Key sharing method and system

key sharing method and system

technical field

The invention relates to communication field, to a key sharing method and system of. Background communication process is a a communication field of two or more than two member participates, a field of without and two participate member is a exceptional box of communication. The communication field with multiple data recipients generally, one or more data senders. May use unicast technique in the interphone or playing technology to transmit the message, and playing technology of the unicast process is easier than diameter of the communication. Common communication field a remote multi-side conference, IP phone, IPTV and network online game and grid computing. The interphone is safely to the communication participant providing access control (authorization and authentication), a communication content voltage for encrypting, a protecting alarm, the replay protection, the source authentication group and authentication equal safety service, preventing non-group member and method for communication content, or normal corner of interference way of communication, and prevents from member the safety threat. The safe requirements of intercommunication mainly comprises: 1st, Authorization and authentication. Without and method permits, and a prove the shape of state of arm multi-side the signal section and receiving and transmitting data, so the broadcasting group is controllable. 2nd, Safe. Single wires with a key node to explain group communication message the content. 3rd, Group member authenticate. The non-group members are to generate the efficient authentication information, is to pretend is a group member to transmitting multicast message. 4th, Authentication source (anti-denying). Group member is to generate other group of members' authentication information, is to pretend is other group of member to transmitting multicast message. On the other side, group member is to deny wherein the transmission signal, a

5th, Anonymous. Providing anonymous used for group member mechanism, i.e., a receiving end is of for receiving broadcast to a message to the considering emitting end of the state. 6th, Integrity. A playing message wherein tampered and method for receiving data. 7th, Anti-replay. Providing program detection mechanism, realizing anti-replay attack. Usually and encryption transmission to a message interworking for security of ensuring consistency between datum communication. The system for sharing key according multi-side the encryption and decryption is installed while the group member know of the ensuring consistency between datum the encrypted message is a group member cover explain. Group member can authenticate is made of the key is realized, wherein the single wires with same group member capable of generating high-energy correctly encrypting multicast message. Solve the communication secret key problem of the sharing system key multi-side is a production and distribution of key. The device for generating and distribution of claim antiforeign, wherein the non-group members are to obtain the key of generating and distribution. The source, authentication integrity and anonymous service normally flowing is two sides or multi-side antiforeign sharing of information. The communication, how is realized antiforeign sharing of key is a research category group of managing key, a wire key is a key of each group of common member, is used to the broadcast message end of the encryption and decryption equal safe operation. How group managing key is studies for group member production, distribution and updating group key, and solve the extension toughness, and reliable problem that hence with. In turn to prevent leakage key, a group flowing a on the encryption transmission. At a data transmission method is as KEK (Key Encryption Keys, auxiliary key) and (TPK Service Protection Keys, encryption group key) in order group confidentiality same. KEK sharing between the key and servers group member, a different group member, the key server is different KEK, the front to realizing group key is updating,/backward encryption requirement. The Jan the Danzu the key management scheme, the key server and each group member common KEK; the initial distributing updating method of set key; and key group and an KEK the encryption of each current group member, then transmits to the opposite party. The solution for realizing simply; the key updating, wherein the encryption and transmission value of times and a group of medium the key server lower end is proportional, therefore the realizing extendibility is two leads, comprising at least for.

The, with connection advanced group key management scheme for tree structure to organize KEK generally, and an IP broadcasting to substrate-processing group key message, a encrypting and transmission value of times of the key server lower end on, wherein obtaining a better extendibility. LKH Logic (Hierarchy Key, a logic level tree) is a field is connected with mature and standard tree on the key group management scheme, the LKH group key management scheme the schematic positive and shown the digital 1. The LKH group key management scheme according to shown the digital 1, the root node (K1-8) is set key, the nodes (bough node and teeth node) are all key, a blade nodes and group member (u1 u9 to exist) is corresponding relationships. Each user with a blade node in the keys to the root node, a group key distribution of each group of member. And a digital 1, front group member u9 engages the key according with u1 is k1, k123 and k1-8, the key according with u4 is k4, k456 and k1-8. The LKH group key management scheme according to shown the digital 1, wherein a new group member is arm or a group of member of; the key server need to the upgrade key of each group of members are substrates to know or known. For example, wherein u9 power, the key server updating key k78 and k1-8, while the other group of member and u8 encryption transmission. The key for updating. The specific the process of: With k1-8 encryption k1-9, transmitted to a user u1), u8With k78 encryption k789, transmitted to a user and u7, u8A with k9 are k1-9 encryption and k789, transmitted to a user u9. The u9 with, a server updating k789 and k1-9; and group member u1-u8 encryption transmission updating key, a specific the process of: With k78 encryption k789, k7 encryption k78, transmitted to a user u7,With k123 encryption k1-8, a to u1-u3; With k456 encryption k1-8, a to u4 to u6. When the LKH group key management scheme, the key server updating group key encryption value of the secondary ((logN), WHEREIN a group of member. A message transmission, the LKH default for IP broadcasting to transmit the key is updating the short clamped, and suggested used to transmit the mode of group; soon the key information of the encrypting method based on a sealed in a message, with the manner of multi-broadcasting each group of members, wherein, the key updating the transmission device of times and maintain is a constant.

Is the LKH group key management scheme, wherein the tree on the key group management scheme - comprising a OFT and LKH ten interface. The LKH group key management scheme, the key server to the group member transmitting the key message, flowing ensuring consistency between datum of the key message the reliability conductor, a to the legitimate group member configured of the terminal group key message, which is of the upgrade group key and/or the auxiliary key, comprising of the casing end of the group of the ACK/NAK. Power of power key message reliably transmitting comprises: Voltage and a group of node fault and group member node short offline the network failure and network congestion for equal. With a mainly comprises the following method and is used for ensuring consistency between datum to the key message distribution the reliability. The existing technology the reliable method for ensuring consistency between datum first key message distribution of: Repeatedly transmit the key message method. The method, a server to the group member transmitting the key message, each key message a transmission of multiple. Group member is allocated the key message for processing first convex part, discards to the short repetition of the transmission line by. The method suitable for the key distributing method of unicast and multi-broadcasting, and simply, can enhance the reliability of the key message updating to a multiple has, and between the group member a to the probability of the key without synchronize, suitable for the group communication field of the partial range time. The existing technology first of ensuring consistency between datum key message distribution's the shortcoming reliability of realizing is: 1st, It fundamentally solve the reliable problem of the group key distribution. The network measurement the jam the condition; the ACK/NAK for very possibly with a texts of all a transmission is discarded, a group member - circuit for obtaining group key message via another method. 2nd, Then the bandwidth consumption. Repeatedly transmit the key message to the waste network bandwidth, an AC bandwidth limited field. The existing technology the reliable method for ensuring consistency between datum second key message distribution of: Based on reliable unicast/group key distributing method of multi-broadcasting. The method introduces the overtime retransmission and receiving data transmission mechanism is a key and servers group member, fundamentally realizing group reliable key message transmission. For IP broadcasting is filled with a message distribution of LKH the same the capacitor is connected to a reliably playing technology. The existing process and device for ensuring consistency between datum key message distribution's the shortcoming reliability of realizing is:

1st, The forward authentication mechanism and method for with the phenomenon for data message firing. A door (ACK acknowledge), which is not NAK (a) response authentication mechanism, a group member of each receiving group key message in transmitting the data message. Wherein the group member and a group key message the time is closed; each group member medium is big, a magnetism group of member almost relative to the unidirection transmitting data message, wherein the pulling network information of sudden bulge of the short - time, worsens the network the jam state, a server further possibly wherein the network processing burden is a overweight, which is of the complete receiving data message. 2nd, Then the burden key of server. Can make the key service processing burden is a data message quantity arc overweight, the key server need to maintain the overtime retransmission timer of each group member, a increasing the burden key of server, and a group member medium of each server that can serve to of the oversized. The existing technology the reliable method for ensuring consistency between datum third key message distribution of: The FEC (Forward Error Correction, forward investigates 4) 4 techniques group key distribution method. The method for increasing with a plurality ratio of the key message the de-repeated information, for example, duplicates increase the front message in the following message the information, causing the is originating no need to receiving the complete message, only need to receiving the multiple ratio is a message to a withdraw the alarm information message. The capacitor is in with good, relative universal device, and methods of scenes can also applied in streaming media. The existing technology third of ensuring consistency between datum key message distribution's the shortcoming reliability of realizing is: Then the transmission device of times, wherein then the transmission burden key of server. Cottons, then the de-repeated information in message, a message transmission burden key of server is correspondingly aggravates. The problem of the invention content in aggregate of the fact of the existing technology, comprising an objective of the present invention claims a key distribution method and system, wherein current charging-discharging performance reliability of the key distribution. An objective of the present invention approves the following technical solution is realized: The key sharing method, comprises steps:

A and group member transmitting the key information request to the adjacent group member; The B, wherein neighbour group member is received in the key information, request to the group member is used to the request the key information. A step is specifically comprising: Key information request comprises a request and a request message. A step is specifically comprising: When the group member discovered of the group of keys and/or all keys the other group of member connected with synchronize, with one or more and group member transmit the key message to request request of the adjacent assembly member end of the key message group of key and/or auxiliary key wherein the transmission. The B is specifically comprising: The B1); the adjacent group member is screwed to the key request message, a command to the group member of the key request message end of the identification authentication, and identification authentication failure; and fixing flexible to the key message, requestOtherwise, operating order B2,B2, a on the adjacent group member to exist to the request the key message, the group member is used for transmitting key message request to the request the key message; The key message of otherwise, informs to the transmitting key message to a request group member of wherein an request to exist. Front of B1) is further - comprising: The B10, wherein neighbour group member is screwed to the key request message, a command to the group member of the key request message to a defending attack inspection; and defending attack inspection failure; and fixing flexible to the key message, requestOtherwise, operating order B1. 6th, Claims A method for according to claim 2, characterised is composed, specifically comprising: When the group member discovered of the group of keys and/or all keys the other group of member connected with synchronize, with one or more and group member for transmitting the support group key and/or the auxiliary key information key request, wherein the key according request wherein an identification and with jurisdiction information. The B is specifically comprising:

B3, wherein neighbour group member to act according to the key request to the identification information of terminal, the transmitting group member of the key request end of the identification authentication; The identification authentication, and according to the key request to the button is disposed in the jurisdiction information, the transmitting group member of the key request to a a jurisdiction inspection, wherein the jurisdiction inspection are, operating order; B3B4, a on the adjacent group member to exist to the request group key and/or the auxiliary key, the transmitting group member is used for key request to the request group key and/or the auxiliary key; Group key and/or the auxiliary key according otherwise, informs to the transmitting key message to a request group member of wherein request without exist. Front - B3 is further - comprising: The B30, wherein neighbour group member is screwed to the key request, a command to the group member of the key request to a defending attack inspection; and defending attack inspection failure; and fixing flexible to the key; request Otherwise, operating order B3. The B - comprising comprises: When the adjacent group member to discover when the key message or the key according group member request is not the newest key message or a key, wherein the adjacent group member to the group member to the position corresponding, reportOr the group member to transmit the newest key message or the key by. The key sharing system, comprising: solicitant group member: To with with neighborship responder group member to transmit the key information, requestresponder group member: For receiving to the key information request of the solicitant group member, transmitted to the solicitant group member is used to the request the key information. The responder group member comprises: Key message buffer: moduleThe key message for transmitting key and server for sending end and buffer; Identification authentication: moduleIs a key message back receiving solicitant group member a request, disposed on the identification authentication to the solicitant group member; The identification authentication failure, stopping processing to the key message, requestKey message transmission module: A with a locating solicitant group member the identification authentication function, and key message buffer module for obtaining to the key message of the solicitant group member request, charges to the solicitant group member and. The responder group member - comprising: Defending attack inspection: moduleIs a key message back receiving solicitant group member a request, using defending attack according to the solicitant group member; For defending attack inspection, failure protection processing to the key request message. The responder group member comprises: Key buffer: moduleGroup key and/or the auxiliary key according information for transmitting key and server for sending and buffer; Identification authentication and jurisdiction inspection: moduleThe identity information of the key request for according to receiving end, and solicitant group member end of the identification authentication, the identification authentication failure fixing flexible to the key; requestThe key in the key request according to receive an with jurisdiction, information to the solicitant group member is a a jurisdiction inspection, wherein jurisdiction inspection failure fixing flexible to the key; requestkey transmission module: A with a locating solicitant group member the identification authentication and jurisdiction inspection are, which the key module buffer obtaining to the input key and/or the auxiliary key for solicitant group member request, charges to the solicitant group member and. The responder group member - comprising: Defending attack inspection Powder Kuai: A key request back receiving solicitant group member, a conducts defending attack according to the request group member; For defending attack inspection, failure protection processing to the key request. A see of the present invention provides's technical solution of the invention is connected with neighborship group member share group key message or the share group key and/or the auxiliary key, wherein current charging-discharging performance reliability and availability for implementing group key and/or the auxiliary key are, wherein a avoiding each group of member from the key server for acquiring key the server performance and network bandwidth of bottleneck with enhanced, a rectifying group system resource

(For example network bandwidth and processing capacity) use factor, enhanced the whole group communication system datum. The auxiliary digital instructional diagram 1) is set LKH key management scheme schematic drawing; Digital 2 is the invention the key message sharing-based key distribution method embodiment the specific action flow, imageDigital 3 is the invention the key sharing-based key distribution method embodiment the specific action flow, imageDigital 4 is the invention the key message sharing-based key distribution system embodiment the specific structure schematic drawing; Digital 5 is the invention the key sharing-based key distribution system embodiment the specific structure schematic drawing. The detailed description of illustrated embodiments the invention claims a key sharing method and system, and a core is: A a neighborship group member share group key message or the share group key and/or the auxiliary key, a component abnormal group member a normal group member is set acquiring key and/or the auxiliary key, avoiding without synchronize with the normal group members' group keys and/or the auxiliary keys. The invention the method comprises realizing - based on key message sharing and a sharing-based two. Based on key for realizing is - comprising: Group member for receiving the request confirm group member state of causing the support, and running group member key according causing the support with jurisdiction. , And group member for receiving the request fixedly connected to the support member set transmit group key and/or the auxiliary key for encrypting transmission method. Based on key message for realizing is - comprising: Group member for receiving the request it confirm group member state of causing the support, the group member for receiving the request and without to the request the group member retransmit densely from

The key message of key server. A method detailed description invention the light of the auxiliary shape, the invention the key message sharing-based key sharing method embodiment the specific action current and shown the digital 2. Comprising the following steps: The pedal 2-1), the neighborship between the group member. First lower is arranged on the neighborship between the group member, which is arranged between the neighborship group member corresponding to each. The invention the other group member does not installed on two neighborships, containing the neighborship without with part is set between the member to exist. Arranged between the group member the neighborship is connected with the key server are arranged, and provided with an method. The damage, group member transmitting the key message request to the adjacent group member. When the group member is arranged on the neighborship, wherein all group member, wherein network failure, thereof, short offline and other end is not received group key message of the key a server, and a discovered for group key and/or the auxiliary key the other group of member connected with synchronize, the adjacent group member transmitting key a dialling ratio of request, request of the adjacent assembly member transmitting to oneself in the key message of corresponding set key and/or auxiliary key. The group of member capable of transmitting the key message to request to the adjacent group member, may send a key message request to the adjacent group member in sequence. The invention claims 2-3, and adjacent group member of key request message to a defending attack and an identification authentication. The adjacent assembly member and key request message, for preventing malicious group member by request message to the group of member emitting the DOS attack, first thereof DOS preventing attack according to the group member for transmitting the key request message. The DOS preventing attack inspection failure; and fixing processing the key request message. The DOS preventing attack polling successfully, and identification authentication to the group member for transmitting the key message, requestThe identification authentication failure; and fixing formed on the key message, requestOtherwise, operating claims 2-4.

The invention 2~4, and adjacent group member of key message request to transmit the key message to a group member of the transmitting key request message. The DOS preventing attack polling successfully, and receiving and group member of the key request message searching the local buffer the key message wherein preserves with a transmitting key message to a request group member of request. The key message of each of the local buffer with transmitting key message to a request group member of request, transmitting the key message to a group member for transmitting the key request message. A command to the key message to request group member for receiving the key the Gen trigram invention, deciphers group key and/or the auxiliary key, disposed on corresponding processing and. The key message of each of the local buffer there is no transmitting key message to a request group member of request, the key message of the group member of a advising transmitting key request message wherein request which is exist. The invention claims a key sharing-based key sharing method embodiment the specific action current and shown the digital 3. Comprising the following steps: The pedal 3-1), the neighborship between the group member. First lower is arranged on the neighborship between the group member, which is arranged between the neighborship group member corresponding to each. The invention the other group member does not installed on two neighborships, containing the neighborship without with part is set between the member. Arranged between neighborship group member is connected with the key server are arranged, and provided with an method. The pedal 3-2, group member transmitting the key request to the adjacent group member. When the group member is arranged on the neighborship, wherein all group member, wherein network failure, thereof, short offline and other end is not received group key message of the key a server, and a discovered for group key and/or the auxiliary key the other group of member connected with synchronize, with a neighborship other group of member to transmit the key request to the request the other group of member themselves close to the sending set corresponding key and/or the auxiliary key. And the upper key request device for identifying and with jurisdiction information.

The group of member capable of neighborship with other group of member to transmit the key is request with multiple, and a neighborship other group of member to transmit the key request with multiple with a. The pedal 3-3, and adjacent group member of the key request of attacks ^r. The other group of member and key request, for preventing malicious group member by request message to the group of member emitting the DOS attack, first thereof DOS preventing attack inspection. A DOS preventing attack inspection failure; and fixing processing the key; requestOtherwise, operating order 3-4. The pedal 3-4, and adjacent group member of the key request end of the identification authentication and jurisdiction inspection. The DOS preventing attack polling successfully, the identification information of the adjacent assembly member according shaft is received the key request of, and identification authentication to the group member for transmitting the key request, and identification authentication failure; and fixing processing the key according request; aA identification authentication successfully, the key according and continuously to act according to the received key request device for with jurisdiction information, a group member of the inspection transmitting key request with a key upper-stage access. A key and access upper-stage inspection failure, the key according and receiving the key request to the adjacent assembly member baffle is formed of said request to informed according to transmit the group member of the key request to flow wherein jurisdiction is insufficient; And the key access upper-stage polling successfully, and execution claims 3-5. The invention claims 3-5, and adjacent group member of the key request to transmit the key a group member for transmitting the key request. And receiving and group member of the key request searching the local buffer the key and/or the auxiliary key for preserves with a transmitting key request to the group member of request. The key and/or the auxiliary key according and local buffer exists to transmitting key request to the group member of request, used for encrypting the via the transmitting key and/or the auxiliary key a group member for transmitting the key request. A command to the key request to the group member for receiving the key and/or the auxiliary key, a time corresponding processing. The key and/or the auxiliary key according and local buffer without exist to transmit the key request to the group member of request, the key and/or the auxiliary key for group member of a advising transmitting key request wherein request which is exist. The key sharing-based or a key message the sharing image processing of embodiment, to prevent between the group member with the phenomenon for implementing group key without synchronize, and safety consideration; the limiting the adjacent group member request to the associated key message of eliminated group key and/or the auxiliary key or communication. Therefore, the lower manager to the conducting corresponding policy; each group member discovered of the adjacent assembly member request associated eliminated group key and/or group key message of auxiliary key or communication, no matter and a sending a group key message of the group of key and/or the auxiliary key or corresponding to the opposite party, wherein inform group key message of group and a group of key and/or the auxiliary key or communication is eliminated, a inform the party opposite to the further request group key message of the newest group key and/or the auxiliary key or communication. In turn to assure the safety, the broadcast message and ensuring consistency between datum the safety of some of authentication mechanism. The invention claims a method is connected with reliable method for ensuring consistency between datum prior key message distribution and light of use, wherein the enhanced reliability of the key is distributed. The invention claims a key message sharing-based key distribution system embodiment the specific structure and shown the digital 4. Comprises the following modules: solicitant group member: A key request message transmission module; the solicitant group member discovered of the group of keys and/or the auxiliary keys the other group of member connected with synchronize, with one or more with with neighborship responder group member to transmit the key message to request request of the responder group member end of the key message group of key and/or auxiliary key wherein the transmission. responder group member: Is a key message back receiving solicitant group member a request, wherein the solicitant group member using defending attack and an identification authentication, to the solicitant group member for transferring message key according wherein request. Comprising: Key message buffer module and defending attack inspection module and identification authentication module and a message transmission module. , A message buffer: moduleThe key message for transmitting key and server for sending end and buffer. , Defending attack inspection: moduleIs a key message back receiving group member a request, for preventing malicious group member launched the DOS attack to by request message, using the DOS attack according to the group of member. The DOS preventing attack inspection failure; and fixing formed on the key request message.

, Identification authentication: moduleIs a key message back receiving solicitant group member a request, disposed on the identification authentication to the solicitant group member; The identification authentication failure, stopping processing to the key request message. , A message transmission module: A bearing is on each group member for transmitting the key request message of DOS attack and an identification authentication part, which the key message buffer module for obtaining to the key message of the solicitant group member request, is connected to the solicitant group member and. The invention claims a key sharing-based key distribution system embodiment the specific structure and shown the digital 5. Comprises the following modules: solicitant group member: A key request transmission module; the solicitant group member discovered of the group of keys and/or the auxiliary keys the other group of member connected with synchronize, with one or more with with neighborship responder group member substrate-processing of the identification and with jurisdiction information to a request request of the responder group member to the input key and/or the auxiliary key is wherein the station. responder group member: A key request back receiving solicitant group member, transmitting time of the solicitant group member defending attack inspection, the identification authentication and jurisdiction, inspect to the solicitant group member the transmitting key according wherein request. Comprising: Cache key module and defending attack inspection module, identification authentication and jurisdiction inspection module and a transmission module. , A buffer: moduleGroup key and/or the auxiliary key according information for transmitting key and server for sending and buffer. , Defending attack inspection: moduleA key request back receiving solicitant group member, for preventing malicious group member emitting the DOS attack to by request message thereof, DOS preventing attack according to the solicitant group member. The DOS preventing attack inspection failure; and fixing formed on the key request. , Identification authentication and jurisdiction inspection: moduleThe identity information of the key request for according to receiving end, and identification authentication to the solicitant group member, and identification authentication failure; and fixing processing the key according request; aA identification authentication successfully, the key according and continuously to act according to the received key request device for with jurisdiction information, the inspection solicitant group member whether a key upper-stage access. A jurisdiction inspection failure; and said processing the key according to a request according informs solicitant group member wherein jurisdiction is insufficient. , A transmission module: For bearing is arranged on the solicitant group member for transmitting the key request defending attack inspection, the identification authentication and jurisdiction inspection, through which the key module buffer obtaining to the input key and/or the auxiliary key for solicitant group member request, is connected to the solicitant group member and. The is of the only the invention good detailed description of illustrated embodiments, and has a protection of this invention are not to limit, a provide of any of familiar and technical field in a range of the invention exposition, the exchanger or the alternative capable of think easily, and covered on the has a protection of this invention. Therefore, has a protection of this invention the is a claim the has a protection and standard.