A data transmission protection method based on HMAC-MD5 algorithm combined with key pre-distribution

Abstract

The application relates to a data transmission protection method based on combination of an HMAC-MD5 algorithm and key pre-distribution, which combines a key pre-distribution scheme and an HMAC-MD5 algorithm based on symmetric cryptography and integrates a key pre-distribution management scheme based on a hash mechanism; that is, before data information participates in communication encryption transmission, the key held by a node is preloaded, and the one-way characteristic of a hash function is utilized to hide part of the key information of the node; the application utilizes the one-way characteristic of the hash function and the key pre-distribution to hide part of the key information of the node to a certain extent, that is, to reduce the number of key leaks of the node, and then to reduce the possibility of destruction of other links of the network by an attacker, so that the security of node communication is improved.

Description

Technical Field

[0001] This invention belongs to the field of data encryption transmission protection technology, specifically relating to a data transmission protection method based on the HMAC-MD5 algorithm combined with key pre-distribution. Background Technology

[0002] When communicating between nodes, encryption and decryption keys are typically used. Whether symmetric or asymmetric encryption is used, the security of the keys directly determines the security of the information transmitted between nodes. Encrypting the data and managing the stored key information in an encrypted manner before transmitting information ensures that even if an attacker captures some sensor nodes and obtains the key information, the secure communication between other nodes will not be significantly disrupted.

[0003] Inter-node communication is vulnerable to capture and compromise by attackers, leading to various security threats such as information leakage, data tampering, eavesdropping, and denial-of-service attacks. Specifically, once an attacker captures key information, they can obtain the key data of other nodes, thereby breaking down multiple communication links. Communication nodes themselves are also susceptible to various security threats such as information leakage, eavesdropping, deception, imitation, and denial-of-service attacks.

[0004] Therefore, research on strengthening the security of data transmission between communication nodes is extremely necessary. Ensuring the security of data transmission between communication nodes is an issue that deserves serious attention. Summary of the Invention

[0005] In view of the shortcomings of existing technologies, this invention proposes a data transmission protection method based on the HMAC-MD5 algorithm combined with key pre-allocation. The core of this method lies in utilizing key pre-allocation and the one-way nature of hash functions to hide some of the node's key information to a certain extent, thereby reducing the number of node key leaks and thus lowering the possibility of attackers disrupting other network links, thereby improving the security of node communication.

[0006] To achieve the above objectives, this invention provides a data transmission protection method based on the HMAC-MD5 algorithm combined with key pre-distribution, characterized by comprising at least the following steps:

[0007] The key pre-distribution scheme is combined with the HMAC-MD5 algorithm based on symmetric cryptography and integrated into a key pre-distribution management scheme based on hash mechanism; that is, before data information participates in the encrypted transmission of communication, the key held by the node is preloaded, and the one-way property of the hash function is used to hide part of the node's key information.

[0008] The steps for combining hash-based key pre-allocation with encryption algorithms are as follows:

[0009] The first step is to obtain the required number of keys S between communication nodes from the keys randomly generated in the key pool to meet the needs between the communication nodes.

[0010] The second step involves randomly assigning m keys from the key pool to the sending and receiving nodes, ensuring that each node's key is unique.

[0011] The third step: confirm the connectivity conditions between nodes, that is, ensure that both parties have the same minimum number of keys q; then determine whether the number of identical keys in both nodes reaches the required value q. If so, they can use the same q keys to concatenate them in the same order to form a key, and then communication can be carried out.

[0012] Fourth step: Confirm the identifiers of the two nodes that need to transmit the data;

[0013] Fifth step: Confirm the value of the modulo parameter L in the key preloading process;

[0014] The sixth step: If the value of the sender's node identifier modulo L is less than the value of the receiver's node identifier modulo L, then the sender needs to perform | Node sender % L - Node receiver % L | additional hash loadings before performing the HMAC-MD5 encryption operation.

[0015] Step 7: Obtain the encryption key and perform program calculations step by step according to the HMAC-MD5 encryption algorithm process.

[0016] Furthermore, in the seventh step, following the HMAC-MD5 encryption algorithm's workflow, the program writing and computation steps are as follows:

[0017] Step 1: Pad the key with 0s. This operation is used to obtain a string of 64 bytes. If the key is longer than 64 bytes, replace the original key with the MD5 hash of the key, and then add 0s to the end to reach 64 bytes.

[0018] Step 2: XOR the string generated in step 1 with ipad(0x36) to generate istring.

[0019] Step 3: Add data after "istring" in step 2.

[0020] Step 4: Perform MD5 calculation on the data stream istring generated in step 3.

[0021] Step 5: Perform an XOR operation on the string generated in Step 1 and opad(0x5c) to obtain the ostring string.

[0022] Step 6: Add the result of step 4, istring, to the end of the ostring from step 5.

[0023] Step 7: Perform an MD5 hash on the data stream ostring generated in step 6 to obtain the output result.

[0024] The above integration ultimately yields HMAC-MD5 encrypted data for transmission.

[0025] This invention employs the above technical solution, combining a key pre-allocation scheme with the HMAC-MD5 algorithm based on symmetric cryptography, and integrating it into a key pre-allocation management scheme based on a hash mechanism. Specifically, before data information participates in encrypted communication transmission, the keys held by the nodes are pre-loaded, and the one-way property of hash functions is used to hide some of the nodes' key information to a certain extent. Thus, even if an attacker obtains the key data between transmitting nodes, the impact on transmission between other nodes will be limited to a small scope. It has at least the following beneficial effects:

[0026] 1. Before transmitting information, the information data is encrypted. By adding key pre-allocation to the one-way characteristic of the hash function, the stored key information is encrypted and managed. This ensures that even if an attacker captures some nodes and obtains their key information, the secure transmission between the remaining nodes will not be disrupted on a large scale.

[0027] 2. By setting the optimal number of keys, minimum connection key value, and modulo parameter, the probability of communication links being compromised can be effectively reduced. The main advantage lies in effectively reducing the probability of other communication links being compromised after a communication node is captured.

[0028] 3. Enhanced security protection makes HMAC more reliable and secure in practical applications, effectively preventing common attack methods such as length extension attacks and selected ciphertext attacks. Standardization and widespread adoption have made HMAC a de facto standard in secure communication, providing a stable and reliable message authentication solution for various security protocols and applications.

[0029] 4. HMAC introduces the concept of a universal message authentication code based on hash functions. Traditional MAC algorithms typically rely on specific symmetric encryption algorithms, such as DES or AES, while HMAC achieves a more universal and flexible design by leveraging the wide applicability and security of hash functions.

[0030] 5. The length extension attack problem existing in traditional MAC is taken into consideration, and the ability to resist attacks is improved by introducing multiple uses of the key in the input of the hash function (through two hashing processes, inner and outer). Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a flowchart of the data transmission protection method of the present invention;

[0033] Figure 2 This is a schematic diagram of the communication link between the communication nodes of the present invention. Figure 1 ;

[0034] Figure 3 This is a schematic diagram of the communication link between the communication nodes of the present invention. Figure 2 . Detailed Implementation

[0035] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Rather, they are merely examples of apparatuses and methods consistent with some aspects of the invention as detailed in the appended claims.

[0036] like Figure 1 , Figure 2 and Figure 3 As shown, this embodiment provides a data transmission protection method based on the HMAC-MD5 algorithm combined with key pre-allocation, characterized by including at least the following steps:

[0037] The key pre-distribution scheme is combined with the HMAC-MD5 algorithm based on symmetric cryptography and integrated into a key pre-distribution management scheme based on hash mechanism; that is, before data information participates in the encrypted transmission of communication, the key held by the node is preloaded, and the one-way property of the hash function is used to hide part of the node's key information.

[0038] The steps for combining hash-based key pre-allocation with encryption algorithms are as follows:

[0039] The first step is to obtain the required number of keys S between communication nodes from the keys randomly generated in the key pool to meet the needs between the communication nodes.

[0040] The second step involves randomly assigning m keys from the key pool to the sending and receiving nodes, ensuring that each node's key is unique.

[0041] The third step: confirm the connectivity conditions between nodes, that is, ensure that both parties have the same minimum number of keys q; then determine whether the number of identical keys in both nodes reaches the required value q. If so, they can use the same q keys to concatenate them in the same order to form a key, and then communication can be carried out.

[0042] Fourth step: Confirm the identifiers of the two nodes that need to transmit the data;

[0043] Fifth step: Confirm the value of the modulo parameter L in the key preloading process;

[0044] The sixth step: If the value of the sender's node identifier modulo L is less than the value of the receiver's node identifier modulo L, then the sender needs to perform | Node sender % L - Node receiver % L | additional hash loadings before performing the HMAC-MD5 encryption operation.

[0045] Step 7: Obtain the encryption key and perform program calculations step by step according to the HMAC-MD5 encryption algorithm process.

[0046] Furthermore, in the seventh step, following the HMAC-MD5 encryption algorithm's workflow, the program writing and computation steps are as follows:

[0047] Step 1: Pad the key with 0s. This operation is used to obtain a string of 64 bytes. If the key is longer than 64 bytes, replace the original key with the MD5 hash of the key, and then add 0s to the end to reach 64 bytes.

[0048] Step 2: XOR the string generated in step 1 with ipad(0x36) to generate istring.

[0049] Step 3: Add data after "istring" in step 2.

[0050] Step 4: Perform MD5 calculation on the data stream istring generated in step 3.

[0051] Step 5: Perform an XOR operation on the string generated in Step 1 and opad(0x5c) to obtain the ostring string.

[0052] Step 6: Add the result of step 4, istring, to the end of the ostring from step 5.

[0053] Step 7: Perform an MD5 hash on the data stream ostring generated in step 6 to obtain the output result.

[0054] The above integration ultimately yields HMAC-MD5 encrypted data for transmission.

[0055] Implementation examples: Figure 2 As shown, assume there are currently seven communication nodes capable of communication, with node identifiers node[i], [i=1,2,3,4,5,6,7], and a key pool S containing six keys K1, K2, K3, K4, K5, and K6. The minimum number of identical keys q required for successful communication is set to 1, and the key ring m=2, meaning each node possesses two keys. node[1-7] possesses the keys and the communication links between nodes (e.g., ...). Figure 2 ):

[0056] like Figure 3 As shown, if key preloading is not performed, assuming that communication node 4 and node 2 need to connect and communicate, they have a common key K5. They can communicate normally with key K5. However, if the attacker captures communication node 2 and communication node 4, the keys K5, K6, and K2 of communication node 2 and communication node 4 will be leaked. This will affect the normal communication between communication nodes 1 and 5, 5 and 6, 3 and 7, and 2 and 3. That is, these four communication links will be compromised. If the keys stored in the nodes before network deployment are preloaded using a hash function (assuming modulo parameter L=5), and the q-composite scheme is used for key preloading, then node1 has keys h1(K1), h1(K2), node2 has keys h2(K2), h2(K5), node3 has keys h3(K2), h3(K6), node4 has keys h4(K5), h4(K6), node5 has keys h0(K2), h0(K5), node6 has keys h1(K5), h1(K6), and node7 has keys h2(K1), h2(K6). The communication links between the nodes (e.g., ...) Figure 3 ):

[0057] At this point, the attacker captures communication nodes node4 and node2, leading to the leakage of the keys h4(K5), h4(K6), h2(K2), and h2(K5). Only the link between communication nodes 2 and 3 is affected, as the attacker can use the captured key h2(K2) to calculate h3(K2) via hash. The other three communication links between nodes 1 and 5, 5 and 6, and 3 and 7 remain unaffected. This is due to the one-way nature of hash functions; the attacker cannot use backtracking to calculate h(K5) from h4(K5) or h2(K5), nor can they calculate h3(K6) and h(K2) from h4(K6) and h2(K2). Therefore, preloading the keys before sending messages to communication nodes effectively reduces the probability of other communication links being compromised due to node capture.

[0058] This invention employs a specific technical solution, integrating a key pre-distribution scheme with the HMAC-MD5 algorithm based on symmetric cryptography, and cleverly embedding it into a hash-based key pre-distribution management framework. Specifically, before data information formally participates in the encrypted communication transmission process, the keys held by each node are pre-loaded and processed. Leveraging the inherent one-way nature of hash functions, some key information from each node is concealed. This aims to limit the potential threat to communication links between other nodes even if an attacker successfully intercepts the key data between transmitting nodes.

[0059] Compared to existing technologies, the core advantage of this invention lies in significantly reducing the risk of the entire communication network being completely penetrated due to the capture of individual communication nodes.

[0060] The benefits achieved by this embodiment include, but are not limited to:

[0061] 1. Data Integrity Protection: By employing the HMAC mechanism, which combines the dual functions of keys and hash functions, strict verification of data integrity is achieved during data transmission and storage, ensuring that data is protected from tampering or damage.

[0062] 2. Authentication Function: HMAC also has the ability to verify the identity of the message sender. By combining the message content with a specific key and using a hash function to generate a unique authentication code, the recipient can easily confirm whether the source of the message matches expectations.

[0063] 3. Replay Attack Defense: Since HMAC incorporates dynamic elements such as timestamps or random numbers, it makes it difficult for attackers to carry out replay attacks using captured authentication codes, thereby effectively improving the system's protection capabilities.

[0064] 4. Simple to implement and highly efficient: HMAC's design philosophy emphasizes simplicity and efficiency, making it particularly suitable for resource-constrained environments such as embedded systems or IoT devices, providing strong support for communication security in these fields.

[0065] 5. Strong hash function compatibility: HMAC can be seamlessly integrated with a variety of recognized secure hash functions (such as SHA-256, SHA-3, etc.), further enhancing its security performance and building a more solid defense for the encryption protection of communication data.

[0066] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A data transmission protection method based on the HMAC-MD5 algorithm combined with key pre-distribution, characterized in that: It should include at least the following steps: The key pre-distribution scheme is combined with the HMAC-MD5 algorithm based on symmetric cryptography and integrated into a key pre-distribution management scheme based on hash mechanism; that is, before data information participates in the encrypted transmission of communication, the key held by the node is preloaded, and the one-way property of the hash function is used to hide part of the node's key information. The steps for combining hash-based key pre-allocation with encryption algorithms are as follows: The first step is to obtain the required number of keys S between communication nodes from the keys randomly generated in the key pool to meet the needs between the communication nodes. The second step involves randomly assigning m keys from the key pool to the sending and receiving nodes, ensuring that each node's key is unique. The third step: confirm the connectivity conditions between nodes, that is, ensure that both parties have the same minimum number of keys q; then determine whether the number of identical keys in both nodes reaches the required value q. If so, they can use the same q keys to concatenate them in the same order to form a key, and then communication can be carried out. Fourth step: Confirm the identifiers of the two nodes that need to transmit the data; Fifth step: Confirm the value of the modulo parameter L in the key preloading process; The sixth step: If the value of the sender's node identifier modulo L is less than the value of the receiver's node identifier modulo L, then the sender needs to perform | Node sender % L - Node receiver % L | additional hash loadings before performing the HMAC-MD5 encryption operation. Step 7: Obtain the encryption key and perform program calculations step by step according to the HMAC-MD5 encryption algorithm process.

2. The method according to claim 1, characterized in that: In the seventh step, following the HMAC-MD5 encryption algorithm, the program writing and calculation steps are as follows: Step 1: Pad the key with 0s. This operation is used to obtain a string of 64 bytes. If the key is longer than 64 bytes, replace the original key with the MD5 hash of the key, and then add 0s to the end to reach 64 bytes. Step 2: XOR the string generated in step 1 with ipad(0x36) to generate an istring; Step 3: Add data after "istring" in step 2; Step 4: Perform MD5 hashing on the data stream istring generated in step 3; Step 5: Perform an XOR operation on the string generated in Step 1 and opad(0x5c) to obtain the ostring string; Step 6: Add the result of step 4, istring, to the end of the ostring from step 5; Step 7: Perform an MD5 hash on the data stream ostring generated in step 6 to obtain the output result; The above integration ultimately yields HMAC-MD5 encrypted data for transmission.

Images