Abstract: A data transmission method, device, and system are provided. The method includes: receiving a first data packet sent by an external network device; verifying an authentication header (AH) packet header of the first data packet by using a first security association (SA); and sending the first data packet to an internet of things (IoT) device if the verification succeeds. According to the embodiments of this application, storage overheads and computational overheads of the IoT device in internet of things can be reduced, to implement end-to-end secure communication between the IoT device and the external network device, and improve security of a communications system.

Abstract: This application provides a secure route identification method and an apparatus. A first AS node receives a first message. The first message is used to indicate a target path for reaching a first route prefix, and the target path is used to indicate a first neighboring relationship between AS nodes on the target path. Then, the first AS node determines, based on the first neighboring relationship and neighbor information of an AS node on the target path that is stored in a blockchain, whether a security threat exists on the target path. The neighbor information of the AS node on the target path includes a second neighboring relationship between the AS node on the target path and another AS node.

Abstract: A data transmission method, device, and system are provided. The method includes: receiving a first data packet sent by an external network device; verifying an authentication header (AH) packet header of the first data packet by using a first security association (SA); and sending the first data packet to an internet of things (IoT) device if the verification succeeds. According to the embodiments of this application, storage overheads and computational overheads of the IoT device in internet of things can be reduced, to implement end-to-end secure communication between the IoT device and the external network device, and improve security of a communications system.

Abstract: Embodiments of the disclosure provide a private key generation method and a device. The method includes: receiving, by a first terminal from a second terminal, a first half session key parameter corresponding to the second terminal and an identifier of the second terminal; sending, by the first terminal, the first half session key parameter corresponding to the second terminal and the identifier of the second terminal to an IKMS entity; sending, by the first terminal to the second terminal, the second half session key parameter corresponding to the second terminal and the encrypted private key corresponding to the second terminal that are sent by the IKMS entity, where the second half session key parameter corresponding to the second terminal is used to decrypt the encrypted private key corresponding to the second terminal. This can prevent a private key from being stolen, and prevent communication information between groups from being stolen.

Abstract: This application provides a secure route identification method and an apparatus. A first AS node receives a first message. The first message is used to indicate a target path for reaching a first route prefix, and the target path is used to indicate a first neighboring relationship between AS nodes on the target path. Then, the first AS node determines, based on the first neighboring relationship and neighbor information of an AS node on the target path that is stored in a blockchain, whether a security threat exists on the target path. The neighbor information of the AS node on the target path includes a second neighboring relationship between the AS node on the target path and another AS node.