Macsec implementation method based on enhanced GCM algorithm

Abstract

The present invention provides a method for implementing Macsec based on an enhanced GCM algorithm. The method includes: sending an initialization vector to an AES / SM4 encryption core to obtain Y0, performing an alpha modular multiplication logic operation on Y0 to obtain an alfa value for each packet, and then performing an exclusive OR operation on the alfa value and each packet value to weaken the correlation between each packet of the original GCM algorithm. Among them, the alpha modular multiplication logic operation expression is: #imgabs0#a0[k] is the input byte array, a j [k] is the output byte array, alpha is a basic element in the GF(2 128 ) domain corresponding to the polynomial x, and j is the exponent of alpha. Without changing the default GCM structure, the present invention strengthens the difference between each packet in the block algorithm and reduces the derivability between packets by adding a simple logic structure, making the algorithm implementation more robust, so as to ensure higher reliability of the Mac frame data processed by MacSec implemented by the present invention.

Description

Technical Field

[0001] The present invention relates to the field of encryption authentication, and in particular to a Macsec implementation method based on an enhanced GCM algorithm. Background Art

[0002] Today, Ethernet technology is widely used in most wide area networks (WANs) responsible for providing global telecommunications, wireless and Internet services, and its low cost and high performance have also made it a popular medium in many emerging applications. Although Ethernet was invented more than 40 years ago, it still has a significant impact on almost every aspect of network and communication systems. As more and more machines become smart and require network connectivity, Ethernet for the Internet of Things or "Industrial Ethernet" has expanded rapidly.

[0003] However, there are many unsafe factors in the application of public networks. These security loopholes can easily lead to information leakage, information destruction, illegal information dissemination, incorrect use of network resources, etc. Therefore, it is necessary to take strong security measures for a safe network environment. As early as 2004, the GCM algorithm was proposed as an operation mode of AES encryption and decryption. It also officially became the encryption certification standard of NIST in 2005. In the IEEE802.1ae standard published in 2006, the GCM algorithm is the default encryption and authentication algorithm of this protocol. The GCM algorithm can be applied to both the IEEE802.1ae standard and the Internet Protocol Security (IPSec). In addition, if only the GCM algorithm is used for authentication without encryption operation, it can be used as an authentication mode, namely GMAC authentication.

[0004] The GCM algorithm encrypts different Count values ​​in groups, and then XORs them with the plaintext to generate ciphertext. Because the Count values ​​between each group are interrelated, if one group is cracked, the corresponding other groups can be easily pushed out, which reduces the security of the data. Summary of the invention

[0005] In order to solve the above technical problems, the present invention discloses a Macsec implementation method based on an enhanced GCM algorithm. Without changing the default GCM structure, the present invention increases the difference between each group in the grouping algorithm by adding a simple logical structure, reduces the derivability between groups, and makes the algorithm more robust, thereby ensuring that the Mac frame data processed by MacSec implemented by the present invention is more reliable. At the same time, the encryption algorithm core supported by the present invention not only includes support for AES-128 / AES-192 / AES-256, but also supports the national encryption SM4 algorithm.

[0006] To achieve the above object, the technical solution of the present invention provides a Macsec implementation method based on an enhanced GCM algorithm, the method comprising: sending an initialization vector to an AES / SM4 encryption core to obtain Y0, performing an α modular multiplication logic operation on Y0 to obtain an alfa value of each group, and then performing an XOR operation on the alfa value and each group value, thereby weakening the correlation between each group of the original GCM algorithm, wherein the α modular multiplication logic operation expression is:

[0007]

[0008] a0[k] is the input byte array, a j [k] is the output byte array, α is the GF(2 128 ) domain, and j is the index of α.

[0009] In a further technical solution, the ciphertext generation process includes: (1) the first encryption, that is, when Count=0, {IV[95:0], 32'h0} is sent to the AES / SM4 encryption core to obtain Y0, where 32'h0 is 32 1-bit 0s; (2) the Y0 value is used to generate the alfa value of each group, and it is XORed with the group {IV[95:0], Count[31:0]} value, and the result is sent to the AES / SM4 encryption core to obtain the IV Count ciphertext of each group, and then XORed with the Mac frame plaintext data to obtain the Mac frame ciphertext.

[0010] In a further technical solution, the authentication generation process includes: additional information modular multiplication, ciphertext modular multiplication and length modular multiplication.

[0011] In a further technical solution, when performing modular multiplication of additional information, the additional identification information in MacSec is 20 bytes or 28 bytes, so the modular multiplication Xor_MultH module is called twice;

[0012] In a further technical solution, when performing modular multiplication of ciphertext, each obtained grouped MacSec ciphertext is XORed with the value of the Xor_MultH storage register and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register until all grouped data are calculated;

[0013] In a further technical solution, when performing length modular multiplication, the additional information length and the ciphertext length are represented by 64 bits respectively, and the two 64 bits are concatenated into 128 bits, XORed with the Xor_MultH storage register value, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register, and finally XORed with the Y0 value to obtain the final ICV value.

[0014] In a further technical solution, calling the modular multiplication Xor_MultH module twice includes: the first time, the first 16 bytes of the additional identification information are XORed with the reset value 0 of the Xor_MultH storage register, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register; the second time, the remaining bytes of the additional identification information are XORed with the Xor_MultH storage register value, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register.

[0015] In a further technical solution, H is pre-calculated and encrypted with all zero values. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 This is a schematic diagram of the MacSec frame data format;

[0017] Figure 2 is a schematic diagram of the MacSec implementation structure based on the Enhanced-GCM algorithm of the present invention;

[0018] Figure 3 is a schematic diagram of the α modular multiplication logic of the present invention;

[0019] Figure 4 is a schematic diagram of the Enhanced-GCM algorithm structure of the present invention;

[0020] Figure 5 It is a schematic diagram of the implementation of the MacSec Enhanced-GCM algorithm of the present invention. DETAILED DESCRIPTION

[0021] The technical solution of the present invention is further described below in conjunction with specific embodiments, but the present invention is not limited to these embodiments.

[0022] In MacSec, the GCM algorithm is used by default to perform authorization encryption and authentication decryption on data. In authentication encryption, the input parameters include the key (Key, K), initialization vector (Initialization Vector, IV), plaintext (Plaintext, P), additional authentication information (Additional Authenticated Data, AAD), and the output parameters include ciphertext (Ciphertext, C) and authentication tag (Tag). In authentication decryption, the input parameters include C, Tag, K, IV, ADD, and the corresponding output has P or FAIL flag. Among them, when the Tag value obtained by authentication decryption is inconsistent with the input Tag value, the FAIL flag is output.

[0023] In the IEEE802.1ae standard, the MacSec frame data format is as follows: Figure 1 As shown. DA is the destination address, SA is the source address, and has the same meaning as a normal Mac frame. The length of SecTag is 8 bytes and 16 bytes optional, among which the length of MacSec Ethertype is 2 bytes, and the fixed value 0x88e5 indicates that the frame is a MacSec frame. TCI is 1 byte long, indicating TAG control information, including version number (V), terminal station (ES), presence of SCI (SC), single copy broadcast (SCB), encrypted payload (E), change text (C) and association number (AN). SL is 1 byte long, indicating a short frame, where Bit7-6 is 0 and Bit5-0 is a valid bit. If the value is less than 48, it indicates the byte between the last byte of SecTag and the first byte of ICV. Otherwise, SL is set to 0. PN is 4 bytes long, and Packet Num is mainly used to prevent replay attacks. In each MacSec frame, PN is unique and usually incremented. PN is also used as part of the initial value (IV) of the cipher suite. SCI is 8 bytes long, a secure channel identifier, which can be used to identify which security association the traffic belongs to. The ICV is appended to each MacSec frame as an integrity check value and ensures the integrity of the data. The ICV length depends on the cipher suite and is between 8-16 bytes.

[0024] This patent uses SCI and PN combination to generate 96-bit IV, and the ICV value uses 16 bytes. The MacSec algorithm structure implemented by this patent is as follows Figure 2 As shown in the figure, the Enhanced-GCM Encryption module is an enhanced structure of the default GCM algorithm. By adding a small amount of circuit overhead, the robustness of the GCM Encryption algorithm is greatly enhanced. Figure 3 The α modular multiplication logic shown in the figure weakens the correlation between the default GCM Count, thereby achieving the unpredictability of the encryption algorithm data. Where α is the GF(2 128 ) is a basic element in the domain. In the present invention, α = 2, polynomial = x 128 +x 7 +x 2 +x+1 is taken as an example, but the actual application is not limited to the above α value and polynomial. Since α and polynomial are unknown in the implementation, even if one of the packets in the block encryption algorithm is stolen, the thief cannot obtain the information of other packets, thus ensuring the security of the data.

[0025] Based on α=2, polynomial=x 128 +x 7 +x 2 +x+1 modular multiplication algorithm and implementation pseudocode:

[0026] Input: (1) j is the index of α, (2) byte array a0[k], k = 0, 1, ..., 15

[0027] Output: byte array a j [k],k=0,1,...,15

[0028]

[0029] Among them, ⊕ is the exclusive OR operation, is rounded down. k is the sequence number of each packet of 128 bits, that is, 16 bytes. i ranges from 0 to j.

[0030]

[0031] like Figure 4 The Enhanced-GCM algorithm structure is shown in Figure 1. The purple part is the new structure introduced by this patent. Figure 3 The modular multiplication logic structure is used, and the result is XORed with the ordinary GCM Count value to generate a new encrypted core plaintext, thereby strengthening the function of the ordinary GCM algorithm.

[0032] Figure 5 The specific circuit for the hardware implementation of the Enhanced-GCM algorithm in the present invention. The yellow part represents the register. In order to make the hardware resources more streamlined, this implementation uses an AES / SM4 encryption core and a MultH modular multiplication logic.

[0033] The ciphertext generation is mainly divided into two processes: First, for the first encryption, that is, when Count=0, {IV[95:0], 32'h0} is sent to the AES / SM4 encryption core to obtain Y0, where 32'h0 represents 32 1-bit 0s. Second, the Y0 value is used to generate the alfa value of each group, and the group {IV[95:0], Count[31:0]} value is XORed, and the result is sent to the AES / SM4 encryption core to obtain the IV Count ciphertext of each group, and then XORed with the Mac frame plaintext data to obtain the Mac frame ciphertext.

[0034] The certification process is mainly divided into three steps:

[0035] First, the additional information is modularly multiplied. The additional identification information in MacSec is 20 bytes or 28 bytes, so the Xor_MultH module is called twice. The first time, the first 16 bytes of the additional identification information are XORed with the reset value 0 of the Xor_MultH storage register, and modularly multiplied with H (pre-calculated and encrypted by all 0 values) to obtain the modular multiplication result and update it to the Xor_MultH storage register. The second time, the remaining bytes of the additional identification information (the part that does not meet the 16-byte part is filled with 0) are XORed with the Xor_MultH storage register value, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register.

[0036] Secondly, the ciphertext modular multiplication. XOR each obtained group MacSec ciphertext with the value of the Xor_MultH storage register, and perform modular multiplication with H to obtain the modular multiplication result and update it to the Xor_MultH storage register until all group data calculations are completed.

[0037] Finally, length modulo multiplication. Figure 4 As shown, the additional information length and the ciphertext length are represented by 64 bits respectively, and the two 64 bits are concatenated into 128 bits, XORed with the Xor_MultH storage register value, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register. Finally, XORed with the Y0 value to obtain the final ICV value.

[0038] In an embodiment of the present invention, a Macsec implementation method based on an enhanced GCM algorithm is provided, the method comprising: sending an initialization vector to an AES / SM4 encryption core to obtain Y0, performing an α modular multiplication logic operation on Y0 to obtain an alfa value of each group, and then performing an XOR operation on the alfa value and each group value, thereby weakening the correlation between each group of the original GCM algorithm, wherein the α modular multiplication logic operation expression is:

[0039]

[0040] a0[k] is the input byte array, a j [k] is the output byte array, α is the GF(2 128 ) domain, and j is the index of α.

[0041] In a further technical solution, the ciphertext generation process includes: (1) the first encryption, that is, when Count=0, {IV[95:0], 32'h0} is sent to the AES / SM4 encryption core to obtain Y0, where 32'h0 is 32 1-bit 0s; (2) the Y0 value is used to generate the alfa value of each group, and it is XORed with the group {IV[95:0], Count[31:0]} value, and the result is sent to the AES / SM4 encryption core to obtain the IV Count ciphertext of each group, and then XORed with the Mac frame plaintext data to obtain the Mac frame ciphertext.

[0042] In a further technical solution, the authentication generation process includes: additional information modular multiplication, ciphertext modular multiplication and length modular multiplication.

[0043] In a further technical solution, when performing modular multiplication of additional information, the additional identification information in MacSec is 20 bytes or 28 bytes, so the modular multiplication Xor_MultH module is called twice;

[0044] In a further technical solution, when performing modular multiplication of ciphertext, each obtained grouped MacSec ciphertext is XORed with the value of the Xor_MultH storage register and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register until all grouped data are calculated;

[0045] In a further technical solution, when performing length modular multiplication, the additional information length and the ciphertext length are represented by 64 bits respectively, and the two 64 bits are concatenated into 128 bits, XORed with the Xor_MultH storage register value, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register, and finally XORed with the Y0 value to obtain the final ICV value.

[0046] In a further technical solution, calling the modular multiplication Xor_MultH module twice includes: the first time, the first 16 bytes of the additional identification information are XORed with the reset value 0 of the Xor_MultH storage register, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register; the second time, the remaining bytes of the additional identification information are XORed with the Xor_MultH storage register value, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register.

[0047] In a further technical solution, H is pre-calculated and encrypted with all zero values.

[0048] The invention aims to solve the problem that the encrypted plaintexts between different groups of the traditional GCM algorithm are highly correlated, resulting in reduced algorithm security. Without changing the default GCM structure, the present invention strengthens the differences between each group in the grouping algorithm by adding a simple logical structure, reduces the derivability between groups, and makes the algorithm more robust. At the same time, the encryption algorithm core supported by the present invention not only includes support for AES-128 / AES-192 / AES-256, but also supports the national encryption SM4 algorithm.

[0049] The above is only a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several modifications and improvements without departing from the inventive concept of the present invention, which all fall within the protection scope of the present invention.

Claims

1. A Macsec implementation method based on an enhanced GCM algorithm, characterized in that: The method comprises: sending an initialization vector to an AES / SM4 encryption core to obtain Y0, performing an α modular multiplication logic operation on Y0 to obtain an alfa value of each group, and then performing an XOR operation on the alfa value and each group value, thereby weakening the correlation between each group of the original GCM algorithm, wherein the α modular multiplication logic operation expression is: a0[k] is the input byte array, a j [k] is the output byte array, α is the GF(2 128 ) domain, j is the index of α; where The authentication generation process includes: additional information modular multiplication, ciphertext modular multiplication and length modular multiplication; and When performing modular multiplication of additional information, the additional identification information in MacSec is 20 bytes or 28 bytes, so the modular multiplication Xor_MultH module is called twice; When performing ciphertext modular multiplication, the obtained grouped MacSec ciphertext is XORed with the value of the Xor_MultH storage register each time, and modularly multiplied with the hash subkey H, and the modular multiplication result is obtained and updated to the Xor_MultH storage register until all grouped data calculations are completed; When performing length modular multiplication, the additional information length and the ciphertext length are represented by 64 bits respectively, and the two 64 bits are concatenated into 128 bits, XORed with the Xor_MultH storage register value, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register, and finally XORed with the Y0 value to obtain the final ICV value.

2. The method according to claim 1, characterized in that The ciphertext generation process includes: (1) The first encryption, that is, when Count = 0, {IV[95:0], 32'h0} is sent to the AES / SM4 encryption core to obtain Y0, where 32'h0 is 32 1-bit 0s; (2) Use the Y0 value to generate the alfa value of each group, and XOR it with the group {IV[95:0], Count[31:0]} value, and send the result to the AES / SM4 encryption core to obtain the IV Count ciphertext of each group, and then XOR it with the Mac frame plaintext data to obtain the Mac frame ciphertext.

3. The method according to claim 1, characterized in that The modular multiplication Xor_MultH module is called twice: the first time, the first 16 bytes of the additional identification information are XORed with the reset value 0 of the Xor_MultH storage register, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register; the second time, the remaining bytes of the additional identification information are XORed with the Xor_MultH storage register value, and modularly multiplied with H to obtain the modular multiplication result and update it to the Xor_MultH storage register.

4. The method according to claim 1 or 3, characterized in that: H is pre-calculated and is obtained by encrypting all 0 values.

Images