key generated by a trusted root, and the other is a key generated by software (such as OpenSSL). The former has higher key security, because the key in the root of trust can only be used by the outside world, but the key information cannot be obtained. The latter key is more efficient for encryption and decryption, because using software algorithms, encryption and decryption operations are performed in memory. Therefore, the first device and the second device obtain each other's communication key from each other, including at least two specific implementations.

In a specific implementation manner, the first device and the second device use a key generated by the root of trust, so the first device and the second device obtain each other's communication key, including: the second device uses the The letter root creates and stores the second communication key, sends the second ciphertext to the first device, and the second ciphertext is the ciphertext of the second public key in the second communication key; the first device decrypts the second ciphertext, Obtain and store the second public key, use the root of trust in itself to create and store the first communication key, send the first ciphertext to the second device, so that the second device decrypts the first ciphertext and obtains the first public key and stored; the first ciphertext is the ciphertext of the first public key in the first communication key. That is, the first device and the second device exchange public keys in their respective communication keys with each other.

In another specific implementation manner, the first device and the second device use keys generated by software (such as Open SSL), so the first device and the second device obtain each other's communication keys from each other, including: the second device uses The trusted root in itself creates and stores the second key parameter, and sends the second ciphertext of the second key parameter to the first device; the first device decrypts the second ciphertext, obtains and stores the second key parameter, and uses The trusted root in itself creates and stores the first key parameter, sends the first ciphertext of the first key parameter to the second device, so that the second device decrypts the first ciphertext, obtains the first key parameter and stores it ; The first device or the second device generates the second communication key and the first communication key according to the first key parameter and the second key parameter. That is, the first device and the second device exchange key parameters with each other, and both can generate a communication key for both parties.

In a specific implementation manner, the second device uses the root of trust in itself to create and store the second key parameter, and sending the second ciphertext of the second key parameter to the first device includes: the second device uses its own The trusted root in the generated second key parameter and stored, the second key parameter includes: the second random number, the prime number, the original root of the prime number and the second target parameter, use the public key in the public key certificate to encrypt the second key parameter. key parameter, obtain the second ciphertext, and send the second ciphertext to the first device; wherein, the relationship between the second random number, the prime number, the original root and the second target parameter is: Y _a =g ^a modp, Y _a is the second target parameter, g is the original root, a is the second random number, and p is a prime number.

In a specific implementation manner, the first device uses the root of trust in itself to create and store the first key parameter, and sending the first ciphertext of the first key parameter to the second device includes: the first device uses its own The trusted root in the certificate creates a first key parameter, the first key parameter includes: a first random number and a first target parameter, and the first key parameter is encrypted with the public key in the public key certificate to obtain the first ciphertext, Send the first ciphertext to the second device; wherein, the relationship between the first random number, the first target parameter, the prime number and the original root is: Y _b =g ^b modp, Y _b is the first target parameter, and b is The first random number, g is the original root, p is the prime number.

In a specific embodiment, the first device or the second device generates the first communication key and the second communication key according to the target formula; the target formula is:

Wherein, K _b is the first communication key, Ka is the second communication key, Y _b is the first target parameter, Y _a is the second target parameter, _b is the first random number, a is the second random number, g is the primitive root and p is the prime number.

S104, the first device or the second device encrypts the target information by using the communication key of the other party, obtains the information ciphertext, and sends the information ciphertext to the other party, so that the other party uses its own communication key to decrypt the information ciphertext and obtain the target information .

The public key certificate, the first identity key certificate and the second identity key certificate are issued to the first device and the second device by the device identity authentication center. The device identity authentication center issues a public key certificate and an identity key certificate corresponding to the device identity key to all the devices in the data center.

In a specific embodiment, it also includes:

The first device processes the target information, obtains the processing result, encrypts the processing result with the second communication key, obtains the resulting ciphertext, and sends the resulting ciphertext to the second device, so that the second device uses the second communication key to decrypt the result ciphertext. text, get the processing result;

or

The second device processes the target information, obtains the processing result, encrypts the processing result with the first communication key, obtains the resulting ciphertext, and sends the resulting ciphertext to the first device, so that the first device or the second device can use the first communication key to encrypt the processing result. Decrypt the resulting ciphertext with the key to obtain the processing result.

In a specific implementation manner, if the communication between the first device and the second device ends, the first device and the second device delete each other's communication key and identity key certificate. In a trusted root, in addition to the identity key, the keys created each time are different, so the communication is created once and released when it is used up, which can improve security.

It can be seen that in the embodiment of the present application, the identity authentication of the first device and the second device in the data center is performed by the device identity authentication center, and a public key certificate and a corresponding identity key certificate are issued for them. The identity security of the device and the second device is guaranteed, and the security of the data center is also improved. Before the first device and the second device communicate, they perform mutual identity authentication, that is, the first device uses the pre-stored public key certificate to verify the second identity key certificate, and the second device uses the pre-stored public key certificate to verify The first identity key certificate, so the identity security of the first device and the second device to be communicated can be ensured again. After the first device and the second device pass the mutual authentication, they exchange the communication key, so the communication key of the other party can be used to encrypt the transmission information for transmission, so that the data is kept encrypted during the transmission process, and the communication data is improved. security.

Referring to FIG. 2 , an embodiment of the present application discloses a second communication method, including:

S201. The device identity authentication center authenticates the device identity.

Please refer to Figure 3, S201 specifically includes:

A. The device requests an identity key certificate from the device identity certification center: the device sends the public key of its own identity key to the device identity certification center (Certificate Authority, CA), and the device identity certification center issues an identity key certificate for it. , IDC) and public key certificate (Certificate Authority Certificate, CAC). The identity key certificate is generated by the CA's private key to sign the device's public key, so the IDC includes the device's public key. The public key certificate includes the public key of the CA, so the public key certificate can be used to verify the identity key certificate, that is, the public key in the public key certificate is used to verify the identity key certificate.

B. Verify the public key certificate requested by the device: The device stores the IDC and CAC issued by the CA for it in its own trusted root, and reads the CAC in the trusted root through the TPM2_NvRead command. If the corresponding CACs recorded are the same, the CAC verification is passed.

C. Verify the identity key certificate requested by the device: read the IDC and CAC in the trusted root through the TPM2_NvRead command, and use the CAC to verify the IDC. If the verification is passed, the IDC is correct.

Among them, the root of trust (such as TPM2.0) is a hardware chip in the device. When the initial state is set, there is no information in the root of trust. The device's own identity key, IDC and CAC are all stored in the non-volatile space of the root of trust. The trusted root storage CAC in the device can improve the efficiency of mutual authentication between subsequent devices. After the device has built-in CAC, you only need to read the CAC in the device for each authentication between devices, and there is no need to apply for a CAC to the CA.

The identity key (Identity Key, IDK) of the device itself includes a public key and a private key. The public key is used to request the IDC and CAC from the CA, and the private key is kept by itself.

It should be noted that the CACs stored in different devices whose identity has been verified by the same CA are the same. See Figure 4 for the structure diagram of each device whose identity has been verified by the CA. In FIG. 4 , OS (Operating System) is an operating system, HW (Hardware) is device hardware, and TPM (Trusted Platform Module, Trusted Platform Module) refers to a foreign trusted root specification.

Specifically, for the structure diagram of the CA authentication device, please refer to FIG. 5 , and the CA certificate in FIG. 5 refers to the CAC.

S202, the device is connected to the data center, and performs mutual authentication with any device in the data center that needs to communicate.

Please refer to FIG. 6 , assuming that the device A accessing the data center needs to communicate with the original device B in the data center, wherein the IDC of device B is abbreviated as IDC_B, and the IDC of device A is abbreviated as IDC_A, then S202 specifically includes:

A. Device A initiates an authentication request to device B, and device B sends its own IDC_B to device A after acquiring the request.

B. Device A reads the CAC in its own root of trust, and uses the public key in it to verify the signature of IDC_B. If the verification is passed, it means that device B is an authenticated device. Then, device A sends its own IDC_A to the device. B.

C. Device B reads the CAC in its own root of trust, and uses the public key in it to verify the signature of IDC_A. If the signature is passed, it means that device A is an authenticated device.

At this time, device B can directly initiate the communication key exchange process, or can return a notification message to device A that the identity authentication process has been completed, so that device A can initiate the communication key exchange process.

Specifically, for a structural diagram of mutual authentication between different devices, please refer to FIG. 7 .

S203 , the two devices that have completed mutual authentication exchange communication keys to perform data communication.

Please refer to Figure 8, the communication key exchange process is as follows:

A. Device A uses its own root of trust to create a communication key (including public key Key_A1 and private key Key_A2), uses the public key in IDC_B (that is, the public key of device B's identity key) to encrypt Key_A1, and transmits the ciphertext to device B. Communication keys can be created with the TPM2_Create command. The public key Key_A1 of the key can be obtained through TPM2_ReadPublic. TPM2_ReadPublic is the command for TPM2.0 to read the public key, which is defined by the TPM2.0 standard. TPM2_Create is a command for TPM2.0 to create a key, which is defined by the TPM2.0 standard.

B. Device B decrypts the received ciphertext with the private key of its own identity key, obtains Key_A1, and uses the trusted root to create a communication key (including public key Key_B1 and private key Key_B2), using the public key in IDC_A ( That is, the public key of the identity key of device A) encrypts Key_B1, and transmits the ciphertext to device A. Key_A1 can be loaded into the trusted root of device B (such as TPM2.0 chip) through PM2_LoadExternal.

C. The private key of device A's own identity key decrypts the received ciphertext to obtain Key_B1.

If device A sends information to device B, device A uses Key_B1 to encrypt the data, and after device B receives the ciphertext, it decrypts it using Key_B2. If device B sends information to device A, device B uses Key_A1 to encrypt the data, and after device A receives the ciphertext, it decrypts it using Key_A2. Among them, the sender uses the TPM2_RSAEncrypt command to send, and the receiver uses the TPM2_RSADecrypt command to receive.

Specifically, for a structural diagram of different devices exchanging communication keys, please refer to FIG. 9 .

It can be seen that in this embodiment, the devices firstly verify their identities before communicating to ensure that both parties in the communication are devices authenticated by the data center. After the authentication is passed, a communication session is created, and the communication data is encrypted based on the identity information of the two parties. Security of transmitted data.

A communication system provided by an embodiment of the present application is introduced below, and a communication system described below and a communication method described above may be referred to each other.

An embodiment of the present application discloses a communication system, including: a first device and a second device in a data center, where the second device is another device in the data center except the first device, wherein:

the first device, configured to send an authentication request to the second device, so that the second device sends its own second identity key certificate to the first device;

The first device is configured to use the pre-stored public key certificate to verify that the second identity key certificate passes, store the second identity key certificate, and send its own first identity key certificate to the second device, so that the second identity key certificate is passed. After the device uses the pre-stored public key certificate to verify that the first identity key certificate is passed, the device stores the first identity key certificate;

The first device and the second device obtain each other's communication key;

The first device or the second device is used to encrypt the target information with the communication key of the other party, obtain the information ciphertext, and send the information ciphertext to the other party, so that the other party can use its own communication key to decrypt the information ciphertext and obtain the target information. information;

The public key certificate, the first identity key certificate and the second identity key certificate are issued to the first device and the second device by the device identity authentication center.

In a specific embodiment, specifically:

The second device uses the root of trust in itself to create and store the second communication key, and sends the second ciphertext to the first device, where the second ciphertext is the ciphertext of the second public key in the second communication key;

The first device decrypts the second ciphertext, obtains and stores the second public key, uses the root of trust in itself to create and stores the first communication key, and sends the first ciphertext to the second device, so that the second device decrypts the first ciphertext. A ciphertext, the first public key is obtained and stored; the first ciphertext is the ciphertext of the first public key in the first communication key.

In a specific embodiment, specifically:

The second device uses the root of trust in itself to create and store the second key parameter, and sends the second ciphertext of the second key parameter to the first device;

The first device decrypts the second ciphertext, obtains and stores the second key parameter, uses the root of trust in itself to create the first key parameter and stores it, and sends the first ciphertext of the first key parameter to the second device, so that the second device decrypts the first ciphertext, obtains the first key parameter and stores it;

The first device or the second device generates the second communication key and the first communication key according to the first key parameter and the second key parameter.

In a specific embodiment, it also includes:

The first device processes the target information, obtains the processing result, encrypts the processing result with the second communication key, obtains the resulting ciphertext, and sends the resulting ciphertext to the second device, so that the second device uses the second communication key to decrypt the result ciphertext. text, get the processing result;

or

The second device processes the target information, obtains the processing result, encrypts the processing result with the first communication key, obtains the resulting ciphertext, and sends the resulting ciphertext to the first device, so that the first device or the second device can use the first communication key to encrypt the processing result. Decrypt the resulting ciphertext with the key to obtain the processing result.

In a specific embodiment, specifically:

The second device uses the trusted root in itself to generate and store the second key parameter. The second key parameter includes: the second random number, the prime number, the original root of the prime number, and the second target parameter. Using the public key in the public key certificate encrypt the second key parameter with the key, obtain the second ciphertext, and send the second ciphertext to the first device;

Among them, the relationship between the second random number, the prime number, the original root and the second target parameter is: Y _a =g ^a modp, Y _a is the second target parameter, g is the original root, a is the second random number, p is a prime number.

In a specific implementation manner, the first device uses the root of trust in itself to create and store the first key parameter, and sends the first ciphertext of the first key parameter to the second device, including:

The first device uses the trusted root in itself to create a first key parameter, the first key parameter includes: a first random number and a first target parameter, encrypts the first key parameter with the public key in the public key certificate, and obtains the first ciphertext, sending the first ciphertext to the second device;

Among them, the relationship between the first random number, the first target parameter, the prime number and the original root is: Y _b =g ^b modp, Y _b is the first target parameter, b is the first random number, g is the original root, p is a prime number.

In a specific embodiment, the first device or the second device generates the first communication key and the second communication key according to the target formula; the target formula is:

Wherein, K _b is the first communication key, Ka is the second communication key, Y _b is the first target parameter, Y _a is the second target parameter, _b is the first random number, a is the second random number, g is the primitive root and p is the prime number.

In a specific embodiment, it also includes:

If the communication between the first device and the second device ends, the first device and the second device delete each other's communication key and identity key certificate.

In a specific embodiment, the device identity authentication center issues all devices in the data center with a public key certificate and an identity key certificate corresponding to the device identity key.

For the more specific working process of each module and unit in this embodiment, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

It can be seen that before the two devices communicate with each other, the devices first verify their identities to ensure that both parties of the communication are devices authenticated by the data center. After the authentication is passed, a communication session is created, and the communication data is encrypted based on the identity information of the two parties. Security of transmitted data.

The following describes a communication device provided by an embodiment of the present application. A communication device described below and a communication method and system described above can be referred to each other.

Referring to FIG. 10 , an embodiment of the present application discloses a communication device, including:

a memory 1001 for storing computer programs;

The processor 1002 is configured to execute the computer program to implement the method disclosed in any of the foregoing embodiments.

A readable storage medium provided by an embodiment of the present application is introduced below. A readable storage medium described below and a communication method, system, and device described above can be referred to each other.

A readable storage medium for storing a computer program, wherein the computer program implements the communication methods disclosed in the foregoing embodiments when executed by a processor. For the specific steps of the method, reference may be made to the corresponding content disclosed in the foregoing embodiments, which will not be repeated here.

References in this application to "first", "second", "third", "fourth", etc. (if any) are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that data so used may be interchanged under appropriate circumstances so that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having", and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method or apparatus comprising a series of steps or elements is not necessarily limited to those steps or elements expressly listed , but may include other steps or elements not expressly listed or inherent to these processes, methods or apparatus.

It should be noted that the descriptions involving "first", "second", etc. in this application are only for the purpose of description, and should not be construed as indicating or implying their relative importance or implying the number of indicated technical features . Thus, a feature delimited with "first", "second" may expressly or implicitly include at least one of that feature. In addition, the technical solutions between the various embodiments can be combined with each other, but must be based on the realization by those of ordinary skill in the art. When the combination of technical solutions is contradictory or cannot be realized, it should be considered that the combination of such technical solutions does not exist. , is not within the scope of protection claimed in this application.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments may be referred to each other.

The steps of a method or algorithm described in conjunction with the embodiments disclosed herein may be directly implemented in hardware, a software module executed by a processor, or a combination of the two. A software module can be placed in random access memory (RAM), internal memory, read only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other in the technical field. in any other form of readable storage medium that is well known.

The principles and implementations of the present application are described herein by using specific examples. The descriptions of the above embodiments are only used to help understand the methods and core ideas of the present application. There will be changes in the specific implementation and application scope. To sum up, the content of this specification should not be construed as a limitation to the application.

Claims (10)

1. a communication method, is characterized in that, comprises: The first device in the data center sends an authentication request to the second device, so that the second device sends its own second identity key certificate to the first device; the second device is the device in the data center. other devices than the first device; After the first device uses the pre-stored public key certificate to verify that the second identity key certificate passes, stores the second identity key certificate, and sends its own first identity key certificate to the second device , so that the second device uses the pre-stored public key certificate to verify that the first identity key certificate passes, and then stores the first identity key certificate; The first device and the second device obtain each other's communication key; The first device or the second device encrypts the target information with the communication key of the counterparty, obtains the ciphertext of the information, and sends the ciphertext of the information to the counterparty, so that the counterparty decrypts the information with its own communication key cipher text to obtain the target information; Wherein, the public key certificate, the first identity key certificate and the second identity key certificate are issued to the first device and the second device by a device identity authentication center. 2. The communication method according to claim 1, wherein the first device and the second device obtain each other's communication key from each other, comprising: The second device uses the root of trust in itself to create and store a second communication key, and sends a second ciphertext to the first device, where the second ciphertext is the first key in the second communication key. The ciphertext of the second public key; The first device decrypts the second ciphertext, obtains the second public key and stores it, uses the root of trust in itself to create a first communication key and stores it, and sends the first ciphertext to the second device , so that the second device decrypts the first ciphertext, obtains and stores the first public key; the first ciphertext is the ciphertext of the first public key in the first communication key. 3. The communication method according to claim 1, wherein the first device and the second device obtain each other's communication key from each other, comprising: The second device uses the root of trust in itself to create and store a second key parameter, and sends the second ciphertext of the second key parameter to the first device; The first device decrypts the second ciphertext, obtains and stores the second key parameter, uses the root of trust in itself to create the first key parameter and stores it, and sends the first key parameter of the first key parameter. Send a ciphertext to the second device, so that the second device decrypts the first ciphertext, obtains the first key parameter and stores it; The first device or the second device generates the second communication key and the first communication key according to the first key parameter and the second key parameter. 4. The communication method according to claim 3, wherein the second device uses the root of trust in itself to create and store a second key parameter, and sends the second ciphertext of the second key parameter to the first device, including: The second device uses the trusted root in itself to generate and store the second key parameter, where the second key parameter includes: a second random number, a prime number, the original root of the prime number, and a second target parameter. The public key in the public key certificate encrypts the second key parameter, obtains the second ciphertext, and sends the second ciphertext to the first device; Wherein, the relationship between the second random number, the prime number, the original root and the second target parameter is: Y _a =g ^a modp, Y _a is the second target parameter, and g is the The primitive root, a is the second random number, and p is the prime number. 5 . The communication method according to claim 4 , wherein the first device uses the root of trust in itself to create and store a first key parameter, and sends the first ciphertext of the first key parameter. 6 . to the second device, comprising: The first device uses the trusted root in itself to create the first key parameter, the first key parameter includes: a first random number and a first target parameter, and uses the public key in the public key certificate encrypting the first key parameter, obtaining the first ciphertext, and sending the first ciphertext to the second device; The relationship among the first random number, the first target parameter, the prime number and the original root is: Y _b =g ^b modp, Y _b is the first target parameter, and b is the the first random number, g is the primitive root, and p is the prime number. 6. The communication method according to claim 5, wherein the first device or the second device generates the first communication key and the second communication key according to a target formula; the target The formula is:

Wherein, K _b is the first communication key, Ka is the second communication key, Y _b is the first target parameter, Y _a is the second target parameter, and _b is the first A random number, a is the second random number, g is the primitive root, and p is the prime number. 7. The communication method according to any one of claims 1-6, characterized in that, further comprising: If the communication between the first device and the second device ends, the first device and the second device delete each other's communication key and identity key certificate. 8. A communication system, comprising: a first device and a second device in the data center, the second device being another device in the data center except the first device, wherein : the first device, configured to send an authentication request to the second device, so that the second device sends its own second identity key certificate to the first device; The first device is configured to use a pre-stored public key certificate to verify that the second identity key certificate passes, store the second identity key certificate, and send its own first identity key certificate to the a second device, so that the second device uses the pre-stored public key certificate to verify that the first identity key certificate passes, and then stores the first identity key certificate; The first device and the second device obtain each other's communication key; The first device or the second device is used to encrypt the target information with the communication key of the other party, obtain the ciphertext of the information, and send the ciphertext of the information to the other party, so that the other party can decrypt it using its own communication key the information ciphertext to obtain the target information; Wherein, the public key certificate, the first identity key certificate and the second identity key certificate are issued to the first device and the second device by a device identity authentication center. 9. A communication device, comprising: memory for storing computer programs; A processor for executing the computer program to implement the communication method according to any one of claims 1 to 7. 10. A readable storage medium, characterized by being used for storing a computer program, wherein the computer program implements the communication method according to any one of claims 1 to 7 when the computer program is executed by a processor.

Images