Wireless encryption device and method using public key to protect variable mechanical authentication password

Abstract

The present invention discloses a wireless encryption device and method for protecting a variable mechanical authentication password using a public key. The wireless encryption communication device includes: a data interface area for opening to other devices for writing operations; an authentication password setting terminal for mechanically setting the authentication password; an algorithm encryption module for storing a non-exportable private key through hardware, and for distributing a public key to a client, encrypting and decrypting the authentication password; a processing and calculation module for client authentication, data encryption transmission and communication process management; a client for sending a connection application message to a wireless encryption communication device, and the connection application message is encrypted by a public key obtained from the wireless encryption communication device; and after the communication connection is established, data communication is performed by a symmetric encryption algorithm. The present invention is used to solve the problem that key exchange in industrial sites is difficult to implement in the prior art, and to achieve the purpose of protecting a variable mechanical authentication password using a public key system and ultimately communicating by a symmetric encryption algorithm.

Description

Technical Field

[0001] The invention relates to the field of wireless encryption communication, and in particular to a wireless encryption device which adopts a public key to protect a variable mechanical authentication password. Background Art

[0002] Classical cryptography (restricted algorithms) is based on the confidentiality of the algorithm, so it cannot be standardized. Due to the mobility of personnel, this cryptography needs to be frequently updated, and its operability is very poor. Modern cryptographic algorithms are open, can be standardized, hardware-based, and productized. Security depends on the size of the key space and the security of the key.

[0003] Currently, cryptography mainly uses asymmetric encryption algorithms represented by RSA and symmetric encryption algorithms represented by AES. The security of keys is guaranteed by combining asymmetric encryption algorithms with symmetric encryption algorithms.

[0004] Asymmetric encryption usually uses two asymmetric keys in the encryption and decryption process, which are called public key and private key. Asymmetric key pairs have two characteristics: first, after encrypting information with one of the keys (public key for encryption, private key for signing), only the other corresponding key (private key for decryption, public key for signature verification) can decrypt it. Second, the public key can be disclosed to others, while the private key is kept secret, and others cannot deduce the corresponding private key from the public key.

[0005] Symmetric encryption refers to an encryption method that uses the same key for encryption and decryption. The sender uses the key to encrypt the plaintext data into ciphertext and then sends it out. After receiving the ciphertext, the receiver uses the same key to decrypt the ciphertext into plaintext for reading. Since the encryption and decryption of symmetric encryption use the same key, the security of symmetric encryption depends not only on the strength of the encryption algorithm itself, but also on whether the key is kept securely. Therefore, how the encryptor can securely pass the key to the decryptor has become a key issue facing symmetric encryption.

[0006] The HTTPS technology currently used in the network introduces a CA authority, a commonly recognized organization, to ensure the legitimacy of the key exchange process. However, the CA authorization model is not suitable for key exchange in industrial sites. It is not realistic and difficult to operate to issue a CA certificate to each client requesting data. Summary of the invention

[0007] The purpose of the present invention is to provide a wireless encryption device that uses a public key to protect a variable mechanical authentication password, so as to solve the problem that key exchange in industrial sites is difficult to implement in the prior art, and to achieve the purpose of using a public key to protect a variable mechanical authentication password and ultimately communicating through a symmetric encryption algorithm.

[0008] The present invention is achieved through the following technical solutions:

[0009] A wireless encryption device that uses a public key to protect a variable mechanical authentication password, including a wireless encryption communication device and a client that wirelessly communicate with each other;

[0010] The wireless encryption communication device includes a data interface area, an authentication password setting terminal, an algorithm encryption module, and a processing and calculation module;

[0011] The data interface area is used to be open to other devices for writing operations;

[0012] The authentication password setting terminal is used to set the authentication password mechanically;

[0013] The algorithm encryption module stores the non-exportable private key through hardware, and is also used to distribute the public key to the client, and encrypt and decrypt the authentication password and the transmission content;

[0014] The processing and computing module is used for client authentication, scheduling of various modules, data encryption transmission management and communication process management;

[0015] The client is used to send a "connection application message" to the wireless encryption communication device, and the "connection application message" is encrypted using a public key obtained from the wireless encryption communication device; and after authentication is passed, the encrypted information is obtained from the wireless encryption device and decrypted.

[0016] The present invention proposes a wireless encryption device that uses a public key to protect a variable mechanical authentication password. The public key system is used to ensure the key security in the key exchange process, and the mechanical variable password is used to ensure the legality check in the authentication process. The communication process uses a symmetric encryption method to ensure the efficiency of communication. The specific process is that a non-exportable private key is built into the wireless encryption communication device through an algorithm encryption module, and the public key corresponding to the private key is announced to the device that needs to communicate with it, that is, the client. At the same time, an authentication password setting terminal, that is, a mechanical terminal, is designed on the wireless encryption communication device to set the authentication password when the client connects to the wireless encryption device; when wireless encrypted communication is required, the client that obtains the public key encrypts the "authentication password" and the "random exchange password" through the public key, and then sends the "application connection message" to the wireless encryption device; after receiving the message, the wireless encryption device decrypts it with the private key and compares it with the authentication password set by itself. After the authentication is successful, the "random exchange password" sent by the client is received, and the client is allowed to establish a connection and start the exclusive mode. Only when the authentication password is changed can the application for a new connection be allowed. The wireless encryption communication device then signs the "random exchange password" with a private key and sends it to the client. The client uses the public key to verify the signed "random exchange password" ciphertext and the actual "random exchange password". If the verification is successful, the wireless encryption communication device and the client communicate using a symmetric encryption algorithm using the "random exchange password" recognized by both parties.

[0017] Furthermore, the wireless encryption communication device communicates with the client through a wireless communication module. The wireless communication module can use a mature wireless communication protocol on the market, such as WIFI, Bluetooth, ZIGBEE and other wireless communication protocols.

[0018] Furthermore, the algorithm encryption module is an asymmetric algorithm encryption chip. The asymmetric algorithm encryption chip stores a non-exportable private key through hardware, which is used for decrypting the encrypted authentication password.

[0019] Furthermore, the asymmetric algorithm encryption chip is a hardware encryption chip, which can be a hardware implementation of various asymmetric encryption algorithms, such as an RSA encryption chip. The RSA encryption chip implements the RSA international standard algorithm in hardware, and the RSA key pair is stored in the chip. Only authorized and authenticated users can obtain the operation rights of the RSA key pair, wherein the RSA key pair is either generated inside the chip or input from the outside by the user through key recovery means, wherein the RSA private key part will not be input or output in plain text under any circumstances; at the same time, in order to protect the security of the RSA private key in the key pool, the RSA implementation scheme in the general chip adds technical measures to prevent side channel attacks.

[0020] A wireless encryption method using a public key to protect a variable mechanical authentication password includes the following steps:

[0021] S1. The wireless encryption communication device distributes the public key Pbk to the client that needs to connect and communicate with it;

[0022] S2. Set the authentication password code of the wireless encryption communication device through the authentication password setting terminal, power on the wireless encryption device, and wait for the client to connect;

[0023] S3. The client sends a "connection request message": the "authentication password" code and the "random exchange key" ek are encrypted using an asymmetric algorithm using the obtained public key pbk, and then attached to the "connection request message" ConnectInfo, and sent to the wireless encryption device; let the public key encryption function be f1, then: ConnectInfo = f1 (pbk, code, ek);

[0024] S4. After receiving the "connection application message", the wireless encryption communication device decrypts it through the algorithm encryption module to obtain ConnectInfoW; assuming that the private key decryption function is f2, then it is as follows: ConnectInfoW = f2 (Connectinfo, prk); wherein prk is the private key;

[0025] S5. The algorithm encryption module obtains the "password to be authenticated" from ConnectInfoW, and compares it with the "authentication password" set in step S2 to obtain the comparison result rsult; assuming that the function for obtaining the "password to be authenticated" is f3, then Result = f3 (ConnectInfoW);

[0026] S6. If the "password to be authenticated" is inconsistent with the "authentication password" code, that is, Result≠code, then send an "authentication failed" message to the client;

[0027] If the "password to be authenticated" is consistent with the "authentication password" code, that is, Result = code, then the wireless encryption communication device obtains the random exchange key ek through ConnectInfoW, and obtains ekSigned through the private key signature, and attaches ekSigned to the "authentication successful" message and sends it to the client; let the function for obtaining the random exchange key be f4, and the function for signing with the private key be f5, then ekSigned = f5 (f4 (ConnectInfoW), prk);

[0028] S7. After receiving the "authentication success" message, the client uses the public key of the wireless encryption communication device to verify the signature of ekSigned and ek. Suppose the signature verification function is f6 and the signature verification result is Result2, then Result2=f6(ekSigned,ek,pbk);

[0029] S8. If the signature verification of Result2 fails, the client rejects the random exchange key ek and checks whether there are any counterfeit wireless encryption communication devices in the surrounding area. After eliminating them, restart from step S1;

[0030] If the signature verification of Result2 is successful, the wireless encryption communication device establishes an encrypted communication connection with the client, and uses the random exchange key ek of that time to communicate through a symmetric encryption algorithm.

[0031] Furthermore, in step S4, after decrypting to obtain ConnectInfoW, the number of authentication attempts count is increased by 1; if the "password to be authenticated" and the "authentication password" code in step S6 are inconsistent, and the number of authentication attempts count is greater than or equal to 3, the wireless encryption communication device enters a self-locking state, and can only be unlocked by changing the authentication password by toggling the mechanical terminal of the authentication password setting terminal or restarting the power, and allowing the client to connect; if the number of authentication attempts is less than 3 times, an "authentication failed" message is sent to the client.

[0032] Furthermore, after step S6 is completed, if the client receives a message of "authentication failed", steps S3-S5 are repeated until a message of "authentication successful" is received, and then step S7 is entered.

[0033] Furthermore, the method of communicating through the symmetric encryption algorithm in step S8 is:

[0034] S9, the client sends a "data request" to the wireless encryption device, the processing and computing module of the wireless encryption device reads the data from the data interface area, encrypts it using the symmetric encryption algorithm through the random exchange key ek, and sends the ciphertext dataEncrypted to the client. Assume that the data to be transmitted is data, and the function of the symmetric encryption algorithm is f7, then dataEncrypted = f7 (ek, data);

[0035] S10. The client receives dataEncrypted, and decrypts it using the symmetric encryption algorithm ek to obtain the real data dataRaw. Suppose the decryption function is f8, then dataRaw = f8 (dataEncrypted, ek).

[0036] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0037] The present invention adopts a wireless encryption device and method that uses a public key to protect a variable mechanical authentication password, which can be widely used in field equipment that is not suitable for wired data acquisition. The wireless encryption communication device and method of the present invention can be easily integrated and ensure identity authentication and data transmission security during the wireless transmission of data from the acquisition device to the client. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings described herein are used to provide a further understanding of the embodiments of the present invention, constitute a part of this application, and do not constitute a limitation of the embodiments of the present invention. In the drawings:

[0039] Figure 1 It is a schematic diagram of the structure of a wireless encryption communication device in a specific embodiment of the present invention.

[0040] Marks and corresponding parts names in the attached drawings:

[0041] 1-data interface area, 2-authentication password setting terminal, 3-algorithm encryption module, 4-processing and calculation module, 5-wireless communication module. DETAILED DESCRIPTION

[0042] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0043] Embodiment 1:

[0044] The invention discloses a wireless encryption device which adopts a public key to protect a variable mechanical authentication password, and comprises two parts: a wireless encryption communication device and a client.

[0045] Among them, the wireless encryption communication device consists of the following six parts:

[0046] a. Data interface area, open to other devices for writing operations, such as a measuring device writing the acquired data into this data area at regular intervals;

[0047] Preferably, it is opened through the 485 protocol, and other devices can communicate with the device through the 485 protocol to write the collected data into the device at a regular interval.

[0048] b. The authentication password setting terminal consists of at least 10 switch terminals. For example, if terminals 1 and 3 are upward and the rest are downward, the authentication password is binary 101.

[0049] In this embodiment, it is preferably composed of 10 dip switches, with 1 for upward and 0 for downward. The default is 0. If terminals 1 and 3 are upward and the rest are downward, the authentication password is binary 1010000000. Authentication password setting: First, set the authentication password through the dip switch, then press the set button, and the processing calculation chip reads the switch value of the dip switch to obtain the authentication password value.

[0050] c. Algorithm encryption module, using low-power RSA / ECC algorithm encryption chip LKT4201N, which stores non-exportable private keys through hardware for decryption of encrypted authentication passwords. LKT4201N implements the RSA international standard algorithm from hardware, and the RSA key pair is stored in the chip. Only authorized and authenticated users can obtain the operation rights of the RSA key pair, where the RSA key pair can be generated inside the chip or input from the outside by the user through key recovery. The RSA private key part will not be input or output in plain text under any circumstances; at the same time, in order to protect the security of the RSA private key in the key pool, LKT4201N has added technical measures to prevent side channel attacks, has a metal shielding protection layer, and comes with a variety of detection sensors. Once the chip detects illegal detection, it will start the internal self-destruction function. It is one of the smart card chips with the highest security level in the world.

[0051] Preferably, the algorithm encryption module is an asymmetric algorithm encryption chip, which stores a non-exportable private key through hardware and is used to decrypt the encrypted authentication password. Taking the RSA encryption chip as an example, it implements the RSA international standard algorithm in hardware, and the RSA key pair is stored in the chip. Only authorized and authenticated users can obtain the operation rights of the RSA key pair, where the RSA key pair is either generated inside the chip or input from the outside by the user through key recovery. The RSA private key part will never be input or output in plain text under any circumstances; at the same time, in order to protect the security of the RSA private key in the key pool, the RSA implementation scheme in the general chip adds technical measures to prevent side channel attacks.

[0052] d. Processing and computing module, used for client authentication, scheduling of various modules, data encryption transmission management, and session management;

[0053] Preferably, the processing and computing module adopts STM32F429IGT6 chip, 180M main frequency, external expansion 64MSDRAMIS42S16400J, downloads the program through JTAG, is programmed based on the Keil platform, and can use programming languages ​​such as java, c, c++ for client authentication, scheduling of various modules, data encryption transmission management, and management of processes such as sessions.

[0054] e. The device has a wireless transmitting and receiving communication chip, which is usually divided into a transmitting module and a receiving module. It is used to convert data into wireless signals and send them out through the transmitting module, and receive signals sent by other transmitting modules through the receiving module. The chip can adopt mature wireless communication protocols on the market, such as WIFI, Bluetooth, ZIGBEE and other wireless communication protocols.

[0055] Preferably, the wireless communication module of the device adopts CC2530, supports ZigBee protocol, has an effective communication distance of 100m, and is used to convert data into wireless signals and send them out through the transmitting module, and receive signals sent by other transmitting modules through the receiving module. The client wireless transmitting and receiving communication chip is the same as above.

[0056] According to the above definition of wireless encryption communication device: set the public key of the device to pbk, the private key to prk, the set authentication password to code, and randomly exchange the key ek.

[0057] The specific workflow is as follows:

[0058] 1. The wireless encryption communication device distributes the public key Pbk to the client that needs to connect and communicate with it;

[0059] 2. Change the authentication password code by dialing the authentication password setting terminal, power on the wireless encryption device, and wait for the client to connect.

[0060] 3. The client sends a "connection request message" and uses the obtained public key pbk to encrypt the "authentication password" code and the "random exchange key" ek using the RSA asymmetric algorithm, attaches it to the "connection request message" ConnectInfo, and sends it to the wireless encryption device. Assuming that the public key encryption function is f1, then we have the following: ConnectInfo = f1 (pbk, code, ek).

[0061] 4. After receiving the "application connection message", the wireless encryption communication device decrypts it through the RSA encryption chip to obtain ConnectInfoW, and increases the number of authentication attempts count by 1; assuming that the private key decryption function is f2, then the following is obtained:

[0062] ConnectInfoW=f2(connectinfo,prk);

[0063] 5. Get the "password to be authenticated" from ConnectInfoW and compare it with the previously set "authentication password" to get the comparison result rsult. Suppose the function for getting the "password to be authenticated" is f3, then Result = f3 (ConnectInfoW) == code;

[0064] 6. If the "password to be authenticated" is inconsistent with the "authentication password" code, and the number of authentication attempts count is greater than or equal to 3 times, the wireless encryption communication device enters a self-locking state and can only be unlocked by changing the authentication password by dialing the authentication password setting terminal or re-powering on, and allowing the client to connect; if the number of authentication attempts is less than 3 times, a message "authentication failed" is sent to the client again;

[0065] 7. If they are consistent, the wireless encryption communication device obtains the random exchange key ek through ConnectInfoW, and obtains ekSigned through the private key signature, and attaches ekSigned to the "authentication successful" message and sends it to the client. Let the function for obtaining the random exchange key be f4, and the function for signing with the private key be f5, then ekSigned = f5 (f4 (ConnectInfoW), prk);

[0066] 8. If the client receives the message "Authentication failed", repeat 3-5 until it receives the message "Authentication successful";

[0067] 9. After receiving the "authentication successful" message, the client uses the public key of the wireless encryption communication device to verify the signature of ekSigned and ek. Let the signature verification function be f6 and the verification result be Result2, then Result2 = f6 (ekSigned, ek, pbk);

[0068] 10. If the signature verification of Result2 fails, the client rejects the random exchange key ek and checks whether there are any counterfeit wireless encryption communication devices in the surrounding area. After eliminating them, start again from step 1.

[0069] 11. If the signature verification of Result2 is successful, the wireless encryption communication device establishes an encrypted communication connection with the client and uses the random exchange key ek of that time to communicate through a symmetric encryption algorithm.

[0070] 12. The client sends a "data request" to the wireless encryption device. The wireless encryption device processing chip reads data from the data interface area, encrypts it using the symmetric encryption algorithm through the random exchange key ek, and sends the ciphertext dataEncrypted to the client. Assume that the data to be transmitted is data, and the function of the symmetric encryption algorithm is f7, then dataEncrypted = f7 (ek, data);

[0071] 13. The client receives dataEncrypted and decrypts it using the symmetric encryption algorithm through ek to obtain the real data dataRaw and then performs corresponding calculations. Suppose the decryption function is f8, then dataRaw = f8 (dataEncrypted, ek).

[0072] This embodiment adopts a public key system to ensure the confidentiality of the authentication password and the random exchange password during the wireless communication exchange process, and adopts a variable mechanical terminal to set the authentication password to ensure the legitimacy of the client. This embodiment can be widely used in field equipment that is not suitable for wired data collection. The wireless encryption communication device of this embodiment can be easily integrated and ensure the identity authentication and data transmission security during the wireless transmission of data from the collection device to the client.

[0073] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A wireless encryption method using a public key to protect a variable mechanical authentication password, characterized in that: A wireless encryption device based on using a public key to protect a variable mechanical authentication password, the wireless encryption device includes a wireless encryption communication device and a client that wirelessly communicate with each other; The wireless encryption communication device includes a data interface area, an authentication password setting terminal, an algorithm encryption module, and a processing and calculation module; The data interface area is used to be open to other devices for writing operations; The authentication password setting terminal is used to set the authentication password mechanically; The algorithm encryption module stores the non-exportable private key through hardware, and is also used to distribute the public key to the client and encrypt and decrypt the authentication password; The processing and computing module is used for client authentication, data encryption transmission management and communication process management; The client is used to send a connection application message to the wireless encryption communication device, and the connection application message is encrypted by a public key obtained from the wireless encryption communication device; The wireless encryption method comprises the following steps: S1. The wireless encryption communication device distributes the public key Pbk to the client that needs to connect and communicate with it; S2. Set the authentication password code of the wireless encryption communication device through the authentication password setting terminal, power on the wireless encryption device, and wait for the client to connect; S3. The client sends a connection request message: the authentication password code and the random exchange key ek are encrypted using an asymmetric algorithm with the obtained public key pbk, and then attached to the connection request message ConnectInfo, and sent to the wireless encryption device; assuming that the public key encryption function is f1, then: ConnectInfo = f1(pbk, code,ek); S4. After receiving the connection application message, the wireless encryption communication device decrypts it through the algorithm encryption module to obtain ConnectInfoW. Assuming that the private key decryption function is f2, the following is true: ConnectInfoW = f2 (Connectinfo, prk); where prk is the private key; S5. The algorithm encryption module obtains the password to be authenticated from ConnectInfoW, and compares it with the authentication password set in step S2 to obtain a comparison result rsult; assuming that the function for obtaining the password to be authenticated is f3, then Result = f3(ConnectInfoW); S6. If the password to be authenticated is inconsistent with the authentication password code, that is, Result≠code, an authentication failure message is sent to the client; If the password to be authenticated is consistent with the authentication password code, that is, Result = code, the wireless encryption communication device obtains the random exchange key ek through ConnectInfoW, and obtains ekSigned through the private key signature, and attaches ekSigned to the authentication success message and sends it to the client; let the function for obtaining the random exchange key be f4, and the function for signing with the private key be f5, then ekSigned = f5(f4(ConnectInfoW), prk); S7. After receiving the authentication success message, the client uses the public key of the wireless encryption communication device to verify the signatures of ekSigned and ek. Suppose the signature verification function is f6 and the verification result is result2, then Result2 = f6(ekSigned, ek, pbk); S8. If the signature verification of Result2 fails, the client rejects the random exchange key ek and checks whether there are any counterfeit wireless encryption communication devices in the surrounding area. After eliminating them, restart from step S1; If the signature verification of Result2 is successful, the wireless encryption communication device establishes an encrypted communication connection with the client, and uses the random exchange key ek of that time to communicate through a symmetric encryption algorithm.

2. The wireless encryption method using a public key to protect a variable mechanical authentication password according to claim 1, characterized in that: In step S4, after decrypting to obtain ConnectInfoW, the number of authentication attempts count is increased by 1; if the password to be authenticated is inconsistent with the authentication password code in step S6, and the number of authentication attempts count is greater than or equal to 3, the wireless encryption communication device enters a self-locking state, and can only be unlocked by changing the authentication password or powering on again by turning the mechanical terminal of the authentication password setting terminal to allow the client to connect; if the number of authentication attempts is less than 3, an authentication failure message is sent to the client.

3. The wireless encryption method using a public key to protect a variable mechanical authentication password according to claim 1, characterized in that: After step S6 is completed, if the client receives a message indicating that the authentication has failed, steps S3-S5 are repeated until a message indicating that the authentication has succeeded is received, and then step S7 is entered.

4. The wireless encryption method using a public key to protect a variable mechanical authentication password according to claim 1, characterized in that: After the communication connection is established in step S8, the exclusive mode is started, and the application for a new connection is allowed only when the authentication password is changed.

5. The wireless encryption method using a public key to protect a variable mechanical authentication password according to claim 1, characterized in that: The method for communicating through the symmetric encryption algorithm in step S8 is: S9, the client sends a data request to the wireless encryption device, the processing and computing module of the wireless encryption device reads the data from the data interface area, encrypts it using the symmetric encryption algorithm through the random exchange key ek, and sends the ciphertext dataEncrypted to the client. Assume that the data to be transmitted is data, and the function of the symmetric encryption algorithm is f7, then dataEncrypted = f7(ek,data); S10. The client receives dataEncrypted and decrypts it using the symmetric encryption algorithm through ek to obtain the real data dataRaw. Suppose the decryption function is f8, then dataRaw = f8(dataEncrypted, ek).

6. The wireless encryption method using a public key to protect a variable mechanical authentication password according to claim 1, characterized in that: The wireless encryption communication device communicates with the client via a wireless communication module.

7. The wireless encryption method using a public key to protect a variable mechanical authentication password according to claim 1, characterized in that: The algorithm encryption module is an asymmetric algorithm encryption chip.

8. The wireless encryption method using a public key to protect a variable mechanical authentication password according to claim 7, characterized in that: The asymmetric algorithm encryption chip is an RSA encryption chip.

Images