WO2021043095A1 - 密钥生成以及终端配网方法、装置、设备 - Google Patents

密钥生成以及终端配网方法、装置、设备 Download PDF

Info

Publication number
WO2021043095A1
WO2021043095A1 PCT/CN2020/112415 CN2020112415W WO2021043095A1 WO 2021043095 A1 WO2021043095 A1 WO 2021043095A1 CN 2020112415 W CN2020112415 W CN 2020112415W WO 2021043095 A1 WO2021043095 A1 WO 2021043095A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
network device
message
key
request message
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2020/112415
Other languages
English (en)
French (fr)
Inventor
于小博
肖月振
王昊
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Priority to JP2022508883A priority Critical patent/JP7572425B2/ja
Priority to EP20860248.2A priority patent/EP4027575A4/en
Priority to US17/637,692 priority patent/US12170727B2/en
Publication of WO2021043095A1 publication Critical patent/WO2021043095A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0889—Techniques to speed-up the configuration process
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0803—Configuration setting
    • H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/041—Key generation or derivation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/50—Secure pairing of devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W24/00—Supervisory, monitoring or testing arrangements
    • H04W24/02—Arrangements for optimising operational condition
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
    • H04W12/047—Key management, e.g. using generic bootstrapping architecture [GBA] without using a trusted network node as an anchor
    • H04W12/0471—Key exchange
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • This application relates to the field of communication technology, in particular to a method, device, and device for key generation and terminal network distribution.
  • WLAN Wireless Local Area Networks
  • smart terminal devices such as mobile phones and computers; some devices do not have screens, for example, IoT devices such as smart air conditioners and smart rice cookers.
  • the Device Provisioning Protocol is a protocol formulated by the Wi-Fi Alliance to solve the problem of terminal provisioning.
  • DPP is composed of three sub-protocols, namely DPP authentication protocol (DPP authentication protocol), DPP configuration protocol (DPP configuration protocol), and DPP introduction protocol (DPP introduction protocol).
  • DPP authentication protocol is mainly used to enable two-way authentication between the network distribution device (called the configurator) and the network device to be configured (called the enrollee) and generate the session key required by the subsequent DPP configuration protocol.
  • the DPP configuration protocol is mainly used to enable the enrollee to obtain the Service Set Identifier (SSID) and Access password.
  • the DPP introduction protocol is mainly used between enrollees to use their own public and private keys to generate the session keys needed for mutual communication.
  • the AP After the AP reconfigures the SSID or access password, it often restarts. Since the enrollee has not obtained the reconfiguration information, it needs to perform a second configuration with the configurator to reconfigure the network.
  • the reconfiguration can only start with the DPP authentication protocol, which increases the complexity and redundancy of the protocol.
  • the embodiments of the present application are proposed to provide a method, device, and equipment for key generation and terminal network distribution that overcome the above-mentioned problems or at least partially solve the above-mentioned problems.
  • an embodiment of the present application provides a key generation method, including:
  • the network device to be configured sends a first request message to the network device, where the first request message includes a first identifier, and the first identifier is used to instruct the network device to perform a network reconfiguration operation;
  • the network device to be configured sends a second message to the network distribution device, where the second message includes second key information, so that the network distribution device generates the session secret according to the second key information. key.
  • an embodiment of the present application provides a key generation device, which is located in a network device to be configured, and includes:
  • a sending module configured to send a first request message to a network distribution device, where the first request message includes a first identifier, and the first identifier is used to instruct the network distribution device to perform a network reconfiguration operation;
  • a receiving module configured to receive a first message sent by the network distribution device, where the first message includes first key information
  • a generating module configured to generate a session key according to the first key information
  • the sending module is further configured to send a second message to the network distribution device, where the second message includes second key information, so that the network distribution device generates the second key information according to the second key information. Session key.
  • an embodiment of the present application provides a network device to be configured, including a processor and a memory, where executable code is stored in the memory, and when the executable code is executed by the processor, the The processor executes the key generation method in the first aspect.
  • the embodiment of the present application provides a non-transitory machine-readable storage medium having executable code stored on the non-transitory machine-readable storage medium, and when the executable code is executed by the processor of the network device to be configured , Enabling the processor to execute the key generation method in the first aspect.
  • an embodiment of the present application provides a method for generating a key, including:
  • the network distribution device receives a first request message sent by the network device to be configured, where the first request message includes a first identifier, and the first identifier is used to instruct the network distribution device to perform a network reconfiguration operation;
  • the network distribution device sends a first message to the network device to be configured according to the first identifier, and the first message includes first key information, so that the network device to be configured according to the first secret Key information to generate a session key;
  • the network distribution device generates the session key according to the second key information.
  • an embodiment of the present application provides a key generation device, which is located in a network distribution device, and includes:
  • a receiving module configured to receive a first request message sent by a network device to be configured, where the first request message includes a first identifier, and the first identifier is used to instruct the network distribution device to perform a network reconfiguration operation;
  • the sending module is configured to send a first message to the network device to be configured according to the first identifier, and the first message includes first key information, so that the network device to be configured according to the first secret Key information to generate a session key;
  • the receiving module is further configured to receive a second message sent by the network device to be configured, where the second message includes second key information;
  • the generating module is configured to generate the session key according to the second key information.
  • an embodiment of the present application provides a network distribution device, including a processor and a memory, where executable code is stored in the memory, and when the executable code is executed by the processor, the The processor executes the key generation method in the fourth aspect.
  • the embodiment of the present application provides a non-transitory machine-readable storage medium having executable code stored on the non-transitory machine-readable storage medium, and when the executable code is executed by a processor of a network distribution device, The processor is caused to execute the key generation method in the fourth aspect.
  • an embodiment of the present application provides a terminal network configuration method, which includes:
  • the network device to be configured sends a first request message to the network device, where the first request message includes a first identifier, and the first identifier is used to instruct the network device to perform a network reconfiguration operation;
  • the network device to be configured sends a second message to the network distribution device, where the second message includes second key information, so that the network distribution device generates the session secret according to the second key information.
  • Key is used in the process of network reconfiguration for the network device to be configured.
  • an embodiment of the present application provides a terminal network distribution device, which is located in a network device to be distributed, and includes:
  • a sending module configured to send a first request message to a network distribution device, where the first request message includes a first identifier, and the first identifier is used to instruct the network distribution device to perform a network reconfiguration operation;
  • a receiving module configured to receive a first message sent by the network distribution device, where the first message includes first key information
  • a generating module configured to generate a session key according to the first key information
  • the sending module is further configured to send a second message to the network distribution device, where the second message includes second key information, so that the network distribution device generates the second key information according to the second key information.
  • Session key includes second key information, so that the network distribution device generates the second key information according to the second key information.
  • the session key is used in the process of network reconfiguration for the network device to be configured.
  • an embodiment of the present application provides a network device to be configured, including: a memory and a processor; wherein executable code is stored in the memory, and when the executable code is executed by the processor, the The processor executes the terminal network distribution method as described in the seventh aspect.
  • an embodiment of the present application provides a terminal network configuration method, which includes:
  • the network distribution device receives a first request message sent by the network device to be configured, where the first request message includes a first identifier, and the first identifier is used to instruct the network distribution device to perform a network reconfiguration operation;
  • the network distribution device sends a first message to the network device to be configured according to the first identifier, and the first message includes first key information, so that the network device to be configured according to the first secret Key information to generate a session key;
  • the network distribution device generates the session key according to the second key information, and the session key is used in the process of reconfiguring the network of the network device to be distributed.
  • an embodiment of the present application provides a terminal network distribution device, which is located in a network distribution device, and includes:
  • a receiving module configured to receive a first request message sent by a network device to be configured, where the first request message includes a first identifier, and the first identifier is used to instruct the network distribution device to perform a network reconfiguration operation;
  • the sending module is configured to send a first message to the network device to be configured according to the first identifier, and the first message includes first key information, so that the network device to be configured according to the first secret Key information to generate a session key;
  • the receiving module is further configured to receive a second message sent by the network device to be configured, where the second message includes second key information;
  • the generating module is configured to generate the session key according to the second key information; the session key is used in the process of network reconfiguration of the network device to be configured.
  • an embodiment of the present application provides a network distribution device, including: a memory and a processor; wherein executable code is stored in the memory, and when the executable code is executed by the processor, the The processor executes the terminal network distribution method according to the tenth aspect.
  • the network device to be configured is currently requesting the network configuration device to perform network configuration through interaction with the network device to configure the network.
  • the device sends the first key information generated by itself to the network device to be configured, and the network device to be configured sends the second key information generated by the device to the network distribution device, so that the network device and the network device to be configured are
  • the key information and another key information received from the other party generate a session key used for subsequent network reconfiguration of the network device to be distributed. Therefore, when it is necessary to perform network reconfiguration on the network device to be distributed, there is no need to perform the DPP authentication process, and only the DPP configuration process needs to be performed based on the newly generated session key, which improves the efficiency of network configuration.
  • an embodiment of the present application provides a method for generating a key, including:
  • the network device to be configured receives an authentication request message sent by the network device, where the authentication request message includes the first random number information and the second random number information;
  • the network device to be configured generates a first session key and a first session key according to the first random number information, the second random number information, and the third random number information and the fourth random number information corresponding to the network device to be configured.
  • the network device to be configured sends an authentication response message corresponding to the authentication request message to the network device, where the authentication response message includes the third random number information and the fourth random number information, so that The distribution network device generates the first session key and the second random number information according to the first random number information, the second random number information, the third random number information, and the fourth random number information. Session key.
  • an embodiment of the present application provides a key generation device, which is located in a network device to be configured, and includes:
  • a receiving module configured to receive an authentication request message sent by a network distribution device, where the authentication request message includes first random number information and second random number information;
  • a generating module configured to generate a first session key and a second random number according to the first random number information, the second random number information, and the third random number information and the fourth random number information corresponding to the network device to be allocated Session key
  • the sending module is configured to send an authentication response message corresponding to the authentication request message to the network distribution device, where the authentication response message includes the third random number information and the fourth random number information, so that all The distribution network device generates the first session key and the second session according to the first random number information, the second random number information, the third random number information, and the fourth random number information Key.
  • an embodiment of the present application provides a network device to be configured, including a processor and a memory, where executable code is stored in the memory, and when the executable code is executed by the processor, the The processor executes the key generation method in the thirteenth aspect.
  • an embodiment of the present application provides a method for generating a key, including:
  • the distribution network device sends an authentication request message to the network device to be distributed, and the authentication request message includes the first random number information and the second random number information, so that the network device to be distributed is based on the first random number information and the first random number information.
  • the network distribution device generates a first session key and a second session key according to the first random number information, the second random number information, the third random number information, and the fourth random number information.
  • an embodiment of the present application provides a key generation device, which is located in a network distribution device, and includes:
  • the sending module is configured to send an authentication request message to the network device to be allocated, the authentication request message including the first random number information and the second random number information, so that the network device to be allocated according to the first random number information , Generating a first session key and a second session key from the second random number information and the third random number information and the fourth random number information corresponding to the network device to be configured;
  • a receiving module configured to receive an authentication response message corresponding to the authentication request message sent by the network device to be configured, where the authentication response message includes the third random number information and the fourth random number information;
  • a generating module configured to generate a first session key and a second session key according to the first random number information, the second random number information, the third random number information, and the fourth random number information.
  • an embodiment of the present application provides a network distribution device, including a processor and a memory, where executable code is stored in the memory, and when the executable code is executed by the processor, the The processor executes the key generation method in the sixteenth aspect.
  • the key generation method provided in the above thirteen aspects can be applied to the DPP authentication process.
  • the network distribution device and the network device to be configured will each generate two random numbers for generating two random numbers.
  • the session key of the network configuration process Taking the authentication process triggered by the distribution network device as an example, the distribution network device sends two random numbers (supposedly expressed as I-nonce1, I-nonce2) generated by itself to the device to be configured. Similarly, the network to be configured The device also sends two random numbers (assumed as R-nonce1, R-nonce2) generated by itself to the network distribution device, so that the network distribution device and the network device to be configured each obtain four random numbers.
  • Both the distribution network device and the network device to be configured can generate the first session key (assumed to be expressed as ke1) according to I-nonce1 and R-nonce1, and generate the second session key according to I-nonce2 and R-nonce2 (assumed to be expressed as ke2).
  • the first session key and the second session key may be used in the subsequent two network configuration processes between the network device to be configured and the network device. Since two session keys are generated at a time, and different session keys are used in different network configuration processes, it is not necessary to go through the authentication protocol process again during the reconfiguration process, which improves the efficiency of network configuration.
  • FIG. 1 is a schematic diagram of the principle of a key generation method provided by an embodiment of this application.
  • FIG. 2 is a schematic flowchart of a key generation method provided by an embodiment of this application.
  • FIG. 3 is a schematic flowchart of a key generation method provided by another embodiment of this application.
  • FIG. 4 is a schematic flowchart of a terminal network distribution method provided by an embodiment of this application.
  • FIG. 5 is a schematic flowchart of a terminal network distribution method provided by another embodiment of this application.
  • FIG. 6 is a schematic flowchart of a terminal network distribution method provided by another embodiment of this application.
  • FIG. 7 is a schematic flowchart of a terminal network distribution method provided by another embodiment of this application.
  • FIG. 8 is a schematic flowchart of a key generation method provided by another embodiment of this application.
  • FIG. 9 is a schematic flowchart of a network configuration using ke1 and ke2 according to an embodiment of the application.
  • FIG. 10 is a schematic structural diagram of a key generation device provided by an embodiment of this application.
  • FIG. 11 is a schematic structural diagram of a network device to be configured corresponding to the key generation device provided in the embodiment shown in FIG. 10;
  • FIG. 12 is a schematic structural diagram of another key generation device provided by an embodiment of this application.
  • FIG. 13 is a schematic structural diagram of a network distribution device corresponding to the key generation device provided in the embodiment shown in FIG. 12;
  • FIG. 14 is a schematic structural diagram of a terminal network distribution device provided by an embodiment of this application.
  • FIG. 15 is a schematic structural diagram of a network device to be distributed corresponding to the terminal network distribution device provided in the embodiment shown in FIG. 14;
  • 16 is a schematic structural diagram of another terminal network distribution device provided by an embodiment of this application.
  • FIG. 17 is a schematic structural diagram of a network distribution device corresponding to the terminal network distribution device provided in the embodiment shown in FIG. 16;
  • FIG. 19 is a schematic structural diagram of a network device to be configured corresponding to the key generation device provided in the embodiment shown in FIG. 18;
  • 20 is a schematic structural diagram of another key generation device provided by an embodiment of this application.
  • FIG. 21 is a schematic structural diagram of a network distribution device corresponding to the key generation device provided in the embodiment shown in FIG. 20.
  • the words “if” and “if” as used herein can be interpreted as “when” or “when” or “in response to determination” or “in response to detection”.
  • the phrase “if determined” or “if detected (statement or event)” can be interpreted as “when determined” or “in response to determination” or “when detected (statement or event) )” or “in response to detection (statement or event)”.
  • the network devices to be distributed in this article can be IoT devices such as smart refrigerators, smart speakers, and robots.
  • the network device to be distributed may also be an IoT device with low power consumption requirements such as infrared sensors and smoke sensors.
  • the network device to be configured refers to a device that needs to be networked. Since it has not been connected to a certain wireless network that it wants to access, it is called a network device to be configured.
  • the network distribution device in this article can be a terminal device such as a mobile phone, a tablet computer, etc.
  • the network distribution device can have access to a certain wireless network through an AP and other network devices.
  • the user's mobile phone has been connected to the home Wi-Fi through a wireless router installed in the home. Fi network.
  • the network distribution device can also be a terminal device that does not have a human-computer interaction screen, such as a smart refrigerator or a smart speaker that has been connected to the AP.
  • the network distribution device can store the network of the AP that it accesses locally.
  • the network configuration information includes the AP's SSID and access password.
  • a network distribution application program may run in the network distribution equipment, and the network configuration of the network equipment to be distributed is realized through the network distribution application program.
  • the distribution network equipment and the distribution network application program can be equivalently replaced.
  • Fig. 1 is a schematic diagram of the principle of a key generation method provided by an embodiment of the application. As shown in Fig. 1, the key generation method may include the following steps:
  • the network device to be configured sends a first request message to the network device, where the first request message includes a first identifier, and the first identifier is used to instruct the network device to perform a network reconfiguration operation.
  • the key generation method of this embodiment can be executed during the DPP configuration process.
  • the above-mentioned first request message may be a request message for the network device to be configured to request the network device to perform network configuration for it (may be expressed as: DPP Configuration request). Moreover, the first request message may be sent to the network distribution device when the network device to be configured performs network configuration for the first time.
  • the first identifier included in the first request message is used to indicate that the network device to be configured has the capability of network reconfiguration.
  • the first identifier may also be used to instruct the network distribution device to carry the first key information in the DPP configuration response message sent next.
  • the DPP configuration response message may be the first message.
  • the first key information may be a public key included in a connector (connector) generated by the network distribution device.
  • the first identifier may be called a reconfiguration status identifier (ReconfigStatus) or a send connector status identifier (SendConnectorStatus).
  • the first identifier can also take other names, which are not specifically limited in the present invention.
  • the connector generated by the network distribution device contains the public key in the public-private key pair generated by the network distribution device.
  • the function of the connector is to provide a secure channel for the communication connection between two devices, such as the equipment to be distributed and the equipment to be distributed.
  • carrying the first identifier in the first request message can prompt the network distribution device to perform the network reconfiguration operation, that is, the execution of the following steps.
  • the network distribution device sends a first message to the network device to be configured according to the first identifier, where the first message includes the first key information.
  • the network distribution device When the network distribution device receives the first request message, and finds that the first request message contains the preset first identifier, it is determined that the network device to be distributed has the capability of network reconfiguration, thereby triggering the notification to the network device to be distributed Send the first message containing the first key information.
  • the first key information may be a public key in a public-private key pair generated when the network distribution device receives the first request message containing the first identifier.
  • the first identifier may not be included in the first request message.
  • the network distribution device may directly carry the first key information in the first message. After receiving the first message, the network device to be configured may ignore the first key information in the first message if it detects that it does not support the reconfiguration capability. Conversely, the network device to be configured may carry the second key information in the second message sent to the network device.
  • the first request message may also include information about the number of session keys to be generated.
  • the network device to be configured After receiving the information about the number of session keys generated, the network device to be configured will generate a corresponding number of connectors according to the information. For example, if the information about the number of generated session keys is 3, the first information sent by the network distribution device to the network device to be configured includes the public keys in the three connectors, namely Connector confC1, Connector confC2, and Connector confC3 .
  • the network device to be configured will sequentially generate Ks1, Ks2, and Ks3 according to the public keys in the three connectors received and the private keys in the public-private key pair generated by itself.
  • the network device to be configured will carry the public keys of three connectors in the second message sent to the network configuration device, namely Connector confE1, Connector confE2, and Connector confE3 .
  • the network distribution equipment will sequentially generate Ks1, Ks2, and Ks3 according to the public keys in the three connectors received and the private keys in the previously generated public-private key pair.
  • the three session keys are used in the second configuration process, the third configuration process, and the fourth configuration process in sequence. After the network configuration device and the network device to be configured receive and send the connection status query result message during the configuration process, the session key used in the current network configuration process will be deleted.
  • this article only takes the generation of the session key Ks required in the second configuration process as an example for description.
  • the network device to be configured generates a session key Ks according to the first key information.
  • the network device to be configured may generate a public-private key pair after sending the above-mentioned first request message, and use the public key as the second key information.
  • the network device to be configured After the network device to be configured obtains the first key information, it combines the second key information generated by itself (that is, the private key corresponding to the public key generated by itself) to generate it for subsequent network connection to the network device to be configured
  • the session key Ks required for reconfiguration After the network device to be configured obtains the first key information, it combines the second key information generated by itself (that is, the private key corresponding to the public key generated by itself) to generate it for subsequent network connection to the network device to be configured
  • the session key Ks required for reconfiguration.
  • the calculation method of the session key Ks is as follows:
  • N the first key information ⁇ the private key corresponding to the second key information
  • Session key Ks HKDF( ⁇ >, "DPP second config", N.x).
  • ⁇ means multiplication;
  • DPP second config means that there is a string of strings here, the value of which can be customized;
  • ⁇ > is passed to HKDF as a salt (salt), which means HKDF's salt-free call;
  • HKDF means one A specific key derivation function (HMAC-based Key Derivation Function).
  • each point on the elliptic curve has (x, y) coordinates.
  • N.x represents the scalar of the complex number N, and x can be the abscissa corresponding to the complex number N on the elliptic curve.
  • the first key information is the public key in the public-private key pair generated by the network device
  • the second key information is the public key in the public-private key pair generated by the network device to be configured.
  • the network device to be configured sends a second message to the network distribution device, where the second message includes the second key information.
  • the network distribution device generates the session key Ks according to the second key information.
  • the manner in which the network distribution device generates the session key Ks is the same as the manner in which the network device to be distributed generates the session key Ks. It is understandable that the network device to be configured and the network distribution device will eventually get the same session key, which is represented by Ks.
  • the session key Ks generated by the network distribution device and the network device to be configured may be used in the process of network reconfiguration of the network device to be distributed.
  • network reconfiguration means: assuming that the network device to be configured has already accessed the AP through the first network configuration process, after that, the AP's SSID or access password is updated, which will trigger the AP to restart. After the AP restarts, because the network device to be configured does not obtain the new network configuration information of the AP at this time, the network device to be configured is disconnected from the AP, and the network device to be configured needs to be reconfigured to make it again Access the AP. Based on this, the above-mentioned session key Ks can be used in the process of network reconfiguration for the network device to be configured.
  • the session key Ks when the aforementioned session key Ks is used in the process of network reconfiguration for the network device to be configured, if the network device to be configured reconnects to the AP, the session key Ks will become invalid, that is, After that, the data interaction between the network equipment to be configured and the network distribution equipment will no longer use the session key Ks for encryption.
  • the life cycle of the session key Ks can also be set. For example, after the network device to be configured reconnects to the AP, the data exchange between the network device to be configured and the network device can also use this The session key Ks is encrypted.
  • FIG. 1 only briefly introduces the principle of the key generation method, and some specific implementation processes of the key generation method are exemplified below in conjunction with the following embodiments.
  • FIG. 2 is a schematic flowchart of a key generation method provided by an embodiment of the application. As shown in FIG. 2, the key generation method may include the following steps:
  • the network device to be distributed and the network distribution device generate an initial session key Ke through the DPP authentication process.
  • the execution of the DPP authentication process can be triggered when the network configuration device performs network configuration on the network configuration device for the first time.
  • the DPP authentication process can be initiated by the network device to be configured, or by the network device.
  • the session key Ke can be generated (the generation of Ke belongs to the prior art and will not be repeated).
  • the session key Ke can be used to treat The interactive messages between the network distribution equipment and the network distribution equipment are encrypted and transmitted.
  • the network device to be configured sends a first request message to the network device.
  • the first request message is encrypted by Ke.
  • the first request message includes a first identifier.
  • the first identifier is used to instruct the network device to perform network reconfiguration operations.
  • the network distribution device sends a first response message corresponding to the first request message to the network device to be configured according to the first identifier, the first response message is encrypted by Ke, and the first response message includes the first key information.
  • the network device to be configured generates a session key Ks according to the first key information.
  • the network device to be configured sends a first confirmation message corresponding to the first response message to the network device, the first confirmation message is encrypted by Ke, and the first confirmation message includes the second key information.
  • the network distribution device generates the session key Ks according to the second key information.
  • the above steps 201 to 206 may be executed during the first network configuration of the network distribution device to be performed by the network distribution device.
  • the first request message may also be referred to as a DPP configuration request, which may be expressed as a DPP Configuration Request, which carries the first identifier described in the foregoing, and may be expressed as SecondConfigStatus.
  • the network distribution device sends a first response message to the network device to be configured, the first response message includes first key information, and the first key information may be a public key currently generated by the network device ,
  • the first key information can be expressed as: Connector confC .
  • Connector is the connector.
  • the first response message may be expressed as a DPP configuration Response, and thus, the first response message may also be referred to as a first DPP configuration confirmation message.
  • the network device to be configured may send a first confirmation message containing the second key information to the network device, and the first confirmation message may be expressed as DPP configuration confirm.
  • the second key information may be the public key in the public-private key pair currently generated by the network device to be configured.
  • the first key information can be expressed as: Connector confE .
  • the session key Ks required for the network reconfiguration of the network device to be distributed is generated.
  • the network device to be configured sends a second request message to the network distribution device, where the second request message is encrypted by the session key Ks.
  • the network distribution device sends a second response message corresponding to the second request message to the network device to be configured, and the second response message is encrypted by the session key Ks.
  • the network device to be configured sends a second confirmation message to the network distribution device, and the second confirmation message is encrypted by the session key Ks.
  • the second confirmation message may be expressed as DPP configuration confirm. Therefore, the second response message may also be referred to as a second DPP configuration confirmation message.
  • the above steps 207 to 208 may be executed during the process of network reconfiguration performed by the network distribution device on the network distribution device to be distributed.
  • Step 207 is executed to trigger the network device to be configured.
  • the network device to be configured can be provided with a button to start the network configuration, and the user presses this button to trigger the network device to be configured to perform step 207.
  • FIG. 3 is a schematic flowchart of a key generation method provided by another embodiment of the application. As shown in FIG. 3, the key generation method may include the following steps:
  • the network equipment to be distributed and the network distribution equipment generate an initial session key Ke through the DPP authentication process.
  • the network device to be configured sends a first request message to the network device.
  • the first request message is encrypted by Ke.
  • the first request message includes a first identifier.
  • the first identifier is used to instruct the network device to perform a network reconfiguration operation.
  • the network distribution device sends a first response message corresponding to the first request message to the network device to be configured according to the first identifier, and the first response message is encrypted by Ke.
  • the network device to be distributed sends a first confirmation message corresponding to the first response message to the network distribution device, the first confirmation message is encrypted by Ke, and the first confirmation message includes the second key information.
  • the network distribution device generates the session key Ks according to the second key information.
  • the first response message may include the current first network configuration information of the AP, so that the network device to be configured can access the AP according to the first network configuration information.
  • the network-to-be-distributed device may send a connection status query result message (which can be expressed as: Status Query Result) to the network-distribution device after a preset time interval to inform Whether the network device to be configured is in a connected state with the AP. Based on this, optionally, the network device to be configured may also carry the second key information in the connection status report information to send to the network distribution device.
  • a connection status query result message (which can be expressed as: Status Query Result) to the network-distribution device after a preset time interval to inform Whether the network device to be configured is in a connected state with the AP.
  • the network device to be configured may also carry the second key information in the connection status report information to send to the network distribution device.
  • the network distribution device sends a notification message to the network device to be configured.
  • the notification message is used to enable the network device to be configured to initiate a network reconfiguration process.
  • the notification message includes the first key information, and the notification message is encrypted by Ke.
  • step 306 when the network device to be configured cannot access the AP, the network device is triggered to send the notification message to the network device to be configured.
  • the network configuration information of the AP changes, the user can trigger the network configuration device to send the notification message to the network device to be configured by operating the network configuration device to scan the two-dimensional code set on the network device to be configured.
  • the network equipment to be configured is often a low-power device.
  • a preset second identifier may be carried in the notification message, and the second identifier is used to instruct the network device to be configured to start the network reconfiguration process. That is to say, when the network device to be configured receives the notification message containing the second identifier, it initiates the execution of the network reconfiguration process, that is, the execution of the following steps.
  • the network device to be configured generates a session key Ks according to the first key information.
  • the network device to be configured sends a second request message to the network distribution device, where the second request message is encrypted by the session key Ks.
  • the network distribution device sends a second response message corresponding to the second request message to the network device to be configured, and the second response message is encrypted by the session key Ks.
  • the network device to be configured sends a second confirmation message to the network distribution device, where the second confirmation message is encrypted by the session key Ks.
  • FIG. 4 is a schematic flowchart of a terminal network distribution method provided by an embodiment of the application. As shown in FIG. 4, the terminal network distribution method may include the following steps:
  • the network device to be distributed and the network distribution device generate an initial session key Ke through the DPP authentication process.
  • the network device to be configured sends a first request message to the network device.
  • the first request message is encrypted by Ke.
  • the first request message includes a first identifier.
  • the first identifier is used to instruct the network device to perform a network reconfiguration operation.
  • the distribution network device sends a first response message corresponding to the first request message to the network device to be configured according to the first identifier, the first response message is encrypted by Ke, and the first response message includes the first key information and the AP's first response message.
  • Network configuration information
  • the network device to be configured generates a session key Ks according to the first key information.
  • the network device to be configured sends a first confirmation message corresponding to the first response message to the network device, the first confirmation message is encrypted by Ke, and the first confirmation message includes the second key information.
  • the network device to be configured accesses the AP according to the first network configuration information.
  • the network configuration information of the current AP (referred to as the first network configuration information) may also be carried in the first response message by the network distribution equipment and transmitted to the network equipment to be distributed.
  • the network device to be configured uses Ke decryption to obtain the first network configuration information, and then access the AP.
  • the network distribution device generates the session key Ks according to the second key information.
  • the network device to be configured sends a second request message to the network distribution device, where the second request message is encrypted by the session key Ks.
  • the network distribution device sends a second response message corresponding to the second request message to the network device to be configured, the second response message is encrypted by the session key Ks, and the second response message includes the second network configuration information of the AP.
  • the network configuration information of the AP After the network configuration information of the AP is changed, the network configuration information of the AP at this time is referred to as the second network configuration information.
  • the network device to be configured sends a second confirmation message to the network distribution device, where the second confirmation message is encrypted by the session key Ks.
  • the network device to be configured decrypts the second network configuration information according to the session key Ks to access the AP.
  • FIG. 5 is a schematic flowchart of a terminal network distribution method provided by another embodiment of the application. As shown in FIG. 5, the terminal network distribution method may include the following steps:
  • the network equipment to be distributed and the network distribution equipment generate an initial session key Ke through the DPP authentication process.
  • the network device to be configured sends a first request message to the network device.
  • the first request message is encrypted by Ke.
  • the first request message includes a first identifier.
  • the first identifier is used to instruct the network device to perform a network reconfiguration operation.
  • the distribution network device sends a first response message corresponding to the first request message to the network device to be configured according to the first identifier, the first response message is encrypted by Ke, and the first response message includes the first key information and the AP's first response message.
  • Network configuration information
  • the network device to be configured generates a session key Ks according to the first key information.
  • the network device to be distributed sends a first confirmation message corresponding to the first response message to the network distribution device, where the first confirmation message is encrypted by Ke.
  • the network device to be configured accesses the AP according to the first network configuration information.
  • the network device to be configured sends a connection status query result message to the network distribution device, and the connection status query result message includes the second key information.
  • connection status query result message may also include a field indicating whether the network device to be configured and the AP are in a connected state.
  • the network distribution device generates the session key Ks according to the second key information.
  • the network distribution device sends a notification message to the network device to be configured.
  • the notification message includes a second identifier for enabling the network device to be configured to initiate a network reconfiguration process.
  • the notification message is encrypted by the session key Ks.
  • the network device to be configured sends a second request message to the network distribution device, where the second request message is encrypted by the session key Ks.
  • the network distribution device sends a second response message corresponding to the second request message to the network device to be configured, the second response message is encrypted by the session key Ks, and the second response message includes the second network configuration information of the AP.
  • the second network configuration information includes the SSID and the access password corresponding to the SSID.
  • the SSID and/or access password in the second network configuration information are different from the SSID and access password included in the first network configuration information.
  • the network device to be configured sends a second confirmation message to the network distribution device, where the second confirmation message is encrypted by the session key Ks.
  • the network device to be configured decrypts the second network configuration information according to the session key Ks to access the AP.
  • FIG. 6 is a schematic flowchart of a terminal network distribution method provided by another embodiment of the application. As shown in FIG. 6, the terminal network distribution method may include the following steps:
  • the network device to be distributed and the network distribution device generate an initial session key Ke through the DPP authentication process.
  • the network device to be configured sends a first request message to the network device.
  • the first request message is encrypted by Ke.
  • the first request message includes a first identifier.
  • the first identifier is used to instruct the network device to perform network reconfiguration operations.
  • the network distribution device sends a first response message corresponding to the first request message to the network device to be configured according to the first identifier, the first response message is encrypted by Ke, and the first response message includes the first network configuration information of the AP.
  • the network device to be distributed sends a first confirmation message corresponding to the first response message to the network distribution device, where the first confirmation message is encrypted by Ke.
  • the network device to be configured accesses the AP according to the first network configuration information.
  • the network device to be configured sends a connection state query result message to the network device.
  • the connection state query result message includes the second key information, and the connection state query result message is encrypted by Ke.
  • the network distribution device generates the session key Ks according to the second key information.
  • the network distribution device sends a notification message to the network device to be configured.
  • the notification message includes the second identifier and the first key information to enable the network device to be configured to start the network reconfiguration process.
  • the notification message is encrypted by Ke.
  • the network device to be configured generates a session key Ks according to the first key information.
  • the network device to be configured sends a second request message to the network distribution device, where the second request message is encrypted by the session key Ks.
  • the network distribution device sends a second response message corresponding to the second request message to the network device to be configured, the second response message is encrypted by the session key Ks, and the second response message includes the second network configuration information of the AP.
  • the network device to be configured sends a second confirmation message to the network distribution device, where the second confirmation message is encrypted by the session key Ks.
  • the network device to be configured decrypts the second network configuration information according to the session key Ks to access the AP.
  • FIG. 7 is a schematic flowchart of a terminal network distribution method according to another embodiment of the application. As shown in FIG. 7, the terminal network distribution method may include the following steps:
  • the network device to be distributed and the network distribution device generate an initial session key Ke through the DPP authentication process.
  • the network device to be configured sends a first request message to the network device.
  • the first request message is encrypted by Ke.
  • the first request message includes a first identifier.
  • the first identifier is used to instruct the network device to perform a network reconfiguration operation.
  • the network distribution device sends a first response message corresponding to the first request message to the network device to be configured according to the first identifier, the first response message is encrypted by Ke, and the first response message includes the first network configuration information of the AP.
  • the network device to be distributed sends a first confirmation message corresponding to the first response message to the network distribution device, where the first confirmation message is encrypted by Ke, and the first confirmation message includes the second key information.
  • the network device to be configured accesses the AP according to the first network configuration information.
  • the network distribution device generates a session key Ks according to the second key information.
  • the network device to be configured sends a connection status query result message to the network distribution device.
  • the network distribution device sends a notification message to the network device to be configured.
  • the notification message includes a second identifier and first key information.
  • the second identifier is used to enable the network device to be configured to initiate the network reconfiguration process, and the notification message is encrypted by Ke. .
  • the network device to be configured generates a session key Ks according to the first key information.
  • the network device to be configured sends a second request message to the network distribution device, where the second request message is encrypted by the session key Ks.
  • the network distribution device sends a second response message corresponding to the second request message to the network device to be configured, the second response message is encrypted by the session key Ks, and the second response message includes the second network configuration information of the AP.
  • the network device to be configured sends a second confirmation message to the network distribution device, where the second confirmation message is encrypted by the session key Ks.
  • the network device to be configured decrypts the second network configuration information according to the session key Ks to access the AP.
  • the above embodiments provide a new implementation scheme of the DPP configuration process.
  • the network device to be configured and the network device exchange during the first network configuration process the key information needed in the subsequent second network reconfiguration process: the above-mentioned first key information and second key information.
  • Key information so that both the network distribution device and the network device to be configured generate the session key Ks that will be used in the next network reconfiguration process.
  • the DPP configuration process is directly executed based on the session key Ks That is, there is no need to perform the DPP authentication process again, which improves the efficiency of the distribution network.
  • the solutions provided in the above embodiments mainly relate to the DPP configuration process.
  • the embodiment of the present application also provides a key generation method implemented in the DPP authentication process.
  • FIG. 8 is a schematic flowchart of a key generation method provided by another embodiment of the application. As shown in FIG. 8, the key generation method includes the following steps:
  • the network distribution device sends an authentication request message to the network device to be distributed, where the authentication request message includes the first random number information and the second random number information.
  • the network device to be allocated generates a first session key and a second session key according to the first random number information, the second random number information, and the third random number information and the fourth random number information corresponding to the network device to be allocated.
  • the network device to be distributed sends an authentication response message corresponding to the authentication request message to the network distribution device, where the authentication response message includes third random number information and fourth random number information.
  • the network distribution device generates a first session key and a second session key according to the first random number information, the second random number information, the third random number information, and the fourth random number information.
  • the first random number information and the second random number information are respectively expressed as: I-nonce1 and I-nonce2, and the third random number information and the fourth random number information are respectively expressed as: R-nonce1 and R -nonce2, denote the first session key and the second session key as: ke1 and ke2, respectively.
  • the key generation method provided in this embodiment can be applied to a scenario where the network distribution device performs network configuration on the network configuration device to be distributed.
  • a two-dimensional code can be set on the network device to be configured, and when network configuration of the network device to be configured is required, scanning the two-dimensional code can trigger the network device to send the authentication request message to the network device to be configured.
  • the DPP authentication process is actively triggered by the network distribution device as an example.
  • the DPP authentication process can also be triggered by the network device to be distributed.
  • the network device to be configured sends an authentication request message (which can be expressed as DPP authentication request) containing its third random number information and fourth random number information to the network device, and the network device sends to the network device to be configured an authentication request message including itself
  • the authentication response message of the first random number information and the second random number information can be expressed as DPP authentication response).
  • a button for triggering network configuration can be set on the network device to be configured, and when the user presses the button, the network device to be configured can be triggered to send an authentication request message to the network device.
  • a network distribution device for a network distribution device, it can generate ke1 based on I-nonce1 and R-nonce1, and generate ke2 based on I-nonce2 and R-nonce2.
  • ke1 can also be generated based on I-nonce1 and R-nonce1
  • ke2 can be generated based on I-nonce2 and R-nonce2.
  • the network device to be configured can be configured to: when receiving an authentication request message including two random numbers I-nonce1 and I-nonce2, it is known that two session keys need to be generated, one of which is It is used in the first network configuration process of the network equipment to be distributed, and the other is used in the network reconfiguration process of the network equipment to be distributed. Assume that ke1 is used in the first network configuration process of the network equipment to be distributed, and ke2 is used in the network reconfiguration process of the network equipment to be distributed.
  • the foregoing authentication request message may include a preset first identifier, and the first identifier instructs the network device to be configured to generate a session key for network reconfiguration. That is, the first identifier can be carried in the authentication request message, so that when the network device to be configured receives the authentication request message containing the first identifier, it directly knows that two session keys need to be generated: ke1 and ke2. In other words, the network device to be configured learns based on the first identifier that, in addition to the need to generate the session key ke1 used in the first network configuration process of the network device to be configured, it also needs to be generated. The network device is the session key ke2 in the network reconfiguration process of the network device to be distributed.
  • Ke1 HKDF(I-nonce1
  • Ke2 HKDF(I-nonce2
  • Mx represents the scalar of M
  • x can be the abscissa corresponding to the complex number M on the elliptic curve
  • M is the public key P l in the protocol key pair of the network distribution device and the network device to be configured
  • the private key b R in the bootstrapping key pair is generated, and the generating formula is:
  • M b R ⁇ P l .
  • Nx represents the scalar quantity of N
  • x can be the abscissa corresponding to the complex number N on the elliptic curve
  • N is the public key P l in the protocol key pair of the network equipment and the network equipment to be distributed
  • the private key p R in the protocol key pair is generated, and the generating formula is:
  • N p R ⁇ P l .
  • Lx represents the scalar of L
  • x can be the abscissa corresponding to the complex number of L on the elliptic curve
  • L is the private key b R in the pair of bootstrapping keys in the device to be configured and the network to be configured
  • the private key p R in the protocol key pair in the device and the public key B l in the bootstrapping key pair in the network distribution device are generated.
  • the generating formula is:
  • Ke1 HKDF(I-nonce1
  • Ke2 HKDF(I-nonce2
  • M is generated by the private key p l in the protocol key pair of the network distribution equipment and the public key B R in the bootstrapping key pair in the network equipment to be configured, and the generating formula is :
  • N is generated by the private key p l in the protocol key pair of the network distribution equipment and the public key P R in the protocol key pair of the network equipment to be distributed, and the generating formula is :
  • N p l ⁇ P R.
  • L is the private key b l in the bootstrapping key pair in the network device to be configured and the public key P R in the protocol key pair in the network device to be configured and the network device to be configured the guide key (bootstrapping key) of the public key B R generated, generates formula:
  • the DPP authentication request message may also include information on the number of generated session keys.
  • the reconfiguration network may need to be performed more than 2 times. Therefore, the network distribution device and the network device to be configured can generate more than two session keys during the DPP authentication process. For example, if the information about the number of generated session keys is 3, the DPP authentication request message sent by the network distribution device to the network device to be configured carries 3 random numbers, which are I-nonce1, I-nonce2, and I- nonce3.
  • the network device to be configured After the network device to be configured receives the DPP authentication request message sent by the network device, it will generate 3 random numbers R-nonce1, R-nonce2, and R-nonce3 according to the received 3 random numbers and the 3 random numbers R-nonce1, R-nonce2 and R-nonce3 generated by itself. Session keys Ke1, Ke2 and Ke3. After that, the network device to be configured sends a DPP authentication reply message to the network device.
  • the DPP authentication reply message includes R-nonce1, R-nonce2, and R-nonce3.
  • the distribution network device After the distribution network device receives the DPP authentication response message sent by the network device to be distributed, it will generate 3 in turn according to the received 3 random numbers and the previously generated 3 random numbers I-nonce1, I-nonce2 and I-nonce3 Session keys Ke1, Ke2 and Ke3.
  • the three session keys are used in the first configuration process, the second configuration process, and the third configuration process in sequence.
  • the session key used in the current network configuration process will be deleted.
  • the above-generated ke1 and ke2 can be used in the subsequent two DPP configuration processes.
  • the use of ke1 and ke2 will be described below in conjunction with the embodiment shown in FIG. 9.
  • FIG. 9 is a schematic diagram of a flow of network configuration using ke1 and ke2 according to an embodiment of the application. As shown in FIG. 9, it includes the following steps:
  • the network device to be configured and the network distribution device generate a first session key ke1 and a second session key ke2 during the DPP authentication process.
  • the network device to be configured sends a first request message to the network distribution device, where the first request message is encrypted by the first session key ke1.
  • the network distribution device sends a first response message corresponding to the first request message to the network device to be configured, the first response message is encrypted by the first session key ke1, and the first response message includes the first network configuration information of the AP.
  • the network device to be configured sends a first confirmation message to the network distribution device, where the first confirmation message is encrypted by the first session key ke1.
  • the network device to be configured uses the first session key ke1 to decrypt the first network configuration information to access the AP.
  • the network device to be configured sends a connection state query result message to the network distribution device, and the connection state query result message is encrypted by the first session key ke1.
  • the network-to-be-distributed device may send a connection status query result message (which can be expressed as: Status Query Result) to the network-distribution device after a preset time interval to inform the network-distribution device of this Whether the network device to be configured is connected to the AP.
  • a connection status query result message (which can be expressed as: Status Query Result)
  • the network distribution device sends a notification message to the network device to be configured, where the notification message is used to enable the network device to be configured to initiate a network reconfiguration process, and the notification message is encrypted by the second session key ke2.
  • the network configuration device can be triggered to send to the network device to be configured The notification message.
  • the user can operate the network distribution device to scan the QR code on the network device to be configured to trigger the network device to send the notification message to the network device to be configured.
  • the network equipment to be configured is often a low-power device.
  • the foregoing notification message may include a second identifier, and the second identifier is used to instruct the network device to be configured to start the network reconfiguration process.
  • the network device to be configured sends a second request message to the network distribution device, where the second request message is encrypted by the second session key ke2.
  • the network distribution device sends a second response message corresponding to the second request message to the network device to be configured, the second response message is encrypted by the second session key ke2, and the second response message includes the second network configuration information of the AP.
  • the network device to be configured sends a second confirmation message to the network distribution device, where the second confirmation message is encrypted by the second session key ke2.
  • the network device to be configured uses the second session key ke2 to decrypt the second network configuration information to access the AP.
  • the key generation device and terminal network distribution device of one or more embodiments of the present application will be described in detail below. Those skilled in the art can understand that these devices can all be configured by using commercially available hardware components through the steps taught in this solution.
  • FIG. 10 is a schematic structural diagram of a key generation device provided by an embodiment of the application. As shown in FIG. 10, the device includes: a sending module 11, a receiving module 12, and a generating module 13.
  • the sending module 11 is configured to send a first request message to a network distribution device, where the first request message includes a first identifier, and the first identifier is used to instruct the network distribution device to perform a network reconfiguration operation.
  • the receiving module 12 is configured to receive a first message sent by the network distribution device, where the first message includes first key information.
  • the generating module 13 is configured to generate a session key according to the first key information.
  • the sending module 11 is further configured to send a second message to the network distribution device, where the second message includes second key information, so that the network distribution device generates all the information according to the second key information.
  • the session key is further configured to send a second message to the network distribution device, where the second message includes second key information, so that the network distribution device generates all the information according to the second key information.
  • the session key is further configured to send a second message to the network distribution device, where the second message includes second key information, so that the network distribution device generates all the information according to the second key information.
  • the first message is a first response message corresponding to the first request message.
  • the second message is a first confirmation message corresponding to the first response message.
  • the first message is a notification message
  • the notification message is used to enable the network device to be configured to start a network reconfiguration process.
  • the notification message includes a second identifier, and the second identifier is used to instruct the network device to be configured to start a network reconfiguration process.
  • the sending module 11 is further configured to: send a second request message to the network distribution device, where the second request message is determined by the session key encryption.
  • the receiving module 12 is further configured to receive a second response message corresponding to the second request message sent by the network distribution device, where the second response message is encrypted by the session key.
  • the sending module 11 is further configured to: send a second confirmation message to the network distribution device,
  • the second confirmation message is encrypted by the session key.
  • the device shown in FIG. 10 can execute the steps performed by the network equipment to be distributed in the embodiments shown in FIGS. 1 to 3.
  • the parts that are not described in detail in this embodiment please refer to the relevant description of the foregoing embodiment, which will not be repeated here. Go into details.
  • the structure of the key generation device shown in FIG. 10 can be implemented as a network device to be distributed.
  • the network device to be configured may include: a first processor 21 and a first memory 22.
  • executable code is stored on the first memory 22, and when the executable code is executed by the first processor 21, at least the first processor 21 is enabled to implement the aforementioned FIGS. 1 to 3 The steps performed by the network device to be configured in the embodiment.
  • the structure of the network device to be configured may also include a first communication interface 23 for communicating with other devices or communication networks.
  • an embodiment of the present application provides a non-transitory machine-readable storage medium that stores executable code on the non-transitory machine-readable storage medium.
  • executable code When used by the processor of the network device to be configured, When executed, the processor is caused to execute the steps executed by the network device to be configured in the embodiments shown in FIG. 1 to FIG. 3.
  • FIG. 12 is a schematic structural diagram of another key generation device provided by an embodiment of the application. As shown in FIG. 12, the device includes: a receiving module 31, a sending module 32, and a generating module 33.
  • the receiving module 31 is configured to receive a first request message sent by a network device to be configured, where the first request message includes a first identifier, and the first identifier is used to instruct the network distribution device to perform a network reconfiguration operation.
  • the sending module 32 is configured to send a first message to the network device to be configured according to the first identifier, and the first message includes first key information, so that the network device to be configured according to the first The key information generates a session key.
  • the receiving module 31 is further configured to receive a second message sent by the network device to be configured, where the second message includes second key information.
  • the generating module 33 is configured to generate the session key according to the second key information.
  • the first message is a first response message corresponding to the first request message.
  • the second message is a first confirmation message corresponding to the first response message.
  • the first message is a notification message
  • the notification message is used to enable the network device to be configured to start a network reconfiguration process.
  • the notification message includes a second identifier, and the second identifier is used to instruct the network device to be configured to start a network reconfiguration process.
  • the receiving module 31 is further configured to: receive a second request message sent by the network device to be configured, the second request message being The session key is encrypted.
  • the sending module 32 is further configured to send a second response message corresponding to the second request message to the network device to be configured, where the second response message is encrypted by the session key.
  • the receiving module 31 is further configured to receive a second confirmation message sent by the network device to be configured, where the second confirmation message is encrypted by the session key.
  • the device shown in FIG. 12 can execute the steps performed by the network distribution equipment in the embodiments shown in FIG. 1 to FIG. 3.
  • the parts that are not described in detail in this embodiment please refer to the related description of the foregoing embodiment, which will not be repeated here.
  • the structure of the key generation device shown in FIG. 12 can be implemented as a network distribution device.
  • the network distribution device may include: a second processor 41 and a second memory 42.
  • executable code is stored on the second memory 42, and when the executable code is executed by the second processor 41, the second processor 41 is at least enabled to implement the aforementioned FIGS. 1 to 3 The steps performed by the network distribution equipment in the embodiment.
  • the structure of the network distribution device may further include a second communication interface 43 for communicating with other devices or communication networks.
  • the embodiments of the present application provide a non-transitory machine-readable storage medium, the non-transitory machine-readable storage medium stores executable code, when the executable code is executed by the processor of the network distribution device At this time, the processor is caused to execute the steps executed by the network distribution device in the embodiment shown in FIG. 1 to FIG. 3 above.
  • FIG. 14 is a schematic structural diagram of a terminal network distribution device provided by an embodiment of this application.
  • the terminal network distribution configuration device is located in a network device to be distributed. As shown in FIG. 14, the device includes: a sending module 51, a receiving module 52, and a generating module 53.
  • the sending module 51 is configured to send a first request message to a network distribution device, where the first request message includes a first identifier, and the first identifier is used to instruct the network distribution device to perform a network reconfiguration operation.
  • the receiving module 52 is configured to receive a first message sent by the network distribution device, where the first message includes first key information.
  • the generating module 53 is configured to generate a session key according to the first key information.
  • the sending module 51 is further configured to send a second message to the network distribution device, where the second message includes second key information, so that the network distribution device can generate all data based on the second key information.
  • the session key; the session key is used in the process of network reconfiguration for the network device to be configured.
  • the first message is a first response message corresponding to the first request message.
  • the second message is a first confirmation message corresponding to the first response message.
  • the receiving module 52 is further configured to: receive a first response message corresponding to the first request message sent by the network distribution device, and the first response message Includes the first network configuration information of the access point.
  • the sending module 51 is further configured to send a connection status query result message to the network distribution device, and the second message is the connection status query result message.
  • the receiving module 52 is further configured to: receive a notification message sent by the network distribution device, where the notification message is used to make the network to be configured The device starts a network reconfiguration process, and the first message is the notification message.
  • the sending module 51 is further configured to send a second request message to the network distribution device, where the second request message is encrypted by the session key.
  • the receiving module 52 is further configured to receive a second response message corresponding to the second request message sent by the network distribution device, and the second response message includes the second network configuration information of the access point, so The second response message is encrypted by the session key.
  • the sending module 51 is further configured to send a second confirmation message to the network distribution device, where the second confirmation message is encrypted by the session key.
  • the device shown in FIG. 14 can execute the steps performed by the network equipment to be configured in the embodiments shown in FIGS. 4 to 7.
  • the network equipment can execute the steps performed by the network equipment to be configured in the embodiments shown in FIGS. 4 to 7.
  • the parts that are not described in detail in this embodiment please refer to the relevant description of the foregoing embodiment, and will not be repeated here. .
  • the structure of the terminal network distribution device shown in FIG. 14 can be implemented as a network device to be distributed.
  • the network device to be configured may include: a third processor 61 and a third memory 62.
  • executable code is stored on the third memory 62, and when the executable code is executed by the third processor 61, at least the third processor 61 is enabled to implement the aforementioned FIGS. 4 to 7 The steps performed by the network device to be configured in the embodiment.
  • the structure of the network device to be configured may further include a third communication interface 63 for communicating with other devices or communication networks.
  • an embodiment of the present application provides a non-transitory machine-readable storage medium that stores executable code on the non-transitory machine-readable storage medium.
  • executable code When used by the processor of the network device to be configured, When executed, the processor is caused to execute the steps executed by the network device to be configured in the embodiments shown in FIG. 4 to FIG. 7.
  • FIG. 16 is a schematic structural diagram of another terminal network distribution device provided by an embodiment of the application, which is located in a device to be connected to the network. As shown in FIG. 16, the device includes: a receiving module 71, a sending module 72, and a generating module 73.
  • the receiving module 71 is configured to receive a first request message sent by a network device to be configured, where the first request message includes a first identifier, and the first identifier is used to instruct the network distribution device to perform a network reconfiguration operation.
  • the sending module 72 is configured to send a first message to the network device to be configured according to the first identifier, and the first message includes first key information, so that the network device to be configured according to the first The key information generates a session key.
  • the receiving module 71 is further configured to receive a second message sent by the network device to be configured, where the second message includes second key information.
  • the generating module 73 is configured to generate the session key according to the second key information; the session key is used in the process of network reconfiguration for the network device to be configured.
  • the first message is a first response message corresponding to the first request message.
  • the second message is a first confirmation message corresponding to the first response message.
  • the sending module 72 is further configured to send a first response message corresponding to the first request message to the network device to be configured, and the first response message includes the first network configuration information of the access point .
  • the receiving module 71 is further configured to: receive a connection status query result message sent by the network device to be configured , The second message is the connection status query result message.
  • the sending module 72 is further configured to send a notification message to the network device to be configured, where the notification message is used to enable the network device to be configured to initiate a network reconfiguration process, and the first message is the notification message .
  • the receiving module 71 is further configured to: receive a second request message sent by the network device to be configured, where the second request message is encrypted by the session key.
  • the sending module 72 is further configured to send a second response message corresponding to the second request message to the network device to be configured, the second response message being encrypted by the session key, and the second response
  • the message includes the second network configuration information of the access point.
  • the receiving module 71 is further configured to receive a second confirmation message sent by the network device to be configured, where the second confirmation message is encrypted by the session key.
  • the device shown in FIG. 16 can execute the steps performed by the network distribution equipment in the embodiments shown in FIG. 4 to FIG. 7.
  • the network distribution equipment in the embodiments shown in FIG. 4 to FIG. 7.
  • parts that are not described in detail in this embodiment please refer to the relevant description of the foregoing embodiment, which will not be repeated here.
  • the structure of the terminal network distribution device shown in FIG. 16 can be implemented as a network distribution device.
  • the network distribution device may include: a fourth processor 81 and a fourth memory 82.
  • executable code is stored on the fourth memory 82, and when the executable code is executed by the fourth processor 81, at least the fourth processor 81 is enabled to implement the aforementioned FIGS. 4 to 7 The steps performed by the network distribution equipment in the embodiment.
  • the structure of the network distribution device may further include a fourth communication interface 83 for communicating with other devices or communication networks.
  • the embodiments of the present application provide a non-transitory machine-readable storage medium, the non-transitory machine-readable storage medium stores executable code, when the executable code is executed by the processor of the network distribution device At this time, the processor is caused to execute the steps performed by the network distribution device in the embodiments shown in Figs. 4 to 7 above.
  • FIG. 18 is a schematic structural diagram of another key generation device provided by an embodiment of the application. As shown in FIG. 18, the device includes: a receiving module 91, a generating module 92, and a sending module 93.
  • the receiving module 91 is configured to receive an authentication request message sent by a network distribution device, where the authentication request message includes the first random number information and the second random number information.
  • the generating module 92 is configured to generate a first session key and a first session key according to the first random number information, the second random number information, and the third random number information and the fourth random number information corresponding to the network device to be configured. 2. Session key.
  • the sending module 93 is configured to send an authentication response message corresponding to the authentication request message to the network distribution device, where the authentication response message includes the third random number information and the fourth random number information, so that The distribution network device generates the first session key and the second random number information according to the first random number information, the second random number information, the third random number information, and the fourth random number information. Session key.
  • the authentication request message includes a first identifier, and the first identifier instructs the network device to be configured to generate a session key for performing network reconfiguration.
  • the sending module 93 is further configured to send a first request message to the network distribution device, where the first request message is encrypted by the first session key.
  • the receiving module 91 is further configured to: receive a first response message corresponding to the first request message sent by the network distribution device, the first response message being encrypted by the first session key, and the first A response message includes the first network configuration information of the access point.
  • the sending module 93 is further configured to send a first confirmation message to the network distribution device, where the first confirmation message is encrypted by the first session key.
  • the sending module 93 is further configured to send a connection state query result message to the network distribution device, where the connection state query result message is encrypted by the first session key.
  • the receiving module 91 is further configured to: receive a notification message sent by the network distribution device, where the notification message is used to enable the network device to be configured to start a network reconfiguration process, and the notification message is sent by the network device.
  • the second session key is encrypted.
  • the notification message includes a second identifier, and the second identifier is used to instruct the network device to be configured to start a network reconfiguration process.
  • the sending module 93 is further configured to: send a second request message to the network distribution device, and the second request message is encrypted by the second session. Key encryption.
  • the receiving module 91 is further configured to receive a second response message corresponding to the second request message sent by the network distribution device, the second response message being encrypted by the second session key, and the first The second response message includes the second network configuration information of the access point.
  • the sending module 93 is further configured to send a second confirmation message to the network distribution device, where the second confirmation message is encrypted by the second session key.
  • the device shown in FIG. 18 can execute the steps performed by the network equipment to be configured in the embodiments shown in FIGS. 8 to 9.
  • the parts that are not described in detail in this embodiment please refer to the relevant description of the foregoing embodiment, which will not be repeated here. Go into details.
  • the structure of the key generation device shown in FIG. 18 can be implemented as a network device to be distributed.
  • the network device to be configured may include: a fifth processor 191 and a fifth memory 192.
  • executable code is stored on the fifth memory 192, and when the executable code is executed by the fifth processor 191, at least the fifth processor 191 is enabled to implement the aforementioned FIGS. 8 to 9 The steps performed by the network device to be configured in the embodiment.
  • the structure of the network device to be configured may further include a fifth communication interface 193 for communicating with other devices or communication networks.
  • an embodiment of the present application provides a non-transitory machine-readable storage medium that stores executable code on the non-transitory machine-readable storage medium.
  • executable code When used by the processor of the network device to be configured, When executed, the processor is caused to execute the steps executed by the network device to be configured in the embodiments shown in FIG. 8 to FIG. 9.
  • FIG. 20 is a schematic structural diagram of another key generation device provided by an embodiment of the application. As shown in FIG. 20, the device includes: a sending module 2001, a receiving module 2002, and a generating module 2003.
  • the sending module 2001 is configured to send an authentication request message to the network device to be allocated, the authentication request message including the first random number information and the second random number information, so that the network device to be allocated according to the first random number Information, the second random number information, and the third random number information and the fourth random number information corresponding to the network device to be configured to generate a first session key and a second session key.
  • the receiving module 2002 is configured to receive an authentication response message corresponding to the authentication request message sent by the network device to be configured, where the authentication response message includes the third random number information and the fourth random number information.
  • a generating module 2003 configured to generate a first session key and a second session key according to the first random number information, the second random number information, the third random number information, and the fourth random number information .
  • the authentication request message includes a first identifier, and the first identifier instructs the network device to be configured to generate a session key for performing network reconfiguration.
  • the receiving module 2002 is further configured to: receive a first request message sent by the network device to be configured, where the first request message is encrypted by the first session key.
  • the sending module 2001 is further configured to send a first response message corresponding to the first request message to the network device to be configured, where the first response message is encrypted by the first session key, and the first response message is encrypted by the first session key.
  • a response message includes the first network configuration information of the access point.
  • the receiving module 2002 is further configured to receive a first confirmation message sent by the network device to be configured, where the first confirmation message is encrypted by the first session key.
  • the receiving module 2002 is further configured to: the network device to receive the network device to be configured A connection state query result message, where the connection state query result message is encrypted by the first session key.
  • the sending module 2001 is further configured to send a notification message to the network device to be configured, where the notification message is used to enable the network device to be configured to start a network reconfiguration process, and the notification message is sent by the network device to be configured.
  • the second session key is encrypted.
  • the notification message includes a second identifier, and the second identifier is used to instruct the network device to be configured to start a network reconfiguration process.
  • the receiving module 2002 is further configured to: the network distribution device receives a second request message sent by the network device to be configured, and the second request message is encrypted by the second session. Key encryption.
  • the sending module 2001 is further configured to send a second response message corresponding to the second request message to the network device to be configured, the second response message being encrypted by the second session key, and the first The second response message includes the second network configuration information of the access point.
  • the receiving module 2002 is further configured to receive a second confirmation message sent by the network device to be configured, where the second confirmation message is encrypted by the second session key.
  • the device shown in FIG. 20 can execute the steps performed by the network distribution equipment in the embodiments shown in FIG. 8 to FIG. 9.
  • the network distribution equipment in the embodiments shown in FIG. 8 to FIG. 9.
  • parts that are not described in detail in this embodiment please refer to the related description of the foregoing embodiment, which will not be repeated here.
  • the structure of the key generation device shown in FIG. 20 can be implemented as a network distribution device.
  • the network distribution device may include: a sixth processor 2101, a sixth memory 2102. Wherein, executable code is stored on the sixth memory 2102, and when the executable code is executed by the sixth processor 2101, at least the sixth processor 2101 is enabled to implement the aforementioned FIGS. 8 to 9 The steps performed by the network distribution equipment in the embodiment.
  • the structure of the network distribution device may further include a sixth communication interface 2103 for communicating with other devices or communication networks.
  • the embodiments of the present application provide a non-transitory machine-readable storage medium, the non-transitory machine-readable storage medium stores executable code, when the executable code is executed by the processor of the network distribution device At this time, the processor is caused to execute the steps executed by the network distribution equipment in the embodiments shown in FIG. 8 to FIG. 9.
  • each implementation manner can be implemented by adding a necessary general hardware platform, and of course, it can also be implemented by a combination of hardware and software.
  • the above technical solution essentially or the part that contributes to the prior art can be embodied in the form of a computer product.
  • This application can use one or more computer usable storage containing computer usable program codes.
  • the form of a computer program product implemented on a medium including but not limited to disk storage, CD-ROM, optical storage, etc.).
  • the network configuration method provided in the embodiments of this application can be executed by one or more programs/software, and the program/software can be provided by the network side.
  • the required corresponding program/software is downloaded to the local non-volatile storage medium, and when it needs to execute the aforementioned key generation method and terminal network distribution method, the program/software is read into the memory through the CPU, and then The program/software is executed by the CPU to implement the key generation method and the terminal network distribution method provided in the foregoing embodiments.
  • the execution process refer to the schematic diagrams in the foregoing FIG. 1 to FIG. 9.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请实施例提供一种密钥生成以及终端配网方法、装置、设备，该密钥生成方法包括：待配网设备向配网设备发送第一请求消息，第一请求消息中包括第一标识，第一标识用于指示配网设备进行网络的重配置操作；待配网设备接收配网设备发送的包括第一密钥信息的第一消息；待配网设备根据第一密钥信息生成会话密钥；待配网设备向配网设备发送第二消息，第二消息中包括第二密钥信息，以使配网设备根据第二密钥信息生成所述会话密钥。待配网设备与配网设备在进行第一次配网的过程中，交换彼此的密钥信息以生成用于后续对待配网设备进行网络重配置所需的会话密钥，使得对待配网设备进行网络重配置时，无需再次执行鉴权过程，提高了网络配置效率。

Description

密钥生成以及终端配网方法、装置、设备
本申请要求2019年09月06日递交的申请号为201910842413.7、发明名称为“密钥生成以及终端配网方法、装置、设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别是涉及一种密钥生成以及终端配网方法、装置、设备。
背景技术
随着通信技术的快速发展，遵循IEEE802.11协议标准的无线局域网(Wireless Local Area Networks，简称WLAN)技术被广泛应用于各种设备中，这些设备中有些设备是具有屏幕(显示屏)的，例如，手机、电脑等智能终端设备；有些设备是不具有屏幕的，例如，智能空调和智能电饭煲等物联网设备。
终端配网一直是Wi-Fi物联网的一个痛点问题。用户购买一个Wi-Fi物联网设备后，需要将此设备配置到家庭Wi-Fi网络中。终端配网协议(Device Provisioning Protocol,简称DPP)是Wi-Fi联盟制定的解决终端配网问题的协议。DPP由三个子协议组成，分别是DPP鉴权协议(DPP authentication protocol)，DPP配置协议(DPP configuration protocol)以及DPP介绍协议(DPP Introduction protocol)。DPP鉴权协议主要用于使配网设备(称为configurator)和待配网设备(称为enrollee)之间能够进行双向鉴权并且生成后续DPP配置协议所需要的会话密钥。DPP配置协议主要用于使待配网设备(enrollee)能够从配网设备(configurator)处获得连接接入点(Access Point，简称AP)所需要的服务集标识(Service Set Identifier，简称SSID)以及接入密码。DPP介绍协议主要用于enrollee之间利用各自的公私钥来生成相互通信所需要的会话密钥。
AP在重配SSID或者接入密码后，往往会重启。enrollee由于没有获得重配的这些信息，则需要与configurator进行二次配置即进行网络的重新配置，重配置只能从DPP鉴权协议开始，使协议复杂度和冗余度增加。
发明内容
鉴于上述问题，提出了本申请实施例以便提供一种克服上述问题或者至少部分地解 决上述问题的一种密钥生成以及终端配网方法、装置、设备。
第一方面，本申请实施例提供一种密钥生成方法，包括：
待配网设备向配网设备发送第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
所述待配网设备接收所述配网设备发送的第一消息，所述第一消息中包括第一密钥信息；
所述待配网设备根据所述第一密钥信息生成会话密钥；
所述待配网设备向所述配网设备发送第二消息，所述第二消息中包括第二密钥信息，以使所述配网设备根据所述第二密钥信息生成所述会话密钥。
第二方面，本申请实施例提供一种密钥生成装置，位于待配网设备中，包括：
发送模块，用于向配网设备发送第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
接收模块，用于接收所述配网设备发送的第一消息，所述第一消息中包括第一密钥信息；
生成模块，用于根据所述第一密钥信息生成会话密钥；
所述发送模块，还用于向所述配网设备发送第二消息，所述第二消息中包括第二密钥信息，以使所述配网设备根据所述第二密钥信息生成所述会话密钥。
第三方面，本申请实施例提供一种待配网设备，包括处理器和存储器，其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行第一方面中的密钥生成方法。
本申请实施例提供了一种非暂时性机器可读存储介质，所述非暂时性机器可读存储介质上存储有可执行代码，当所述可执行代码被待配网设备的处理器执行时，使所述处理器执行第一方面中的密钥生成方法。
第四方面，本申请实施例提供一种密钥生成方法，包括：
配网设备接收待配网设备发送的第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
所述配网设备根据所述第一标识向所述待配网设备发送第一消息，所述第一消息中包括第一密钥信息，以使所述待配网设备根据所述第一密钥信息生成会话密钥；
所述配网设备接收所述待配网设备发送的第二消息，所述第二消息中包括第二密钥信息；
所述配网设备根据所述第二密钥信息生成所述会话密钥。
第五方面，本申请实施例提供一种密钥生成装置，位于配网设备中，包括：
接收模块，用于接收待配网设备发送的第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
发送模块，用于根据所述第一标识向所述待配网设备发送第一消息，所述第一消息中包括第一密钥信息，以使所述待配网设备根据所述第一密钥信息生成会话密钥；
所述接收模块，还用于接收所述待配网设备发送的第二消息，所述第二消息中包括第二密钥信息；
生成模块，用于根据所述第二密钥信息生成所述会话密钥。
第六方面，本申请实施例提供一种配网设备，包括处理器和存储器，其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行第四方面中的密钥生成方法。
本申请实施例提供了一种非暂时性机器可读存储介质，所述非暂时性机器可读存储介质上存储有可执行代码，当所述可执行代码被配网设备的处理器执行时，使所述处理器执行第四方面中的密钥生成方法。
第七方面，本申请实施例提供一种终端配网方法，该方法包括：
待配网设备向配网设备发送第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
所述待配网设备接收所述配网设备发送的第一消息，所述第一消息中包括第一密钥信息；
所述待配网设备根据所述第一密钥信息生成会话密钥；
所述待配网设备向所述配网设备发送第二消息，所述第二消息中包括第二密钥信息，以使所述配网设备根据所述第二密钥信息生成所述会话密钥；所述会话密钥被用于对所述待配网设备进行网络的重配置的过程中。
第八方面，本申请实施例提供一种终端配网装置，位于待配网设备，包括：
发送模块，用于向配网设备发送第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
接收模块，用于接收所述配网设备发送的第一消息，所述第一消息中包括第一密钥信息；
生成模块，用于根据所述第一密钥信息生成会话密钥；
所述发送模块，还用于向所述配网设备发送第二消息，所述第二消息中包括第二密钥信息，以使所述配网设备根据所述第二密钥信息生成所述会话密钥；
所述会话密钥被用于对所述待配网设备进行网络的重配置的过程中。
第九方面，本申请实施例提供一种待配网设备，包括：存储器、处理器；其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行如第七方面所述的终端配网方法。
第十方面，本申请实施例提供一种终端配网方法，该方法包括：
配网设备接收待配网设备发送的第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
所述配网设备根据所述第一标识向所述待配网设备发送第一消息，所述第一消息中包括第一密钥信息，以使所述待配网设备根据所述第一密钥信息生成会话密钥；
所述配网设备接收所述待配网设备发送的第二消息，所述第二消息中包括第二密钥信息；
所述配网设备根据所述第二密钥信息生成所述会话密钥，所述会话密钥被用于对所述待配网设备进行网络的重配置的过程中。
第十一方面，本申请实施例提供一种终端配网装置，位于配网设备，包括：
接收模块，用于接收待配网设备发送的第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
发送模块，用于根据所述第一标识向所述待配网设备发送第一消息，所述第一消息中包括第一密钥信息，以使所述待配网设备根据所述第一密钥信息生成会话密钥；
所述接收模块，还用于接收所述待配网设备发送的第二消息，所述第二消息中包括第二密钥信息；
生成模块，用于根据所述第二密钥信息生成所述会话密钥；所述会话密钥被用于对所述待配网设备进行网络的重配置的过程中。
第十二方面，本申请实施例提供一种配网设备，包括：存储器、处理器；其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行如第十方面所述的终端配网方法。
在以上各个方面提供的密钥生成方法、终端配网方法中，以网络配置场景来说，待配网设备在当前请求配网设备进行网络配置的过程中，通过与配网设备交互，配网设备将自身产生的第一密钥信息发送给待配网设备，待配网设备将自身产生的第二密钥信息 发送至配网设备，使得配网设备和待配网设备根据自己产生的密钥信息以及从对方接收到的另一密钥信息生成用于后续对待配网设备进行网络重配置所需的会话密钥。从而，当需要对待配网设备进行网络重配置时，无需再执行DPP鉴权过程，仅需要基于新生成的会话密钥执行DPP配置过程即可，提高了网络配置效率。
第十三方面，本申请实施例提供一种密钥生成方法，包括：
待配网设备接收配网设备发送的认证请求消息，所述认证请求消息中包括第一随机数信息和第二随机数信息；
所述待配网设备根据所述第一随机数信息、所述第二随机数信息以及所述待配网设备对应的第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥；
所述待配网设备向所述配网设备发送与所述认证请求消息对应的认证应答消息，所述认证应答消息中包括所述第三随机数信息和所述第四随机数信息，以使所述配网设备根据所述第一随机数信息、所述第二随机数信息以及所述第三随机数信息和所述第四随机数信息生成所述第一会话密钥和所述第二会话密钥。
第十四方面，本申请实施例提供一种密钥生成装置，位于待配网设备中，包括：
接收模块，用于接收配网设备发送的认证请求消息，所述认证请求消息中包括第一随机数信息和第二随机数信息；
生成模块，用于根据所述第一随机数信息、所述第二随机数信息以及所述待配网设备对应的第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥；
发送模块，用于向所述配网设备发送与所述认证请求消息对应的认证应答消息，所述认证应答消息中包括所述第三随机数信息和所述第四随机数信息，以使所述配网设备根据所述第一随机数信息、所述第二随机数信息以及所述第三随机数信息和所述第四随机数信息生成所述第一会话密钥和所述第二会话密钥。
第十五方面，本申请实施例提供一种待配网设备，包括处理器和存储器，其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行第十三方面中的密钥生成方法。
第十六方面，本申请实施例提供一种密钥生成方法，包括：
配网设备向待配网设备发送认证请求消息，所述认证请求消息中包括第一随机数信息和第二随机数信息，以使所述待配网设备根据所述第一随机数信息、所述第二随机数信息以及所述待配网设备对应的第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥；
所述配网设备接收所述待配网设备发送的所述认证请求消息对应的认证应答消息，所述认证应答消息中包括所述第三随机数信息和所述第四随机数信息；
所述配网设备根据所述第一随机数信息、所述第二随机数信息以及所述第三随机数信息和所述第四随机数信息生成第一会话密钥和第二会话密钥。
第十七方面，本申请实施例提供一种密钥生成装置，位于配网设备中，包括：
发送模块，用于向待配网设备发送认证请求消息，所述认证请求消息中包括第一随机数信息和第二随机数信息，以使所述待配网设备根据所述第一随机数信息、所述第二随机数信息以及所述待配网设备对应的第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥；
接收模块，用于接收所述待配网设备发送的所述认证请求消息对应的认证应答消息，所述认证应答消息中包括所述第三随机数信息和所述第四随机数信息；
生成模块，用于根据所述第一随机数信息、所述第二随机数信息以及所述第三随机数信息和所述第四随机数信息生成第一会话密钥和第二会话密钥。
第十八方面，本申请实施例提供一种配网设备，包括处理器和存储器，其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行第十六方面中的密钥生成方法。
以上十三方面提供的密钥生成方法可以适用于DPP鉴权过程中，在该鉴权过程中，配网设备和待配网设备各自会生成两个随机数，以用于生成用于两次配网过程的会话密钥。以配网设备触发该鉴权过程为例来说，配网设备将自己产生的两个随机数(假设表示为I-nonce1,I-nonce2)发送至待配网设备，同样地，待配网设备也将自己产生的两个随机数(假设表示为R-nonce1,R-nonce2)发送至配网设备，由此，配网设备和待配网设备各自获得四个随机数。配网设备和待配网设备都可以根据I-nonce1和R-nonce1生成第一会话密钥(假设表示为ke1)，以及根据I-nonce2和R-nonce2生成第二会话密钥(假设表示为ke2)。第一会话密钥和第二会话密钥可以被用于后续待配网设备与配网设备之间的两次网络配置过程中。由于一次生成两个会话密钥，在不同的网络配置过程中使用不同的会话密钥，可以使得在重配置过程中不需要再经历一次鉴权协议流程，提高了网络配置效率。
附图说明
为了更清楚地说明本申请实施例中的技术方案，下面将对实施例描述中所需要使用 的附图作一简单地介绍，显而易见地，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本申请一实施例提供的密钥生成方法的原理示意图；
图2为本申请一实施例提供的密钥生成方法的流程示意图；
图3为本申请另一实施例提供的密钥生成方法的流程示意图；
图4为本申请一实施例提供的终端配网方法的流程示意图；
图5为本申请另一实施例提供的终端配网方法的流程示意图；
图6为本申请另一实施例提供的终端配网方法的流程示意图；
图7为本申请另一实施例提供的终端配网方法的流程示意图；
图8为本申请另一实施例提供的密钥生成方法的流程示意图；
图9为本申请一实施例提供的使用ke1和ke2进行网络配置的流程示意图；
图10为本申请实施例提供的一种密钥生成装置的结构示意图；
图11为与图10所示实施例提供的密钥生成装置对应的待配网设备的结构示意图；
图12为本申请实施例提供的另一种密钥生成装置的结构示意图；
图13为与图12所示实施例提供的密钥生成装置对应的配网设备的结构示意图；
图14为本申请实施例提供的一种终端配网装置的结构示意图；
图15为与图14所示实施例提供的终端配网装置对应的待配网设备的结构示意图；
图16为本申请实施例提供的另一种终端配网装置的结构示意图；
图17为与图16所示实施例提供的终端配网装置对应的配网设备的结构示意图；
图18为本申请实施例提供的另一种密钥生成装置的结构示意图；
图19为与图18所示实施例提供的密钥生成装置对应的待配网设备的结构示意图；
图20为本申请实施例提供的另一种密钥生成装置的结构示意图；
图21为与图20所示实施例提供的密钥生成装置对应的配网设备的结构示意图。
具体实施方式
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范 围。
在本申请实施例中使用的术语是仅仅出于描述特定实施例的目的，而非旨在限制本申请。在本申请实施例和所附权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其他含义，“多种”一般包含至少两种。
取决于语境，如在此所使用的词语“如果”、“若”可以被解释成为“在……时”或“当……时”或“响应于确定”或“响应于检测”。类似地，取决于语境，短语“如果确定”或“如果检测(陈述的条件或事件)”可以被解释成为“当确定时”或“响应于确定”或“当检测(陈述的条件或事件)时”或“响应于检测(陈述的条件或事件)”。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的商品或者系统不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种商品或者系统所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的商品或者系统中还存在另外的相同要素。
另外，下述各方法实施例中的步骤时序仅为一种举例，而非严格限定。
在具体介绍本申请实施例提供的方案前，先对本文中涉及到的几个概念进行说明。
本文中的待配网设备可以是诸如智能冰箱、智能音箱、机器人等物联网设备。特别地，待配网设备也可以是红外传感器，烟雾传感器等具有低功耗需求的物联网设备。该待配网设备是指需要被配网的设备，由于还没有被连接到希望其接入的某个无线网络中，因此称为待配网设备。
本文中的配网设备可以是手机、平板电脑等终端设备，该配网设备可以通过AP等网络设备已经接入某个无线网络，比如用户的手机通过家中安装的无线路由器已经接入家庭Wi-Fi网络。
值得说明的是，配网设备也可以是已经接入AP的智能冰箱、智能音箱等不具有人机交互屏幕的终端设备，此时，该配网设备本地可以存储有其接入的AP的网络配置信息，以便对未接入AP的待配网设备进行网络配置。其中，网络配置信息包括AP的SSID和接入密码。
另外，配网设备中可以运行有配网应用程序，通过该配网应用程序实现对待配网设备的网络配置。本文中，配网设备和配网应用程序可以做等同替换。
下面对本申请实施例提供的方案进行说明。
图1为本申请一实施例提供的密钥生成方法的原理示意图，如图1所示，该密钥生成方法可以包括如下步骤：
101、待配网设备向配网设备发送第一请求消息，第一请求消息中包括第一标识，第一标识用于指示配网设备进行网络的重配置操作。
在配网设备对待配网设备进行网络配置的场景中，本实施例的密钥生成方法可以在DPP配置过程中执行。
上述第一请求消息可以是待配网设备请求配网设备为其进行网络配置的请求消息(可以表示为：DPP Configuration request)。而且，该第一请求消息可以是待配网设备首次进行网络配置的时候向配网设备发送的。该第一请求消息中包含的第一标识，用以表明待配网设备具有网络重配置的能力。可选地，第一标识也可以用于指示配网设备在接下来发送的DPP配置应答消息中携带第一密钥信息。DPP配置应答消息可以是第一消息。第一密钥信息可以是配网设备生成的连接器(connector)中所包含的公钥。第一标识可以叫做重配置状态标识(ReconfigStatus)或者叫做发送连接器状态标识(SendConnectorStatus)。第一标识也可以取其他的名称，本发明对此不做具体限定。其中，配网设备生成的连接器中包含其生成的公私钥对中的公钥。连接器的作用概括来说就是为两个设备进行通信连接提供安全的通道，这两个设备比如为待配网设备和配网设备。
可以理解的是，在第一请求消息中携带该第一标识，可以促使配网设备执行网络的重配置操作，即下述步骤的执行。
102、配网设备根据第一标识向待配网设备发送第一消息，第一消息中包括第一密钥信息。
配网设备接收到第一请求消息时，解析发现该第一请求消息中包含预设的该第一标识，则确定待配网设备具有网络重配置的能力，从而，会触发向待配网设备发送包含第一密钥信息的第一消息。
其中，第一密钥信息可以是配网设备在接收到包含第一标识的第一请求消息时生成的公私钥对中的公钥。
可选地，第一请求消息中也可以不包含第一标识。配网设备可以直接在第一消息中携带第一密钥信息。待配网设备在接收到第一消息后，如果检测到不支持重配置能力，可以忽略第一消息中的第一密钥信息。反之，待配网设备可以在向配网设备发送的第二消息中携带第二密钥信息。
可选地，第一请求消息中还可以包括生成会话密钥数量的信息。待配网设备在收到生成会话密钥数量的信息后，会根据该信息生成相应数量的连接器(connector)。例如，如果生成会话密钥数量的信息为3，则配网设备在向待配网设备发送的第一信息中包括3个连接器中的公钥，分别是Connector confC1，Connector confC2以及Connector confC3。待配网设备会根据收到的三个连接器中的公钥以及自身生成的公私钥对里的私钥来依次生成Ks1，Ks2以及Ks3。同样的，待配网设备会在发送给配网设备的第二消息中携带3个连接器的公钥，分别为Connector confE1，Connector confE2以及Connector confE3。配网设备会根据收到的三个连接器中的公钥以及之前自身生成的公私钥对里的私钥来依次生成Ks1，Ks2以及Ks3。三个会话密钥依次用于第二次配置过程，第三次配置过程以及第四次配置过程。配网设备和待配网设备在接收以及发送配置过程中的连接状态查询结果消息后，会删除当下配网过程中所用到的会话密钥。
为方便描述，本文中仅以生成第二次配置过程中所需的会话密钥Ks为例进行说明。
103、待配网设备根据第一密钥信息生成会话密钥Ks。
待配网设备可以在发送上述第一请求消息后生成公私钥对，将该公钥作为第二密钥信息。
待配网设备在得到第一密钥信息后，结合自己生成的第二密钥信息(即结合自己所生成的公钥所对应的私钥)，生成用于后续对该待配网设备进行网络重配置所需用到的会话密钥Ks。
其中，会话密钥Ks的计算方式如下：
N＝第一密钥信息×第二密钥信息对应的私钥；
会话密钥Ks＝HKDF(<>，“DPP second config”，N.x)。
其中，×表示乘法；“DPP second config”表示此处有一串字符串，其取值可以自定义；<>作为盐(salt)传递给HKDF，表示HKDF的无盐(salt)调用；HKDF表示一种特定的密钥衍生函数(HMAC-based Key Derivation Function)。
其中，在使用HKDF的过程中，椭圆曲线上的每个点都有(x,y)坐标。可以通过采用其x坐标并忽略y坐标将复数元素转换为标量。例如：val＝Pub.x。
基于此，N.x表示复数N的标量，x可以是N这个复数在椭圆曲线上对应的横坐标。
如前文所述，第一密钥信息为配网设备生成的公私钥对中的公钥，第二密钥信息为待配网设备生成的公私钥对中的公钥。
104、待配网设备向配网设备发送第二消息，第二消息中包括第二密钥信息。
105、配网设备根据第二密钥信息生成会话密钥Ks。
配网设备生成会话密钥Ks的方式与待配网设备生成会话密钥Ks的方式相同。可以理解的是，待配网设备和配网设备最终都会得到相同的会话密钥，以Ks表示。
在一可选实施例中，配网设备和待配网设备所生成的会话密钥Ks可以被用于对待配网设备进行网络的重配置的过程中。
本文中，网络重配置的意思是指：假设待配网设备通过第一次网络配置过程已经接入AP，之后，由于AP的SSID或接入密码被更新，从而会触发AP重启。AP重启后，由于此时待配网设备并未获得AP的新的网络配置信息，使得待配网设备与AP断开了连接，从而需要对该待配网设备进行网络重配置，使其再次接入该AP。基于此，上述会话密钥Ks即可以被用于对该待配网设备进行网络重配置的过程中。
可以理解的是，当上述会话密钥Ks被用于对该待配网设备进行网络重配置的过程中时，若待配网设备重新接入AP，则该会话密钥Ks便会失效，即此后待配网设备与配网设备之间的数据交互将不再使用该会话密钥Ks进行加密。当然，可选地，该会话密钥Ks的生命周期也是可以被设定的，比如在待配网设备重新接入AP后，待配网设备与配网设备之间的数据交互也可以使用该会话密钥Ks进行加密。
图1所示实施例仅是对密钥生成方法的原理进行了简单介绍，下面结合以下实施例对该密钥生成方法的一些具体的实现过程进行示例性说明。
图2为本申请一实施例提供的密钥生成方法的流程示意图，如图2所示，该密钥生成方法可以包括如下步骤：
201、待配网设备与配网设备通过DPP鉴权过程生成初始的会话密钥Ke。
本实施例中，可选地，在配网设备首次对待配网设备进行网络配置时，可以触发该DPP鉴权过程的执行。该DPP鉴权过程可以由待配网设备发起，也可以由配网设备发起。
在DPP鉴权过程中可以生成会话密钥Ke(Ke的生成属于现有技术，不展开赘述)，在后续第一次对待配网设备进行网络配置的过程中，可以使用该会话密钥Ke对待配网设备与配网设备之间的交互消息进行加密传输。
202、待配网设备向配网设备发送第一请求消息，第一请求消息由Ke加密，第一请求消息中包括第一标识，第一标识用于指示配网设备进行网络的重配置操作。
203、配网设备根据第一标识向待配网设备发送与第一请求消息对应的第一应答消息，第一应答消息由Ke加密，第一应答消息中包括第一密钥信息。
204、待配网设备根据第一密钥信息生成会话密钥Ks。
205、待配网设备向配网设备发送与第一应答消息对应的第一确认消息，第一确认消息由Ke加密，第一确认消息中包括第二密钥信息。
206、配网设备根据第二密钥信息生成会话密钥Ks。
上述步骤201至步骤206可以是在配网设备在首次对待配网设备进行网络配置的过程中执行。
其中，第一请求消息也可以称为DPP配置请求，可以表示为DPP Configuration Request，其中携带有前文中所述的第一标识，可以表示为SecondConfigStatus。
响应于该第一请求消息，配网设备向待配网设备发送第一应答消息，第一应答消息中包括第一密钥信息，该第一密钥信息可以是配网设备当前生成的公钥，该第一密钥信息可以表示为：Connector confC。待配网设备根据Connector confC生成会话密钥Ks的过程可以参见前述实施例中的说明。Connector即为连接器。第一应答消息可以表示为DPP configuration Response，从而，第一应答消息也可以称为第一DPP配置确认消息。
待配网设备若成功接收到第一应答消息，则可以向配网设备发送包含第二密钥信息的第一确认消息，第一确认消息可以表示为DPP configuration confirm。其中，第二密钥信息可以是待配网设备当前生成的公私钥对中的公钥。该第一密钥信息可以表示为：Connector confE。配网设备根据Connector confE生成会话密钥Ks的过程可以参见前述实施例中的说明。
至此，在对待配网设备的第一次网络配置过程中，生成了用于对待配网设备进行网络重配置所需的会话密钥Ks。
207、待配网设备向配网设备发送第二请求消息，第二请求消息由会话密钥Ks加密。
208、配网设备向待配网设备发送与第二请求消息对应的第二应答消息，第二应答消息由会话密钥Ks加密。
209、待配网设备向配网设备发送第二确认消息，第二确认消息由会话密钥Ks加密。
其中，第二确认消息可以表示为DPP configuration confirm，从而，第二应答消息也可以称为第二DPP配置确认消息。
上述步骤207至步骤208可以是在配网设备对待配网设备进行网络重配置的过程中执行。
实际应用中，AP的SSID或接入密码往往是由于用户的手动更新而发生变化的，因此，用户在改变AP的SSID或接入密码后，可选地，可以对待配网设备施加触发操作，以触发待配网设备执行步骤207。比如，待配网设备上可以设置有启动配网的按键，用 户按下这个按键，触发待配网设备执行步骤207。
图3为本申请另一实施例提供的密钥生成方法的流程示意图，如图3所示，该密钥生成方法可以包括如下步骤：
301、待配网设备与配网设备通过DPP鉴权过程生成初始的会话密钥Ke。
302、待配网设备向配网设备发送第一请求消息，第一请求消息由Ke加密，第一请求消息中包括第一标识，第一标识用于指示配网设备进行网络的重配置操作。
303、配网设备根据第一标识向待配网设备发送与第一请求消息对应的第一应答消息，第一应答消息由Ke加密。
304、待配网设备向配网设备发送与第一应答消息对应的第一确认消息，第一确认消息由Ke加密，第一确认消息中包括第二密钥信息。
305、配网设备根据第二密钥信息生成会话密钥Ks。
可选地，第一应答消息中可以包括AP当前的第一网络配置信息，以使得待配网设备可以根据该第一网络配置信息接入AP。
在一可选实施例中，待配网设备在接收到第一确认消息后，可以在预设时间间隔后向配网设备发送连接状态查询结果消息(可以表示为：Status Query Result)，以告知配网设备该待配网设备与AP是否处于连接状态。基于此，可选地，待配网设备也可以将第二密钥信息携带在该连接状态报告信息中以发送至配网设备。
306、配网设备向待配网设备发送通知消息，通知消息用于使得待配网设备启动网络的重配置过程，通知消息中包括第一密钥信息，通知消息由Ke加密。
在步骤306中，当待配网设备不能接入AP时，会触发配网设备向该待配网设备发送该通知消息。可选地，当AP的网络配置信息发生改变时，用户可以通过操作配网设备扫描待配网设备上设置的二维码来触发配网设备向该待配网设备发送该通知消息。
值得说明的是，待配网设备往往是低功耗设备，为降低耗能，配置待配网设备工作于被动的监听模式，当发现连接不上AP后，以周期性监听配网设备发送的该通知消息。如果待配网设备不是低功耗设备，则待配网设备可以在检测到不能接入AP时，直接退回到配置信道(configuration channel)，并且在配置信道上周期性的发送DPP配置请求消息(即对应于下文中的第二请求消息)，发送的DPP配置请求消息用Ks进行加密。
可选地，可以在通知消息中携带预设的第二标识，第二标识用于指示待配网设备启动网络的重配置过程。也就是说，当待配网设备接收到包含该第二标识的通知消息时，启动网络重配置过程的执行，即下面步骤的执行。
307、待配网设备根据第一密钥信息生成会话密钥Ks。
308、待配网设备向配网设备发送第二请求消息，第二请求消息由会话密钥Ks加密。
309、配网设备向待配网设备发送与第二请求消息对应的第二应答消息，第二应答消息由会话密钥Ks加密。
310、待配网设备向配网设备发送第二确认消息，第二确认消息由会话密钥Ks加密。
由图2和图3所示实施例可知，上文中的第一密钥信息和第二密钥信息的发送时机并不严格限定，只要在重配置过程启动之前完成会话密钥Ks的生成即可。
图2和图3所示实施例中着重说明了在对待配网设备进行网络配置的过程中密钥生成方法如何执行，相对应地，当采用这种密钥生成方法时，终端配网方案可以参照如下实施例实施。
图4为本申请一实施例提供的终端配网方法的流程示意图，如图4所示，该终端配网方法可以包括如下步骤：
401、待配网设备与配网设备通过DPP鉴权过程生成初始的会话密钥Ke。
402、待配网设备向配网设备发送第一请求消息，第一请求消息由Ke加密，第一请求消息中包括第一标识，第一标识用于指示配网设备进行网络的重配置操作。
403、配网设备根据第一标识向待配网设备发送与第一请求消息对应的第一应答消息，第一应答消息由Ke加密，第一应答消息中包括第一密钥信息以及AP的第一网络配置信息。
404、待配网设备根据第一密钥信息生成会话密钥Ks。
405、待配网设备向配网设备发送与第一应答消息对应的第一确认消息，第一确认消息由Ke加密，第一确认消息中包括第二密钥信息。
406、待配网设备根据第一网络配置信息接入AP。
配网设备可以将当前AP的网络配置信息(称为第一网络配置信息)也携带在第一应答消息中传输给待配网设备。
待配网设备使用Ke解密得到该第一网络配置信息，进而接入AP。
407、配网设备根据第二密钥信息生成会话密钥Ks。
408、待配网设备向配网设备发送第二请求消息，第二请求消息由会话密钥Ks加密。
409、配网设备向待配网设备发送与第二请求消息对应的第二应答消息，第二应答消息由会话密钥Ks加密，第二应答消息中包括AP的第二网络配置信息。
AP的网络配置信息发生改变后，将此时AP的网络配置信息称为第二网络配置信息。
410、待配网设备向配网设备发送第二确认消息，第二确认消息由会话密钥Ks加密。
411、待配网设备根据会话密钥Ks解密出第二网络配置信息以接入AP。
图5为本申请另一实施例提供的终端配网方法的流程示意图，如图5所示，该终端配网方法可以包括如下步骤：
501、待配网设备与配网设备通过DPP鉴权过程生成初始的会话密钥Ke。
502、待配网设备向配网设备发送第一请求消息，第一请求消息由Ke加密，第一请求消息中包括第一标识，第一标识用于指示配网设备进行网络的重配置操作。
503、配网设备根据第一标识向待配网设备发送与第一请求消息对应的第一应答消息，第一应答消息由Ke加密，第一应答消息中包括第一密钥信息以及AP的第一网络配置信息。
504、待配网设备根据第一密钥信息生成会话密钥Ks。
505、待配网设备向配网设备发送与第一应答消息对应的第一确认消息，第一确认消息由Ke加密。
506、待配网设备根据第一网络配置信息接入AP。
507、待配网设备向配网设备发送连接状态查询结果消息，连接状态查询结果消息中包括第二密钥信息。
可以理解的是，连接状态查询结果消息中还可以包括指示待配网设备与AP是否处于连接状态的字段。
508、配网设备根据第二密钥信息生成会话密钥Ks。
509、配网设备向待配网设备发送通知消息，通知消息中包括第二标识，以用于使得待配网设备启动网络的重配置过程，通知消息由会话密钥Ks加密。
510、待配网设备向配网设备发送第二请求消息，第二请求消息由会话密钥Ks加密。
511、配网设备向待配网设备发送与第二请求消息对应的第二应答消息，第二应答消息由会话密钥Ks加密，第二应答消息中包括AP的第二网络配置信息。
第二网络配置信息中包括SSID以及SSID对应的接入密码。其中，第二网络配置信息中的SSID和/或接入密码与第一网络配置信息中包括的SSID以及接入密码不同。
512、待配网设备向配网设备发送第二确认消息，第二确认消息由会话密钥Ks加密。
513、待配网设备根据会话密钥Ks解密出第二网络配置信息以接入AP。
图6为本申请另一实施例提供的终端配网方法的流程示意图，如图6所示，该终端配网方法可以包括如下步骤：
601、待配网设备与配网设备通过DPP鉴权过程生成初始的会话密钥Ke。
602、待配网设备向配网设备发送第一请求消息，第一请求消息由Ke加密，第一请求消息中包括第一标识，第一标识用于指示配网设备进行网络的重配置操作。
603、配网设备根据第一标识向待配网设备发送与第一请求消息对应的第一应答消息，第一应答消息由Ke加密，第一应答消息中包括AP的第一网络配置信息。
604、待配网设备向配网设备发送与第一应答消息对应的第一确认消息，第一确认消息由Ke加密。
605、待配网设备根据第一网络配置信息接入AP。
606、待配网设备向配网设备发送连接状态查询结果消息，连接状态查询结果消息中包括第二密钥信息，连接状态查询结果消息由Ke加密。
607、配网设备根据第二密钥信息生成会话密钥Ks。
608、配网设备向待配网设备发送通知消息，通知消息中包括第二标识和第一密钥信息，以用于使得待配网设备启动网络的重配置过程，通知消息由Ke加密。
609、待配网设备根据第一密钥信息生成会话密钥Ks。
610、待配网设备向配网设备发送第二请求消息，第二请求消息由会话密钥Ks加密。
611、配网设备向待配网设备发送与第二请求消息对应的第二应答消息，第二应答消息由会话密钥Ks加密，第二应答消息中包括AP的第二网络配置信息。
612、待配网设备向配网设备发送第二确认消息，第二确认消息由会话密钥Ks加密。
613、待配网设备根据会话密钥Ks解密出第二网络配置信息以接入AP。
图7为本申请另一实施例提供的终端配网方法的流程示意图，如图7所示，该终端配网方法可以包括如下步骤：
701、待配网设备与配网设备通过DPP鉴权过程生成初始的会话密钥Ke。
702、待配网设备向配网设备发送第一请求消息，第一请求消息由Ke加密，第一请求消息中包括第一标识，第一标识用于指示配网设备进行网络的重配置操作。
703、配网设备根据第一标识向待配网设备发送与第一请求消息对应的第一应答消息，第一应答消息由Ke加密，第一应答消息中包括AP的第一网络配置信息。
704、待配网设备向配网设备发送与第一应答消息对应的第一确认消息，第一确认消息由Ke加密，第一确认消息中包括第二密钥信息。
705、待配网设备根据第一网络配置信息接入AP。
706、配网设备根据第二密钥信息生成会话密钥Ks。
707、待配网设备向配网设备发送连接状态查询结果消息。
708、配网设备向待配网设备发送通知消息，通知消息中包括第二标识和第一密钥信息，第二标识用于使得待配网设备启动网络的重配置过程，通知消息由Ke加密。
709、待配网设备根据第一密钥信息生成会话密钥Ks。
710、待配网设备向配网设备发送第二请求消息，第二请求消息由会话密钥Ks加密。
711、配网设备向待配网设备发送与第二请求消息对应的第二应答消息，第二应答消息由会话密钥Ks加密，第二应答消息中包括AP的第二网络配置信息。
712、待配网设备向配网设备发送第二确认消息，第二确认消息由会话密钥Ks加密。
713、待配网设备根据会话密钥Ks解密出第二网络配置信息以接入AP。
综上，以上各个实施例提供了一种新的DPP配置过程的实现方案。在该方案下，待配网设备和配网设备在第一次网络配置过程中互相交换在后续第二次重新配网过程中所需的密钥信息：上述第一密钥信息和第二密钥信息，以使得配网设备和待配网设备都生成在下一次网络重配过程中所需使用的会话密钥Ks，如此，在网络重配过程中，直接基于会话密钥Ks执行DPP配置过程即可，无需再次执行DPP鉴权过程，提高了配网效率。
以上各实施例中提供的方案主要涉及的是DPP配置过程。下面，本申请实施例还提供一种在DPP鉴权过程中实施的密钥生成方法。
图8为本申请另一实施例提供的密钥生成方法的流程示意图，如图8所示，该密钥生成方法包括如下步骤：
801、配网设备向待配网设备发送认证请求消息，认证请求消息中包括第一随机数信息和第二随机数信息。
802、待配网设备根据第一随机数信息、第二随机数信息以及待配网设备对应的第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥。
803、待配网设备向配网设备发送与认证请求消息对应的认证应答消息，认证应答消息中包括第三随机数信息和第四随机数信息。
804、配网设备根据第一随机数信息、第二随机数信息以及第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥。
下面为描述方便，将第一随机数信息和第二随机数信息分别表示为：I-nonce1和I-nonce2，将第三随机数信息和第四随机数信息分别表示为：R-nonce1和R-nonce2，将第一会话密钥和第二会话密钥分别表示为：ke1和ke2。
本实施例提供的密钥生成方法可以适用于配网设备对待配网设备进行网络配置的场 景中。
可选地，可以在待配网设备上设置一个二维码，当需要对待配网设备进行网络配置时，通过扫描该二维码可以触发配网设备向待配网设备发送上述认证请求消息。
值得说明的是，本实施例中，是以配网设备主动触发了DPP鉴权过程为例进行的说明，实际上，DPP鉴权过程也可以由待配网设备触发。此时，待配网设备向配网设备发送包含自己的第三随机数信息和第四随机数信息的认证请求消息(可以表示为DPP authentication request)，配网设备向待配网设备发送包括自己的第一随机数信息和第二随机数信息的认证应答消息(可以表示为DPP authentication response)。此时，可选地，在待配网设备上可以设置触发配网的按键，当用户按下该按键时，可以触发待配网设备向配网设备发送认证请求消息。
可以理解的是，对于配网设备和待配网设备来说，都会得到上述四个随机数：I-nonce1、I-nonce2、R-nonce1和R-nonce2。
概括来说，对配网设备来说，其可以根据I-nonce1和R-nonce1生成ke1，以及根据I-nonce2和R-nonce2生成ke2。同样地，对于待配网设备来说，也可以根据I-nonce1和R-nonce1生成ke1，以及根据I-nonce2和R-nonce2生成ke2。
值得说明的是，待配网设备可以被配置为：当接收到包括I-nonce1和I-nonce2两个随机数的认证请求消息时，即得知需要生成两个会话密钥，其中，一个被用在配网设备对待配网设备的首次网络配置过程中，另一个被用在配网设备对待配网设备的网络重配置过程中。假设ke1被用在配网设备对待配网设备的首次网络配置过程中，ke2被用在配网设备对待配网设备的网络重配置过程中。
当然，可选地，上述认证请求消息中可以包括预设的第一标识，第一标识指示待配网设备生成用于进行网络重配置的会话密钥。也就是说，可以在认证请求消息中携带该第一标识，以使待配网设备接收到包含该第一标识的认证请求消息时，直接得知需要生成两个会话密钥：ke1和ke2。也即是说，待配网设备基于该第一标识得知，除了需要生成被用在配网设备对待配网设备的首次网络配置过程中的会话密钥ke1外，还需要生成被用在配网设备对待配网设备的网络重配置过程中的会话密钥ke2。
下面对ke1和ke2的详细生成过程进行说明。
对于待配网设备来说：
Ke1＝HKDF(I-nonce1|R-nonce1,“DPP Re-configuration Key”,M.x|N.x[|L.x])；
Ke2＝HKDF(I-nonce2|R-nonce2,“DPP Re-configuration Key”,M.x|N.x[|L.x])。
其中，M.x表示M的标量，x可以是M这个复数在椭圆曲线上对应的横坐标，M是由配网设备的协议密钥(protocol key)对中的公钥P l以及待配网设备中的引导密钥(bootstrapping key)对中的私钥b R生成的，生成公式为：
M＝b R×P l。
其中，N.x表示N的标量，x可以是N这个复数在椭圆曲线上对应的横坐标，N是由配网设备的协议密钥(protocol key)对中的公钥P l以及待配网设备中的协议密钥(protocol key)对中的私钥p R生成的，生成公式为：
N＝p R×P l。
其中，L.x表示L的标量，x可以是L这个复数在椭圆曲线上对应的横坐标，L是由待配网设备中的引导密钥(bootstrapping key)对中的私钥b R以及待配网设备中的协议密钥(protocol key)对中的私钥p R以及配网设备中的引导密钥(bootstrapping key)对中的公钥B l生成的，生成公式为：
L＝((b R+p R)modulo q)×B l
其中，|表示拼接(串联)操作，“DPP Re-configuration Key”表示此处是一串字符串，该字符串的取值可以自定义。[]表示该中括号中的变量或字段L.x是可选的或者只有在特定条件下才使用。modulo q表示模运算。
对于配网设备来说：
Ke1＝HKDF(I-nonce1|R-nonce1,“DPP Re-configuration Key”,M.x|N.x[|L.x])；
Ke2＝HKDF(I-nonce2|R-nonce2,“DPP Re-configuration Key”,M.x|N.x[|L.x])。
其中，M是由配网设备的协议密钥(protocol key)对中的私钥p l以及待配网设备中的引导密钥(bootstrapping key)对中的公钥B R生成的，生成公式为：
M＝p l×B R。
其中，N是由配网设备的协议密钥(protocol key)对中的私钥p l以及待配网设备中的协议密钥(protocol key)对中的公钥P R生成的，生成公式为：
N＝p l×P R。
其中，L是由配网设备中的引导密钥(bootstrapping key)对中的私钥b l以及待配网设备中的协议密钥(protocol key)对中的公钥P R以及待配网设备中的引导密钥(bootstrapping key)对中的公钥B R生成的，生成公式为：
L＝b l×(B R+P R)。
值得说明的是，对于配网设备和待配网设备来说，上述公式中涉及到的M、N、L的 计算方式是不相同的。
可选地，DPP认证请求消息中还可以包括生成会话密钥数量的信息。重配网可能需要进行多于2次。因此，配网设备以及待配网设备可以在DPP鉴权过程中生成2个以上的会话密钥。例如，如果生成会话密钥数量的信息为3，则配网设备在向待配网设备中发送的DPP鉴权请求信息中携带3个随机数，依次是I-nonce1，I-nonce2以及I-nonce3。待配网设备收到配网设备发送的DPP鉴权请求消息后，会根据收到的3个随机数以及自身生成的3个随机数R-nonce1，R-nonce2以及R-nonce3依次生成3个会话密钥Ke1，Ke2以及Ke3。之后，待配网设备向配网设备发送DPP鉴权答复消息，DPP鉴权答复消息中包括R-nonce1，R-nonce2以及R-nonce3。配网设备收到待配网设备发送的DPP鉴权应答消息后，会根据收到的3个随机数以及之前生成的3个随机数I-nonce1，I-nonce2以及I-nonce3依次生成3个会话密钥Ke1，Ke2以及Ke3。三个会话密钥依次用于第一次配置过程，第二次配置过程以及第三次配置过程。配网设备和待配网设备在接收以及发送配置过程中的连接状态查询结果消息后，会删除当下配网过程中所用到的会话密钥。
在配网设备对待配网设备进行网络配置的场景中，上述生成的ke1和ke2可以被用于后续两个DPP配置过程中。下面结合图9所示实施例对ke1和ke2的使用过程进行说明。
图9为本申请一实施例提供的使用ke1和ke2进行网络配置的流程示意图，如图9所示，包括如下步骤：
901、待配网设备与配网设备在DPP鉴权过程中生成第一会话密钥ke1和第二会话密钥ke2。
其中，ke1和ke2的生成过程参见图8所示实施例中的说明，在此不赘述。
902、待配网设备向配网设备发送第一请求消息，第一请求消息由第一会话密钥ke1加密。
903、配网设备向待配网设备发送与第一请求消息对应的第一应答消息，第一应答消息由第一会话密钥ke1加密，第一应答消息中包括AP的第一网络配置信息。
904、待配网设备向配网设备发送第一确认消息，第一确认消息由第一会话密钥ke1加密。
905、待配网设备使用第一会话密钥ke1解密出第一网络配置信息以接入AP。
906、待配网设备向配网设备发送连接状态查询结果消息，连接状态查询结果消息由第一会话密钥ke1加密。
可选地，待配网设备在接收到第一确认消息后，可以在预设时间间隔后向配网设备发送连接状态查询结果消息(可以表示为：Status Query Result)，以告知配网设备该待配网设备与AP是否处于连接状态。
907、配网设备向待配网设备发送通知消息，通知消息用于使得待配网设备启动网络的重配置过程，通知消息由第二会话密钥ke2加密。
如前文所述，当AP的网络配置信息由第一网络配置信息变为第二网络配置信息时,且当待配网设备为低功耗设备时，可以触发配网设备向待配网设备发送该通知消息。
可选地，AP的网络配置信息发生改变时，用户可以操作配网设备扫描待配网设备上的二维码，以触发配网设备向待配网设备发送该通知消息。
值得说明的是，待配网设备往往是低功耗设备，为降低耗能，配置待配网设备工作于被动的监听模式，当发现连接不上AP后，以周期性监听配网设备发送的该通知消息。如果待配网设备不是低功耗设备，则待配网设备可以在检测到不能接入AP时，直接退回到配置信道(configuration channel)，并且在配置信道上周期性的发送DPP配置请求消息(即对应于下文中的第二请求消息)，发送的DPP配置请求消息用Ks进行加密。
可选地，上述通知消息中可以包括第二标识，第二标识用于指示待配网设备启动网络的重配置过程。
908、待配网设备向配网设备发送第二请求消息，第二请求消息由第二会话密钥ke2加密。
909、配网设备向待配网设备发送与第二请求消息对应的第二应答消息，第二应答消息由第二会话密钥ke2加密，第二应答消息中包括AP的第二网络配置信息。
910、待配网设备向配网设备发送第二确认消息，第二确认消息由第二会话密钥ke2加密。
911、待配网设备使用第二会话密钥ke2解密出第二网络配置信息以接入AP。
以下将详细描述本申请的一个或多个实施例的密钥生成装置、终端配网装置。本领域技术人员可以理解，这些装置均可使用市售的硬件组件通过本方案所教导的步骤进行配置来构成。
图10为本申请实施例提供的一种密钥生成装置的结构示意图，如图10所示，该装置包括：发送模块11、接收模块12、生成模块13。
发送模块11，用于向配网设备发送第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作。
接收模块12，用于接收所述配网设备发送的第一消息，所述第一消息中包括第一密钥信息。
生成模块13，用于根据所述第一密钥信息生成会话密钥。
所述发送模块11，还用于向所述配网设备发送第二消息，所述第二消息中包括第二密钥信息，以使所述配网设备根据所述第二密钥信息生成所述会话密钥。
可选地，所述第一消息是与所述第一请求消息对应的第一应答消息。
可选地，所述第二消息是与所述第一应答消息对应的第一确认消息。
可选地，所述第一消息是通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程。
可选地，所述通知消息中包括第二标识，所述第二标识用于指示所述待配网设备启动网络的重配置过程。
可选地，在向所述配网设备发送第二消息之后，所述发送模块11还用于：向所述配网设备发送第二请求消息，所述第二请求消息由所述会话密钥加密。所述接收模块12还用于：接收所述配网设备发送的与所述第二请求消息对应的第二应答消息，所述第二应答消息由所述会话密钥加密。
可选地，接收所述配网设备发送的与所述第二请求消息对应的第二应答消息之后，所述发送模块11还用于：向所述配网设备发送第二确认消息，所述第二确认消息由所述会话密钥加密。
图10所示装置可以执行前述图1至图3所示各实施例中待配网设备所执行的步骤，本实施例未详细描述的部分，可参考前述实施例的相关说明，在此不再赘述。
在一个可能的设计中，上述图10所示的密钥生成装置的结构可实现为待配网设备。如图11所示，该待配网设备可以包括：第一处理器21、第一存储器22。其中，所述第一存储器22上存储有可执行代码，当所述可执行代码被所述第一处理器21执行时，至少使所述第一处理器21实现前述图1至图3所示实施例中待配网设备所执行的各步骤。
其中，该待配网设备的结构中还可以包括第一通信接口23，用于与其他设备或通信网络通信。
另外，本申请实施例提供了一种非暂时性机器可读存储介质，所述非暂时性机器可读存储介质上存储有可执行代码，当所述可执行代码被待配网设备的处理器执行时，使 所述处理器执行前述图1至图3所示实施例中的待配网设备所执行的各步骤。
图12为本申请实施例提供的另一种密钥生成装置的结构示意图，如图12所示，该装置包括：接收模块31、发送模块32、生成模块33。
接收模块31，用于接收待配网设备发送的第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作。
发送模块32，用于根据所述第一标识向所述待配网设备发送第一消息，所述第一消息中包括第一密钥信息，以使所述待配网设备根据所述第一密钥信息生成会话密钥。
所述接收模块31，还用于接收所述待配网设备发送的第二消息，所述第二消息中包括第二密钥信息。
生成模块33，用于根据所述第二密钥信息生成所述会话密钥。
可选地，所述第一消息是与所述第一请求消息对应的第一应答消息。
可选地，所述第二消息是与所述第一应答消息对应的第一确认消息。
可选地，所述第一消息是通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程。
可选地，所述通知消息中包括第二标识，所述第二标识用于指示所述待配网设备启动网络的重配置过程。
可选地，根据所述第二密钥信息生成所述会话密钥之后，所述接收模块31还用于：接收所述待配网设备发送的第二请求消息，所述第二请求消息由所述会话密钥加密。所述发送模块32还用于：向所述待配网设备发送与所述第二请求消息对应的第二应答消息，所述第二应答消息由所述会话密钥加密。所述接收模块31还用于：接收所述待配网设备发送的第二确认消息，所述第二确认消息由所述会话密钥加密。
图12所示装置可以执行前述图1至图3所示实施例中配网设备所执行的步骤，本实施例未详细描述的部分，可参考前述实施例的相关说明，在此不再赘述。
在一个可能的设计中，上述图12所示的密钥生成装置的结构可实现为配网设备。如图13所示，该配网设备可以包括：第二处理器41、第二存储器42。其中，所述第二存储器42上存储有可执行代码，当所述可执行代码被所述第二处理器41执行时，至少使所述第二处理器41实现前述图1至图3所示实施例中配网设备所执行的各步骤。其中，该配网设备的结构中还可以包括第二通信接口43，用于与其他设备或通信网络通信。
另外，本申请实施例提供了一种非暂时性机器可读存储介质，所述非暂时性机器可读存储介质上存储有可执行代码，当所述可执行代码被配网设备的处理器执行时，使所 述处理器执行前述图1至图3所示实施例中的配网设备所执行的各步骤。
图14为本申请实施例提供的一种终端配网装置的结构示意图，该终端配网配置装置位于待配网设备中。如图14所示，该装置包括：发送模块51、接收模块52、生成模块53。
发送模块51，用于向配网设备发送第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作。
接收模块52，用于接收所述配网设备发送的第一消息，所述第一消息中包括第一密钥信息。
生成模块53，用于根据所述第一密钥信息生成会话密钥。
所述发送模块51，还用于向所述配网设备发送第二消息，所述第二消息中包括第二密钥信息，以使所述配网设备根据所述第二密钥信息生成所述会话密钥；所述会话密钥被用于对所述待配网设备进行网络的重配置的过程中。
可选地，所述第一消息是与所述第一请求消息对应的第一应答消息。
可选地，所述第二消息是与所述第一应答消息对应的第一确认消息。
可选地，向配网设备发送第一请求消息之后，所述接收模块52还用于：接收所述配网设备发送的与所述第一请求消息对应的第一应答消息，第一应答消息中包括接入点的第一网络配置信息。
可选地，所述发送模块51还用于：向所述配网设备发送连接状态查询结果消息，所述第二消息是所述连接状态查询结果消息。
可选地，向所述配网设备发送连接状态查询结果消息之后，所述接收模块52还用于：接收所述配网设备发送的通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程，所述第一消息是所述通知消息。
可选地，所述发送模块51还用于：向所述配网设备发送第二请求消息，所述第二请求消息由所述会话密钥加密。所述接收模块52还用于：接收所述配网设备发送的与所述第二请求消息对应的第二应答消息，所述第二应答消息中包括接入点的第二网络配置信息，所述第二应答消息由所述会话密钥加密。所述发送模块51还用于：向所述配网设备发送第二确认消息，所述第二确认消息由所述会话密钥加密。
图14所示装置可以执行前述图4至图7所示实施例中待配网设备所执行的步骤，本实施例未详细描述的部分，可参考前述实施例的相关说明，在此不再赘述。
在一个可能的设计中，上述图14所示的终端配网装置的结构可实现为待配网设备。 如图15所示，该待配网设备可以包括：第三处理器61、第三存储器62。其中，所述第三存储器62上存储有可执行代码，当所述可执行代码被所述第三处理器61执行时，至少使所述第三处理器61实现前述图4至图7所示实施例中待配网设备所执行的各步骤。
其中，该待配网设备的结构中还可以包括第三通信接口63，用于与其他设备或通信网络通信。
另外，本申请实施例提供了一种非暂时性机器可读存储介质，所述非暂时性机器可读存储介质上存储有可执行代码，当所述可执行代码被待配网设备的处理器执行时，使所述处理器执行前述图4至图7所示实施例中的待配网设备所执行的各步骤。
图16为本申请实施例提供的另一种终端配网装置的结构示意图，位于待入网设备中，如图16所示，该装置包括：接收模块71、发送模块72、生成模块73。
接收模块71，用于接收待配网设备发送的第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作。
发送模块72，用于根据所述第一标识向所述待配网设备发送第一消息，所述第一消息中包括第一密钥信息，以使所述待配网设备根据所述第一密钥信息生成会话密钥。
所述接收模块71，还用于接收所述待配网设备发送的第二消息，所述第二消息中包括第二密钥信息。
生成模块73，用于根据所述第二密钥信息生成所述会话密钥；所述会话密钥被用于对所述待配网设备进行网络的重配置的过程中。
可选地，所述第一消息是与所述第一请求消息对应的第一应答消息。
可选地，所述第二消息是与所述第一应答消息对应的第一确认消息。
可选地，所述发送模块72还用于：向所述待配网设备发送与所述第一请求消息对应的第一应答消息，第一应答消息中包括接入点的第一网络配置信息。
可选地，向所述待配网设备发送与所述第一请求消息对应的第一应答消息之后，所述接收模块71还用于：接收所述待配网设备发送的连接状态查询结果消息，所述第二消息是所述连接状态查询结果消息。所述发送模块72还用于：向所述待配网设备发送通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程，所述第一消息是所述通知消息。
可选地，所述接收模块71还用于：接收所述待配网设备发送的第二请求消息，所述第二请求消息由所述会话密钥加密。所述发送模块72还用于：向所述待配网设备发送与所述第二请求消息对应的第二应答消息，所述第二应答消息由所述会话密钥加密，所述 第二应答消息中包括接入点的第二网络配置信息。所述接收模块71还用于：接收所述待配网设备发送的第二确认消息，所述第二确认消息由所述会话密钥加密。
图16所示装置可以执行前述图4至图7所示实施例中配网设备所执行的步骤，本实施例未详细描述的部分，可参考前述实施例的相关说明，在此不再赘述。
在一个可能的设计中，上述图16所示的终端配网装置的结构可实现为配网设备。如图17所示，该配网设备可以包括：第四处理器81、第四存储器82。其中，所述第四存储器82上存储有可执行代码，当所述可执行代码被所述第四处理器81执行时，至少使所述第四处理器81实现前述图4至图7所示实施例中配网设备所执行的各步骤。
其中，该配网设备的结构中还可以包括第四通信接口83，用于与其他设备或通信网络通信。
另外，本申请实施例提供了一种非暂时性机器可读存储介质，所述非暂时性机器可读存储介质上存储有可执行代码，当所述可执行代码被配网设备的处理器执行时，使所述处理器执行前述图4至图7所示实施例中的配网设备所执行的各步骤。
图18为本申请实施例提供的另一种密钥生成装置的结构示意图，如图18所示，该装置包括：接收模块91、生成模块92、发送模块93。
接收模块91，用于接收配网设备发送的认证请求消息，所述认证请求消息中包括第一随机数信息和第二随机数信息。
生成模块92，用于根据所述第一随机数信息、所述第二随机数信息以及所述待配网设备对应的第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥。
发送模块93，用于向所述配网设备发送与所述认证请求消息对应的认证应答消息，所述认证应答消息中包括所述第三随机数信息和所述第四随机数信息，以使所述配网设备根据所述第一随机数信息、所述第二随机数信息以及所述第三随机数信息和所述第四随机数信息生成所述第一会话密钥和所述第二会话密钥。
可选地，所述认证请求消息中包括第一标识，所述第一标识指示所述待配网设备生成用于进行网络重配置的会话密钥。
可选地，所述发送模块93还用于：向所述配网设备发送第一请求消息，所述第一请求消息由所述第一会话密钥加密。所述接收模块91还用于：接收所述配网设备发送的与所述第一请求消息对应的第一应答消息，所述第一应答消息由所述第一会话密钥加密，所述第一应答消息中包括接入点的第一网络配置信息。所述发送模块93还用于：向所述配网设备发送第一确认消息，所述第一确认消息由所述第一会话密钥加密。
可选地，所述发送模块93还用于：向所述配网设备发送连接状态查询结果消息，所述连接状态查询结果消息由所述第一会话密钥加密。
可选地，所述接收模块91还用于：接收所述配网设备发送的通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程，所述通知消息由所述第二会话密钥加密。
其中，可选地，所述通知消息中包括第二标识，所述第二标识用于指示所述待配网设备启动网络的重配置过程。
可选地，接收所述配网设备发送的通知消息之后，所述发送模块93还用于：向所述配网设备发送第二请求消息，所述第二请求消息由所述第二会话密钥加密。所述接收模块91还用于：接收所述配网设备发送的与所述第二请求消息对应的第二应答消息，所述第二应答消息由所述第二会话密钥加密，所述第二应答消息中包括接入点的第二网络配置信息。所述发送模块93还用于：向所述配网设备发送第二确认消息，所述第二确认消息由所述第二会话密钥加密。
图18所示装置可以执行前述图8至图9所示各实施例中待配网设备所执行的步骤，本实施例未详细描述的部分，可参考前述实施例的相关说明，在此不再赘述。
在一个可能的设计中，上述图18所示的密钥生成装置的结构可实现为待配网设备。如图19所示，该待配网设备可以包括：第五处理器191、第五存储器192。其中，所述第五存储器192上存储有可执行代码，当所述可执行代码被所述第五处理器191执行时，至少使所述第五处理器191实现前述图8至图9所示实施例中待配网设备所执行的各步骤。
其中，该待配网设备的结构中还可以包括第五通信接口193，用于与其他设备或通信网络通信。
另外，本申请实施例提供了一种非暂时性机器可读存储介质，所述非暂时性机器可读存储介质上存储有可执行代码，当所述可执行代码被待配网设备的处理器执行时，使所述处理器执行前述图8至图9所示实施例中的待配网设备所执行的各步骤。
图20为本申请实施例提供的另一种密钥生成装置的结构示意图，如图20所示，该装置包括：发送模块2001、接收模块2002、生成模块2003。
发送模块2001，用于向待配网设备发送认证请求消息，所述认证请求消息中包括第一随机数信息和第二随机数信息，以使所述待配网设备根据所述第一随机数信息、所述第二随机数信息以及所述待配网设备对应的第三随机数信息和第四随机数信息生成第一 会话密钥和第二会话密钥。
接收模块2002，用于接收所述待配网设备发送的所述认证请求消息对应的认证应答消息，所述认证应答消息中包括所述第三随机数信息和所述第四随机数信息。
生成模块2003，用于根据所述第一随机数信息、所述第二随机数信息以及所述第三随机数信息和所述第四随机数信息生成第一会话密钥和第二会话密钥。
可选地，所述认证请求消息中包括第一标识，所述第一标识指示所述待配网设备生成用于进行网络重配置的会话密钥。
可选地，所述接收模块2002还用于：接收所述待配网设备发送的第一请求消息，所述第一请求消息由所述第一会话密钥加密。所述发送模块2001还用于：向所述待配网设备发送与所述第一请求消息对应的第一应答消息，所述第一应答消息由所述第一会话密钥加密，所述第一应答消息中包括接入点的第一网络配置信息。所述接收模块2002还用于：接收所述待配网设备发送的第一确认消息，所述第一确认消息由所述第一会话密钥加密。
可选地，向所述待配网设备发送与所述第一请求消息对应的第一应答消息之后，所述接收模块2002还用于：所述配网设备接收所述待配网设备发送的连接状态查询结果消息，所述连接状态查询结果消息由所述第一会话密钥加密。
可选地，所述发送模块2001还用于：向所述待配网设备发送通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程，所述通知消息由所述第二会话密钥加密。
其中，可选地，所述通知消息中包括第二标识，所述第二标识用于指示所述待配网设备启动网络的重配置过程。
可选地，发送通知消息之后，所述接收模块2002还用于：所述配网设备接收所述待配网设备发送的第二请求消息，所述第二请求消息由所述第二会话密钥加密。所述发送模块2001还用于：向所述待配网设备发送与所述第二请求消息对应的第二应答消息，所述第二应答消息由所述第二会话密钥加密，所述第二应答消息中包括接入点的第二网络配置信息。所述接收模块2002还用于：接收所述待配网设备发送的第二确认消息，所述第二确认消息由所述第二会话密钥加密。
图20所示装置可以执行前述图8至图9所示实施例中配网设备所执行的步骤，本实施例未详细描述的部分，可参考前述实施例的相关说明，在此不再赘述。
在一个可能的设计中，上述图20所示的密钥生成装置的结构可实现为配网设备。如 图21所示，该配网设备可以包括：第六处理器2101、第六存储器2102。其中，所述第六存储器2102上存储有可执行代码，当所述可执行代码被所述第六处理器2101执行时，至少使所述第六处理器2101实现前述图8至图9所示实施例中配网设备所执行的各步骤。
其中，该配网设备的结构中还可以包括第六通信接口2103，用于与其他设备或通信网络通信。
另外，本申请实施例提供了一种非暂时性机器可读存储介质，所述非暂时性机器可读存储介质上存储有可执行代码，当所述可执行代码被配网设备的处理器执行时，使所述处理器执行前述图8至图9所示实施例中的配网设备所执行的各步骤。
以上所描述的装置实施例仅仅是示意性的，其中所述作为分离部件说明的单元可以是或者也可以不是物理上分开的。可以根据实际的需要选择其中的部分或者全部模块来实现本实施例方案的目的。本领域普通技术人员在不付出创造性的劳动的情况下，即可以理解并实施。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到各实施方式可借助加必需的通用硬件平台的方式来实现，当然也可以通过硬件和软件结合的方式来实现。基于这样的理解，上述技术方案本质上或者说对现有技术做出贡献的部分可以以计算机产品的形式体现出来，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请实施例提供的网络配置方法可以由某一种或多种程序/软件来执行，该程序/软件可以由网络侧提供，前述实施例中提及的配网设备、待配网设备可以将所需的相应程序/软件下载到本地的非易失性存储介质中，并在其需要执行前述密钥生成方法、终端配网方法时，通过CPU将该程序/软件读取到内存中，进而由CPU执行该程序/软件以实现前述实施例中所提供的密钥生成方法、终端配网方法，执行过程可以参见前述图1至图9中的示意。
最后应说明的是：以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围。

Claims (60)

  1. 一种密钥生成方法，其特征在于，包括：
    待配网设备向配网设备发送第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
    所述待配网设备接收所述配网设备发送的第一消息，所述第一消息中包括第一密钥信息；
    所述待配网设备根据所述第一密钥信息生成会话密钥；
    所述待配网设备向所述配网设备发送第二消息，所述第二消息中包括第二密钥信息，以使所述配网设备根据所述第二密钥信息生成所述会话密钥。
  2. 根据权利要求1所述的方法，其特征在于，所述第一消息是与所述第一请求消息对应的第一应答消息。
  3. 根据权利要求2所述的方法，其特征在于，所述第二消息是与所述第一应答消息对应的第一确认消息。
  4. 根据权利要求1所述的方法，其特征在于，所述第一消息是通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程。
  5. 根据权利要求4所述的方法，其特征在于，所述通知消息中包括第二标识，所述第二标识用于指示所述待配网设备启动网络的重配置过程。
  6. 根据权利要求1所述的方法，其特征在于，所述待配网设备向所述配网设备发送第二消息之后，还包括：
    所述待配网设备向所述配网设备发送第二请求消息，所述第二请求消息由所述会话密钥加密；
    所述待配网设备接收所述配网设备发送的与所述第二请求消息对应的第二应答消息，所述第二应答消息由所述会话密钥加密。
  7. 根据权利要求6所述的方法，其特征在于，所述待配网设备接收所述配网设备发送的与所述第二请求消息对应的第二应答消息之后，还包括：
    所述待配网设备向所述配网设备发送第二确认消息，所述第二确认消息由所述会话密钥加密。
  8. 一种密钥生成方法，其特征在于，包括：
    配网设备接收待配网设备发送的第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
    所述配网设备根据所述第一标识向所述待配网设备发送第一消息，所述第一消息中包括第一密钥信息，以使所述待配网设备根据所述第一密钥信息生成会话密钥；
    所述配网设备接收所述待配网设备发送的第二消息，所述第二消息中包括第二密钥信息；
    所述配网设备根据所述第二密钥信息生成所述会话密钥。
  9. 根据权利要求8所述的方法，其特征在于，所述第一消息是与所述第一请求消息对应的第一应答消息。
  10. 根据权利要求9所述的方法，其特征在于，所述第二消息是与所述第一应答消息对应的第一确认消息。
  11. 根据权利要求8所述的方法，其特征在于，所述第一消息是通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程。
  12. 根据权利要求11所述的方法，其特征在于，所述通知消息中包括第二标识，所述第二标识用于指示所述待配网设备启动网络的重配置过程。
  13. 根据权利要求8所述的方法，其特征在于，所述配网设备根据所述第二密钥信息生成所述会话密钥之后，还包括：
    所述配网设备接收所述待配网设备发送的第二请求消息，所述第二请求消息由所述会话密钥加密；
    所述配网设备向所述待配网设备发送与所述第二请求消息对应的第二应答消息，所述第二应答消息由所述会话密钥加密。
  14. 根据权利要求13所述的方法，其特征在于，所述配网设备向所述待配网设备发送与所述第二请求消息对应的第二应答消息之后，还包括：
    所述配网设备接收所述待配网设备发送的第二确认消息，所述第二确认消息由所述会话密钥加密。
  15. 一种终端配网方法，其特征在于，包括：
    待配网设备向配网设备发送第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
    所述待配网设备接收所述配网设备发送的第一消息，所述第一消息中包括第一密钥信息；
    所述待配网设备根据所述第一密钥信息生成会话密钥；
    所述待配网设备向所述配网设备发送第二消息，所述第二消息中包括第二密钥信 息，以使所述配网设备根据所述第二密钥信息生成所述会话密钥；所述会话密钥被用于对所述待配网设备进行网络的重配置的过程中。
  16. 根据权利要求15所述的方法，其特征在于，所述第一消息是与所述第一请求消息对应的第一应答消息。
  17. 根据权利要求16所述的方法，其特征在于，所述第二消息是与所述第一应答消息对应的第一确认消息。
  18. 根据权利要求15所述的方法，其特征在于，所述待配网设备向配网设备发送第一请求消息之后，还包括：
    所述待配网设备接收所述配网设备发送的与所述第一请求消息对应的第一应答消息，第一应答消息中包括接入点的第一网络配置信息。
  19. 根据权利要求18所述的方法，其特征在于，所述方法还包括：
    所述待配网设备向所述配网设备发送连接状态查询结果消息，所述第二消息是所述连接状态查询结果消息。
  20. 根据权利要求19所述的方法，其特征在于，所述待配网设备向所述配网设备发送连接状态查询结果消息之后，还包括：
    所述待配网设备接收所述配网设备发送的通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程，所述第一消息是所述通知消息。
  21. 根据权利要求15至20中任一项所述的方法，其特征在于，所述方法还包括：
    所述待配网设备向所述配网设备发送第二请求消息，所述第二请求消息由所述会话密钥加密；
    所述待配网设备接收所述配网设备发送的与所述第二请求消息对应的第二应答消息，所述第二应答消息中包括接入点的第二网络配置信息，所述第二应答消息由所述会话密钥加密。
  22. 根据权利要求21所述的方法，其特征在于，所述待配网设备接收所述配网设备发送的与所述第二请求消息对应的第二应答消息之后，还包括：
    所述待配网设备向所述配网设备发送第二确认消息，所述第二确认消息由所述会话密钥加密。
  23. 一种终端配网方法，其特征在于，包括：
    配网设备接收待配网设备发送的第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
    所述配网设备根据所述第一标识向所述待配网设备发送第一消息，所述第一消息中包括第一密钥信息，以使所述待配网设备根据所述第一密钥信息生成会话密钥；
    所述配网设备接收所述待配网设备发送的第二消息，所述第二消息中包括第二密钥信息；
    所述配网设备根据所述第二密钥信息生成所述会话密钥，所述会话密钥被用于对所述待配网设备进行网络的重配置的过程中。
  24. 根据权利要求23所述的方法，其特征在于，所述第一消息是与所述第一请求消息对应的第一应答消息。
  25. 根据权利要求24所述的方法，其特征在于，所述第二消息是与所述第一应答消息对应的第一确认消息。
  26. 根据权利要求23所述的方法，其特征在于，所述配网设备接收待配网设备发送的第一请求消息之后，还包括：
    所述配网设备向所述待配网设备发送与所述第一请求消息对应的第一应答消息，第一应答消息中包括接入点的第一网络配置信息。
  27. 根据权利要求26所述的方法，其特征在于，所述配网设备向所述待配网设备发送与所述第一请求消息对应的第一应答消息之后，还包括：
    所述配网设备接收所述待配网设备发送的连接状态查询结果消息，所述第二消息是所述连接状态查询结果消息。
  28. 根据权利要求27所述的方法，其特征在于，所述配网设备接收所述待配网设备发送的连接状态查询结果消息之后，还包括：
    所述配网设备向所述待配网设备发送通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程，所述第一消息是所述通知消息。
  29. 根据权利要求23至28中任一项所述的方法，其特征在于，所述方法还包括：
    所述配网设备接收所述待配网设备发送的第二请求消息，所述第二请求消息由所述会话密钥加密；
    所述配网设备向所述待配网设备发送与所述第二请求消息对应的第二应答消息，所述第二应答消息由所述会话密钥加密，所述第二应答消息中包括接入点的第二网络配置信息。
  30. 根据权利要求29所述的方法，其特征在于，所述配网设备向所述待配网设备发送与所述第二请求消息对应的第二应答消息之后，还包括：
    所述配网设备接收所述待配网设备发送的第二确认消息，所述第二确认消息由所述会话密钥加密。
  31. 一种密钥生成装置，其特征在于，位于待配网设备中，包括：
    发送模块，用于向配网设备发送第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
    接收模块，用于接收所述配网设备发送的第一消息，所述第一消息中包括第一密钥信息；
    生成模块，用于根据所述第一密钥信息生成会话密钥；
    所述发送模块，还用于向所述配网设备发送第二消息，所述第二消息中包括第二密钥信息，以使所述配网设备根据所述第二密钥信息生成所述会话密钥。
  32. 一种密钥生成装置，其特征在于，位于配网设备中，包括：
    接收模块，用于接收待配网设备发送的第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
    发送模块，用于根据所述第一标识向所述待配网设备发送第一消息，所述第一消息中包括第一密钥信息，以使所述待配网设备根据所述第一密钥信息生成会话密钥；
    所述接收模块，还用于接收所述待配网设备发送的第二消息，所述第二消息中包括第二密钥信息；
    生成模块，用于根据所述第二密钥信息生成所述会话密钥。
  33. 一种待配网设备，其特征在于，包括：存储器、处理器；其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行如权利要求1至7中任一项所述的密钥生成方法。
  34. 一种配网设备，其特征在于，包括：存储器、处理器；其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行如权利要求8至14中任一项所述的密钥生成方法。
  35. 一种终端配网装置，其特征在于，位于待配网设备中，包括：
    发送模块，用于向配网设备发送第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
    接收模块，用于接收所述配网设备发送的第一消息，所述第一消息中包括第一密钥信息；
    生成模块，用于根据所述第一密钥信息生成会话密钥；
    所述发送模块，还用于向所述配网设备发送第二消息，所述第二消息中包括第二密钥信息，以使所述配网设备根据所述第二密钥信息生成所述会话密钥；
    所述会话密钥被用于对所述待配网设备进行网络的重配置的过程中。
  36. 一种终端配网装置，其特征在于，位于配网设备中，包括：
    接收模块，用于接收待配网设备发送的第一请求消息，所述第一请求消息中包括第一标识，所述第一标识用于指示所述配网设备进行网络的重配置操作；
    发送模块，用于根据所述第一标识向所述待配网设备发送第一消息，所述第一消息中包括第一密钥信息，以使所述待配网设备根据所述第一密钥信息生成会话密钥；
    所述接收模块，还用于接收所述待配网设备发送的第二消息，所述第二消息中包括第二密钥信息；
    生成模块，用于根据所述第二密钥信息生成所述会话密钥；所述会话密钥被用于对所述待配网设备进行网络的重配置的过程中。
  37. 一种待配网设备，其特征在于，包括：存储器、处理器；其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行如权利要求15至22中任一项所述的终端配网方法。
  38. 一种配网设备，其特征在于，包括：存储器、处理器；其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行如权利要求23至30中任一项所述的终端配网方法。
  39. 一种密钥生成方法，其特征在于，包括：
    待配网设备接收配网设备发送的认证请求消息，所述认证请求消息中包括第一随机数信息和第二随机数信息；
    所述待配网设备根据所述第一随机数信息、所述第二随机数信息以及所述待配网设备对应的第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥；
    所述待配网设备向所述配网设备发送与所述认证请求消息对应的认证应答消息，所述认证应答消息中包括所述第三随机数信息和所述第四随机数信息，以使所述配网设备根据所述第一随机数信息、所述第二随机数信息以及所述第三随机数信息和所述第四随机数信息生成所述第一会话密钥和所述第二会话密钥。
  40. 根据权利要求39所述的方法，其特征在于，所述认证请求消息中包括第一标识，所述第一标识指示所述待配网设备生成用于进行网络重配置的会话密钥。
  41. 根据权利要求39所述的方法，其特征在于，所述待配网设备向所述配网设备 发送与所述认证请求消息对应的认证应答消息之后，还包括：
    所述待配网设备向所述配网设备发送第一请求消息，所述第一请求消息由所述第一会话密钥加密；
    所述待配网设备接收所述配网设备发送的与所述第一请求消息对应的第一应答消息，所述第一应答消息由所述第一会话密钥加密，所述第一应答消息中包括接入点的第一网络配置信息。
  42. 根据权利要求41所述的方法，其特征在于，所述待配网设备接收所述配网设备发送的与所述第一请求消息对应的第一应答消息之后，还包括：
    所述待配网设备向所述配网设备发送第一确认消息，所述第一确认消息由所述第一会话密钥加密。
  43. 根据权利要求41所述的方法，其特征在于，所述方法还包括：
    所述待配网设备向所述配网设备发送连接状态查询结果消息，所述连接状态查询结果消息由所述第一会话密钥加密。
  44. 根据权利要求39至43中任一项所述的方法，其特征在于，所述方法还包括：
    所述待配网设备接收所述配网设备发送的通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程，所述通知消息由所述第二会话密钥加密。
  45. 根据权利要求44所述的方法，其特征在于，所述通知消息中包括第二标识，所述第二标识用于指示所述待配网设备启动网络的重配置过程。
  46. 根据权利要求44所述的方法，其特征在于，所述待配网设备接收所述配网设备发送的通知消息之后，还包括：
    所述待配网设备向所述配网设备发送第二请求消息，所述第二请求消息由所述第二会话密钥加密；
    所述待配网设备接收所述配网设备发送的与所述第二请求消息对应的第二应答消息，所述第二应答消息由所述第二会话密钥加密，所述第二应答消息中包括接入点的第二网络配置信息。
  47. 根据权利要求46所述的方法，其特征在于，所述待配网设备接收所述配网设备发送的与所述第二请求消息对应的第二应答消息之后，还包括：
    所述待配网设备向所述配网设备发送第二确认消息，所述第二确认消息由所述第二会话密钥加密。
  48. 一种密钥生成方法，其特征在于，包括：
    配网设备向待配网设备发送认证请求消息，所述认证请求消息中包括第一随机数信息和第二随机数信息，以使所述待配网设备根据所述第一随机数信息、所述第二随机数信息以及所述待配网设备对应的第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥；
    所述配网设备接收所述待配网设备发送的所述认证请求消息对应的认证应答消息，所述认证应答消息中包括所述第三随机数信息和所述第四随机数信息；
    所述配网设备根据所述第一随机数信息、所述第二随机数信息以及所述第三随机数信息和所述第四随机数信息生成第一会话密钥和第二会话密钥。
  49. 根据权利要求48所述的方法，其特征在于，所述认证请求消息中包括第一标识，所述第一标识指示所述待配网设备生成用于进行网络重配置的会话密钥。
  50. 根据权利要求48所述的方法，其特征在于，所述方法还包括：
    所述配网设备接收所述待配网设备发送的第一请求消息，所述第一请求消息由所述第一会话密钥加密；
    所述配网设备向所述待配网设备发送与所述第一请求消息对应的第一应答消息，所述第一应答消息由所述第一会话密钥加密，所述第一应答消息中包括接入点的第一网络配置信息。
  51. 根据权利要求50所述的方法，其特征在于，所述配网设备向所述待配网设备发送与所述第一请求消息对应的第一应答消息之后，还包括：
    所述配网设备接收所述待配网设备发送的第一确认消息，所述第一确认消息由所述第一会话密钥加密。
  52. 根据权利要求50所述的方法，其特征在于，所述配网设备向所述待配网设备发送与所述第一请求消息对应的第一应答消息之后，还包括：
    所述配网设备接收所述待配网设备发送的连接状态查询结果消息，所述连接状态查询结果消息由所述第一会话密钥加密。
  53. 根据权利要求48至52中任一项所述的方法，其特征在于，所述方法还包括：
    所述配网设备向所述待配网设备发送通知消息，所述通知消息用于使得所述待配网设备启动网络的重配置过程，所述通知消息由所述第二会话密钥加密。
  54. 根据权利要求53所述的方法，其特征在于，所述通知消息中包括第二标识，所述第二标识用于指示所述待配网设备启动网络的重配置过程。
  55. 根据权利要求53所述的方法，其特征在于，所述配网设备向所述待配网设备 发送通知消息之后，还包括：
    所述配网设备接收所述待配网设备发送的第二请求消息，所述第二请求消息由所述第二会话密钥加密；
    所述配网设备向所述待配网设备发送与所述第二请求消息对应的第二应答消息，所述第二应答消息由所述第二会话密钥加密，所述第二应答消息中包括接入点的第二网络配置信息。
  56. 根据权利要求55所述的方法，其特征在于，所述配网设备向所述待配网设备发送与所述第二请求消息对应的第二应答消息之后，还包括：
    所述配网设备接收所述待配网设备发送的第二确认消息，所述第二确认消息由所述第二会话密钥加密。
  57. 一种密钥生成装置，其特征在于，位于待配网设备，包括：
    接收模块，用于接收配网设备发送的认证请求消息，所述认证请求消息中包括第一随机数信息和第二随机数信息；
    生成模块，用于根据所述第一随机数信息、所述第二随机数信息以及所述待配网设备对应的第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥；
    发送模块，用于向所述配网设备发送与所述认证请求消息对应的认证应答消息，所述认证应答消息中包括所述第三随机数信息和所述第四随机数信息，以使所述配网设备根据所述第一随机数信息、所述第二随机数信息以及所述第三随机数信息和所述第四随机数信息生成所述第一会话密钥和所述第二会话密钥。
  58. 一种密钥生成装置，其特征在于，位于配网设备，包括：
    发送模块，用于向待配网设备发送认证请求消息，所述认证请求消息中包括第一随机数信息和第二随机数信息，以使所述待配网设备根据所述第一随机数信息、所述第二随机数信息以及所述待配网设备对应的第三随机数信息和第四随机数信息生成第一会话密钥和第二会话密钥；
    接收模块，用于接收所述待配网设备发送的所述认证请求消息对应的认证应答消息，所述认证应答消息中包括所述第三随机数信息和所述第四随机数信息；
    生成模块，用于根据所述第一随机数信息、所述第二随机数信息以及所述第三随机数信息和所述第四随机数信息生成第一会话密钥和第二会话密钥。
  59. 一种待配网设备，其特征在于，包括：存储器、处理器；其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行如权利 要求39至47中任一项所述的密钥生成方法。
  60. 一种配网设备，其特征在于，包括：存储器、处理器；其中，所述存储器上存储有可执行代码，当所述可执行代码被所述处理器执行时，使所述处理器执行如权利要求48至56中任一项所述的密钥生成方法。
PCT/CN2020/112415 2019-09-06 2020-08-31 密钥生成以及终端配网方法、装置、设备 Ceased WO2021043095A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2022508883A JP7572425B2 (ja) 2019-09-06 2020-08-31 鍵生成及び端末プロビジョニングのための方法、装置、及びデバイス
EP20860248.2A EP4027575A4 (en) 2019-09-06 2020-08-31 Key generation and terminal provisioning method and apparatus, and devices
US17/637,692 US12170727B2 (en) 2019-09-06 2020-08-31 Method, apparatus, and device for key generation and terminal provisioning

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910842413.7A CN112566113B (zh) 2019-09-06 2019-09-06 密钥生成以及终端配网方法、装置、设备
CN201910842413.7 2019-09-06

Publications (1)

Publication Number Publication Date
WO2021043095A1 true WO2021043095A1 (zh) 2021-03-11

Family

ID=74853020

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/112415 Ceased WO2021043095A1 (zh) 2019-09-06 2020-08-31 密钥生成以及终端配网方法、装置、设备

Country Status (6)

Country Link
US (1) US12170727B2 (zh)
EP (1) EP4027575A4 (zh)
JP (1) JP7572425B2 (zh)
CN (1) CN112566113B (zh)
TW (1) TW202112101A (zh)
WO (1) WO2021043095A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116095673A (zh) * 2021-11-05 2023-05-09 华为技术有限公司 一种通信系统、网络修复方法及设备
CN119010024A (zh) * 2024-10-25 2024-11-22 中曜达数能生态科技(浙江)有限公司 一种配电网智能重构方法及系统

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108476205B (zh) * 2015-12-21 2019-12-03 皇家飞利浦有限公司 登记者设备、配置器设备及其方法
US12041049B1 (en) * 2020-04-29 2024-07-16 Cable Television Laboratories, Inc. Internet of things (IoT) systems and methods
CN115486106B (zh) * 2020-05-01 2026-04-17 皇家飞利浦有限公司 随机mac配置
CN116868599A (zh) * 2021-02-04 2023-10-10 三星电子株式会社 用于发送/接收网络配置信息的电子装置及其运行方法
CN114125895B (zh) * 2021-10-29 2024-04-12 云鲸智能(深圳)有限公司 无线通信方法、系统、基站、机器人及存储介质
CN114339787A (zh) * 2021-12-31 2022-04-12 深圳市优必选科技股份有限公司 智能设备的配网方法、终端设备及计算机可读存储介质

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018075135A1 (en) * 2016-10-19 2018-04-26 Qualcomm Incorporated Configurator key package for device provisioning protocol (dpp)
US20180316562A1 (en) * 2017-04-27 2018-11-01 Blackberry Limited Network policy configuration
CN110115099A (zh) * 2016-12-26 2019-08-09 佳能株式会社 通信设备、控制方法和程序

Family Cites Families (16)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7127613B2 (en) * 2002-02-25 2006-10-24 Sun Microsystems, Inc. Secured peer-to-peer network data exchange
JP4764639B2 (ja) * 2005-01-28 2011-09-07 株式会社オーク情報システム ファイルの暗号化・復号化プログラム、プログラム格納媒体
JP4502393B2 (ja) * 2005-06-13 2010-07-14 キヤノン株式会社 通信パラメータの共有方法及び通信装置
JPWO2008156107A1 (ja) * 2007-06-18 2010-08-26 日本電気株式会社 電子データの暗号化及び暗号化データ復号化システム及びその方法
US10873842B2 (en) 2016-04-08 2020-12-22 Blackberry Limited Managed object to provision a device according to one of plural provisioning techniques
JP6794191B2 (ja) 2016-09-02 2020-12-02 キヤノン株式会社 通信装置、通信方法、及びプログラム
SG10201609247YA (en) * 2016-11-04 2018-06-28 Huawei Int Pte Ltd System and method for configuring a wireless device for wireless network access
WO2018119852A1 (en) * 2016-12-29 2018-07-05 Gemalto Smart Cards Technology Co., Ltd. Method for mutual authentication between device and secure element
US20180278625A1 (en) * 2017-03-24 2018-09-27 Qualcomm Incorporated Exchanging message authentication codes for additional security in a communication system
WO2018201381A1 (zh) * 2017-05-04 2018-11-08 华为技术有限公司 一种密钥生成方法及相关设备
JP7109243B2 (ja) 2017-07-28 2022-07-29 キヤノン株式会社 通信装置、通信装置の制御方法及びプログラム
CN107645725B (zh) * 2017-09-21 2020-09-25 广东美的制冷设备有限公司 网络配置方法及系统、路由设备和入网设备
CN108494638A (zh) * 2018-02-09 2018-09-04 海尔优家智能科技（北京）有限公司 一种配置设备入网的方法、路由器、终端及介质
US10169587B1 (en) * 2018-04-27 2019-01-01 John A. Nix Hosted device provisioning protocol with servers and a networked initiator
CN109039627A (zh) * 2018-11-02 2018-12-18 美的集团股份有限公司 密钥协商方法、设备、存储介质以及系统
US12192184B2 (en) * 2021-12-08 2025-01-07 John A. Nix Secure session resumption using post-quantum cryptography

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2018075135A1 (en) * 2016-10-19 2018-04-26 Qualcomm Incorporated Configurator key package for device provisioning protocol (dpp)
CN110115099A (zh) * 2016-12-26 2019-08-09 佳能株式会社 通信设备、控制方法和程序
US20180316562A1 (en) * 2017-04-27 2018-11-01 Blackberry Limited Network policy configuration

Non-Patent Citations (4)

* Cited by examiner, † Cited by third party
Title
ANONYMOUS: "Device Provisioning Protocol Specification Version 1.1", 3 December 2018 (2018-12-03), pages 1 - 124, XP055787821, Retrieved from the Internet <URL:https://www.wi-fi.org/downloads-public/Device_Provisioning_Protocol_Specification_v1.1_1.pdf/35330> *
ANONYMOUS: "DRAFT Device Provisioning Protocol Specification Version 1.2", 3 March 2020 (2020-03-03), pages 1 - 174, XP055787796, Retrieved from the Internet <URL:https://www.wi-fi.org/download.php?file=/sites/default/files/private/DRAFT%20Device_Provisioning_Protocol_Specification_v_1.2_0.pdf> *
FISH_OU: "Diffie Hellman (DH) Key Exchange and ECDH (quote)", 6 January 2015 (2015-01-06), pages 1 - 2, XP009526677, Retrieved from the Internet <URL:https://www.cnblogs.com/fishou/p/4206451.html> *
See also references of EP4027575A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116095673A (zh) * 2021-11-05 2023-05-09 华为技术有限公司 一种通信系统、网络修复方法及设备
CN119010024A (zh) * 2024-10-25 2024-11-22 中曜达数能生态科技(浙江)有限公司 一种配电网智能重构方法及系统

Also Published As

Publication number Publication date
TW202112101A (zh) 2021-03-16
EP4027575A4 (en) 2023-12-13
JP2022547404A (ja) 2022-11-14
JP7572425B2 (ja) 2024-10-23
US20220294623A1 (en) 2022-09-15
EP4027575A1 (en) 2022-07-13
US12170727B2 (en) 2024-12-17
CN112566113B (zh) 2023-04-07
CN112566113A (zh) 2021-03-26

Similar Documents

Publication Publication Date Title
CN112566113B (zh) 密钥生成以及终端配网方法、装置、设备
CN110611905B (zh) 信息共享方法、终端设备、存储介质及计算机程序产品
CN104618988B (zh) 智能设备网络接入方法及装置
CN106535288B (zh) 一种发送和获取wifi联网信息的方法和对应装置
CN111787517A (zh) 智能设备激活绑定的方法和装置
JP6929390B2 (ja) ワイヤレス・ローカル・エリア・ネットワーク構成方法及びデバイス
CN111787540B (zh) 接入物联网的方法、装置、电子设备及可读存储介质
WO2023280194A1 (zh) 网络连接管理方法、装置、可读介质、程序产品及电子设备
CN113301563B (zh) 网络配置方法、装置、设备和存储介质
WO2023202631A1 (zh) 签约方法、装置、通信设备、物联网设备及网元
CN109996260A (zh) 配置系统、客户端设备、嵌入式设备配置方法及存储介质
WO2022028259A1 (zh) 用户签约数据的获取方法及装置
WO2014161277A1 (zh) 便携式wlan热点的连接方法及系统
CN114520967A (zh) 设备接入网络的方法、系统及相应的物联网设备
WO2019019280A1 (zh) 物联网终端数据的分时段加密方法及装置
WO2019019282A1 (zh) 物联网终端数据的按顺序加密方法及装置
WO2017147745A1 (zh) 一种对接入点ap的认证方法、系统及相关设备
CN113099445B (zh) 网络配置方法、设备连接方法、装置、设备和系统
CN113873554A (zh) 用于Mesh组网的同步配置获取和下发的方法和系统
CN113099511B (zh) 网络配置方法、装置、设备和系统
WO2018053895A1 (zh) 物联网接入点基于类型的上行数据加密控制方法及装置
WO2019010796A1 (zh) 物联网ap接收数据的分设备加密方法及装置
WO2018205328A1 (zh) 一种设备接入无线网络的系统及方法
WO2019010793A1 (zh) 物联网接入点接收数据的分时段加密方法及装置
WO2019015038A1 (zh) 物联网中继器基于类型的上行数据加密控制方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20860248

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2022508883

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020860248

Country of ref document: EP

Effective date: 20220406