A symmetric encryption and decryption algorithm packet processing method

Abstract

The present invention provides a symmetric encryption and decryption algorithm packet processing method, the method comprising the following steps: S1, dividing an x-bit plaintext into the first y bits and the last z bits, the first y bits are subjected to a symmetric encryption algorithm with the same key to generate a y-bit ciphertext, and the encryption length is y bits; S2, the last z bits of the x-bit plaintext are subjected to a symmetric encryption algorithm with the same key to generate a z-bit ciphertext, wherein xyz is a positive integer, which is an integer multiple of the minimum length of the encryption algorithm, and the last z bits of the plaintext are transmitted through breakpoint continuation; S3, connecting the ciphertexts obtained by the two segment encryptions of S1 and S2 together to obtain the final ciphertext. The advantages of the present application are: 1. In the case of unstable transmission medium, time consumption can be saved. By adopting segmented encryption transmission, the probability of transmission failure is greatly reduced, and even if it fails, the wasted time is proportional to the data length. Thus, time overhead is saved. 2. In the case of insufficient transmission capacity of the transmission medium, the use of packet processing can avoid the limitation of the transmission medium.

Description

Technical Field

[0001] The present invention relates to the field of encryption technology, and in particular to a symmetric encryption and decryption algorithm packet processing method. Background Art

[0002] In today's society, encryption technology is used in all walks of life, especially in the fields of finance and security. Among them, symmetric encryption algorithms are encryption algorithms that have been used earlier and are mature in technology. In symmetric encryption algorithms, the data sender processes the plaintext (original data) and the encryption key together through a special encryption algorithm, turning it into a complex encrypted ciphertext and sending it out. After the recipient receives the ciphertext, if he wants to interpret the original text, he needs to use the encryption key and the inverse algorithm of the same algorithm to decrypt the ciphertext to restore it to readable plaintext. In symmetric encryption algorithms, there is only one key used, and both the sender and the receiver use this key to encrypt and decrypt data, which requires the decryption party to know the encryption key in advance.

[0003] The encryption method using a single-key cipher, where the same key can be used for both encryption and decryption, is called symmetric encryption, also known as single-key encryption. Commonly used one-way encryption algorithms include:

[0004] 1. DES (Data Encryption Standard): Data encryption standard, fast, suitable for encrypting large amounts of data;

[0005] 2. 3DES (Triple DES): Based on DES, a piece of data is encrypted three times with three different keys, which is stronger;

[0006] 3. AES (Advanced Encryption Standard): Advanced Encryption Standard is the next generation encryption algorithm standard with fast speed and high security level, supporting encryption of 128, 192, 256, and 512-bit keys;

[0007] 4. Blowfish.

[0008] Algorithm features:

[0009] 1. The encryption and decryption parties use the same key;

[0010] 2. The speed of encryption and decryption is relatively fast, which is suitable for the use of relatively long data;

[0011] 3. The key transmission process is insecure and easy to be cracked, and key management is also troublesome;

[0012] Commonly used algorithms in symmetric encryption algorithms include: DES, 3DES, TDEA, Blowfish, RC2, RC4, RC5, IDEA, SKIPJACK, etc. Different algorithms have different implementation mechanisms.

[0013] However, the prior art has the following defects:

[0014] The larger the amount of encrypted data, the longer the algorithm takes and the higher the stability of the system is required, because the larger the amount of data, the more likely it is that data will be lost during transmission.

[0015] 1: Increase the time overhead in case of unstable transmission medium.

[0016] like Figure 1 As shown in the figure, since the length of the data before encryption and decryption is equal to the length of the encrypted and decrypted data, the symmetric encryption is affected by the transmission medium. If the transmission volume is too large, the transmission channel (socket serial port spi iic, etc.) is unstable for the transmission of large data. If the data transmitted at this time is the encrypted data 8k, if there is a 10-bit data transmission loss or abnormality, the transmission fails. This results in a waste of encryption time at end A, transmission medium B time, and decryption time at end C.

[0017] 2: Communication is not possible due to the transmission medium transmission capacity limitation.

[0018] The amount of data after encryption at end A is 10k, and the existing transmission medium B can only transmit 8k at most, so it cannot communicate to end C. Summary of the invention

[0019] The technical problem to be solved by the present invention is:

[0020] 1 Based on socket communication, it is well known that the probability of packet loss in network communication is very high, especially based on UDP transmission protocol. If the amount of encrypted data to be transmitted is large, the probability of packet loss will also be relatively high. If the unpacking solution is adopted and cyclic transmission is performed, a certain amount of data is transmitted each time, and the probability of packet loss is close to 0. The cost of retransmission will also be reduced.

[0021] 2 If the system application layer wants to encrypt a large amount of data, then the encryption time will be longer in a certain period of time, thus affecting the responsiveness of other processes. If the unpacking process is used, using the CPU fragmentation time to encrypt a large amount of data, then the system responsiveness is very important.

[0022] 3 If the device is a CPU and an encryption IC communicating, if the encrypted data is within a certain threshold, it cannot exceed a certain amount of data, but the application must encrypt such a large amount of data. The purpose can be achieved by using sub-packet processing and then re-combining. Or if the hardware communication i2c, spi, and serial port communication are unstable, and large amounts of data will also cause data loss, using sub-packet processing can also avoid such problems.

[0023] Specifically, the present invention provides a symmetric encryption and decryption algorithm packet processing method, the method comprising the following steps:

[0024] S1, divide the x-bit plaintext into the first y bits and the last z bits. The first y bits are encrypted by the symmetric encryption algorithm with the same key to generate y-bit ciphertext. The encryption length is y bits.

[0025] S2, the last z bits of the x-bit plaintext are encrypted by a symmetric encryption algorithm with the same key to generate a z-bit ciphertext, and the encryption length is z bits, where xyz is a positive integer and must be an integer multiple of the minimum length of the encryption algorithm; for example, in the des algorithm, the minimum data unit is 64 bits, so x, y, z must be a multiple of 64, and the last z bits of the plaintext are transmitted by breakpoint continuation;

[0026] S3, connects the ciphertexts obtained by the two segment encryptions of S1 and S2 to obtain the final ciphertext.

[0027] The method adopts a segmented encryption mode based on the fact that the encrypted data obtained by encrypting the encrypted data once and by encrypting the encrypted data in segments are the same.

[0028] During the packet processing process, the method requires a buffer (B) as an intermediate buffer for breakpoint resuming.

[0029] The breakpoint resume mode is achieved by an encryption and decryption resume method.

[0030] The encryption method in the encryption and decryption retransmission method is the DES encryption algorithm.

[0031] The core of the des encryption algorithm is to encrypt or decrypt at least 64 bits at a time, and the encryption or decryption requirement is 1024 bits. Breakpoint resume is achieved by analyzing the underlying algorithm.

[0032] In the method, if the application layer (A) needs to send 8192-byte ciphertext data to a security chip (C) specifically responsible for decryption for decryption, and there are limitations in the middle and 8192 bytes of data cannot be transmitted to the security chip (C) at one time, then an intermediate buffer (B) is required to resume the transmission.

[0033] The limitations in the middle include data loss caused by large data volume, or hardware limitations, serial port or SPI transmission limitations.

[0034] The des algorithm is to calculate the function value of the CalcDES (uchar KeyIdx, uchar*DataIn, ushort DataLen, uchar*DataOut, uchar Mode) function, where KeyIdx is the number of the security chip storing the key, DataIn is the data input, DataOut is the data output, and Mode is encryption or decryption;

[0035] First, initialize index index = 0;

[0036] Secondly, determine whether the data size is greater than or equal to 1024, that is, (size-index)>=1024. If so, result=Security_CalcDES(keyIdx,DataIn+index,1024,DataOut+index,(uchar)mode); and index+=1024;

[0037] If not, result = Security_CalcDES(keyIdx, DataIn+index, size-index, DataOut+index, (uchar)mode); and index+=(size-index).

[0038] The subpacket size is 1024 or an integer multiple of 64 bits.

[0039] Therefore, the advantages of this application are:

[0040] 1: When the transmission medium is unstable, it can save time. By adopting segmented encrypted transmission, the probability of transmission failure is greatly reduced. Even if it fails, the time wasted is proportional to the data length. Thus, time expenditure is saved.

[0041] 2: When the transmission capacity of the transmission medium is insufficient, packet processing can be used to avoid the limitations of the transmission medium. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention.

[0043] Figure 1 It is a schematic diagram in the prior art.

[0044] Figure 2 It is a schematic flow chart of the method of the present invention.

[0045] Figure 3 It is a coded schematic diagram of the first specific embodiment of the present invention.

[0046] FIG4(1) is a schematic diagram of the whole-segment coding of the second specific embodiment of the present invention.

[0047] FIG4(2) is a second schematic diagram of the entire coding of the second specific embodiment following FIG4(1). DETAILED DESCRIPTION

[0048] In order to more clearly understand the technical content and advantages of the present invention, the present invention is now further described in detail in conjunction with the accompanying drawings.

[0049] Different symmetric encryption algorithms have different packet splitting methods, but the ideas are roughly the same. They are based on the fact that the encrypted data obtained by encrypting it once and by segmentation are the same. Therefore, segmentation encryption can be used.

[0050] like Figure 2 The present invention relates to a symmetric encryption and decryption algorithm packet processing method, the method comprising the following steps:

[0051] S1, divide the x-bit plaintext into the first y bits and the last z bits. The first y bits are encrypted by the symmetric encryption algorithm with the same key to generate y-bit ciphertext. The encryption length is y bits.

[0052] S2, the last z bits of the x-bit plaintext are encrypted by a symmetric encryption algorithm with the same key to generate a z-bit ciphertext, and the encryption length is z bits, where xyz is a positive integer and must be an integer multiple of the minimum length of the encryption algorithm. For example, in the des algorithm, the minimum data unit is 64 bits, so x, y, z must be a multiple of 64, and the last z bits of the plaintext are transmitted by breakpoint continuation.

[0053] S3, connects the ciphertexts obtained by the two segment encryptions of S1 and S2 to obtain the final ciphertext.

[0054] The logic of the symmetric algorithm is briefly described as follows:

[0055] The plain text ABCDEFGHIJKL is encrypted by a symmetric algorithm to generate the cipher text LKJIHGFEDCBA, with an encryption length of 12 bits;

[0056] The plaintext ABCDEF is encrypted by the symmetric encryption algorithm with the same key to generate the ciphertext LKJIHG with an encryption length of 6 bits;

[0057] The plaintext GHIJKL is encrypted by the symmetric encryption algorithm with the same key to generate the ciphertext FEDCBA with an encryption length of 6 bits;

[0058] Then the plaintext ABCDEFGHIJK can be connected together to obtain the ciphertext LKJIHGFEDCBA after two segment encryptions. This is the central idea.

[0059] For example, the DES encryption algorithm. Since DES is a block algorithm that uses key encryption, the core of the DES algorithm is to encrypt or decrypt at least 64 bits at a time, and the encryption or decryption requirements are often 1024 bits, or larger. If the application layer (A) needs to send 8192-byte ciphertext data to a security chip C that is specifically responsible for decryption, there are many restrictions in the middle (large data volume causes data loss, or hardware limitations, serial port or SPI transmission limitations), and 8192 bytes of data cannot be transmitted to the security chip at one time, then it is necessary to use an intermediate buffer (B) to resume the download, just like downloading a movie. If there is no network in the middle, you can continue downloading the next time the network is connected, then buffer B can play this role. Figure 3 As shown, the core code example of the specific embodiment 1. The des algorithm is to calculate the function value of the CalcDES (uchar KeyIdx, uchar*DataIn, ushort DataLen, uchar*DataOut, uchar Mode) function, where KeyIdx is the number of the security chip to save the key, DataIn is the data input, DataOut is the data output, and Mode is encryption or decryption;

[0060] First, initialize index index = 0;

[0061] Secondly, determine whether the data size is greater than or equal to 1024, that is, determine whether (size-index)>=1024,

[0062] If yes, then

[0063] result=Security_CalcDES(keyIdx,DataIn+index,1024,DataOut+index,(uchar)mode); and index+=1024;

[0064] If no, then

[0065] result=Security_CalcDES(keyIdx,DataIn+index,size-index,DataOut+index,(uchar)mode); and index+=(size-index).

[0066] The above is a simple example of encryption and decryption retransmission method. The sub-packet size is 1024, which is determined by the user, but must be an integer multiple of 64.

[0067] Packet splitting algorithm: For different symmetric encryption algorithms, the difficulty of unpacking varies and is greatly affected by the encryption mode.

[0068] There are many variants of DES encryption, and the difficulty of the retransmission method will also be doubled. It is necessary to retransmit according to the principle of the underlying algorithm. Specifically, the implementation method is the specific embodiment 2, such as Figure 4(1)-Figure 4(2) As shown, the value of the DukptDes() function is calculated, where GroupIdx is the group in which the security chip stores the key; KeyVarType is the key type; pucIV is a variable parameter to increase the encryption and decryption strength; Mode is the encryption and decryption mode based on pucIV; KsnOut is the key serial number output;

[0069]

[0070]

[0071]

[0072]

[0073] The mixing of different encryption parameters increases the difficulty of resuming transmission, and researchers are also required to analyze the underlying algorithm implementation in order to implement the resuming algorithm.

[0074] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A symmetric encryption and decryption algorithm packet processing method, characterized in that: The method The following steps are involved: S1, divide the x-bit plaintext into the first y bits and the last z bits. The first y bits are encrypted by the symmetric encryption algorithm with the same key to generate y-bit ciphertext. The encryption length is y bits. S2, the last z bits of the x-bit plaintext are encrypted by a symmetric encryption algorithm with the same key to generate a z-bit ciphertext, and the encryption length is z bits, where x, y, and z are positive integers and must be integer multiples of the minimum length of the encryption algorithm. The last z bits of the plaintext are transmitted in a breakpoint-resume manner; S3, concatenates the ciphertexts obtained by the two segment encryptions of S1 and S2 to obtain the final ciphertext; The method adopts a segmented encryption method based on the fact that the encrypted data obtained by encrypting the encrypted data once and by segmentation are the same; In the process of packet sub-processing, the method requires a buffer (B) as an intermediate buffer for breakpoint resuming; The breakpoint resume mode is achieved by an encryption and decryption resume method; The encryption method in the encryption and decryption retransmission method is the DES encryption algorithm; The core of DES encryption or decryption algorithm is to encrypt or decrypt at least 64 bits at a time, and breakpoint resume can be achieved by analyzing the underlying algorithm; In the method, the application layer (A) needs to send 8192-byte ciphertext data to a security chip (C) that is specifically responsible for decryption for decryption. When there is a limitation in the middle and 8192 bytes of data cannot be transmitted to the security chip (C) at one time, an intermediate buffer (B) is needed to resume the transmission at the breakpoint. The limitations in the middle include data loss caused by large data volume, or hardware limitations; The DES encryption or decryption algorithm is to calculate the function value of the CalcDES(uchar KeyIdx, uchar * DataIn, ushortDataLen, uchar * DataOut, uchar Mode) function, where KeyIdx is the number of the security chip storing the key, DataIn is the data input, DataOut is the data output, and Mode is encryption or decryption; First, initialize the index index=0; Secondly, determine whether the data size is greater than or equal to 1024, that is, (size-index) >= 1024, If yes, then result = Security_CalcDES(keyIdx,DataIn+index,1024, DataOut+index,(uchar)mode); and index += 1024; If no, then result = Security_CalcDES(keyIdx,DataIn+index,size-index, DataOut+index,(uchar)mode); and index += (size-index); The subpacket size is an integer multiple of 64 bits.

Images