CN118827010A - Information transmission method, device, equipment and storage medium - Google Patents

Abstract

The application discloses an information transmission method, an information transmission device, information transmission equipment and a storage medium. Wherein the method comprises the following steps: encrypting a first random number, a second random number, an identifier of a first device and an identifier of a first optical module in the first device to obtain first information; and sending the first information to a second device, wherein the first information is used for authenticating the first device by the second device.

Description

Information transmission method, device, equipment and storage medium

Technical Field

The present application relates to the field of wireless communication technology, and in particular to an information transmission method, device, equipment and storage medium.

Background Art

At present, any device connected to Ethernet can receive the transmission data, which makes network attacks more likely to occur in Ethernet. Data encryption, secure communication protocols, and physical security enhancements can be taken to prevent network attacks. Existing network encryption mechanisms include the Transport Layer Security (TLS) protocol, the Internet Protocol Security (IPSec) protocol, and the Media Access Control Security (MACSec) protocol at the link layer, which are used to provide security services at different network levels. The Physical Security (PHYSec) protocol is a security encryption technology that works at the Ethernet physical layer and encrypts and decrypts the bit stream at the physical layer. PHYSec can protect all upper-layer protocols and data, conceal traffic characteristics, and has extremely high security. In related technologies, in the process of authenticating devices in Ethernet, the legitimacy of the optical module cannot be confirmed, and there are certain security risks.

Summary of the invention

In view of this, embodiments of the present application hope to provide an information transmission method, apparatus, device and storage medium.

The technical solution of the embodiment of the present application is implemented as follows:

The present application provides an information transmission method, which is applied to a first device, and the method includes:

Encrypting a first random number, a second random number, an identifier of the first device, and an identifier of a first optical module in the first device to obtain first information;

The first information is sent to a second device, wherein the first information is used by the second device to authenticate the first device.

In addition, according to at least one embodiment of the present application, the method further includes:

The identifier of the first optical module is read from a memory of the first optical module in the first device.

In addition, according to at least one embodiment of the present application, encrypting the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device includes:

Get the pre-configured shared key;

The shared key is used to encrypt the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device.

In addition, according to at least one embodiment of the present application, the method further includes:

receiving second information; the second information is obtained by encrypting the first random number, the identifier of the second device, and the identifier of the second optical module in the second device by the second device using a preconfigured shared key;

Based on the second information, the second device is authenticated.

In addition, according to at least one embodiment of the present application, authenticating the second device based on the second information includes:

Decrypting the first random number, the identifier of the second device, and the identifier of the second optical module in the second device in the second information by using the preconfigured shared key to obtain the identifier of the second optical module;

Determining whether the second optical module is legal according to the identifier of the second optical module;

When it is determined that the second optical module is legal, encrypt the first random number, the identifier of the second device, and the identifier of the second optical module obtained by decryption by using a preconfigured shared key to obtain third information;

Comparing the third information with the second information to obtain a comparison result;

When the comparison result indicates that the third information is identical to the second information, it is determined that the second device is a legitimate device.

In addition, according to at least one embodiment of the present application, the method further includes:

sending a first message to and from the second device;

If the first message sent by the second device is not received within a preset time period, the current security port is closed.

In addition, according to at least one embodiment of the present application, the method further includes:

After the second device passes authentication, obtaining a physical layer link state;

If the physical layer link state is disconnected, the authentication of the legitimacy of the second device becomes invalid;

After the authentication of the second device fails, obtaining the physical layer link status again;

If the physical layer link state is a connected state, the legitimacy of the second device is re-authenticated.

In addition, according to at least one embodiment of the present application, the method further includes:

After the second device passes authentication, obtaining a physical layer link state;

If the physical layer link state is a disconnected state, opening a timing window, and not re-authenticating the legitimacy of the second device within the timing window;

After the timing window ends, obtaining the physical layer link status again;

If the physical layer link state obtained again is a connected state, the legitimacy of the second device is re-authenticated, and the timing window ends;

If the physical layer link state obtained again is a disconnected state, the authentication of the legitimacy of the second device becomes invalid, and the next timing window is opened.

The present application provides an information transmission method, which is applied to a second device, and the method includes:

Receive first information; the first information is obtained by the first device encrypting a first random number, a second random number, an identifier of the first device, and an identifier of a first optical module in the first device;

Based on the first information, the first device is authenticated.

In addition, according to at least one embodiment of the present application, authenticating the first device based on the first information includes:

Decrypting the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device in the first information by using a preconfigured shared key to obtain the identifier of the first optical module;

determining, according to the second identifier, whether the first optical module is legal;

When it is determined that the first optical module is legal, encrypt the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module obtained by decryption by using a preconfigured shared key to obtain fourth information;

Comparing the fourth information with the first information to obtain a comparison result;

When the comparison result indicates that the fourth information is identical to the first information, it is determined that the first device is a legitimate device.

In addition, according to at least one embodiment of the present application, the method further includes:

Get the pre-configured shared key;

Using the shared key, encrypt the first random number, the identifier of the second device, and the identifier of the second optical module in the second device to obtain second information;

The second information is sent to the first device; wherein the second information is used by the first device to authenticate the second device.

In addition, according to at least one embodiment of the present application, the method further includes:

The identifier of the second optical module is read from the memory of the second optical module in the second device.

In addition, according to at least one embodiment of the present application, the method further includes:

Sending a first message to and from the first device;

If the first message sent by the first device is not received within a preset time period, the current security port is closed.

In addition, according to at least one embodiment of the present application, the method further includes:

After the first device passes authentication, obtaining a physical layer link state;

If the physical layer link state is disconnected, the authentication of the legitimacy of the first device becomes invalid;

After the authentication of the first device fails, obtaining the physical layer link status again;

If the physical layer link state is a connected state, the legitimacy of the first device is re-authenticated.

In addition, according to at least one embodiment of the present application, the method further includes:

After the first device passes authentication, obtaining a physical layer link state;

If the physical layer link state is a disconnected state, opening a timing window, and not re-authenticating the legitimacy of the first device within the timing window;

After the timing window ends, obtaining the physical layer link status again;

If the physical layer link state obtained again is a connected state, the legitimacy of the first device is re-authenticated, and the timing window ends;

If the physical layer link state obtained again is a disconnected state, the authentication of the legitimacy of the first device becomes invalid, and the next timing window is opened.

The present application provides an information transmission device, including:

A first processing module, configured to encrypt a first random number, a second random number, an identifier of the first device, and an identifier of a first optical module in the first device to obtain first information;

A sending module is used to send the first information to a second device, wherein the first information is used by the second device to authenticate the first device.

The present application provides an information transmission device, including:

A receiving module, used to receive first information; the first information is obtained by encrypting the first random number, the second random number, the identifier of the first device and the identifier of the first optical module in the first device by the second device;

A second processing module is configured to authenticate the first device based on the first information.

At least one embodiment of the present application provides a first device, including a processor and a memory for storing a computer program that can be run on the processor.

Wherein, when the processor is used to run the computer program, it executes the steps of any method on the first device side.

At least one embodiment of the present application provides a second device, including a processor and a memory for storing a computer program that can be run on the processor.

Wherein, when the processor is used to run the computer program, it executes the steps of any method on the second device side.

The information transmission method, apparatus, device and storage medium provided in the embodiments of the present application encrypt a first random number, a second random number, an identifier of the first device and an identifier of the first optical module in the first device to obtain first information; and send the first information to a second device, wherein the first information is used by the second device to authenticate the first device.

By adopting the technical solution provided in the embodiment of the present application, in the process of authenticating the first device, in addition to adding the identification of the first device to the authentication process, the unique identification of the first optical module of the first device is also added to the authentication process, thereby ensuring the legitimacy of the device and the optical module.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of a first implementation flow of an information transmission method according to an embodiment of the present application;

FIG2 is a second schematic diagram of the implementation flow of the information transmission method according to an embodiment of the present application;

3 is a schematic diagram of a system architecture for an information transmission method according to an embodiment of the present application;

FIG4 is a schematic diagram of a specific implementation flow of the information transmission method according to an embodiment of the present application;

5 is a schematic diagram of determining whether the other end is online through the physical layer link status according to an embodiment of the present application;

FIG6 is a schematic diagram of the first structure of the information transmission device according to an embodiment of the present application;

FIG7 is a second schematic diagram of the structure of the information transmission device according to an embodiment of the present application;

FIG8 is a schematic diagram of the composition structure of the first device according to an embodiment of the present application;

FIG. 9 is a schematic diagram of the composition structure of the second device according to an embodiment of the present application.

DETAILED DESCRIPTION

Before introducing the technical solutions of the embodiments of the present application, the related technologies are first introduced.

Currently, Ethernet is widely used in data centers, carrier networks, industrial Internet, Internet of Things, automotive Ethernet and other scenarios. Its security is directly related to the business production of key industries such as telecommunications, energy, transportation, electricity, finance, etc., and may even pose a threat to human life and national security. Since Ethernet is a shared communication link, any device connected to Ethernet can receive the transmitted data, making network attacks more likely to occur in Ethernet. With the emergence of 800Gbps and 1.6Tbps Ethernet, the amount of data transmitted by Ethernet links has increased sharply, and the damage and impact caused by network attacks are more significant.

To this end, measures such as data encryption, secure communication protocols, and physical security enhancements are needed to prevent eavesdropping attacks.

Existing network encryption mechanisms include transport layer TLS, network layer IPSec, and link layer MACSec, which provide security services at different network levels. Physical layer security (PHYSec) is a security encryption technology that works at the Ethernet physical layer and encrypts and decrypts the bit stream of the physical layer. The identity authentication mechanism of PHYSec is mainly to ensure that the two ends of the communication are legitimate Ethernet devices. Traditional Ethernet authentication methods are based on the authentication methods of link layer device (such as switches) ports, such as 802.1X, MAC address authentication, etc.

PHYSec is a security encryption technology that works at the Ethernet physical layer and encrypts and decrypts the bit stream at the physical layer. The Ethernet frame header at the data link layer and the IP header at the network layer are both payloads of the physical layer bit stream. Therefore, PHYSec can protect all upper layer protocols and data, mask traffic characteristics, and has extremely high security.

In the related art, the PHYSec identity authentication only uses the information of the communication device during the authentication process, and does not use the information of the optical module on the interface, so the legitimacy of the optical module cannot be confirmed, which poses certain security risks.

Based on this, in an embodiment of the present application, the first random number, the second random number, the identifier of the first device and the identifier of the first optical module in the first device are encrypted to obtain first information; the first information is sent to the second device, wherein the first information is used by the second device to authenticate the first device.

Referring to FIG. 1 , FIG. 1 is a schematic diagram of an implementation flow of an information transmission method according to an embodiment of the present application, which is applied to a first device. The method includes steps 101 to 102:

Step 101: encrypt a first random number, a second random number, an identifier of a first device, and an identifier of a first optical module in the first device to obtain first information.

As an example, the first random number is generated by the first device.

As an example, the second random number is generated by the second device.

As an example, before the first device determines the first information, the second device may send the generated second random number to the first device.

As an example, the first random number and the second random number may be generated by a random function, wherein the random function may be RAND().

As an example, the identification of the first device may be obtained from a local memory of the first device.

In some embodiments, the method further comprises:

The identifier of the first optical module is read from a memory of the first optical module in the first device.

As an example, the memory may refer to an Electrically-Erasable Programmable Read-Only Memory (EEPROM), but includes but is not limited to EEPROM.

As an example, the first optical module is a core component in a communication network. The first optical module supports hot plugging and can be inserted into the first device for use.

As an example, the first device may read the identifier of the first optical module stored in the EEPROM of the first optical module into the device through an IIC interface.

Step 102: Send the first information to a second device, wherein the first information is used by the second device to authenticate the first device.

In some embodiments, encrypting the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device includes:

Get the pre-configured shared key;

The shared key is used to encrypt the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device.

As an example, the preconfigured shared key may refer to PSK.

As an example, the first device may send a first request to a server, where the first request is used to request a preconfigured shared key; the server responds to the first request, authenticates the first device, and configures the shared key to the first device after the first device passes the authentication.

The server may generate the shared key by using a random number generator, and the server may obtain the identifier of the first device. When the identifier of the first device is stored in a local database, it is determined that the first device has passed the authentication.

In some embodiments, the method further comprises:

receiving second information; the second information is obtained by encrypting the first random number, the identifier of the second device and the identifier of the second optical module in the second device by the second device using a preconfigured shared key; the first random number is generated by the first device;

Based on the second information, the second device is authenticated.

As an example, before the first device receives the second information sent by the second device, the first device may send the first random number to the second device.

As an example, the first information sent by the first device to the second device is obtained by encrypting the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device, and the second information sent by the second device to the first device is obtained by encrypting the first random number, the identifier of the second device, and the identifier of the second optical module in the second device. In this way, it is prevented that other devices pretend to be the second device and send authentication information to the first identity in the event of a network attack.

As an example, the second device may also encrypt the second random number, the identifier of the second device, and the identifier of the second optical module in the second device by using a preconfigured shared key.

As an example, the second device may obtain the identification of the second device from a local memory of the second device and send the identification to the first device.

As an example, the second device may read the identification of the second optical module from a memory of the second optical module in the second device.

As an example, the memory may refer to EEPROM, but includes but is not limited to EEPROM.

As an example, the second optical module is a core component in a communication network. The second optical module supports hot plugging and can be inserted into the second device for use.

In some embodiments, authenticating the second device based on the second information includes:

Decrypting the first random number, the identifier of the second device, and the identifier of the second optical module in the second device in the second information by using the preconfigured shared key to obtain the identifier of the second optical module;

Determining whether the second optical module is legal according to the identifier of the second optical module;

When it is determined that the second optical module is legal, encrypt the first random number, the identifier of the second device, and the identifier of the second optical module obtained by decryption by using a preconfigured shared key to obtain third information;

Comparing the third information with the second information to obtain a comparison result;

When the comparison result indicates that the third information is identical to the second information, it is determined that the second device is a legitimate device.

As an example, the first device may locally store the serial number of the second optical module in the second device. After the first device decodes the second information to obtain the identifier of the second optical module, the decoded identifier of the second optical module is compared with the locally stored serial number of the second optical module. If the two are the same, the second optical module is determined to be legal; otherwise, the second optical module is determined to be illegal.

As an example, a database may be stored in the server, in which the serial number of the second optical module in the second device is stored. After the first device decodes the second information to obtain the identifier of the second optical module, the database may be obtained from the server, and a query may be made as to whether the database contains the identifier of the decoded second optical module. If the database contains the identifier of the decoded second optical module, the second optical module is determined to be legal; otherwise, the second optical module is determined to be illegal.

As an example, after the first device decodes the second information to obtain the identifier of the second optical module, the decoded identifier of the second optical module can also be sent to the server, and the server queries whether the database contains the decoded identifier of the second optical module. If the database contains the decoded identifier of the second optical module, an indication message is sent to the first device, and the indication message is used to indicate that the second optical module is legal; otherwise, an indication message is sent to the first device, and the indication message is used to indicate that the second optical module is illegal.

As an example, the first information and the second information may be two sequences, which may be sequences consisting of 0 and 1. When the two sequences are the same, the second device is determined to be a legitimate device. Furthermore, the two sequences may be converted into corresponding character strings respectively. When the two character strings are the same, the second device is determined to be a legitimate device.

Here, there is no restriction on the encryption algorithm as long as it meets the security requirements. It can be based on the AES-Cipher-base Message Authentication Code (CMAC) algorithm of the Advanced Encrypted Standard (AES).

It should be noted that during the authentication process of the first device to the second device, in addition to adding the identifier of the second device to the authentication process, the unique identifier of the second optical module of the second device is also added to the authentication process, thereby ensuring the legitimacy of the second device and the second optical module.

In some embodiments, the method further comprises:

sending a first message to and from the second device;

If the first message sent by the second device is not received within a preset time period, the current security port is closed.

In some embodiments, the method further comprises:

After the second device passes authentication, obtaining a physical layer link state;

If the physical layer link state is disconnected, the authentication of the legitimacy of the second device becomes invalid;

After the authentication of the second device fails, obtaining the physical layer link status again;

If the physical layer link state is a connected state, the legitimacy of the second device is re-authenticated.

As an example, the physical layer link state includes a connected state (up) and a disconnected state (down).

In some embodiments, the method further comprises:

After the second device passes authentication, obtaining a physical layer link state;

If the physical layer link state is a disconnected state, opening a timing window, and not re-authenticating the legitimacy of the second device within the timing window;

After the timing window ends, obtaining the physical layer link status again;

If the physical layer link state obtained again is a connected state, the legitimacy of the second device is re-authenticated, and the timing window ends;

If the physical layer link state obtained again is a disconnected state, the authentication of the legitimacy of the second device becomes invalid, and the next timing window is opened.

In the embodiment of the present application, the following advantages are possessed:

(1) In the process of authenticating the first device, in addition to adding the identifier of the first device to the authentication process, the unique identifier of the first optical module of the first device is also added to the authentication process, thereby ensuring the legitimacy of the device and the optical module.

(2) The optical module identification-based authentication mechanism technology is one of the key technologies to implement the PHYSec solution. The PHYSec authentication mechanism integrates the optical module’s unique identity (ID) into the authentication process, ensuring the legitimacy of both the device and the optical module.

Referring to FIG. 2 , FIG. 2 is a schematic diagram of an implementation flow of an information transmission method according to an embodiment of the present application, which is applied to a second device. The method includes steps 201 to 202:

Step 201: Receive first information; the first information is obtained by encrypting a first random number, a second random number, an identifier of the first device, and an identifier of a first optical module in the first device by a first device.

As an example, the first random number is generated by the first device.

As an example, the second random number is generated by the second device.

As an example, during the process in which the first device determines the first information, the second device may send a generated second random number to the first device.

As an example, the first random number and the second random number may be generated by a random function, wherein the random function may be RAND().

As an example, the identification of the first device may be obtained by the first device from a local memory of the first device.

As an example, the first device may read the identification of the first optical module from a memory of the first optical module in the first device.

As an example, the memory may refer to EEPROM, but includes but is not limited to EEPROM.

As an example, the first optical module is a core component in a communication network. The first optical module supports hot plugging and can be inserted into the first device for use.

As an example, the first device may read the identifier of the first optical module stored in the EEPROM of the first optical module into the device through an IIC interface.

As an example, the first device may obtain a preconfigured shared key, and use the preconfigured shared key to encrypt the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device to obtain the first information.

As an example, the preconfigured shared key may refer to PSK.

As an example, the first device may send a first request to a server, where the first request is used to request a preconfigured shared key; the server responds to the first request, authenticates the first device, and configures the shared key to the first device after the first device passes the authentication.

The server may generate the shared key by using a random number generator, and the server may obtain the identifier of the first device. When the identifier of the first device is stored in a local database, it is determined that the first device has passed the authentication.

Step 202: Authenticate the first device based on the first information.

In some embodiments, authenticating the first device based on the first information includes:

Decrypting the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device in the first information by using a preconfigured shared key to obtain the identifier of the first optical module;

determining, according to the second identifier, whether the first optical module is legal;

When it is determined that the first optical module is legal, encrypt the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module obtained by decryption by using a preconfigured shared key to obtain fourth information;

Comparing the fourth information with the first information to obtain a comparison result;

When the comparison result indicates that the fourth information is identical to the first information, it is determined that the first device is a legitimate device.

As an example, the second device may locally store the serial number of the first optical module in the first device. After the second device decodes the first information to obtain the identifier of the first optical module, the decoded identifier of the first optical module is compared with the serial number of the first optical module stored locally. If the two are the same, the first optical module is determined to be legal; otherwise, the first optical module is determined to be illegal.

As an example, a database may be stored in the server, in which the serial number of the first optical module in the first device is stored. After the second device decodes the first information to obtain the identifier of the first optical module, the database may be obtained from the server, and a query may be made as to whether the database contains the identifier of the decoded first optical module. If the database contains the identifier of the decoded first optical module, the first optical module is determined to be legal; otherwise, the first optical module is determined to be illegal.

As an example, after the second device decodes the first information to obtain the identifier of the first optical module, the decoded identifier of the first optical module can also be sent to the server, and the server queries whether the database contains the decoded identifier of the first optical module. If the database contains the decoded identifier of the first optical module, an indication message is sent to the second device, and the indication message is used to indicate that the first optical module is legal; otherwise, an indication message is sent to the second device, and the indication message is used to indicate that the first optical module is illegal.

Here, there is no restriction on the encryption algorithm, as long as it meets the security requirements, and it can be based on the AES-CMAC algorithm of AES.

It should be noted that during the authentication process of the first device by the second device, in addition to adding the identification of the first device to the authentication process, the unique identification of the first optical module of the first device is also added to the authentication process, thereby ensuring the legitimacy of the first device and the first optical module.

In some embodiments, the method further comprises:

Get the pre-configured shared key;

Using the shared key, encrypting the first random number, the identifier of the second device, and the identifier of the second optical module in the second device to obtain second information; the first random number is generated by the first device;

The second information is sent to the first device; wherein the second information is used by the first device to authenticate the second device.

As an example, before the first device receives the second information sent by the second device, the first device may send the first random number to the second device.

As an example, the second device may obtain the identification of the second device from a local memory of the second device and send the identification to the first device.

As an example, the second optical module is a core component in a communication network. The second optical module supports hot plugging and can be inserted into the second device for use.

In some embodiments, the method further comprises:

The identifier of the second optical module is read from the memory of the second optical module in the second device.

As an example, the memory may refer to EEPROM, but includes but is not limited to EEPROM.

In some embodiments, the method further comprises:

Sending a first message to and from the first device;

If the first message sent by the first device is not received within a preset time period, the current security port is closed.

In some embodiments, the method further comprises:

After the first device passes authentication, obtaining a physical layer link state;

If the physical layer link state is disconnected, the authentication of the legitimacy of the first device becomes invalid;

After the authentication of the first device fails, obtaining the physical layer link status again;

If the physical layer link state is a connected state, the legitimacy of the first device is re-authenticated.

As an example, the physical layer link state includes a connected state (up) and a disconnected state (down).

In some embodiments, the method further comprises:

After the first device passes authentication, obtaining a physical layer link state;

If the physical layer link state is a disconnected state, opening a timing window, and not re-authenticating the legitimacy of the first device within the timing window;

After the timing window ends, obtaining the physical layer link status again;

If the physical layer link state obtained again is a connected state, the legitimacy of the first device is re-authenticated, and the timing window ends;

If the physical layer link state obtained again is a disconnected state, the authentication of the legitimacy of the first device becomes invalid, and the next timing window is opened.

In the embodiment of the present application, the following advantages are possessed:

(1) In the process of authenticating the first device, in addition to adding the identifier of the first device to the authentication process, the unique identifier of the first optical module of the first device is also added to the authentication process, thereby ensuring the legitimacy of the device and the optical module.

(2) The optical module identification-based authentication mechanism technology is one of the key technologies to implement the PHYSec solution. The PHYSec authentication mechanism integrates the optical module’s unique identity (ID) into the authentication process, ensuring the legitimacy of both the device and the optical module.

See FIG. 3 , which is a schematic diagram of a system architecture of an information transmission method according to an embodiment of the present application, wherein the system includes:

A management system is used for the first device and the second device to obtain a pre-configured shared key.

The first device is used to obtain a preconfigured shared key; use the shared key to encrypt a first random number, a second random number, an identifier of the first device, and an identifier of a first optical module in the first device to obtain first information; and send the first information to a second device.

The second device is used to receive the first information; and authenticate the first device based on the first information.

The second device is also used to obtain a preconfigured shared key; use the shared key to encrypt the first random number, the identifier of the second device and the identifier of the second optical module in the second device to obtain second information; and send the second information to the first device.

The first device is further used to receive the second information; and authenticate the second device based on the second information.

Referring to FIG. 4 , FIG. 4 is a schematic diagram of a specific implementation flow of the information transmission method according to an embodiment of the present application, wherein the method comprises steps 401 to 410:

Step 401: The administrator pre-configures a shared key PSK for two communication devices through the management system.

Step 402: The first device Bob receives a second random number.

Here, the second device Alice generates a second random number and sends it to the first device Bob.

Here, the number of bits of the second random number may be 256 bits.

Here, the second random number is represented by random number A.

Step 403: After receiving the second random number, the first device Bob generates a first random number.

Here, the number of bits of the first random number may be 256 bits.

Here, the first random number is represented by a random value B.

Step 404: the first device Bob reads the identifier of the first optical module from the EEPROM of the first optical module, and obtains the identifier of the first device Bob from the local memory.

Step 405: The first device Bob uses a preconfigured shared key PSK to perform an encryption operation on the first random number, the second random number, the identifier of the first device Bob, and the identifier of the first optical module to obtain first information.

Here, the first random number is represented by a random value B.

Here, the second random number is represented by random number A.

Here, the identification of the first device is express.

Here, the identification of the first optical module is express.

Here, the first information is express.

Step 406: The first device Bob sends the first random number, the identifier of the first device Bob, and the first information to the second device Alice.

Step 407: the second device Alice receives the first random number, the identifier of the first device Bob and the first information, and authenticates the first device Bob based on the first random number, the identifier of the first device Bob and the first information.

Here, the second device Alice authenticates the first device Bob, including:

First, after receiving the first information, the second device Alice uses the shared key PSK preconfigured on the local end to decrypt the first information and obtain the identifier of the first optical module.

Here, the first information is express.

Here, the identification of the first optical module is express.

Second, based on the identifier of the first optical module, determine whether the first optical module is legal.

Here, the process of determining whether the first optical module is legal has been described above and will not be repeated here.

Here, the first optical module is represented by optical module B.

Third, if the first optical module is legal, the first random number, the second random number, the identifier Bob of the first device and the identifier of the first optical module obtained by decryption are encrypted using a preconfigured shared key to obtain fourth information.

Here, the fourth information is used express.

Here, there is no restriction on the encryption algorithm as long as it meets the security requirements. The AES-CMAC algorithm based on AES is recommended.

Finally, the fourth information is compared with the first information to obtain a comparison result.

Here, contrast With received If the two are inconsistent, the authentication of the first device Bob fails and the authentication process is terminated; if the two are consistent, the authentication of the first device Bob succeeds.

Step 408: After the second device Alice successfully authenticates the first device Bob, the preconfigured shared key PSK is used to perform encryption operation on the first random number, the identifier of the second device Alice, and the identifier of the second optical module to obtain second information.

Here, the first random number is represented by a random value B, which is generated by the first device Bob and sent to the second device Alice.

Here, the identification of the second device is express.

Here, the identification of the second optical module is express.

Here, the second information is used express.

Here, there is no restriction on the encryption algorithm as long as it meets the security requirements. The AES-CMAC algorithm based on AES is recommended.

Step 409: the second device Alice sends the identifier of the second device Alice and the second information to the first device Bob.

Step 410: The first device Bob receives the identifier and the second information of the second device Alice, and authenticates the second device Alice based on the identifier and the second information of the second device Alice.

Here, the first device Bob authenticates the second device Alice, including:

First, after receiving the second information, the first device Bob uses the shared key PSK pre-configured on the local end to decrypt the second information and obtain the identifier of the second optical module.

Here, the second information is used express.

Here, the identification of the second optical module is express.

Second, based on the identifier of the second optical module, determine whether the second optical module is legal.

Here, the second optical module is represented by optical module A.

Third, if the second optical module is legal, the first random number, the identifier of the second device and the identifier of the second optical module obtained by decryption are encrypted using a preconfigured shared key to obtain third information.

Here, the third information is used express.

Here, there is no restriction on the encryption algorithm as long as it meets the security requirements. The AES-CMAC algorithm based on AES is recommended.

Finally, the third information is compared with the second information to obtain a comparison result.

Here, contrast With received If the two are inconsistent, the authentication of the second device Alice fails and the authentication process is terminated; if the two are consistent, the authentication of the second device Alice succeeds, and the bilateral authentication succeeds.

Refer to Figure 5, which is a schematic diagram of an embodiment of the present application for determining whether the other party is online through the physical layer link status. As shown in Figure 5, after completing the mutual authentication between the first device and the second device, determine whether the other party is online through the physical layer link status.

Here, the physical layer link state includes a connected state (up) and a disconnected state (down).

Here, according to the user's demand for security, two modes can be provided for customers to flexibly choose based on the way of judging the online status of the other party based on the physical layer link status.

The first is high security mode: after the two-end devices complete the two-way authentication, if the physical layer of the device detects that the link is disconnected (down), it means that the link is interrupted for some reason and the current authentication becomes invalid. If the physical layer of the device detects that the link is connected (up) again, the two-end devices of the link need to re-perform the two-way authentication.

The second mode is high usability mode: design a timing window with a window period of T and an initial state of connected state (up). After the two-end devices complete the two-way authentication, when the device detects that the physical layer link state is disconnected (down), the timer starts timing. No re-authentication is performed within a window period. After a window period T ends, check the physical layer link state. If the physical layer link state is still disconnected (down), a new round of window timing is started, and the current authentication is invalid, but the service is not blocked. Once the physical layer link state is detected to be connected (up), re-authentication is initiated; if the physical layer link state is connected (up), re-authentication is started, the timer is stopped, and the timer is reset. The window period T is configurable.

Here, the authentication protocol can be based on Ethernet frame bearer (EAPoL) or physical layer channel bearer. If Ethernet frame bearer is used, after the authentication is successful, the device port needs to maintain a timer and send a handshake message to the other end every fixed time (such as 30 seconds) to keep the port authentication alive. If the handshake message sent by the other end is not received within the set time (such as 90 seconds), the local device will close the current security port.

Here, based on the way of carrying the authentication protocol over the physical layer channel, after successful authentication, the physical layer link status (up/down) can be directly used to quickly determine whether the other end is offline, eliminating the mechanism in which both ends send handshake messages at fixed intervals to notify the other end that the local end is still online after successful authentication.

In this example, the following advantages are achieved:

(1) By pre-configuring a shared key PSK for two communicating devices in advance, the device reads the optical module identifier stored in the EEPROM of the optical module into the device through the IIC interface. The two devices perform two-way identity authentication based on the EAP authentication framework by exchanging authentication information. The authentication information can be the ciphertext obtained by the device using the shared key PSK to encrypt the device ID, the optical module ID, and the secure random number.

(2) An identity authentication mechanism for the optical module identifier is proposed, and the unique identity identifier (ID) of the optical module is integrated into the authentication process. The identifier of the optical module participates in the encryption and decryption operations, which ensures the legitimacy of the optical module while ensuring the legitimacy of the device.

(3) The method of judging the online status of the other party based on the physical layer link status can provide multiple modes for customers to flexibly choose.

In high security mode, if the physical layer of the device detects that the physical layer link is in a disconnected state (down), the current authentication will become invalid. If the physical layer of the device detects that the link is in an up state again, the devices at both ends of the link need to re-perform bidirectional authentication.

High usability mode: Design a timing window, multiple flash disconnections, and only re-authenticate once without blocking services.

(4) Based on the method of carrying the authentication protocol over the physical layer channel, after successful authentication, the physical layer status can be directly used to quickly determine whether the other end is offline, eliminating the mechanism in which both ends send handshake messages at fixed intervals to notify the other end that the local end is still online after successful authentication.

To implement the information transmission method of the embodiment of the present application, the embodiment of the present application further provides an information transmission device, which is arranged in the first device. FIG6 is a schematic diagram of the composition structure of the information transmission device of the embodiment of the present application. As shown in FIG6 , the device includes:

A first processing module 61 is used to encrypt the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device to obtain first information;

The sending module 62 is used to send the first information to a second device, wherein the first information is used by the second device to authenticate the first device.

In one embodiment, the device is further used for:

The identifier of the first optical module is read from a memory of the first optical module in the first device.

In addition, according to at least one embodiment of the present application, encrypting the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device includes:

Get the pre-configured shared key;

The shared key is used to encrypt the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device.

In one embodiment, the device is further used for:

receiving second information; the second information is obtained by encrypting the first random number, the identifier of the second device and the identifier of the second optical module in the second device by the second device using a preconfigured shared key; the first random number is generated by the first device;

Based on the second information, the second device is authenticated.

In one embodiment, the device is further used for:

Decrypting the first random number, the identifier of the second device, and the identifier of the second optical module in the second device in the second information by using the preconfigured shared key to obtain the identifier of the second optical module;

Determining whether the second optical module is legal according to the identifier of the second optical module;

When it is determined that the second optical module is legal, encrypt the first random number, the identifier of the second device, and the identifier of the second optical module obtained by decryption by using a preconfigured shared key to obtain third information;

Comparing the third information with the second information to obtain a comparison result;

When the comparison result indicates that the third information is identical to the second information, it is determined that the second device is a legitimate device.

In one embodiment, the device is further used for:

sending a first message to and from the second device;

If the first message sent by the second device is not received within a preset time period, the current security port is closed.

In one embodiment, the device is further used for:

After the second device passes authentication, obtaining a physical layer link state;

If the physical layer link state is disconnected, the authentication of the legitimacy of the second device becomes invalid;

After the authentication of the second device fails, obtaining the physical layer link status again;

If the physical layer link state is a connected state, the legitimacy of the second device is re-authenticated.

In one embodiment, the device is further used for:

After the second device passes authentication, obtaining a physical layer link state;

If the physical layer link state is a disconnected state, opening a timing window, and not re-authenticating the legitimacy of the second device within the timing window;

After the timing window ends, obtaining the physical layer link status again;

If the physical layer link state obtained again is a connected state, the legitimacy of the second device is re-authenticated, and the timing window ends;

If the physical layer link state obtained again is a disconnected state, the authentication of the legitimacy of the second device becomes invalid, and the next timing window is opened.

In actual application, the sending unit 62 can be implemented by a communication interface in the information transmission device; the first processing unit 61 can be implemented by a processor in the information transmission device.

It should be noted that: the information transmission device provided in the above embodiment only uses the division of the above program modules as an example when performing information transmission. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the information transmission device provided in the above embodiment and the information transmission method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

To implement the information transmission method of the embodiment of the present application, the embodiment of the present application further provides an information transmission device, which is arranged on the second device. FIG. 7 is a schematic diagram of the composition structure of the information transmission device of the embodiment of the present application. As shown in FIG. 7 , the device includes:

The receiving module 71 is used to receive first information; the first information is obtained by encrypting the first random number, the second random number, the identifier of the first device and the identifier of the first optical module in the first device by the second device;

The second processing module 72 is configured to authenticate the first device based on the first information.

In one embodiment, the second processing module 72 is used to:

Decrypting the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device in the first information by using a preconfigured shared key to obtain the identifier of the first optical module;

determining, according to the second identifier, whether the first optical module is legal;

When it is determined that the first optical module is legal, encrypt the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module obtained by decryption using a preconfigured shared key to obtain fourth information;

Comparing the fourth information with the first information to obtain a comparison result;

When the comparison result indicates that the fourth information is identical to the first information, it is determined that the first device is a legitimate device.

In one embodiment, the device is further used for:

Get the pre-configured shared key;

Using the shared key, encrypting the first random number, the identifier of the second device, and the identifier of the second optical module in the second device to obtain second information; the first random number is generated by the first device;

The second information is sent to the first device; wherein the second information is used by the first device to authenticate the second device.

In one embodiment, the device is further used for:

The identifier of the second optical module is read from the memory of the second optical module in the second device.

In one embodiment, the method further comprises:

Sending a first message to and from the first device;

If the first message sent by the first device is not received within a preset time period, the current security port is closed.

In one embodiment, the device is further used for:

After the first device passes authentication, obtaining a physical layer link state;

If the physical layer link state is disconnected, the authentication of the legitimacy of the first device becomes invalid;

After the authentication of the first device fails, obtaining the physical layer link status again;

If the physical layer link state is a connected state, the legitimacy of the first device is re-authenticated.

In one embodiment, the device is further used for:

After the first device passes authentication, obtaining a physical layer link state;

If the physical layer link state is a disconnected state, opening a timing window, and not re-authenticating the legitimacy of the first device within the timing window;

After the timing window ends, obtaining the physical layer link status again;

If the physical layer link state obtained again is a connected state, the legitimacy of the first device is re-authenticated, and the timing window ends;

If the physical layer link state obtained again is a disconnected state, the authentication of the legitimacy of the first device becomes invalid, and the next timing window is opened.

In actual application, the receiving unit 71 can be implemented by a communication interface in the information transmission device; the second processing unit 72 can be implemented by a processor in the information transmission device.

It should be noted that: the information transmission device provided in the above embodiment only uses the division of the above program modules as an example when performing information transmission. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the information transmission device provided in the above embodiment and the information transmission method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

The embodiment of the present application further provides a first device, as shown in FIG8 , including:

The first communication interface 81 is capable of exchanging information with other first devices;

The first processor 82 is connected to the first communication interface 81 and is used to execute the method provided by one or more technical solutions of the first device side when running a computer program. The computer program is stored in the first memory 83.

It should be noted that the specific processing process of the first processor 82 and the first communication interface 81 is detailed in the method embodiment and will not be repeated here.

Of course, in actual application, the various components in the first device 80 are coupled together through the bus system 84. It can be understood that the bus system 84 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 84 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, various buses are marked as the bus system 84 in FIG. 8.

The first memory 83 in the embodiment of the present application is used to store various types of data to support the operation of the first device 80. Examples of such data include: any computer program used to operate on the first device 80.

The method disclosed in the above embodiment of the present application can be applied to the first processor 82, or implemented by the first processor 82. The first processor 82 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the first processor 82. The above-mentioned first processor 82 may be a general-purpose processor, a digital data processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The first processor 82 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the first memory 83, and the first processor 82 reads the information in the first memory 83 and completes the steps of the above method in combination with its hardware.

The embodiment of the present application further provides a second device, as shown in FIG9 , including:

The second communication interface 91 is capable of exchanging information with other first devices;

The second processor 92 is connected to the second communication interface 91 and is used to execute the method provided by one or more technical solutions of the second device side when running a computer program. The computer program is stored in the second memory 93.

It should be noted that: the specific processing process of the second processor 92 and the second communication interface 91 is detailed in the method embodiment, which will not be repeated here.

Of course, in actual application, the various components in the second device 90 are coupled together through the bus system 94. It can be understood that the bus system 94 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 94 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, various buses are marked as the bus system 94 in FIG. 9.

The second memory 93 in the embodiment of the present application is used to store various types of data to support the operation of the second device 90. Examples of such data include: any computer program used to operate on the second device 90.

The method disclosed in the above embodiment of the present application can be applied to the second processor 92, or implemented by the second processor 92. The second processor 92 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the second processor 92. The above second processor 92 may be a general processor, a digital data processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The second processor 92 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium, which is located in the second memory 93, and the second processor 92 reads the information in the second memory 93 and completes the steps of the above method in combination with its hardware.

In an exemplary embodiment, the first device 80 and the second device 90 can be implemented by one or more application specific integrated circuits (ASIC), DSP, programmable logic device (PLD), complex programmable logic device (CPLD), field programmable gate array (FPGA), general processor, controller, microcontroller (MCU), microprocessor, or other electronic components to execute the aforementioned method.

It can be understood that the memory (first memory 83, second memory 93) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memory.

In an exemplary embodiment, the present application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, a memory storing a computer program, and the computer program can be executed by the first processor 82 of the first device 80 to complete the steps of the first device side method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims (20)

1. An information transmission method, characterized in that it is applied to a first device, the method comprising: Encrypting a first random number, a second random number, an identifier of the first device, and an identifier of a first optical module in the first device to obtain first information; The first information is sent to a second device, wherein the first information is used by the second device to authenticate the first device. 2. The method according to claim 1, characterized in that the method further comprises: The identifier of the first optical module is read from a memory of the first optical module in the first device. 3. The method according to claim 1, characterized in that The encrypting the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device includes: Get the pre-configured shared key; The shared key is used to encrypt the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device. 4. The method according to claim 1, characterized in that the method further comprises: receiving second information; the second information is obtained by encrypting the first random number, the identifier of the second device and the identifier of the second optical module in the second device by the second device using a preconfigured shared key; the first random number is generated by the first device; Based on the second information, the second device is authenticated. 5. The method according to claim 4, characterized in that The authenticating the second device based on the second information includes: Decrypting the first random number, the identifier of the second device, and the identifier of the second optical module in the second device in the second information by using the preconfigured shared key to obtain the identifier of the second optical module; Determining whether the second optical module is legal according to the identifier of the second optical module; When it is determined that the second optical module is legal, encrypt the first random number, the identifier of the second device, and the identifier of the second optical module obtained by decryption by using a preconfigured shared key to obtain third information; Comparing the third information with the second information to obtain a comparison result; When the comparison result indicates that the third information is identical to the second information, it is determined that the second device is a legitimate device. 6. The method according to claim 5, characterized in that the method further comprises: sending a first message to and from the second device; If the first message sent by the second device is not received within a preset time period, the current security port is closed. 7. The method according to claim 5, characterized in that the method further comprises: After the second device passes authentication, obtaining a physical layer link state; If the physical layer link state is disconnected, the authentication of the legitimacy of the second device becomes invalid; After the authentication of the second device fails, obtaining the physical layer link status again; If the physical layer link state is a connected state, the legitimacy of the second device is re-authenticated. 8. The method according to claim 5, characterized in that the method further comprises: After the second device passes authentication, obtaining a physical layer link state; If the physical layer link state is a disconnected state, opening a timing window, and not re-authenticating the legitimacy of the second device within the timing window; After the timing window ends, obtaining the physical layer link status again; If the physical layer link state obtained again is a connected state, the legitimacy of the second device is re-authenticated, and the timing window ends; If the physical layer link state obtained again is a disconnected state, the authentication of the legitimacy of the second device becomes invalid, and the next timing window is opened. 9. An information transmission method, characterized in that it is applied to a second device, the method comprising: Receive first information; the first information is obtained by the first device encrypting a first random number, a second random number, an identifier of the first device, and an identifier of a first optical module in the first device; Based on the first information, the first device is authenticated. 10. The method according to claim 9, characterized in that The authenticating the first device based on the first information includes: Decrypting the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module in the first device in the first information by using a preconfigured shared key to obtain the identifier of the first optical module; determining, according to the second identifier, whether the first optical module is legal; When it is determined that the first optical module is legal, encrypt the first random number, the second random number, the identifier of the first device, and the identifier of the first optical module obtained by decryption using a preconfigured shared key to obtain fourth information; Comparing the fourth information with the first information to obtain a comparison result; When the comparison result indicates that the fourth information is identical to the first information, it is determined that the first device is a legitimate device. 11. The method according to claim 9, characterized in that the method further comprises: Get the pre-configured shared key; Using the shared key, encrypting the first random number, the identifier of the second device, and the identifier of the second optical module in the second device to obtain second information; the first random number is generated by the first device; The second information is sent to the first device; wherein the second information is used by the first device to authenticate the second device. 12. The method according to claim 11, characterized in that the method further comprises: The identifier of the second optical module is read from the memory of the second optical module in the second device. 13. The method according to claim 10, characterized in that the method further comprises: Sending a first message to and from the first device; If the first message sent by the first device is not received within a preset time period, the current security port is closed. 14. The method according to claim 10, characterized in that the method further comprises: After the first device passes authentication, obtaining a physical layer link state; If the physical layer link state is disconnected, the authentication of the legitimacy of the first device becomes invalid; After the authentication of the first device fails, obtaining the physical layer link status again; If the physical layer link state is a connected state, the legitimacy of the first device is re-authenticated. 15. The method according to claim 10, characterized in that the method further comprises: After the first device passes authentication, obtaining a physical layer link state; If the physical layer link state is a disconnected state, opening a timing window, and not re-authenticating the legitimacy of the first device within the timing window; After the timing window ends, obtaining the physical layer link status again; If the physical layer link state obtained again is a connected state, the legitimacy of the first device is re-authenticated, and the timing window ends; If the physical layer link state obtained again is a disconnected state, the authentication of the legitimacy of the first device becomes invalid, and the next timing window is opened. 16. An information transmission device, comprising: A first processing module, configured to encrypt a first random number, a second random number, an identifier of the first device, and an identifier of a first optical module in the first device to obtain first information; A sending module is used to send the first information to a second device, wherein the first information is used by the second device to authenticate the first device. 17. An information transmission device, comprising: A receiving module, used to receive first information; the first information is obtained by encrypting the first random number, the second random number, the identifier of the first device and the identifier of the first optical module in the first device by the second device; The second processing module is used to authenticate the first device based on the first information. 18. A first device, comprising a processor and a memory for storing a computer program that can be run on the processor, Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 1 to 8. 19. A second device, comprising a processor and a memory for storing a computer program that can be run on the processor, Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 9 to 15. 20. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the computer program implements the steps of the method described in any one of claims 1 to 8, or implements the steps of the method described in any one of claims 9 to 15.