CN118174942A - Data transmission method, device and readable storage medium - Google Patents

Abstract

The application discloses a data transmission method, a data transmission device and a readable storage medium, which relate to the technical field of communication and are used for improving the safety of cache data in a CCN (common carrier network). Applied to a Content Centric Network (CCN); the CCN network is configured with a plurality of CCN routers, and the plurality of CCN routers are configured with a Trusted Execution Environment (TEE) module; the method comprises the following steps: receiving a request message from a first terminal; the request message is used for requesting target content; for each CCN router included in the path, encrypting the target content by using a TEE module of the CCN router, and caching the encrypted target content into the CCN router included in the path; the path is a path for the CCN network to send the target content to the first terminal; the CCN router included in the utilization path transmits the target content to the first terminal.

Description

Data transmission method, device and readable storage medium

Technical Field

The embodiments of the present application relate to the field of communication technology, and in particular, to a data transmission method, device, and readable storage medium.

Background technique

As network traffic is growing, the data transmission efficiency under the transmission control protocol (TCP)/internet protocol (IP) architecture is getting worse and worse. Information-centric networking (ICN) has emerged in this context. ICN changes the current end-to-end communication mechanism of the Internet, separates content from terminal locations, and provides storage and multi-party communication services through a publish/subscribe paradigm.

Content Centric Networking (CCN) is a specific implementation of ICN. Routers in a CCN network will cache user request content along the way. When other users have the same request content, the router can first determine whether the local cache has the requested content. If so, it will directly feedback to the corresponding user. However, if multiple routers in a CCN network cache the requested content, the risk of leakage of the requested content will be greatly increased.

Summary of the invention

The present application provides a data transmission method, device and readable storage medium for improving the security of cached data in a CCN network.

In order to achieve the above objectives, this application adopts the following technical solutions:

In a first aspect, a data transmission method is provided, which is applied to a content centric network CCN; the CCN network is configured with multiple CCN routers, and the multiple CCN routers are configured with a trusted execution environment TEE module, and the method includes: receiving a request message from a first terminal; the request message is used to request target content; for each CCN router included in the path, the target content is encrypted using the TEE module of the CCN router, and the encrypted target content is cached in the CCN router included in the path; the path is the path for the CCN network to send the target content to the first terminal; and the target content is sent to the first terminal using the CCN router included in the path.

Optionally, the request message includes a content identifier of the target content; and the method further includes: acquiring the target content in the CCN network according to the content identifier.

Optionally, according to the content identifier, the target content is obtained in the CCN network; including: determining whether the forward forwarding table includes the content identifier; the forward forwarding table includes multiple ports and multiple preset content identifiers included in each port; when the forward forwarding table includes the content identifier, determining the target port corresponding to the content identifier from the forward forwarding table; and obtaining the target content from the target port.

Optionally, determining whether the forward forwarding table includes the content identifier includes: determining whether the target content is cached in the cache data of the CCN network; and determining whether the forward forwarding table includes the content identifier when the target content is not cached in the cache data of the CCN network.

Optionally, acquiring the target content in the CCN network according to the content identifier includes: acquiring the target content from the cache data of the CCN network based on the content identifier when the target content is cached in the cache data of the CCN network.

Optionally, the request message also includes a trusted identifier of the target content; the trusted identifier is used to indicate the importance of the target content; and the target content is encrypted using the TEE module of the CCN router, including: when the trusted identifier is a target trusted identifier, the target content is encrypted using the TEE module of the CCN router.

Optionally, when the target content is cached in the cache data of the CCN network, the TEE module stores the original digital signature corresponding to each target content, and uses the CCN router included in the path to send the target content to the first terminal, including: obtaining a content summary of the target content; using the content signature key in the TEE module to process the content summary to generate a digital signature at the current moment corresponding to the target content; when the digital signature at the current moment is the same as the original digital signature, using the CCN router included in the path to send the target content to the first terminal.

Based on the technical solution provided by the present application, after receiving the request message from the first terminal, the target content is encrypted using the TEE module, and the encrypted target content is cached in the CCN router included in the path, and the target content is sent to the first terminal using the CCN router included in the path. That is, the present application constructs a new CCN network architecture by adding the TEE module. Since the TEE module is a secure area provided by the device in a hardware manner, information in the secure area can only be accessed through an authorized interface. In this way, after the encrypted target content is cached in the CCN router included in the path, it is more difficult for a third party to decrypt or tamper with the target content, which can reduce the probability of the target content being decrypted or tampered with by a third party, and improve the security of cached data in the CCN network.

In a second aspect, a data transmission device is provided, which is applied to a content-centric network CCN; the CCN network is configured with multiple CCN routers, and multiple CCN routers are configured with a trusted execution environment TEE module, and the device includes: a receiving unit, a processing unit, and a sending unit; the receiving unit is used to receive a request message from a first terminal; the request message is used to request target content; the processing unit is used to encrypt the target content using the TEE module of the CCN router for each CCN router included in the path, and cache the encrypted target content to the CCN router included in the path; the path is the path for the CCN network to send the target content to the first terminal; the sending unit is used to send the target content to the first terminal using the CCN router included in the path.

Optionally, the request message includes a content identifier of the target content; and the processing unit is further configured to: obtain the target content in the CCN network according to the content identifier.

Optionally, the processing unit is specifically used to: determine whether the forward forwarding table includes a content identifier; the forward forwarding table includes multiple ports and multiple preset content identifiers included in each port; when the forward forwarding table includes the content identifier, determine the target port corresponding to the content identifier from the forward forwarding table; and obtain the target content from the target port.

Optionally, the processing unit is further configured to: determine whether the target content is cached in the cache data of the CCN network; and if the target content is not cached in the cache data of the CCN network, determine whether the forward forwarding table includes the content identifier.

Optionally, the processing unit is further configured to: when the target content is cached in the cache data of the CCN network, obtain the target content from the cache data of the CCN network based on the content identifier.

Optionally, the request message also includes a trusted identifier of the target content; the trusted identifier is used to indicate the importance of the target content; the processing unit is specifically used to: when the trusted identifier is a target trusted identifier, encrypt the target content using the TEE module of the CCN router.

Optionally, when the target content is cached in the cache data of the CCN network, the TEE module stores the original digital signature corresponding to each target content, and the sending unit is specifically used to: obtain a content summary of the target content; use the content signature key in the TEE module to process the content summary to generate a digital signature corresponding to the target content at the current moment; when the digital signature at the current moment is the same as the original digital signature, use the CCN router included in the path to send the target content to the first terminal.

In a third aspect, a data transmission device is provided, which can implement the functions performed by the data transmission device in the above-mentioned aspects or possible designs, and the functions can be implemented through hardware, such as: in one possible design, the data transmission device may include: a processor and a communication interface, and the processor can be used to support the data transmission device to implement the functions involved in the above-mentioned first aspect or any possible design of the first aspect.

In another possible design, the data transmission device may further include a memory, the memory being used to store computer-executable instructions and data necessary for the data transmission device. When the data transmission device is running, the processor executes the computer-executable instructions stored in the memory, so that the data transmission device performs the first aspect or any possible data transmission method of the first aspect.

In a fourth aspect, a computer-readable storage medium is provided, which may be a readable non-volatile storage medium, and which stores computer instructions or programs. When the computer-readable storage medium is run on a computer, the computer can execute the first aspect or any possible data transmission method of the above aspects.

In a fifth aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the data transmission method of the first aspect or any possible design of the above aspects.

In a sixth aspect, an electronic device is provided, the electronic device comprising one or more processors and one or more memories. The one or more memories are coupled to the one or more processors, the one or more memories are used to store computer program codes, the computer program codes include computer instructions, and when the one or more processors execute the computer instructions, the electronic device executes the data transmission method as described in the first aspect or any possible design of the first aspect.

In a seventh aspect, a chip system is provided, the chip system including a processor and a communication interface, the chip system can be used to implement the function performed by the data transmission device in the first aspect or any possible design of the first aspect. In one possible design, the chip system also includes a memory, the memory is used to store program instructions and/or data. The chip system can be composed of a chip, or it can include a chip and other discrete devices, without limitation.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a CCN router forwarding process provided by an embodiment of the present application;

FIG2 is a schematic diagram of the structure of a data transmission system provided in an embodiment of the present application;

FIG3 is a schematic diagram of the structure of another data transmission system provided in an embodiment of the present application;

FIG4 is a schematic diagram of the structure of a CCN router provided in an embodiment of the present application;

FIG5 is a schematic diagram of the structure of a data transmission device provided in an embodiment of the present application;

FIG6 is a schematic diagram of a flow chart of a data transmission method provided in an embodiment of the present application;

FIG7 is a schematic diagram of the composition of an interest message provided in an embodiment of the present application;

FIG8 is a flow chart of another data transmission method provided in an embodiment of the present application;

FIG9 is a schematic diagram of the composition of a response message provided in an embodiment of the present application;

FIG10 is a schematic diagram of a flow chart of another data transmission method provided in an embodiment of the present application;

FIG11 is a schematic diagram of a flow chart of another data transmission method provided in an embodiment of the present application;

FIG. 12 is a schematic diagram of the structure of another data transmission device provided in an embodiment of the present application.

Detailed ways

In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

It should also be understood that the term “comprising” indicates the presence of described features, integers, steps, operations, elements and/or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements and/or components.

The following is an introduction to the professional terms involved in the application:

1. Trusted Execution Environment (TEE): It provides a secure area in the device through hardware, that is, to build a writable secure isolation area independent of the operating system in the chip, to ensure that privacy and sensitive data are stored and calculated in its isolated and trusted area, and the information in the secure area can only be accessed through the authorized interface, ensuring that the program code or private data will not be illegally obtained or tampered with by the operating system or other applications. All parties involved in the calculation can use remote authentication to verify the credibility of the environment. When the calculation is completed, the original data and process data can be destroyed in the TEE environment as required to avoid the risk of leakage.

As network traffic is growing, the data transmission efficiency under the TCP/IP architecture is getting worse and worse. P2P (Peer-to-Peer) systems such as Bit Torrent are widely used in the transmission of multimedia data, but their transmission efficiency is also not ideal, because peers can only obtain data blocks from a small part of peers. In general, peers only have very limited information when downloading the same content and network topology. ICN networks came into being in this context. ICN changes the current end-to-end communication mechanism of the Internet, separates content from terminal locations, and provides storage and multi-party communication services through publish/subscribe methods. The introduction of ICN changes the user's focus from the terminal to the content, that is, users no longer need to worry about where to get the data they want, but only need to care about what content they want.

The CCN network is a specific implementation of ICN. There are two main types of data packets in the CCN network: interest packets and data packets. In the CCN network, the content is determined by identifying the content, similar to the IP address prefix. For example: "/aaa.cn/video/wigeta.mpg", where aaa.cn is a name that can be recognized by the entire network, video is the content type, and wigeta.mpg is the content name. The request data packet is used to send a request for content. If the node that receives the request can satisfy the request, it will send the response data through the content data packet. The IO of the CCN network adopts hierarchical naming, and its global router system needs to process the IO name prefix at least at the content provider level. In addition, the forwarding state of each packet will guide the data packet to the user along the transmission path. The number of name prefixes in CCN will also reach the scale level of second-level domain names.

The CCN network node is used to store, forward and perform router tasks for data packets. The CCN network node may include a content store (CS), a pending interest table (PIT), and a forwarding information base (FIB).

Among them, the content storage is similar to the cache of an IP router, but the cached content will not be cleared after each communication. The content can be used for the next communication, which can help reduce content download time and network bandwidth usage.

The pending request table is used to record the request information that has passed, so that the requested content can be smoothly transmitted back to the requesting node in sequence. The content data packet is forwarded back to the content requester step by step according to the PIT prompt. When the content is transmitted back, the entry is deleted from the PIT.

The forwarding table is used to send a request data packet to a destination. For example, request data packets can be sent to multiple destinations at the same time.

In an example, Fig. 1 shows a schematic diagram of a CCN router forwarding process. In conjunction with Fig. 1 , the CCN router forwarding process may include the following S1-S6.

S1. The CCN router receives a request data message from a subscription terminal.

The request data message is used to request target content.

In practical applications, the specific form of the request data message may be a request data packet.

S2. The CCN router matches the content cache according to the request data message.

For example, if the content cache includes the target content, it is determined that the match is successful. If the content cache does not include the target content, it is determined that the match fails.

S3. If the match is successful, the target content is sent to the subscription terminal.

S4. If the match is successful, check whether the target content exists in the PIT.

S5. If there is an entry for the target content in the PIT, add the request port to the list.

In some embodiments, the CCN router may also request the data packet to intercept the request data packet.

It should be noted that the purpose of intercepting the request data packet is to prevent repeated requests for the same data. When a content data packet is responded, the content is sent to all ports requesting data.

S6. If there is no entry for the target content in the PIT, query the FIB and forward the request data packet to the next CCN router according to the instruction of the FIB.

The routers in the CCN network will cache the user's request content along the way. When other users have the same request content, the router can first determine whether the local cache has the request content. If so, it will directly feedback to the corresponding user. However, if multiple routers in the CCN network cache the request content, the risk of request content leakage will be greatly increased.

In view of this, an embodiment of the present application provides a data transmission method, which is applied to a content-centric network CCN; the CCN network is configured with a trusted execution environment TEE module and multiple CCN routers; the method includes: receiving a request message from a first terminal; the request message is used to request target content; using the TEE module to encrypt the target content, and caching the encrypted target content to the CCN router included in the path; the path is the path for the content-centric network to send the target content to the first terminal; using the CCN router included in the path to send the target content to the first terminal.

The method provided in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

It should be noted that the network system described in the embodiment of the present application is to more clearly illustrate the technical solution of the embodiment of the present application, and does not constitute a limitation on the technical solution provided in the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of network systems and the emergence of other network systems, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems.

Fig. 2 is a schematic diagram showing the structure of a data transmission system 10 provided in an embodiment of the present application. As shown in Fig. 2 , the data transmission system 10 may include a first terminal 11 , a CCN network 12 , and a second terminal 13 .

The first terminal 11 and the second terminal 13 are respectively connected to the CCN network 12. For example, the connection can be made wirelessly or by wire, without limitation.

Among them, the first terminal 11 (also referred to as a content requester) involved in the embodiments of the present application can be used to request target content from the CCN network 12. The first terminal 11 can also be referred to as a terminal, a mobile station (MS), a mobile terminal (MT), etc., and is a device that provides voice and/or data connectivity to users. For example, the first terminal 11 can be a handheld device with a wireless connection function, a vehicle-mounted device, etc. Specifically, it can be: a smart phone (mobile phone), a pocket personal computer (PPC), a handheld computer, a personal digital assistant (PDA), a laptop, a tablet computer, a wearable device, or a vehicle-mounted device, etc. The embodiments of the present application do not limit the specific technology, specific number, and specific device form adopted by the first terminal 11.

The CCN network 12 can be used to search for target content and send the target content to the first terminal 11, CCN network. The CCN network 12 can be an electronic device with processing functions such as a computer or a server. For example, the CCN network 12 can be a computer, a server, etc. Among them, the server can be a single server, or it can be a server cluster composed of multiple servers. In some implementations, the server cluster can also be a distributed cluster. The embodiments of the present application do not limit the specific technology, specific quantity and specific device form of the CCN network 12.

The second terminal 13 (also referred to as a content provider) can be used to provide target content. For example, the second terminal 13 can be a handheld device with a wireless connection function, a vehicle-mounted device, etc. Specifically, it can be: a smart phone (mobile phone), a pocket personal computer (PPC), a handheld computer, a personal digital assistant (PDA), a laptop computer, a tablet computer, a wearable device, or a vehicle-mounted device, etc. The embodiments of the present application do not limit the specific technology, specific number, and specific device form adopted by the second terminal 13.

Fig. 3 is a schematic diagram of the structure of another data transmission system 20 provided in an embodiment of the present application. As shown in Fig. 3, the data transmission system 20 may include a CCN router, a network key management center, a first terminal (which may be called a client), and a second terminal (which may be called a content publisher).

Among them, the CCN router is a router of the CCN network, which is used to forward CCN network messages. The CCN router deploys a hardware-based trusted execution environment and a TEE module (TEE confidential computing module) that performs TEE functions. The CCN router TEE module automatically generates the content signing key Kd and stores it in the TEE module. The Kd in each CCN router is not necessarily the same. For simplicity, the CCN local signing key is collectively referred to as Kd.

The network key management center is used to generate, publish and manage the CCN network key Kc; the network router key Kc: generated by the network key management center and published to the TEE module of all CCN servers in the network for storage. This key is used to encrypt network content. When the content encryption key needs to be updated, the network key management center generates a key update message, carrying the new key Kc' and its own authentication information, and transmits it through the local TEE to the TEE modules of all CCN routers in the network for replacement.

The client is the user application end of the CCN network, which is used to send interest messages, receive content response messages, and display relevant content to users.

Content publishers are content authors who publish corresponding content files to the CCN network.

Figure 4 shows a schematic diagram of the structure of a CCN router. As shown in Figure 4, the CCN router includes a content encryption judgment module, a TTE module, a CS module, a pending request table, and a forwarding table.

The content encryption determination module is used to determine whether to encrypt the target content. For example, it can determine whether to encrypt the target content based on the trust value corresponding to the target content.

The CS module is used to store plain text data of common content and to store encrypted data and data summaries of highly confidential content.

The TTE module, pending request table, and forward forwarding table can refer to the above description and will not be described in detail here.

Figures 2 and 3 are merely exemplary framework diagrams. The names of the various devices included in Figures 2 and 3 are not restricted, and in addition to the functional nodes shown in Figures 2 and 3, other nodes may also be included, which is not limited in the embodiments of the present application.

In specific implementation, each device in FIG. 2 and FIG. 3 may adopt the composition structure shown in FIG. 5, or include the components shown in FIG. 5. FIG. 5 is a schematic diagram of the structure of a data transmission device 200 provided in an embodiment of the present application. The data transmission device 200 may be a network device, or the data transmission device 200 may be a chip or system on chip in the network device. As shown in FIG. 5, the data transmission device 200 includes a processor 201, a communication interface 202, and a communication line 203.

Furthermore, the data transmission device 200 may further include a memory 204 . The processor 201 , the memory 204 and the communication interface 202 may be connected via a communication line 203 .

The processor 201 is a CPU, a general processor, a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 201 may also be other devices with processing functions, such as circuits, devices, or software modules, without limitation.

The communication interface 202 is used to communicate with other devices or other communication networks. The communication interface 202 can be a module, a circuit, a communication interface or any device capable of implementing communication.

The communication line 203 is used to transmit information between the components included in the data transmission device 200.

The memory 204 is used to store instructions, where the instructions may be computer programs.

The memory 204 may be a read-only memory (ROM) or other types of static storage devices that can store static information and/or instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and/or instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage media or other magnetic storage devices, etc., without limitation.

It should be noted that the memory 204 can exist independently of the processor 201, or can be integrated with the processor 201. The memory 204 can be used to store instructions or program codes or some data, etc. The memory 204 can be located inside the data transmission device 200, or outside the data transmission device 200, without limitation. The processor 201 is used to execute the instructions stored in the memory 204 to implement the data transmission method provided in the following embodiments of the present application.

In one example, the processor 201 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 5 .

As an optional implementation manner, the data transmission device 200 includes multiple processors. For example, in addition to the processor 201 in FIG. 5 , it may also include a processor 205 .

It should be pointed out that the component structure shown in Figure 5 does not constitute a limitation on the various devices in Figures 2 and 3. In addition to the components shown in Figure 5, the various devices in Figures 2 and 3 may include more or fewer components than those in Figure 5, or combine certain components, or arrange the components differently.

In the embodiment of the present application, the chip system may be composed of a chip, or may include a chip and other discrete devices.

In addition, the actions, terms, etc. involved in the various embodiments of the present application can refer to each other without limitation. The message names or parameter names in the messages exchanged between the various devices in the embodiments of the present application are only examples, and other names can also be used in the specific implementation without limitation.

In order to clearly describe the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with substantially the same functions and effects. Those skilled in the art can understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference.

It should be noted that, in this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

In this application, "at least one" means one or more, and "plurality" means two or more. "And/or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character "/" generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can mean: a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, c can be single or multiple.

The data transmission method provided in the embodiment of the present application is described below in conjunction with the data transmission systems shown in Figures 2 and 3.

FIG6 is a data transmission method provided by an embodiment of the present application, which is applied to a content-centric network CCN; the CCN network is configured with multiple CCN routers, and multiple CCN routers are configured with a trusted execution environment TEE module. As shown in FIG6 , the method includes the following S301-S303:

S301: Receive a request message from a first terminal.

The request message is used to request the target content. The type of the target content can be set as needed. For example, it can be text content, audio content, video content, etc.

The request message may include an interest message. The content of the interest message may be set as required. For example, as shown in FIG. 7 , the interest message may include: content name, selector, random number, trusted value, etc.

As a possible implementation, the first terminal may send a request message to the CCN network in response to a control instruction of the user on the CCN network client. Correspondingly, the CCN network receives the request message from the first terminal through the CCN network client data.

It should be noted that the trust value in the interest message can be used to indicate the importance of the target content. For example, the trust value can include a first trust value (for example, 1) and a second trust value (for example, 0).

When the trust value in the interest message is the first trust value, it can indicate that the target content is important content (or confidential content). When the trust value in the interest message is the second trust value, it can indicate that the target content is ordinary content.

In some embodiments, the request message may further include port information of the first terminal, so that the CCN network can send the target content to the first terminal according to the port information of the first terminal.

S302: For each CCN router included in the route path, the target content is encrypted using the TEE module of the CCN router, and the encrypted target content is cached in the CCN router included in the route path.

The path is the path for the CCN network to send the target content to the first terminal. In conjunction with Figure 2, when the CCN network does not cache the target content, the target content is stored in the content publisher, and the CCN routers included in the path may include CCN router 1 and CCN router 3. When the CCN network caches the target content, such as the target content is stored in CCN router 2, the CCN routers included in the path may include CCN router 1 and CCN router 2.

The target content is obtained by the CCN network in the CCN network according to the content identifier.

As another possible implementation, each CCN router in the CCN network path may encrypt all target contents using the TEE module of the CCN router, and cache the encrypted target contents in the CCN router included in the path.

As another possible implementation, each CCN router in the CCN network path may determine a trusted value corresponding to the target content, and encrypt the target content using a TEE module of the CCN router when the trusted identifier is the target trusted identifier.

For example, each CCN router in the CCN network path sends the target content to the confidential computing module in its own TEE module and encrypts it using the key Kc to generate the encrypted target content Ck, and generates the content summary Cd using the key Kd, and sends the content name, Ck, Cd, timestamp and other contents to the CS in the CCN network for storage.

In some embodiments, when the importance of the target content is low (eg, the configured trust value is 0), the CCN network may directly cache the target data in the CS.

S303: Send the target content to the first terminal by using the CCN router included in the route.

As a possible implementation manner, when the target content is not cached in the cache data of the CCN network, the CCN router in the CCN network may send the target content to the first terminal through the port record of the first terminal.

As another possible implementation, when the target content is cached in the cache data of the CCN network, the CCN router in the CCN network can verify the integrity of the target content and send the target content to the first terminal through the port record of the first terminal when the integrity has not changed.

Based on the technical solution provided by the present application, after receiving the request message from the first terminal, the target content is encrypted using the TEE module, and the encrypted target content is cached in the CCN router included in the path, and the target content is sent to the first terminal using the CCN router included in the path. That is, the present application constructs a new CCN network architecture by adding the TEE module. Since the TEE module is a secure area provided by the device in a hardware manner, the information in the secure area can only be accessed through the authorized interface. In this way, after the encrypted target content is cached in the CCN router included in the path, it is more difficult for a third party to decrypt or tamper with the target content, which can reduce the probability of the target content being decrypted or tampered with by a third party, and improve the security of cached data in the CCN network.

In a possible embodiment, as shown in FIG8 , in order to obtain target content, the data transmission method of the present application may further include the following S401 - S403 .

S401: Determine whether a forwarding information base (FIB) includes a content identifier.

The forward forwarding table includes a plurality of ports and a plurality of preset content identifiers included in each port.

As a possible implementation, the CCN network may send the content identifier to multiple CCN routers included in the CCN network, so that each CCN router determines whether its forwarding table includes the content identifier and sends the search result of the content identifier to the CCN network.

It should be noted that the reported data may include a first timestamp when the target passive IoT terminal sends the reported data, and the network device may determine the difference between the second timestamp and the first timestamp, and determine the difference as the delay of the reported data.

S402: When the forward forwarding table includes the content identifier, determine the target port corresponding to the content identifier from the forward forwarding table.

The target port is the port corresponding to the second terminal that generates the target content.

As a possible implementation manner, when the forward forwarding table of the target CCN router includes the content identifier, the CCN network may determine the target port corresponding to the content identifier through the forward forwarding table of the target CCN router.

In some embodiments, when the forward forwarding table does not include the content identifier, the CCN network can send a request message to all ports in the CCN network through a CCN router, so that the terminal corresponding to each port determines whether the target content exists according to the content identifier, and determines the port where the target content exists as the target port.

It can be understood that by fully forwarding the request message to all ports, the search time for the target content can be reduced and the search efficiency for the target content can be improved.

S403: Acquire target content from the target port.

As a possible implementation, the target terminal corresponding to the target port can generate a response message according to the request message, and send the response message to the CCN network through the target port. Correspondingly, the CCN network can obtain the response message from the target port of the target CCN router, and obtain the target content by parsing the response message.

It should be noted that, when the request message includes a trust value, the trust value in the response message is the same as the trust value in the request message. For example, when the trust value in the response message is 1, the trust value in the response message is also 1.

In an example, a schematic diagram of the composition of a response message is shown in Figure 9. As shown in Figure 9, the response message may include a content name, a selector, a random number, a trusted value, and a target content.

In some embodiments, the CCN network may determine whether the target content is cached in the cache data of the CCN network, and if the target content is cached in the cache data of the CCN network, obtain the target content from the cache data of the CCN network based on the content identifier.

In a possible embodiment, as shown in FIG. 10 , in order to determine whether the forwarding table includes a content identifier, S401 of the present application may specifically include the following S501 - S502 .

S501: Determine whether target content is cached in the cache data of the CCN network.

The cache data may specifically be cache data in a CCN router, for example, cache data in a CS (content storage).

As a possible implementation manner, a CCN router in the CCN network may search cache data in a local CS (content storage) according to the content identifier to see whether the target content is cached.

S502: When the target content is not cached in the cache data of the CCN network, determine whether the forwarding table includes a content identifier.

A possible embodiment, as shown in Figure 11, when the target content is cached in the cache data of the CCN network, the TEE module stores the original digital signature corresponding to each target content. In order to use the CCN router included in the path to send the target content to the first terminal, S303 in this application may include the following S601-S603.

S601: Obtain a content summary of the target content.

The content summary is pre-stored in the slave cache data.

As a possible implementation manner, the CCN network may obtain a content summary of the target content from cache data through a CCN router.

In some embodiments, when the content summary of the target content is not stored in the cache data, the CCN network may use a preset summary generation algorithm to obtain the content summary of the target content.

S602: Use the content signing key in the TEE module to process the content summary and generate a digital signature corresponding to the target content at the current moment.

In one example, when the target content is encrypted content, the CCN network can transmit the encrypted target content (Ck) and content summary (Cd) to the TEE module (also known as the confidential computing function module) to generate a digital signature corresponding to the target content at the current moment.

It should be noted that the key corresponding to the encrypted content is stored in the TEE module of the CCN router. Unauthorized applications, codes, and even administrators cannot steal and tamper with the keys in the TEE module of the CCN router.

S603: When the digital signature at the current moment is the same as the original digital signature, the CCN network sends the target content to the first terminal by using the CCN router included in the route.

In some embodiments, when the digital signature at the current moment is different from the original digital signature, the CCN network may discard the target content and delete the target content in the cached data.

It is understandable that when the network device receives the reported data sent by the target passive IoT terminal and the reported data meets the preset conditions, the relay device disconnects from the target passive IoT terminal. That is, when the quality of the uplink signal transmitted by the target passive IoT terminal is good, the relay device stops transmitting uplink data to the target passive IoT terminal, avoiding the receiving of the same uplink data repeatedly sent by the relay device and the target passive IoT, thereby improving resource utilization.

The various solutions in the above embodiments of the present application can be combined without contradiction.

The embodiment of the present application can divide the data transmission device into functional modules or functional units according to the above method example. For example, each functional module or functional unit can be divided according to each function, or two or more functions can be integrated into one processing module. The above integrated module can be implemented in the form of hardware or in the form of software functional modules or functional units. Among them, the division of modules or units in the embodiment of the present application is schematic, which is only a logical function division. There may be other division methods in actual implementation.

In the case of dividing each functional module according to each function, FIG12 shows a schematic diagram of the structure of a data transmission device 700, which can be a data transmission device or a chip used in a data transmission device. The data transmission device 700 can be used to perform the functions of the data transmission device involved in the above embodiment. The data transmission device 700 shown in FIG12 may include: a receiving unit 701, a processing unit 702, and a sending unit 703; the receiving unit 701 is used to receive a request message from the first terminal; the request message is used to request the target content; the processing unit 702 is used to encrypt the target content using the TEE module of the CCN router for each CCN router included in the path, and cache the encrypted target content to the CCN router included in the path; the path is the path for the CCN network to send the target content to the first terminal; the sending unit 703 is used to send the target content to the first terminal using the CCN router included in the path.

Optionally, the request message includes a content identifier of the target content; the processing unit 702 is further configured to: obtain the target content in the CCN network according to the content identifier.

Optionally, the processing unit 702 is specifically used to: determine whether the forward forwarding table includes a content identifier; the forward forwarding table includes multiple ports and multiple preset content identifiers included in each port; when the forward forwarding table includes the content identifier, determine the target port corresponding to the content identifier from the forward forwarding table; and obtain the target content from the target port.

Optionally, the processing unit 702 is further configured to: determine whether the target content is cached in the cache data of the CCN network; and if the target content is not cached in the cache data of the CCN network, determine whether the forward forwarding table includes the content identifier.

Optionally, the processing unit 702 is further configured to: when the target content is cached in the cache data of the CCN network, obtain the target content from the cache data of the CCN network based on the content identifier.

Optionally, the request message also includes a trusted identifier of the target content; the trusted identifier is used to indicate the importance of the target content; the processing unit 702 is specifically used to: when the trusted identifier is a target trusted identifier, use the TEE module of the CCN router to encrypt the target content.

Optionally, when the target content is cached in the cache data of the CCN network, the TEE module stores the original digital signature corresponding to each target content, and the sending unit 703 is specifically used to: obtain a content summary of the target content; use the content signature key in the TEE module to process the content summary to generate a digital signature at the current moment corresponding to the target content; when the digital signature at the current moment is the same as the original digital signature, use the CCN router included in the path to send the target content to the first terminal.

The embodiment of the present application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be completed by a computer program to instruct the relevant hardware, and the program can be stored in the above computer-readable storage medium. When the program is executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be an internal storage unit of the data transmission device (including the data sending end and/or the data receiving end) of any of the above embodiments, such as a hard disk or memory of the data transmission device. The above computer-readable storage medium can also be an external storage device of the above terminal device, such as a plug-in hard disk equipped on the above terminal device, a smart memory card (smart media card, SMC), a secure digital (secure digital, SD) card, a flash card (flash card), etc. Further, the above computer-readable storage medium can also include both the internal storage unit of the above data transmission device and an external storage device. The above computer-readable storage medium is used to store the above computer program and other programs and data required by the above data transmission device. The above computer-readable storage medium can also be used to temporarily store data that has been output or is to be output.

It should be noted that the terms "first" and "second" in the specification, claims and drawings of the present application are used to distinguish different objects rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

It should be understood that in the present application, "at least one (item)" means one or more, "more than one" means two or more, "at least two (items)" means two or three and more than three, and "and/or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and/or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character "/" generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may be one physical unit or multiple physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions to enable a device (which can be a single-chip microcomputer, chip, etc.) or a processor (processor) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks or optical disks.

The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto, and any changes or substitutions within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims (10)

1. A data transmission method, characterized by being applied to a content centric network CCN; the CCN network is configured with a plurality of CCN routers, and the plurality of CCN routers are configured with a Trusted Execution Environment (TEE) module; the method comprises the following steps:

receiving a request message from a first terminal; the request message is used for requesting target content;

Encrypting the target content by using a TEE module of each CCN router included in the path, and caching the encrypted target content into the CCN router included in the path; the path is a path for the CCN to send the target content to the first terminal;

And transmitting the target content to the first terminal by using the CCN router included in the path.

2. The method of claim 1, wherein the request message includes a content identification of the target content; the method further comprises the steps of:

And acquiring the target content in the CCN according to the content identification.

3. The method of claim 2, wherein the target content is obtained in the CCN network according to the content identification; comprising the following steps:

Determining whether a forward forwarding table includes the content identification; the forward forwarding table comprises a plurality of ports and a plurality of preset content identifiers contained in each port;

determining a target port corresponding to the content identifier from the forward forwarding table under the condition that the forward forwarding table comprises the content identifier;

And acquiring the target content from the target port.

4. The method of claim 3, wherein the determining whether the forward forwarding table includes the content identification comprises:

determining whether the target content is cached in the cache data of the CCN;

and under the condition that the target content is not cached in the cache data of the CCN, determining whether the content identification exists in the forward forwarding table.

5. The method of claim 4, wherein the obtaining the target content in the CCN network based on the content identification comprises:

and under the condition that the target content is cached in the cache data of the CCN, acquiring the target content from the cache data of the CCN based on the content identification.

6. The method of claim 5, wherein the transmitting the target content to the first terminal using the CCN router included in the pathway path comprises:

Under the condition that the target content is cached in the cache data of the CCN, obtaining a content abstract of the target content; the TEE module stores an original digital signature corresponding to each target content;

processing the content abstract by using a content signing key in the TEE module to generate a digital signature of the current moment corresponding to the target content;

And under the condition that the digital signature at the current moment is the same as the original digital signature, the CCN router included in the path is utilized to send the target content to the first terminal.

7. The method according to any of claims 1-6, wherein the request message further comprises a trusted identification of the target content; the trusted identifier is used for indicating the importance degree of the target content; the encrypting the target content by using the TEE module of the CCN router includes:

And under the condition that the trusted identifier is a target trusted identifier, encrypting the target content by using a TEE module of the CCN router.

8. A data transmission device, characterized by being applied to a content-centric network CCN; the CCN network is configured with a plurality of CCN routers, and the plurality of CCN routers are configured with a Trusted Execution Environment (TEE) module; the device comprises: the device comprises a receiving unit, a processing unit and a sending unit;

The receiving unit is used for receiving a request message from the first terminal; the request message is used for requesting target content;

The processing unit is configured to encrypt, for each CCN router included in the path, the target content by using a TEE module of the CCN router, and cache the encrypted target content into the CCN router included in the path; the path is a path for the CCN to send the target content to the first terminal;

The sending unit is configured to send the target content to the first terminal by using a CCN router included in the path.

9. A computer readable storage medium having instructions stored therein which, when executed, implement the method of any of claims 1-7.

10. An electronic device, comprising: a processor, a memory, and a communication interface; wherein the communication interface is used for the electronic equipment to communicate with other equipment or network; the memory is configured to store one or more programs, the one or more programs comprising computer-executable instructions that, when executed by the electronic device, cause the processor to execute the computer-executable instructions stored by the memory to cause the electronic device to perform the method of any of claims 1-7.