IP-based microwave communication encryption method and system

Abstract

The invention discloses an IP-based microwave communication encryption method and system, and the method comprises the steps: generating a license source file based on a time factor according to an MAC address, an available bandwidth, a modulation mode and the like of microwave equipment, importing an AES key to be used in the equipment, encrypting the license file into which the AES key is imported in an AES / RSA mixed encryption mode, and transmitting the encrypted license file to a server; generating an encryption license; on the basis of an equipment management interface or other remote communication means with encryption characteristics, the encryption license is imported, the integrity and the validity of the license are verified, and the license is stored in an encryption chip with the encryption characteristics. According to the invention, multiple encryption means and algorithms are utilized to carry out hybrid encryption to improve the storage security of the key in the device, and an external encryption chip is combined to complete the real-time encryption of the link, so that the network modulation data is subjected to low-delay lossless full encryption to improve the security, privacy and long-term stability of the whole microwave communication system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of microwave communication, in particular to an IP-based microwave communication encryption method and system. BACKGROUND

[0002] In a microwave communication system, microwave devices often appear as point-to-point pairs, which are responsible for transmitting and forwarding data between DUs and RUs in 5G / 6G base stations in some geographical span range or extreme environment. However, in a traditional IP-based microwave communication link system, the data modulation and demodulation of all radio frequency links are completely based on network packets. In actual use scenarios, it is easy to be affected by monitoring, information theft, data hijacking, network attacks and other problems, which also causes certain influence and disturbance to the communication security of the base station.

[0003] The traditional microwave system encryption method mainly uses protocols with encryption algorithms for communication at the network layer (such as HTTPS, SFTP, SSH, etc.). However, these methods have the following problems:

[0004] Resource consumption and bandwidth utilization: The device performance requirements of the network packet initiator or receiver are high. For some edge or embedded devices with limited computing power, the support of the encryption protocol is not good, and it cannot meet the high-concurrency communication demand; encryption will occupy more traffic compared with non-encrypted communication, further reducing the overall bandwidth utilization.

[0005] Information security: In some encrypted communication, a part of the "encryption" uses signature verification. For the signature method, only a verification data is added to the original data, which is transparent to the actual data to be protected. In the case where the user does not specify or is not clear about the encryption method, confusion is easy to occur, causing information leakage.

[0006] Privacy security: In data communication, only the data itself is encrypted in encrypted communication, while the IP address, MAC address and device information of the device sending and receiving are transmitted in clear text, which is easy to be affected by technical monitoring, positioning / attacks, and affects the security of the device. SUMMARY

[0007] The present application relates to the technical field of microwave communication, in particular to an IP-based microwave communication encryption method and system.

[0008] To achieve the above-mentioned purpose, the present application provides the following technical scheme: an IP-based microwave communication encryption method, comprising the following steps:

[0009] S100, generating a time factor based license source file for the MAC address, available bandwidth and modulation mode of the microwave device, importing the AES key to be used in the device, and encrypting the license file with the imported AES key in the form of AES / RSA hybrid encryption to generate an encrypted license;

[0010] S200, importing the encrypted license under the device management interface or other remote communication means with encryption features, verifying the integrity and validity of the license, storing it in the encryption chip with encryption features, and clearing all cache information generated during the processing;

[0011] S300, extracting and parsing the encrypted license during device initialization, and limiting and controlling the system support mode and duration according to the restriction information and key;

[0012] S400, obtaining the state of the FPGA or other encryption chip, activating it, switching the device modulation link from direct modulation to forwarding modulation, forwarding the modulation data from the modulation chip to the FPGA or other encryption chip, and transmitting the data received by the modulation chip link back;

[0013] S500, checking the data state of the FPGA or other encryption chip, extracting the key used by the encryption link in the encrypted license file, importing it into the FPGA or other encryption chip, and switching the state machine to start link encryption;

[0014] S600, creating an interrupt monitoring task to monitor data exceptions triggered by the FPGA or other encryption chip, switching the data to a backup link, closing the abnormal link in lossless mode, and extracting the abnormal features to attempt to restore the link state.

[0015] Preferably, the steps of S100 include:

[0016] S110, obtaining the MAC address, available bandwidth, modulation mode and available time range of the microwave device, and generating a clear license file based on time factors;

[0017] S120, importing the AES key required by the FPGA or other encryption chip into the clear license file according to the format;

[0018] S130, encrypting the clear license file using the key of AES256 or other AES algorithm to generate an AES encrypted license file, recording the AES key, salt value and time used for encryption, and generating a clear AES key file;

[0019] S140, encrypt the plaintext AES key file using the public key of RSA2048 or other RSA algorithm, to generate an AES key file encrypted by RSA;

[0020] S150, bit splice the "AES key file encrypted by RSA" and "license file encrypted by AES" to generate an encrypted license file.

[0021] Preferably, the steps of S200 include:

[0022] S210, log in the device using an account with administrator privileges, enable the RSA private key import program in the device, upload the pre-prepared private key for RSA decryption to the device and store it in the TPM or other encryption chip, and set it as persistent storage in the chip;

[0023] S220, connect through the management interface or other remote encryption means with encryption features, enable the encrypted license import program in the device, and upload the specified encrypted license file, and the software bit splits the encrypted license file into "AES key file encrypted by RSA" and "license file encrypted by AES", and stores them in the cache;

[0024] S230, decrypt the "AES key file encrypted by RSA" using the RSA private key that has been imported in the TPM or other encryption chip, to extract the AES key and salt value;

[0025] S240, decrypt the "license file encrypted by AES" using the AES key and salt value to obtain the "plaintext license file", compare the MAC address list of the license with the MAC address of the device, and after verification, store the encrypted license file in the local file system, and clear the cache files generated during decryption and the memory in the software.

[0026] Preferably, the steps of S300 include:

[0027] S310, start the encrypted license file parsing program during the device initialization or MAC address comparison license success processing;

[0028] S320, split into "AES key file encrypted by RSA" and "license file encrypted by AES", and store them in the cache;

[0029] S330, decrypt the "AES key file encrypted by RSA" using the RSA private key that has been imported in the TPM or other encryption chip, to extract the AES key and salt value;

[0030] S340, decrypt the "AES encrypted license file" using the AES key and the salt value to obtain the "plaintext license file", extract the available time, bandwidth, modulation mode, FPGA AES key information of the device, and store them into the variables of the software system, and clean up the data cache and memory in the software generated by encryption.

[0031] S350, authorize the device according to the available time, bandwidth, and modulation mode information of the device, and change the function range that the device can use.

[0032] Preferably, the step S400 comprises:

[0033] S410, check the device hardware version number from the device driver, determine whether the FPGA or other encryption chip exists, if it exists, power it on and load the FPGA or other encryption chip program, check the progress of the program import, and perform the next step operation after the import is completed;

[0034] S420, reconfigure the device modulation link, in addition to reconfiguring the ETH PHY, PLA, ACM, WideBand, NCOFrequency modules, it is also necessary to enable the Test Bus and Injection Bus links of the Tx and Rx links between the GPM and the Protection link, the Test Bus link is used to forward the data to be sent from the GPM to the Tx link of the Protection and the data to be sent from the Protection to the Rx link of the GPM to the FPGA or other encryption chip through the high-speed GPIO, and after the encryption or forwarding of the FPGA or other encryption chip, the data is transmitted to the high-speed GPIO Injection Bus, the Injection Bus sends the Tx data to the Protection and the Rx data to the GPM;

[0035] S430, disconnect the link connection between the GPM and the Protection and convert to full Test Bus and Injection Bus forwarding mode, start the modulation chip modulation start program;

[0036] S440, start the RF modulation program, at this time the transmit and receive links of the device have been opened and configured.

[0037] Preferably, the step S500 comprises:

[0038] S510 communicates with FPGA or other encryption chips to check the data status sent by Test Bus, determine whether the data bits are aligned and their errors, and set an abnormal interrupt trigger command to handle modulation instability or data misalignment / errors in the early stages of Bypass setting or Bypass / AES encryption state switching.

[0039] S520: Set the FPGA or other encryption chip with the AES key extracted from the encryption license, switch the state machine, and switch the FPGA or other encryption chip from bypass mode to AES encryption mode.

[0040] S530. After a link switch occurs, a link check thread needs to be started to check the communication status between the local end and the peer end. The current connection status is determined by trend prediction. Only 720 cycles are monitored. If the requirements are met after 720 cycles, the link is determined to be stable and the thread is closed.

[0041] S540: If the link does not meet the stability requirements after 720 monitoring cycles, the output of the link will be automatically shut down. If all links encounter problems, the local FPGA or other encryption chip will be shut down, the analysis information will be saved to the log, and an error alarm will be reported. At the same time, the link will be restored to a pass-through link for maintenance and communication debugging according to the set time.

[0042] Preferably, step S600 includes:

[0043] S610. After the thread is closed, an interrupt monitoring task is automatically created. When an interrupt is detected to be triggered by the FPGA or other encryption chip, the abnormal link and the number of abnormalities are determined, and the abnormal post-processor is enabled.

[0044] S620. If the anomaly occurs in a single channel of a single modulation chip, enable the link aggregation and QoS modulation offloading scheme, adjust the permitted forwarding bandwidth from 100% to 75% or 50% in a short time, shut down the output of the FPGA or other encryption chip to the Injection Bus, attempt to switch the AES mode modulation back to bypass mode, and trigger the link check thread.

[0045] An IP-based microwave communication encryption system is provided for executing any of the IP-based microwave communication encryption methods described above.

[0046] Compared with the prior art, the beneficial effects of the present invention are:

[0047] 1. Secure key transmission and storage mechanism; Traditional AES keys are mainly transmitted in plaintext files or data via encrypted transmission protocols. Although protected by encryption protocols, the data itself is in plaintext, and there is still a risk of leakage during single storage and distribution. This invention stores the key in the form of an encryption license. Since the encryption license itself uses a hybrid encryption algorithm of symmetric encryption (AES) and asymmetric encryption algorithm (RSA), the key transmission between devices is relatively secure. In addition, a timecode is imported each time an encryption license is generated, so that the bit comparison between different encryption licenses has no correlation logic, thereby further improving the security of the key transmission process.

[0048] 2. Secure link encryption method: Traditional microwave communication links are usually unencrypted or only encrypted using software algorithms, lacking encryption protection for privacy information and only providing basic protection for data; This invention introduces TestBus and Injection Bus into the link, and leads the directly connected link data to an external FPGA or other dedicated encryption chip for processing, thereby encrypting the pure network data in the link, which significantly improves the security and privacy of information transmission in the communication link.

[0049] 3. Lossless and low-latency link encryption: Traditional microwave communication encryption requires a lot of bandwidth to transmit encrypted data, while this invention uses pure network binary data stream for AES symmetric encryption, ensuring that the data size of each frame before and after encryption remains consistent. At the same time, due to the use of data stream encryption technology, the encryption and decryption delay on the link is fixed, which has extremely high stability for the transmission of PTP (Precise Time Protocol) and SyncE (Synchronous Ethernet).

[0050] 4. Intelligent link inspection and self-recovery mechanism; Traditional microwave communication links lack link-level encryption schemes, and the connection status of the link is easily affected by the environment; This invention has specially designed an intelligent inspection and recovery system for links, which loads multi-dimensional data to judge and predict the stability of the link, thereby distinguishing whether the link anomaly is caused by the external environment or internal faults, and automatically recovering or reconfiguring according to the analysis results, to ensure the reliability and stability of the link.

[0051] In summary, this invention significantly improves the security and reliability of microwave communication through innovative encryption technology, lossless and low-latency link encryption methods, and intelligent link management mechanisms, and has broad application prospects. Attached Figure Description

[0052] Figure 1 This is a flowchart illustrating an IP-based microwave communication encryption method and system provided in an embodiment of this application. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] Example 1: Refer to Figure 1 This is a flowchart illustrating an IP-based microwave communication encryption method and system provided in an embodiment of the present invention. The flowchart may include at least steps S100-S600:

[0055] Step S100 should include at least steps S110-S150:

[0056] S110. Obtain the MAC address used by the microwave device, the permitted available bandwidth, the modulation mode, and the time range during which it can be used, and generate a plaintext license file based on the time factor.

[0057] Specifically, the MAC address of a typical device is 48 bits. Multiple MAC addresses are allowed to appear in the license file to activate multiple devices with a single encrypted license file. An example of a MAC address list is shown below:

[0058] MAC_ADDR = 01:01:01:01:01:01,

[0059] 01:01:01:01:01:02,

[0060] 01:01:01:01:01:03, 01:01:01:01:01:04

[0062] 01:01:01:01:01:01 represents the local device that needs to import the encryption license.

[0063] The permitted available bandwidth is as follows: assuming the device supports bandwidth from 7M to 112M, we only allow the device to use 7M, 14M, and 112M. An example of the bandwidth allocation would be:

[0064] VALID_BW = 7,14,112

[0065] The permitted available modulation modes are as follows: assuming the device supports a modulation range from QPSK to 4096QAM, and we only allow the device to use QPSK, 256QAM, and 512QAM, then an example of the permitted modulation modes would be:

[0066] VALID_M = QPSK, 256QAM, 512QAM

[0067] The permitted timeframe is, assuming the device is allowed to be used from January 1, 2025 to January 1, 2029, then an example of the permitted timeframe would be:

[0068] START_T = 2025-1-1

[0069] VALID_T = 2029-1-1

[0070] Furthermore, the generated time-based plaintext source file contains the following:

[0071] MAC_ADDR = 01:01:01:01:01:01,

[0072] 01:01:01:01:01:02,

[0073] 01:01:01:01:01:03, 01:01:01:01:01:04

[0075] VALID_BW = 7,14,112

[0076] VALID_M = QPSK, 256QAM, 512QAM

[0077] START_T = 2025-1-1

[0078] VALID_T = 2029-1-1

[0079] S120. Import the AES key required for the FPGA or other encryption chip into the plaintext license file according to the format (key length and format depend on the AES encryption algorithm used);

[0080] Assuming the FPGA or other encryption chip uses the AES256 encryption algorithm, and assuming the AES256 key to be configured is:

[0081] 40df2fbe2d2dca5b6e95831889559f938190b946e44efee023a2be054a1bd500, therefore, the plaintext license file (ProductionSource.conf) with the AES key imported is:

[0082] MAC_ADDR = 01:01:01:01:01:01,

[0083] 01:01:01:01:01:02,

[0084] 01:01:01:01:01:03, 01:01:01:01:01:04

[0086] VALID_BW = 7,14,112

[0087] VALID_M = QPSK, 256QAM, 512QAM

[0088] START_T = 2025-1-1

[0089] VALID_T = 2029-1-1

[0090] FPGA_AES_MODE = 256

[0091] FPGA_AES_KEY=40df2fbe2d2dca5b6e95831889559f938190b946e44efee023a2be054a1bd500

[0092] S130. Encrypt the plaintext license file using a key of AES256 or other AES algorithm to generate an AES-encrypted license file, record the AES key, salt value and time used for encryption, and generate a plaintext AES key file.

[0093] Assuming the encryption format used to encrypt the plaintext license file is AES256, and assuming the command currently used by a third-party public library of OpenSSL is:

[0094] openssl rand-hex 32>aes_key.txt

[0095] Therefore, the AES256 key stored in the file aes_key.txt is f47159ad92fa3659a8d93a44f93e7d5093d73bf5aa37c343ec91f66ad70bd627

[0096] For the process of encrypting plaintext with an imported AES key using an AES256 key, refer to the instructions for using the OpenSSL third-party public library. The commands used are:

[0097] openssl enc-aes-256-cbc-pbkdf2-iter 100000-salt-inProductionSource.conf-out encrypted.bin-pass file:aes_key.txt

[0098] The encrypted.bin file is a license file encrypted with AES. The salt value used in the AES encryption process is concatenated and stored in the hybrid encryption process, and it currently only exists in system variables.

[0099] S140. Encrypt the plaintext AES key file using the public key of RSA using RSA2048 or other RSA algorithms to generate an RSA-encrypted AES key file.

[0100] Specifically, for the implementation details in the software, refer to the usage of OpenSSL third-party public library commands:

[0101] Generate an RSA2048 private key:

[0102] openssl genpkey-algorithm RSA-out private.pem-pkeyopt rsa_keygen_bits:2048

[0103] Generate a public key from the private key:

[0104] openssl rsa-pubout-in private.pem-out public.pem

[0105] Encrypt the plaintext AES key file using an RSA2048 public key and pad it with OAEP:

[0106] openssl pkeyutl-encrypt-in aes_key.txt-out aes_key_encrypted.bin-pubin-inkey public.pem-pkeyopt rsa_padding_mode:oaep

[0107] This yields the AES key file encrypted with RSA: aes_key_encrypted.bin.

[0108] S150. Concatenate the bits of the "AES key file encrypted by RSA" and the "license file encrypted by AES" to generate an encrypted license file.

[0109] Specifically, the actual "AES key file encrypted by RSA" should contain two parts: 1. the AES key file aes_key_encrypted.bin encrypted by RSA, which is calculated by the OpenSSL third-party public library; 2. the salt value.

[0110] Furthermore, to achieve bit concatenation between the "RSA-encrypted AES key file" and the "AES-encrypted license file," a fixed size must be planned for each part to ensure that the final license generated across different devices can be decrypted and read. Therefore, based on the characteristics of the encrypted data and the file type, the corresponding address block occupancy is as follows:

[0111] 0-255 bytes aes_key_encrypted.bin

[0112] 256-271 bytes of salt value (stored in hex format)

[0113] 272-n bytes of license file encrypted with AES

[0114] Where n is the size of the AES-encrypted license file + 271.

[0115] The above three parts are concatenated according to the specified address using C++ or Python script code to generate an "encrypted license file" (License.dat).

[0116] Explanation of the connection between the preceding and following steps

[0117] S110 provides the most basic requirement authorization scheme for the subsequent S120 AES key import part.

[0118] S120 imports the AES key, merges it, and then passes it to S130 for encryption to generate an AES-encrypted license file.

[0119] S130 encrypts the plaintext license file using the AES encryption algorithm and records the AES key and salt value, which are used in S140 to encrypt the AES key using the RSA encryption algorithm to generate an RSA-encrypted AES key file.

[0120] S140 uses an RSA key and encryption algorithm to encrypt the AES key and generates an "ESA-encrypted AES key file" for S150 bit concatenation.

[0121] S150 uses the "RSA-encrypted AES key file" and "AES-encrypted license file" generated by S130 and S140 to perform bit concatenation to generate an encrypted license file.

[0122] Step S200 should include at least steps S210-S240:

[0123] S210. Log in to the device using an account with administrator privileges, enable the RSA private key import program on the device, upload the pre-prepared private key for RSA decryption to the device and store it in the TPM or other encrypted chip, and set it as persistent storage in the chip (by default, the TPM's import and export program is configured to be operable only by the administrator account).

[0124] Specifically, the software of microwave equipment should include system access control and TPM control programs. For the TMP control program, tmp2-tools is usually used, and it is assumed that tmp2-tools has been initialized during operation.

[0125] The following is a sample command for creating a TPM master key:

[0126] tpm2_createprimary-Co-G rsa-c primary.ctx

[0127] Import the RSA private key into TPM:

[0128] tpm2_import -C primary.ctx -G rsa -i private_key.pem -u key.pub-rkey.priv

[0129] Load the imported private key:

[0130] tpm2_load -C primary.ctx -u key.pub -r key.priv -c imported_key.ctx

[0131] Set the key to be stored permanently:

[0132] tpm2_evictcontrol-Co-c imported_key.ctx-o 0x81010000

[0133] Verification key persistence:

[0134] tpm2_readpublic-c 0x81010000

[0135] S220: Connect via management interface or other remote encryption methods with encryption features, enable the encryption license import program in the device, and upload the specified encryption license file. The software performs bit splitting on the encryption license file, splitting it into "AES key file encrypted by RSA" and "license file encrypted by AES", and stores them in the cache.

[0136] S230. Use the RSA private key that has been imported into the TPM or other encryption chip to decrypt the "AES key file encrypted by RSA" and extract the AES key and salt value.

[0137] S240. Use the AES key and salt value to decrypt the "AES-encrypted license file" to obtain the "plaintext license file". Extract the list of licensed MAC addresses and compare it with the MAC address of the device itself. After verification, store the encrypted license file in the local file system and clean up the cache files and memory generated during the decryption process.

[0138] Explanation of the connection between the preceding and following steps:

[0139] S210 provides a secure storage scheme for RSA keys, which are used for the verification and decryption of subsequent S220 and S230 keys.

[0140] S220 provides the function of splitting the encrypted license file for subsequent extraction of the key and verification of the license in S230.

[0141] S230 uses the files provided by S210 and S220 and the RSA key stored in TPM to decrypt the "AES key file encrypted by RSA", extract the AES key and salt value, and use them in S240 to decrypt the "license file encrypted by AES".

[0142] S240 uses the decrypted AES key and salt value from S230 to decrypt the "AES-encrypted license file" in S220 and extract and verify the local MAC address. After a successful match, the encrypted license file is stored and the encryption / decryption files generated during the process are cleaned up.

[0143] Step S300 should include at least steps S310-S350:

[0144] S310. Initiate the encrypted license file parsing program during device initialization or MAC address verification successful authorization process;

[0145] Specifically, the encryption license file parser is a publicly callable interface program or an independent program that exists in any system in other forms. The input content is the encryption license file, the device's MAC address, and the current system time.

[0146] S320, split into "AES key file encrypted with RSA" and "license file encrypted with AES", and store them in the cache;

[0147] Specifically, the encrypted license parser splits the input encrypted license file into two parts: an "RSA-encrypted AES key file" and an "AES-encrypted license file," and stores them in a cache. The encrypted license parser can be configured to automatically clear the cache upon accidental expiration and to clear the cache upon timeout, providing caching and memory protection features.

[0148] S330: Use the RSA private key that has been imported into the TPM or other encryption chip to decrypt the "AES key file encrypted by RSA" and extract the AES key and salt value.

[0149] Specifically, the encryption license parsing program calls the tmp2-tools tool to extract the RSA private key that has been stored in the TMP chip, decrypt the "AES key file encrypted by RSA", and extract the AES key and salt value.

[0150] S340. Use the AES key and salt value to decrypt the "AES-encrypted license file" to obtain the "plaintext license file". Extract information such as the device's available time, bandwidth, modulation mode, and FPGA AES key, and store it in the software system's variables. Clean up the encrypted data cache and the software's memory.

[0151] Specifically, the extracted AES key and salt value are used to decrypt the "AES-encrypted license file" to obtain a "plaintext license file," such as the "plaintext license file with imported AES key" listed in S120. Information from this file is extracted and configured into the system. Although the MAC address was verified in S240, it is still checked or skipped here to prevent MAC address tampering, depending on specific needs. The current time (system time, which will be synchronized with NTP or PTP) input to the encrypted license file parsing program is also checked. If either the MAC address or time is not satisfied, the system automatically switches to a specific unauthorized bandwidth and modulation range allowed by the system and autonomously disables the FPGA AES encryption / decryption function as needed. The cache and memory generated during the decryption process are automatically cleaned up, and the plaintext license file is remembered or stored in a volatile memory variable using a more secure method.

[0152] Furthermore, the encrypted license file parser will not end when the parsing task is completed. It will reside in the background, listening to the current time and MAC address. In the event of an unauthorized incident, it will automatically call the main system program to switch to a specific bandwidth and modulation range that the system allows without authorization.

[0153] S350: Based on information such as the device's available time, bandwidth, and modulation mode, restrict or update the device's authorization, and change the scope of functions that the device can use.

[0154] The main system program sets the displayable range of LMS based on the information stored in the volatile memory variable in S340, and then limits it in the background callback APP.

[0155] It should be further noted that the system has already completed the modification of the range and the automatic switching of the actual modulation bandwidth and modulation mode during initialization. No additional automatic switching is performed in the actual main program control.

[0156] Explanation of the connection between the preceding and following steps:

[0157] S310 provides the location and input variables for the encrypted license file parser. The encrypted license file is used for subsequent bit splitting in S320. The device's MAC address and current system time are used in S340 as the basis for judging whether the license has expired or the system has been tampered with.

[0158] S320 splits the encrypted license file input in S310 into an "AES key file encrypted with RSA" and an "AES license file encrypted with AES", and stores them in a cache for S330 to decrypt.

[0159] S330 reads the RSA private key imported into TPM from S210 and decrypts the "AES key file encrypted by RSA", extracts the AES key and salt value, and decrypts S340.

[0160] S340 uses the AES key and salt extracted from S330 to decrypt the "AES-encrypted license file" split in S320 to obtain the "plaintext license file". It then determines the MAC address of the device and the current system time input in S310. The "plaintext license file" will be used in S350 to restrict the LMS and its main program background display and usage scope.

[0161] The S350 uses a "plaintext license document" to restrict the display and usability of the LMS and main program backend.

[0162] Step S400 should include at least steps S410-S440:

[0163] S410. Check the device hardware version number from the device driver to determine if the FPGA or other encryption chip exists. If it exists, power it on and load the program of the FPGA or other encryption chip. Check the progress of the program import and proceed to the next step after the import is complete.

[0164] Specifically, the main program reads the high and low levels of resistors from the hardware through its external I / O or I / O expansion chips or other programmable chips mounted on the chip running the main program itself. It uses different resistors to determine the number of links in the current system, the hardware version number, and whether the FPGA or other encryption chip exists. If it exists, it powers on the FPGA or other encryption chip during the system initialization process and automatically loads the program of the FPGA or other encryption chip. In the initialization sequence, it checks the startup status of the FPGA or other encryption chip before the modulation chip initialization and performs a timeout check.

[0165] S420, reconfiguring the device modulation link requires not only reconfiguring modules such as ETH PHY, PLA, ACM, WideBand, and NCOFrequency, but also enabling Test Bus and Injection Bus links for Tx and Rx links between GPM and Protection links. The Test Bus link is used to forward data from the Tx link (unencrypted source data) that GPM is about to send to Protection and from the Rx link (received source data or encrypted data) that Protection is about to send to GPM via high-speed GPIO to FPGA or other encryption chips. After encryption or forwarding by FPGA or other encryption chips (initially in Bypass data forwarding mode), the data is passed to the high-speed GPIO Injection Bus. The Injection Bus sends Tx data to Protection and Rx data to GPM.

[0166] Specifically, after the FPGA starts, the initialization startup program for the modulation chip is initiated, loading the main firmware and PHY firmware, and loading the DC file (Device Config) file into the modulation chip to complete the basic link and port mapping work in the modulation chip. According to the currently reserved bandwidth configuration, the corresponding bandwidth BIN file is loaded to load the various parameters required by the corresponding link modulation algorithm. The ETH PHY, PLA, ACM, WideBand, NCO Frequency and other modules are configured, the Test Bus and Injection Bus links are configured, and the default link data is looped back from the internal GPM to the Protection link interface through the Test Bus and Injection Bus to the external FPGA or other encryption chip. At this time, the FPGA or other encryption chip is working in forwarding mode rather than encryption mode.

[0167] Specifically, the current data stream from GPM to Protection and the data sent by Test Bus are completely mirrored. Currently, the data stream on Test Bus is used for timing training and error frame analysis of FPGA or other encryption / decryption chips to ensure that the start and end frames sent by the modulation chip are correct.

[0168] Start the modulation sequence of the modulation chip.

[0169] S430: Disconnect the link between GPM and Protection, switch to full Test Bus and Injection Bus forwarding mode, and start the modulation chip modulation start program.

[0170] Specifically, the main program sends the current modulation parameters to the FPGA or other encryption chip and calculates the frame length for subsequent locking. Based on the current modulation system design, the specific link frame length calculation algorithm is as follows:

[0171] Assuming the current modulation bandwidth is BW (MHz) and the roll-off factor set according to the ETSI standard is Rolloff (%), then the Symbol Rate for the current bandwidth should be:

[0172]

[0173] If the current pilot space length is PoiltSpacing(Symbol), then the number of pilots required for the Preamble is:

[0174]

[0175] The length of the Preamble is fixed at 32 Symbols.

[0176] Based on the current modulation mode, it has been attempted to convert to BitsInSymbol, with the unit being bit.

[0177] Therefore, the formula for converting the data length of an LDPC frame in the air should be:

[0178]

[0179] NonPilotInAirframe=Premble+ACM-PilotInPreamble+SymbolsInAirfame LDPC

[0180]

[0181]

[0182] Airframelength=NonPilotInAirframe+PilotInAirframe

[0183] Therefore, the data length of an LDPC frame in the air is:

[0184] DataBitsInAirframe LDPC =MotherCodeRate+WordLength×1008×AF_Blocks

[0185] in:

[0186] BitsInSymbol is the number of bits used in the modulation mode, for example, QPSK modulation is 2 bits.

[0187] WordLength is typically 2, 4, 8, or 16 bytes, in kilobytes (K).

[0188] Puncturing is the punching length.

[0189] ACM fixed length is 16QPSK Symbol

[0190] PilotSpacing is the pilot length.

[0191] AF_Blocks are manually set Airframe Blocks

[0192] Therefore, the data length of the current modulation mode in uncode mode is:

[0193] BitsInSymbol uncode =BitsInSymbol - BitsInSymbol LDPC

[0194] BytesInAirframe uncode =DataBitsInAirframe LDPC ×BitsInSymbol uncode

[0195]

[0196] The relevant parameters for RS mode are similar to those for uncode mode, so they will not be repeated here.

[0197] Therefore, based on the calculation results of the above parts, the final data length for a certain modulation and bandwidth is:

[0198] DataLength=DataBitsInAirframe LDPC+DataBitsInAirframe RS +DataBitsInAirframe uncode

[0199] Therefore, the data length that the FPGA or other encryption chip needs to process is DataLength + 2 (Byte), where 2 is the identification code and ACM profile code sent by the test bus. The current system supports modulation from QPSK to 4096QAM. If a more advanced modulation chip is used, more modulation modes can be supported, but the principle is the same. By mapping the ACM profile to different modulation modes one by one, the data length of all modulation modes is preloaded before the FPGA enables encryption. This allows the FPGA or other encryption chip to achieve lossless switching of the link when the link automatically switches the modulation mode according to the actual signal-to-noise ratio of the link after encryption.

[0200] Furthermore, after the basic data configuration of the FPGA is completed, disconnect the GPM to Protection link, and keep the TestBus to FPGA to Injection Bus link working. The current working mode of the FPGA should be Bypass mode.

[0201] S440. Start the RF modulation program. At this point, both the transmit and receive links of the device are open and configured.

[0202] Specifically, initialize the RF module, configure the frequency and power of the RF module, and enable modulation.

[0203] Furthermore, after modulation is enabled, the intermediate frequency signal emitted by the modulation chip will be spectrum shifted from the 100M-1G intermediate frequency signal (depending on the specific frequency used) to the 5G-43G frequency range with the center frequency as the reference and the bandwidth as the spectrum width. DPD is then enabled to perform pre-distortion calculation on the signal output by the PA to improve the transmitted signal to the optimal state.

[0204] Explanation of the connection between the preceding and following steps:

[0205] The S410 provides cross-platform program detection logic. When the presence of an FPGA is detected, the FPGA is powered on and its code is loaded, providing a prerequisite for the configuration of the S420.

[0206] After the S410 startup timing, the S420 configures the modulation chip, forwards the link data to the FPGA chip, and prepares for the FPGA Bypass mode in the S430.

[0207] The S430 calculates the length of the data frames sent from the Test Bus and the preloaded mode to adapt to lossless switching between different modulation modes, preparing for subsequent encryption, and outputs the intermediate frequency signal of the S440 RF output in the modulation chip.

[0208] The S440 modulates the intermediate frequency signal output of the S430 and performs spectrum shifting to realize the frequency conversion of the modulated signal from the intermediate frequency to the microwave frequency band.

[0209] Step S500 should include at least steps S510-S540:

[0210] S510 communicates with FPGA or other encryption chips to check the data status sent by Test Bus, determine whether the data bits are aligned and their errors, and set an abnormal interrupt trigger command to handle modulation instability or data misalignment / errors in the early stages of Bypass setting or Bypass / AES encryption state switching.

[0211] Specifically, it communicates with the FPGA or other encryption chip to check whether the Test Bus data is normal and whether the data length in the current modulation mode meets expectations. It sets up automatic monitoring triggers and generates an interrupt trigger signal for post-processing of subsequent link anomalies.

[0212] In particular, since the clock rates output from the Test Bus to the FPGA or other encryption chips are different for different bandwidths and modulation modes, it is necessary to collect the clock sample of the highest modulation with the highest bandwidth allowed in the current system, and internally increase the PLL clock frequency to about twice the output frequency (the output frequency is different for different chips) to achieve oversampling, so as to prevent data errors caused by insufficient sampling rate and ultimately affect the stability of the link and the encryption recovery.

[0213] S520: Set the FPGA or other encryption chip with the AES key extracted from the encryption license, switch the state machine, and switch the FPGA or other encryption chip from the bypass (input, source data, output, source data) mode to the AES encryption mode (input, source data, output, AES encrypted data).

[0214] Specifically, the AES key extracted from S340 and stored in the system variables is used to configure the FPGA or other encryption chip, and an encryption enable command is sent to the encryption chip. The encryption algorithm uses the standard AES256, and the specific principle of the encryption algorithm will not be elaborated here.

[0215] Furthermore, the main encryption process involves extracting the previously preloaded DataLength from the data stream sent by the Test Bus. To achieve a faster response speed, the encryption chip pre-configures a FIFO, which encrypts the data every 128 bits. Once the encryption is complete, the data is immediately sent to the Injection Bus. The 2-byte frame header of the Frame is not involved in the encryption; when its data is received, it is directly sent to the Injection Bus.

[0216] In particular, due to different modulation modes and bandwidths, and different configurations for puncturing, AF_Blocks, etc., the DataLength will also be different. In most cases, the final data length cannot be divided evenly by 128 bits. Therefore, the handling of the remainder will be divided into several cases as follows:

[0217] Direct forwarding method (no protection for the last digit): By forwarding the remaining data less than 128 bits without encrypting it, the advantage of this method is stable link latency and no bad packets. However, there is a risk of data leakage of less than 128 bits per frame. It is suitable for scenarios that are sensitive to time delay loss and have a certain degree of encryption capability in in-band communication.

[0218] Phase adjustment method (protecting the last digit, but adjusting the phase at the beginning of the data frame): Since microwave communication generally adopts a design method with equal ends, the frame length sent to the Test Bus is consistent for a certain bandwidth and a certain modulation mode. Therefore, after the Test Bus sends the data, it is sent to the FIFO for buffering. The buffer length is about 2 to 3 128-bit widths, thus forming a delay of a uniform length. When the data end length is less than 128 bits, it waits for the start of the next packet of valid data, and then assembles it into 128 bits and cuts it according to the actual ratio. The encrypted data with the original length + frame header flag bit + original length is sent to the Injection Bus.

[0219] Furthermore, when the other end receives the data, it extracts the encrypted data from both ends, converts it into plaintext data, and forwards it from the FPGA to the Injection Bus according to the original length ratio.

[0220] While this solution can fully protect all data, the link latency is slightly higher than that of solution 1. Furthermore, since the frame header is not the only parameter, the system also needs to introduce a self-reset function (phase calibration) after parameter abnormality. It cannot synchronize the synchronization signal from the RF analog domain or chip output, so it is only suitable for link-stable systems.

[0221] Since microwave communication systems are often affected by environmental factors, the demand for or choice of Option 1 is relatively more common in daily microwave communication.

[0222] S530: After a link switch occurs (bypass -> AES encryption / initialization -> bypass / AES encryption bypass), a link check thread needs to be started to check the communication status between the local end and the peer end (including heartbeat packet integrity, SNR / RSL and other related indicators). The current connection status is determined to be stable by using trend prediction. Only 720 cycles are monitored. If the requirements are met after 720 cycles, the link is determined to be stable and the thread is closed.

[0223] Specifically, data frame verification logic is added to the FPGA or other encryption chip to obtain and verify the frame length based on the frame header characteristics. Since the specific logic of the FPGA or other encryption chip does not verify the actual transmitted data, only frame header verification and length verification based on the frame header are required.

[0224] Furthermore, when a link switch occurs, a monitoring thread is started with a period of 100ms, and the judgment logic is as follows:

[0225] Check 1. Heartbeat packet reception integrity. If the heartbeat packet is complete, skip this loop; otherwise, proceed to check 2.

[0226] 2. Check the RSL threshold alarm and record the RSL threshold alarm status.

[0227] 3. Check the SNR threshold alarm and determine the combined conditions:

[0228] If the SNR is normal and the RSL is normal, or the power warning is high, or the power warning is low, record the data and skip the loop;

[0229] If a poor SNR warning is issued and a low power warning (RSL) is issued, record the data and skip the loop.

[0230] If a poor SNR warning is issued and an RSL (normal or high power warning) is issued, proceed to check step 4.

[0231] 4. Check the frame header latch exception and frame length latch exception detected in the FPGA, and determine the following conditions:

[0232] If any latch fails but functions normally in real time, the latch state is cleared and read again. If it still fails, the modulation chip and RF chip are reconfigured, the current cycle thread is stopped, and it is triggered again as needed.

[0233] If any latch fails and a real-time failure occurs, the modulation chip and RF chip are reconfigured (this is only allowed to be triggered once by the thread; the thread will not be triggered repeatedly here).

[0234] If all latches are normal and real-time is also normal, then record the data and skip the loop.

[0235] After 720 cycles are satisfied, the link stability is determined based on the recorded data. If any item in check 4 is not satisfied in the 240 consecutive sets of data at the end of the data, the link is considered unstable.

[0236] S540: If the link does not meet the stability requirements after 720 monitoring cycles, the output of the link will be automatically shut down. If all links encounter problems, the local FPGA or other encryption chip will be shut down, the analysis information will be saved to the log, and an error alarm will be reported. At the same time, the link will be restored to a pass-through link for maintenance and communication debugging according to the set time.

[0237] Specifically, when an unstable link is detected, the output of that link is shut down, and the modulation chip is reconfigured to use the default link for communication. The analysis information is saved to the log and an alarm is reported. When all link checks result in instability, in addition to switching the link communication path, saving the log, and reporting an alarm, the FPGA or other encryption chips will be directly shut down to save power.

[0238] Explanation of the connection between the preceding and following steps:

[0239] S510 provides the logic for checking the output status of the modulation chip by the FPGA or other encryption chip, provides the initial data flow check for S520, and provides the basis for Test Bus logic analysis for S530.

[0240] After the basic checks of S510, S520 uses the extracted AES key to configure the FPGA or other encryption chips and triggers the link check logic of S530.

[0241] S530 enables system monitoring and link instability monitoring after the state switch between S510 and S520, and attempts to recover based on the abnormal state. If it is still determined to be abnormal, S540 is activated for processing.

[0242] The S540 is triggered by the S530 and is used to switch links, save analysis information, report errors, and power off the FPGA.

[0243] Step S600 should include at least steps S610-S620:

[0244] S610. After the thread is closed, an interrupt monitoring task is automatically created. When an interrupt is detected to be triggered by the FPGA or other encryption chip, the abnormal link and the number of abnormalities are determined, and the abnormal post-processor is enabled.

[0245] Specifically, the detection logic of S510 is reused. When a link anomaly has been detected but an anomaly occurs in actual operation, the number of link anomalies is checked and the anomaly post-processing procedure is activated.

[0246] S620. If the anomaly occurs in a single path of a single modulation chip (each modulation chip supports two links), enable the link aggregation and QoS modulation offloading scheme, and adjust the permitted forwarding bandwidth from 100% to 75% or 50% in a short time (assuming there are two modulation chips, the specific requirement depends on the number of modulation chips, generally 75% for single mode and 50% for XPIC mode), turn off the output of the FPGA or other encryption chip to the Injection Bus, attempt to switch the AES mode modulation back to bypass mode, and trigger the link check thread.

[0247] Specifically, regarding the capabilities of a particular modulation chip, each modulation chip supports two independent links, and these two independent links are aggregated into a single network port for communication through the PLA's functionality. If a system has four links, and each link is configured with the same bandwidth and modulation mode, then in single mode, if one of the four links is lost, the total communication capability decreases by 25%. One modulation chip occupies 50% of the original total bandwidth, and the data forwarding volume of another modulation chip with one faulty link occupies 25% of the original total bandwidth. The output of the FPGA on the faulty link is shut down, and to prevent data leakage, no switching attempt is made at this time.

[0248] Furthermore, when both channels of a modulation chip malfunction, the VLAN used by the chip is switched to isolate the main communication forwarding, and an attempt is made to switch back to bypass mode and check the link status. This completes the implementation steps of S500.

[0249] Unlike other systems, when an abnormality is triggered on one of the paths in XPIC, the link remains inactive and continues to transmit in its current state. Only when two paths on a certain modulation chip become abnormal will the network port of that modulation chip be shut down directly from the switch end, and an attempt will be made to switch these two paths back to bypass mode and check the link status. This completes the implementation steps of S500.

[0250] Explanation of the connection between the preceding and following steps:

[0251] S610 provides a specific implementation plan for the monitoring task, and the execution process of S620 is called back after an anomaly is detected.

[0252] S620 is triggered by S610, implements two different exception post-processing logics for Single and XPIC, and calls back the S500 process.

[0253] The method of this invention includes: generating a time-based license source file based on the MAC address, available bandwidth, modulation mode, etc. of a microwave device; importing the AES key to be used in the device; encrypting the license file with the imported AES key using a hybrid AES / RSA encryption method to generate an encrypted license; importing the encrypted license through a device management interface or other remote communication methods with encryption features, verifying its integrity and validity, storing it in an encryption chip with encryption features, and clearing all cached information generated during the processing; extracting and parsing the encrypted license during device initialization, and restricting and controlling the system's supported modes, duration, etc., based on the restriction information and key. The system acquires the status of the FPGA or other encryption chip and activates it, switching the device modulation link from direct modulation to forward modulation, so that the modulated data is forwarded from the modulation chip to the FPGA or other encryption chip and transmitted back to the data receiving end of the modulation chip link; it checks the data status of the FPGA or other encryption chip, extracts the key used by the encryption link from the encryption license file, imports it into the FPGA or other encryption chip, switches the state machine to start link encryption; it creates an interruption monitoring task, such as monitoring abnormal data triggering from the FPGA or other encryption chip, switching the data to the backup link, shutting down the abnormal link in lossless mode, and extracting abnormal characteristics to attempt to restore the link status. It has the following beneficial effects:

[0254] • A cost-effective solution suitable for all outdoor applications;

[0255] • Quality of Service (QoS) based on port, Virtual LAN (VLAN) identifier / priority, and Differential Service Code Point (DSCP) is used to implement traffic prioritization;

[0256] • Scalable bandwidth (up to 112MHz) and flexible modulation schemes (quadratic phase shift keying (QPSK) to 4096 quadrature amplitude modulation (QAM)), adaptive coding modulation (ACM), supporting XPIC and non-XPIC data processing links;

[0257] • Supports all licensed and unlicensed frequency bands from 5.15GHz to 43.5GHz;

[0258] • AES-256 encryption and decryption;

[0259] • Supports SyncE / 1588v2 PTP TC / BC;

[0260] • 4+0 capacity can reach up to 4Gbps;

[0261] • The web interface allows for flexible device configuration and management capabilities, and supports the Simple Network Management Protocol (SNMP).

[0262] • Supports local and remote loopback functionality for line checks;

[0263] • Provides system logs for alarms, events, and configurations;

[0264] • In addition to lower overall system cost and more stable performance, it also saves on wiring and cable maintenance costs;

[0265] • Flexible networking, good scalability, plug and play, and provides a variety of different hardware architectures such as 1+0, 2+0 and 4+0 for different application scenarios;

[0266] This invention employs a hybrid encryption method combining RSA, AES, and bit concatenation to encrypt and decrypt licenses. This significantly increases the difficulty of brute-force attacks. In practical field applications, microwave communication equipment often exists in hops or loops. Without AES link encryption, the security of key transmission is greatly enhanced. Furthermore, the use of secure transmission protocols and authentication channels such as SFTP and HTTPS provided by the microwave system significantly improves the security of key transmission between devices compared to traditional microwave communication equipment. In addition, a timecode is imported each time an encrypted license is generated, eliminating the logical correlation between bit comparisons of different encrypted licenses, thereby further improving the security and anti-decryption capabilities of the key transmission process.

[0267] This invention encrypts the pure network data stream in the communication link by disconnecting the conventional link and introducing a Test Bus and Injection Bus within the device to connect to an external encryption chip. The direct link data is then processed by an external FPGA or other dedicated encryption chip, significantly improving the security and privacy of information transmission. Furthermore, since encryption and decryption occur at the intermediate layer between the network and modulation layers, external encryption of the link does not additionally affect the device's modulation and demodulation performance. This prevents the start and stop of encryption / decryption from impacting link performance and the security and stability of information transmission between devices (modulation does not interfere with security).

[0268] This invention employs AES symmetric encryption on the data stream to ensure that the data size of each frame remains consistent before and after encryption, and that the timing and delay are stable. This is beneficial for the transmission and calculation of PTP (Precise Time Protocol) and SyncE (Synchronous Ethernet) and improves the accuracy of system timing. Although the introduction of an external encryption / decryption chip will introduce a small amount of delay, these delays are fixed and the exchangeable network bandwidth in microwave communication equipment remains unchanged compared to before encryption.

[0269] This invention designs an intelligent inspection and recovery system for links. By loading multi-dimensional data to judge and predict the stability of the link, it analyzes the causes of abnormal link failures and performs automatic recovery or reconfiguration based on the judgment, thereby ensuring the reliability and stability of link service transmission.

[0270] The contents not described in detail in this specification are prior art known to those skilled in the art. Although embodiments of the present invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A microwave communication encryption method based on IP, characterized in that: Includes the following steps: S100. Generate a time-based license source file for the microwave equipment's MAC address, available bandwidth, and modulation mode. Import the AES key to be used in the equipment and encrypt the license file with the imported AES key using AES / RSA hybrid encryption to generate an encrypted license. S200, based on the device management interface or other remote communication methods with encryption features, imports the encryption license, verifies its integrity and validity, stores it in the encryption chip with encryption features, and clears all cached information generated during the processing. S300: During device initialization, the encryption license is extracted and parsed, and restrictions and controls are applied to the system's supported modes and durations based on the restriction information and keys. S400: Obtain the status of the FPGA or other encryption chip, activate it, switch the device modulation link from direct modulation to forward modulation, so that the modulation data is forwarded from the modulation chip to the FPGA or other encryption chip, and transmitted back to the data receiving end of the modulation chip link. S500 checks the data status of the FPGA or other encryption chip, extracts the key used by the encryption link from the encryption license file, imports it into the FPGA or other encryption chip, and switches the state machine to start link encryption. S600: Create an interruption monitoring task, such as monitoring abnormal data triggering from FPGA or other encryption chips, switch the data to the backup link, shut down the abnormal link in lossless mode, and extract abnormal features to attempt to restore the link status.

2. The IP-based microwave communication encryption method according to claim 1, characterized in that: The steps of S100 include: S110. Obtain the MAC address used by the microwave device, the permitted available bandwidth, the modulation mode, and the permitted time range, and generate a plaintext license file based on the time factor. S120. Import the AES key required for the FPGA or other encryption chip into the plaintext license file according to the specified format. S130. Encrypt the plaintext license file using a key of AES256 or other AES algorithm to generate an AES-encrypted license file, record the AES key, salt value and time used for encryption, and generate a plaintext AES key file. S140. Encrypt the plaintext AES key file using the public key of RSA using RSA2048 or other RSA algorithms to generate an RSA-encrypted AES key file. S150. Concatenate the bits of the "AES key file encrypted by RSA" and the "license file encrypted by AES" to generate an encrypted license file.

3. The IP-based microwave communication encryption method according to claim 1, characterized in that: The steps of S200 include: S210. Log in to the device using an account with administrator privileges, enable the RSA private key import program on the device, upload the pre-prepared private key for RSA decryption to the device and store it in the TPM or other encrypted chip, and set it as persistent storage in the chip. S220: Connect via management interface or other remote encryption methods with encryption features, enable the encryption license import program in the device, and upload the specified encryption license file. The software performs bit splitting on the encryption license file, splitting it into "AES key file encrypted by RSA" and "license file encrypted by AES", and stores them in the cache. S230. Use the RSA private key that has been imported into the TPM or other encryption chip to decrypt the "AES key file encrypted by RSA" and extract the AES key and salt value. S240. Use the AES key and salt value to decrypt the "AES-encrypted license file" to obtain the "plaintext license file". Extract the list of licensed MAC addresses and compare it with the MAC address of the device itself. After verification, store the encrypted license file in the local file system and clean up the cache files and memory generated during the decryption process.

4. The IP-based microwave communication encryption method according to claim 1, characterized in that: The steps of S300 include: S310. Initiate the encrypted license file parsing program during device initialization or MAC address verification successful authorization process; S320, split into "AES key file encrypted with RSA" and "license file encrypted with AES", and store them in the cache; S330: Use the RSA private key that has been imported into the TPM or other encryption chip to decrypt the "AES key file encrypted by RSA" and extract the AES key and salt value. S340. Use the AES key and salt value to decrypt the "AES-encrypted license file" to obtain the "plaintext license file". Extract the available time, bandwidth, modulation mode, and FPGA AES key information of the device and store them in the variables of the software system. Clean up the data cache generated by encryption and the memory in the software. S350. Based on the device's available time, bandwidth, and modulation mode information, restrict or update the device's authorization, and change the scope of functions that the device can use.

5. The IP-based microwave communication encryption method according to claim 1, characterized in that: The steps of S400 include: S410. Check the device hardware version number from the device driver to determine if the FPGA or other encryption chip exists. If it exists, power it on and load the program of the FPGA or other encryption chip. Check the progress of the program import and proceed to the next step after the import is complete. S420, reconfiguring the device modulation link requires not only reconfiguring the ETH PHY, PLA, ACM, WideBand, and NCOFrequency modules, but also enabling the Test Bus and Injection Bus links for the Tx and Rx links between the GPM and Protection links. The Test Bus link is used to forward the Tx link from the GPM to the Protection and the Rx link from the Protection to the GPM via high-speed GPIO to the FPGA or other encryption chips. After encryption or forwarding by the FPGA or other encryption chips, the data is passed to the high-speed GPIO Injection Bus. The Injection Bus sends the Tx data to the Protection and the Rx data to the GPM. S430: Disconnect the link between GPM and Protection, switch to full Test Bus and Injection Bus forwarding mode, and start the modulation chip modulation start program; S440. Start the RF modulation program. At this point, both the transmit and receive links of the device are open and configured.

6. The IP-based microwave communication encryption method according to claim 1, characterized in that: The steps of S500 include: S510 communicates with FPGA or other encryption chips to check the data status sent by Test Bus, determine whether the data bits are aligned and their errors, and set an abnormal interrupt trigger command to handle modulation instability or data misalignment / errors in the early stages of Bypass setting or Bypass / AES encryption state switching. S520: Set the FPGA or other encryption chip with the AES key extracted from the encryption license, switch the state machine, and switch the FPGA or other encryption chip from bypass mode to AES encryption mode. S530. After a link switch occurs, a link check thread needs to be started to check the communication status between the local end and the peer end. The current connection status is determined by trend prediction. Only 720 cycles are monitored. If the requirements are met after 720 cycles, the link is determined to be stable and the thread is closed. S540: If the link does not meet the stability requirements after 720 monitoring cycles, the output of the link will be automatically shut down. If all links encounter problems, the local FPGA or other encryption chip will be shut down, the analysis information will be saved to the log, and an error alarm will be reported. At the same time, the link will be restored to a pass-through link for maintenance and communication debugging according to the set time.

7. The IP-based microwave communication encryption method according to claim 1, characterized in that: The steps of S600 include: S610. After the thread is closed, an interrupt monitoring task is automatically created. When an interrupt is detected to be triggered by the FPGA or other encryption chip, the abnormal link and the number of abnormalities are determined, and the abnormal post-processor is enabled. S620. If the anomaly occurs in a single channel of a single modulation chip, enable the link aggregation and QoS modulation offloading scheme, adjust the permitted forwarding bandwidth from 100% to 75% or 50% in a short time, shut down the output of the FPGA or other encryption chip to the Injection Bus, attempt to switch the AES mode modulation back to bypass mode, and trigger the link check thread.

8. An IP-based microwave communication encryption system, characterized in that, Used to perform the IP-based microwave communication encryption method as described in any one of claims 1-7.

Images