A network transmission method and device for encryption and decryption

Abstract

The present invention discloses an encryption and decryption network transmission method and device, which adopts a mode of connecting a server with multiple PADs, and the server and PAD ends are equipped with the same encryption module. The encryption module is designed with the idea of ​​red and black isolated power supply. The encryption module includes a USB network card module, FPGA, an internal network CPU and an external network CPU; the encryption module needs to be powered on through an authentication medium. After the authentication is successful, the wifi module of the external network CPU actively establishes a connection with other devices. After the connection is successful, the two parties conduct key negotiation and negotiate a common session key. After the session key is generated, network data can be sent and received; the sending end sends the message to the encryption module, the encryption module encrypts the entire message through the FPGA, and sends the encrypted ciphertext to the receiving end. After receiving the encryption module at the receiving end, the message is decrypted through the FPGA and the plaintext is returned to the receiving host. Therefore, the core data in the wireless network is all ciphertext, which ensures the security and reliability of the data path.

Description

Technical Field

[0001] The present invention relates to secure transmission of network data, and in particular to a system for realizing secure transmission of network data based on a cryptographic algorithm and applied on an Internet platform. Background Art

[0002] With the development of computer technology and communication technology, tablet computers have been widely used. People's requirements for things and information exchange have become more diversified, daily life and office work have become more information-based, and many enterprises and institutions have realized computerized management. At the same time, people's requirements for the confidentiality of network data security are also getting higher and higher.

[0003] At present, most companies usually print out the documents to be reviewed before holding confidential expert meetings. When the meeting is held, the documents are sent to each expert, who reviews the reviewed documents or uses a projector to project the document information. When experts make suggestions on the documents, users are required to take notes and record the opinions of each expert. At the end of the meeting, the minutes are printed and signed by the experts. At present, this form of meeting has some problems, such as: 1) Waste of resources: users need to print multiple copies of documents before the expert meeting, which causes waste of resources when the number of reviewed documents is large; 2) Low security: The printing and destruction process of confidential documents is cumbersome and has poor security; 3) Cumbersome operation: Confidential documents need to be reviewed for security during the printing process. In this case, considering that the current network conference has low security, the content of the general meeting needs to be kept confidential. If non-meeting personnel join or network data is illegally stolen during transmission, confidential information will be leaked, which poses a great risk. Summary of the invention

[0004] In view of the current security issues of online conferences, and solving the cumbersome process of holding confidential meetings, the present invention provides an encrypted and decrypted network transmission system, which adopts the "paperless sharing" mode of conference information and has the characteristics of security and confidentiality, high efficiency and convenience, rapid deployment, and green environmental protection.

[0005] In order to solve the above technical problems, on the one hand, the present invention proposes an encryption and decryption network transmission device, including a server and several PAD terminals, wherein the server and PAD terminals are respectively equipped with encryption modules for isolating the internal and external networks, and adopt wireless VPN technology to build a wireless VPN system to form a data tunnel. Among them:

[0006] The encryption module includes a USB network card module, an FPGA module, a power module, an internal network CPU connected to the internal network, and an external network CPU connected to the external network; the USB network card module realizes data exchange between the server or PAD terminal and the FPGA module; the FPGA module is used for protocol message analysis, data forwarding and commercial secret algorithm implementation; the commercial secret algorithm adopts the AES symmetric algorithm, the internal network CPU and the external network CPU are connected to the FPGA module using the SDIO interface, the internal network CPU is used for configuration management, power-on authentication and key information management, and the external network CPU has a wifi module; the encryption module is equipped with an authentication medium;

[0007] The server and the encryption module equipped therewith are connected via a USB network card module, the network message sent by the server is encrypted by the encryption module equipped therewith, after the network message is encrypted, the external network CPU is connected to the wireless AP via a network cable to send data; at the same time, the network data received from the external network CPU is decrypted by the encryption module, and the decrypted plaintext data is sent to the server;

[0008] In the PAD terminal and the encryption module it is equipped with: the PAD terminal removes all wireless interfaces and transmits data only through the WIFI module. The PAD terminal and the encryption module are connected to the USB network card module. The network messages transmitted from the PAD end are encrypted by the encryption module it is equipped with. After the network messages are encrypted, they are sent to the external network through the wifi module; at the same time, the network messages received from the wifi module are decrypted by the encryption module, and the plain text data is sent to the PAD terminal after decryption.

[0009] Furthermore, in the network transmission device described in the present invention, the USB network card module adopts a PHY chip.

[0010] At the same time, the present invention proposes a method for realizing network transmission by using the above network transmission device, mainly in which the core data part of the network data packet is not parsed during the entire transmission process, and the core information is completely encrypted during the transmission process of the external network, including the following steps:

[0011] Step 1, the encryption module verifies the key component through the authentication medium, and if the verification is successful, the encryption module operates normally, wherein the authentication medium has an anti-copying function;

[0012] Step 2: The working key information is sent from the server or PAD terminal to the FPGA module through the USB network card module of the encryption module. The FPGA module parses the message and forwards it to the intranet CPU. The intranet CPU parses the working key Wkey; calls the AES algorithm in the FPGA module, uses the device key R to encrypt the working key Wkey, and saves the working key ciphertext in the intranet CPU;

[0013] Step 3: The encryption module equipped on the server is the master device, and the encryption module equipped on the PAD terminal is the slave device, and a connection is established between the master device and all the slave devices through a TCP connection in a one-to-many transmission mode;

[0014] Step 4: After the connection is established, the master device and the slave device negotiate a key and negotiate a common key as a session key for data message encryption / decryption transmission;

[0015] Step 5: Network message transmission. During the transmission process, the master device and the slave device, the sender encrypts and the receiver decrypts.

[0016] Furthermore, the specific content of step 1 of the network transmission method is:

[0017] The authentication medium stores a device key component R1, the intranet CPU stores a device key component R2 and a device key component Rc, and the device key component Rc is a ciphertext of a 16-byte random number ram and CRC (ram);

[0018] The authentication medium is connected to the encryption module. After the power module powers on the encryption module, the intranet CPU reads the device key component R1 in the authentication medium and the device key component R2 in the FLASH to generate the device key R, R=R1xorR2; the intranet CPU calls the AES algorithm in the FPGA module through the SDIO interface to decrypt the device key component Rc, and after the operation, detects whether the decrypted plaintext satisfies the ram||CRC(ram) format. If so, the device key R is successfully generated, and the encryption module starts normally;

[0019] After the power-on authentication is successful, the intranet CPU re-acquires the 32-byte random number, the first 16 bytes are the updated device key component R1, and the last 16 bytes are the device key component R3, and the device key R is recalculated, R=R1xorR2; the device key component Rc is recalculated, Rc is the ciphertext of R3||CRC(R3), the recalculated device key component Rc is stored in the intranet CPU, and the updated device key component R1 is rewritten into the authentication medium as the next power-on authentication, so that the device key component R1 in the authentication medium and the device key component Rc stored in the intranet CPU are different each time the computer is powered on.

[0020] In step 2 of the network transmission method, each time the encryption module is powered on, the device key R is used to decrypt the working key Wkey through the AES algorithm in the FPGA module, and the decrypted working key Wkey is sent to the FPGA module for key negotiation operations; when the device key component R1 and the device key component Rc are updated, the regenerated device key R is used to re-encrypt the working key Wkey, and the working key ciphertext file stored in the FLASH is updated.

[0021] In step three of the network transmission method, after the master device is powered on, the external network CPU of the master device starts a TCP connection request mode to wait for the connection of the slave device, and the external network CPU of the slave device starts a TCP connection mode to actively connect to the master device; after the master device successfully connects to a slave device, it obtains the IP address information of the slave device, and sends the IP address information to the FPGA module of the master device through the SDIO interface; the FPGA module receives the message parsing message, forwards the message to the internal network CPU, and after the internal network CPU parses it, it saves the address information, and then initiates a key negotiation operation.

[0022] The specific content of step 4 of the network transmission method is as follows: in the master device: the intranet CPU obtains a 16-byte random number Wka, and sends the random number Wka to the FPGA module through the SDIO interface. The FPGA module calls the AES algorithm to encrypt the Wka, and the key uses the working key Wkey, and the encryption result is recorded as Wkac; the intranet CPU encapsulates the Wkac negotiation message and sends the negotiation message to the external network CPU through the FPGA module, and the external network CPU sends the Wkac message to the slave device established with it; in the slave device: the external network CPU receives the message, and the external network CPU sends the message to the FPGA module, and the FPGA module parses the message as a session negotiation, calls the AES algorithm of the FPGA module to decrypt the Wkac, and the key uses the working key Wkey. After decryption, Wka is obtained, and the FPGA module sends the Wka to the intranet CPU, and the intranet CPU saves the Wka; the intranet CPU obtains a 16-byte random number Wkb, and sends the Wkb to the FPGA module through the SDIO interface. The PGA module uses the working key Wkey to call the AES algorithm to encrypt Wkb and obtain the ciphertext Wkbc. After the encryption operation is successful, the ciphertext is returned to the intranet CPU. The intranet CPU encapsulates the Wkbc negotiation message and sends the negotiation message to the external network CPU through the FPGA module. The external network CPU sends the message Wkbc to the master device. The external network CPU of the master device receives the message Wkbc and sends it to the FPGA module. The FPGA module parses the message as a session negotiation and calls the AES algorithm of the FPGA module to decrypt Wkbc. The decryption result is the Wkb. The FPGA module sends the Wkb to the intranet CPU. The intranet CPU synthesizes the session key Wk, Wk=WkaxorWkb, and establishes a mapping relationship between the session key and the connection device address according to the destination address of the slave device connected to the master device. When the master device is disconnected from the slave device, the intranet CPU actively clears the session key Wk. After the session key is generated, the slave device is notified to generate the key. After receiving the key, the slave device synthesizes the session key Wk, and the negotiation ends.

[0023] The session key is created each time a device is connected to ensure that the session key of each connected device is different, and the master device stores the session key information of all connected slave devices.

[0024] The specific content of step 5 of the network transmission method is: after the session negotiation is completed, the master device and the slave device perform network communication, wherein:

[0025] The network data transmission process from the server to the PAD terminal is: the server sends a network message to the main device, the FPGA module of the main device receives the message, forwards the message to the intranet CPU through SDIO, the intranet CPU parses the message and parses it into a network message, the intranet processing unit extracts the message destination address information, finds the corresponding session key, calls the FPGA's internal commercial AES algorithm interface to encrypt the entire message, and sends the encrypted message and the destination address information to the external network CPU. The external network CPU re-encapsulates the ciphertext and sends the encapsulated ciphertext to the slave device according to the destination address information; the slave device's external network CPU receives the data message, removes the encapsulated protocol header, and sends the ciphertext data to the FPGA through the SDIO interface. The FPGA uses the session key Wk to call the commercial AES algorithm to decrypt the message, and the decrypted plaintext is sent to the PAD terminal through the USB network interface to complete the data transmission.

[0026] The network data transmission process from the PAD terminal to the server is: the PAD terminal sends the network message to the FPGA module through the USB network card module of the configured slave device. The FPGA module uses the session key Wk to call the AES algorithm to encrypt the network message, and sends the encrypted network message to the external network CPU. The external network CPU re-encapsulates the encrypted message, and sends the encapsulated message to the main device. The external network CPU of the main device receives the message and removes the encapsulated protocol header. The external network CPU sends the network address information of the sending end of the encryption module connected to the PAD terminal and the received message to the internal network CPU through the FPGA module. The internal network CPU searches for the corresponding session key Wk according to the network address information, and sends the session key and ciphertext to the FPGA module. The FPGA module calls the AES algorithm to decrypt the ciphertext, and the decrypted message is sent to the server through the USB network card module to complete the data communication.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] (1) The hardware design of the encryption module adopts a red-black isolation architecture. The internal network CPU is used for key information management and message encryption and decryption operations are processed through the FPGA. The ciphertext after operation is sent to the external network. All core information in the wireless network is encrypted.

[0029] (2) The server and PAD are equipped with the same encryption module, which is equipped with a unique authentication medium. The device can be started normally only after passing the authentication. After each successful authentication, the key component in the authentication medium will be replaced to prevent the medium from being illegally copied and ensure the security of the encryption device.

[0030] (3) After the server and PAD establish a connection, the two parties negotiate a key. The negotiated session key is used for data encryption and decryption. The session key will be regenerated each time a connection is established, making data transmission more reliable.

[0031] (4) The system uses PAD as a browsing tool and removes all wireless interfaces of the PAD terminal. Network messages can only be transmitted through the external network CPU of the encryption module to ensure reliable transmission.

[0032] (5) Implement symmetric encryption and decryption algorithms within the FPGA module to improve computing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a scene deployment diagram of the network transmission equipment for encryption and decryption of the present invention;

[0034] Figure 2 It is a system connection diagram of the encryption and decryption network transmission equipment of the present invention;

[0035] Figure 3 yes Figure 2 The hardware schematic diagram of the encryption module shown in;

[0036] Figure 4 It is a flowchart of power-on authentication in the network transmission method of encryption and decryption of the present invention;

[0037] Figure 5 It is a flow chart of session negotiation in the encryption and decryption network transmission method of the present invention;

[0038] Figure 6 It is a flow chart of network data transmission between a server and a PAD in the network transmission method for encryption and decryption of the present invention;

[0039] Figure 7 It is a flow chart of network data transmission between PAD and server in the encryption and decryption network transmission method of the present invention. DETAILED DESCRIPTION

[0040] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but the following embodiments are by no means intended to limit the present invention in any way.

[0041] In view of the above problems, the present invention designs an encryption and decryption network transmission method and device. The application scenarios of the present invention are as follows: the main framework of the system adopts a B / S architecture. To support group meetings, the administrator needs to register the meeting information, and then add meeting members according to the meeting information, and assign a meeting number to each member. The administrator deploys the meeting files to the corresponding location of the server according to the meeting scenario; when the meeting is held, the user logs in to the account through the PAD. After the login is successful, the file information list deployed by the administrator can be seen. The user selects the file, browses the file online, and annotates the file information. After the annotation is completed, the background will automatically generate a review opinion form for the user. The administrator can browse the user's annotation information in the management interface for centralized processing. The administrator can flexibly group personnel and support multiple meetings to be held at the same time. The scenario deployment diagram of the encryption and decryption network transmission device proposed by the present invention is shown in the following figure. Figure 1 shown.

[0042] In order to ensure the security of data transmission, the encryption and decryption network transmission equipment proposed in the present invention includes a server and several PAD terminals, and the system adopts wireless VPN technology. The server and PAD terminals are respectively equipped with encryption modules for isolating the internal and external networks. By equipping the server and PAD with encryption modules, a wireless VPN system is constructed to form a data tunnel. The core data part of the network data packet is not parsed during the entire transmission process, and all the core information in the wireless network is encrypted.

[0043] The cryptographic device draws on the idea of ​​red-black isolated power supply and adopts a structure that isolates the internal and external networks. The encryption algorithm is implemented through an FPGA chip and isolated through an encryption module, which cannot be bypassed. The encryption module is equipped with an authentication medium.

[0044] In the server end and the encryption module equipped therewith: the server end and the encryption module are connected via a USB network card module, the network message transmitted by the server end is encrypted by the encryption module equipped therewith, after the network message is encrypted, the external network CPU connects to the wireless AP via a network cable to send data; at the same time, the network data received from the external network CPU is decrypted by the encryption module, and the decrypted plaintext data is sent to the server end; therefore, the core data in the wireless network are all ciphertext, ensuring the security of the data path.

[0045] The PAD terminal can be a general product in society, but the PAD's own WIFI, Bluetooth and other wireless interfaces need to be removed, and data is transmitted only through the WIFI module embedded in the external cryptographic device, ensuring the security of the data path. The PAD terminal and the encryption module it is equipped with: the PAD terminal removes all wireless interfaces and transmits data only through the WIFI module. The PAD terminal and the encryption module are connected to the USB network card module. The network message transmitted from the PAD end is encrypted by the encryption module it is equipped with. After the network message is encrypted, it is sent to the external network through the wifi module; at the same time, the network message received from the wifi module is decrypted by the encryption module, and the plain text data is sent to the PAD terminal after decryption. PAD needs to be equipped with a browser, and there is no need to install software. The system connection diagram is as follows Figure 2 shown.

[0046] The hardware of the encryption module of the network transmission device of the present invention is as follows Figure 3 As shown in the figure, the design is based on the idea of ​​red and black isolated power supply. The encryption module consists of USB network card module, FPGA, internal network CPU and external network CPU. The encryption module is connected to the host through the USB interface. The USB network card module uses PHY chip to realize data exchange between the host and FPGA interface; the FPGA module includes protocol message parsing, data forwarding, and commercial secret algorithm implementation. The algorithm uses the commercial AES symmetric algorithm. The internal network CPU and FPGA are connected using the SDIO interface. The internal network CPU is mainly used for configuration management, power-on authentication and key information management. The interface FPGA and the external network CPU are connected using the SDIO interface. The external network CPU has a wifi module. Each encryption module is configured with an authentication medium, which is used for encryption module power-on authentication. The key component of the device is stored in the authentication medium. After each authentication is passed, the key component in the authentication medium will be updated to prevent others from illegally copying and using the device.

[0047] The network transmission method implemented by the above network transmission device does not parse the core data part of the network data packet during the entire transmission process, and all core information is encrypted during the transmission process of the external network; the network transmission method includes:

[0048] The first step is to start the device. The encryption module verifies the key component through the authentication medium. If the verification is successful, the encryption module runs normally. The authentication medium has an anti-copying function. Each device is equipped with an authentication medium. The authentication medium stores the device key component R1. The intranet CPU stores the device key component R2 and the device key component Rc. The device key component Rc is the ciphertext of the 16-byte random number ram and CRC (ram); the authentication medium is connected to the encryption module. After the power module powers on the encryption module, the intranet CPU reads the device key component R1 in the authentication medium and the device key component R2 in the FLASH to generate the device key R, R = R1xorR2; the intranet CPU calls the commercial AES algorithm in the FPGA module through the SDIO interface to decrypt the device key component Rc. After the operation, it detects whether the decrypted plaintext meets the ram||CRC (ram) format. If it does, the device key R is successfully generated and the device is started normally through the encryption module.

[0049] After the power-on authentication is successful, the intranet CPU re-acquires the 32-byte random number, the first 16 bytes are the updated device key component R1, and the last 16 bytes are the device key component R3, and the device key R is recalculated, R=R1xorR2; the device key component Rc is recalculated, Rc is the ciphertext of R3||CRC(R3), the recalculated device key component Rc is stored in the intranet CPU, and the updated device key component R1 is rewritten into the authentication medium as the next power-on authentication, so that the device key component R1 in the authentication medium and the device key component Rc stored in the intranet CPU are different each time the computer is powered on. Ensure that the data in the authentication medium changes each time the computer is powered on to prevent the authentication medium from being copied by others and illegally using the device. The device authentication process is as follows: Figure 4 shown.

[0050] The second step is to inject the working key. The working key information is sent from the server or PAD terminal to the FPGA module through the USB network card module of the encryption module it is equipped with. The FPGA module parses the message and forwards the message to the intranet CPU. The intranet CPU parses the working key Wkey; calls the commercial symmetric AES algorithm in the FPGA module, uses the device key R to encrypt the working key Wkey, and saves the working key ciphertext in the intranet CPU.

[0051] Each time the encryption module is powered on, the synthesized device key R is used to call the commercial AES algorithm in the FPGA module to decrypt the working key, the device key R is used to decrypt the working key Wkey, and the decrypted working key Wkey is sent to the FPGA module for key negotiation operations; when the power-on authentication medium component is refreshed, that is, when the device key component R1 and the device key component Rc are updated, the regenerated device key R is used to re-encrypt the working key Wkey, and the working key ciphertext file stored in the FLASH is updated.

[0052] Step 3: Establish connections between multiple devices (WiFi module and PAD). The encryption module equipped on the server is the master device, and the encryption module equipped on the PAD terminal is the slave device. The mode is one-to-many transmission. After the device is powered on, a connection is established between the master device and all slave devices through a TCP connection.

[0053] After the master device is powered on, the external network CPU of the master device starts the TCP connection request mode to wait for the connection of the slave device, and the external network CPU of the slave device starts the TCP connection mode to actively connect to the master device; after the master device successfully connects to a slave device, it obtains the IP address information of the slave device and sends the IP address information to the FPGA module of the master device through the SDIO interface; the FPGA module receives the message parsing message and forwards the message to the internal network CPU. After the internal network CPU parses it, it saves the address information and then initiates a key negotiation operation.

[0054] Step 4: Session negotiation: After the connection is established, the master device and the slave device conduct key negotiation and negotiate a common key as the session key for data message encryption / decryption transmission.

[0055] In the master device: the intranet CPU obtains a 16-byte random number Wka, and sends the random number Wka to the FPGA module through the SDIO interface. The FPGA module calls the AES algorithm to encrypt Wka, and the key uses the working key Wkey. The encryption result is recorded as Wkac; the intranet CPU encapsulates the Wkac negotiation message and sends the negotiation message to the external network CPU through the FPGA module. The external network CPU sends the Wkac message to the slave device established with it. In the slave device: the external network CPU receives the message, and the external network CPU sends the message to the FPGA module. The FPGA module parses the message as session negotiation, calls the AES algorithm of the FPGA module to decrypt the Wkac, and uses the working key Wkey (the same as the working key of the master device) as the key. After decryption, Wka is obtained, and the FPGA module sends the Wka to the internal network CPU, and the internal network CPU saves the Wka; the internal network CPU obtains a 16-byte random number Wkb, and sends the Wkb to the FPGA module through the SDIO interface. The FPGA module uses the working key Wkey to call the AES algorithm to encrypt the Wkb and obtain the ciphertext Wkbc. After the encryption operation is successful, the ciphertext is returned to the internal network CPU. The internal network CPU encapsulates the Wkbc negotiation message and sends the negotiation message to the external network CPU through the FPGA module. The external network CPU sends the message Wkbc to the master device. The external network CPU of the master device receives the message Wkbc and sends it to the FPGA module. The FPGA module parses the message as a session negotiation and calls the AES algorithm of the FPGA module to decrypt Wkbc. The decryption result is the Wkb. The FPGA module sends the Wkb to the internal network CPU. The internal network CPU synthesizes the session key Wk (Wk = WkaxorWkb) and establishes a mapping relationship between the session key and the address of the connected device according to the destination address of the slave device connected to the master device. When the session connection is disconnected, that is, when the master device is disconnected from the slave device, the internal network CPU actively clears the session key Wk. After the session key is generated, the slave device is notified of the key generation. After receiving the key, the slave device synthesizes the session key Wk, and the negotiation ends.

[0056] The session key is created each time a device is connected to ensure that each connected device has a different session key. The master device stores the session key information of all connected slave devices. The session negotiation process is as follows: Figure 5 shown.

[0057] The fifth step is network message transmission. During the transmission process, the master device and the slave device, the sender encrypts and the receiver decrypts.

[0058] After the session negotiation is completed, the master device and the slave device communicate over the network, where:

[0059] The network data transmission process from the server to the PAD terminal is: the server sends a network message to the main device, the FPGA module of the main device receives the message, forwards the message to the intranet CPU through SDIO, the intranet CPU parses the message and parses it into a network message, the intranet processing unit extracts the message destination address information, finds the corresponding session key, calls the FPGA's internal commercial AES algorithm interface to encrypt the entire message, and sends the encrypted message and the destination address information to the external network CPU. The external network CPU re-encapsulates the ciphertext and sends the encapsulated ciphertext to the slave device according to the destination address information; the slave device's external network CPU receives the data message, removes the encapsulated protocol header, and sends the ciphertext data to the FPGA through the SDIO interface. The FPGA uses the session key Wk to call the commercial AES algorithm to decrypt the message, and the decrypted plaintext is sent to the PAD terminal through the USB network interface to complete the data transmission.

[0060] The network data transmission process from the PAD terminal to the server is as follows: the PAD terminal sends a network message to the FPGA module through the USB network card module of the slave device configured by it. The FPGA module uses the session key Wk to call the AES algorithm to encrypt the network message, and sends the encrypted network message to the external network CPU. The external network CPU re-encapsulates the encrypted message, and sends the encapsulated message to the main device. The external network CPU of the main device receives the message, removes the encapsulated protocol header, and the external network CPU sends the sending end of the encryption module connected to the PAD terminal (that is, the WIFI module of the encryption module, such as Figure 3 The network address information (as shown) and the received message are sent to the intranet CPU through the FPGA module. The intranet CPU searches for the corresponding session key Wk according to the network address information, and sends the session key and ciphertext to the FPGA module. The FPGA module calls the AES algorithm to decrypt the ciphertext. The decrypted message is sent to the server through the USB network card module to complete the data communication.

[0061] The network message is fully encrypted during the communication process to ensure the security of data transmission. The network data transmission process between the server and the PAD is as follows: Figure 6 As shown in the figure, the network data transmission process between PAD and server is as follows Figure 7 shown.

[0062] Although the present invention has been described above in conjunction with the accompanying drawings, the present invention is not limited to the above-mentioned specific embodiments, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can make many modifications without departing from the purpose of the present invention, all of which are within the protection of the present invention.

Claims

1. A method for encrypting and decrypting network transmission, characterized in that: Using network transmission equipment, the core data part of the network data packet is not parsed during the entire transmission process, and the core information is completely encrypted during the transmission process of the external network; the network transmission method includes: Step 1: After the encryption module is connected to the authentication medium, the key component is verified. If the verification is successful, the encryption module operates normally, wherein the authentication medium has an anti-copying function; Step 2: The working key information is sent from the server or PAD terminal to the FPGA module through the USB network card module of the encryption module. The FPGA module parses the message and forwards it to the intranet CPU. The intranet CPU parses the working key Wkey; calls the AES algorithm in the FPGA module, uses the device key R to encrypt the working key Wkey, and saves the working key ciphertext in the intranet CPU; Step 3: The encryption module equipped on the server is the master device, and the encryption module equipped on the PAD terminal is the slave device, and a connection is established between the master device and all the slave devices through a TCP connection in a one-to-many transmission mode; Step 4: After the connection is established, the master device and the slave device negotiate a key and negotiate a common key as a session key for data message encryption / decryption transmission; Step 5: Network message transmission, during the transmission process, the master device and the slave device, wherein the sender performs encryption and the receiver performs decryption; The specific contents of step one are: The authentication medium stores a device key component R1, the intranet CPU stores a device key component R2 and a device key component Rc, and the device key component Rc is a ciphertext of a 16-byte random number ram and CRC (ram); The authentication medium is connected to the encryption module. After the power module powers on the encryption module, the intranet CPU reads the device key component R1 in the authentication medium and the device key component R2 in the FLASH to generate the device key R, R=R1xorR2; the intranet CPU calls the AES algorithm in the FPGA module through the SDIO interface to decrypt the device key component Rc, and after the operation, detects whether the decrypted plaintext satisfies the ram||CRC(ram) format. If so, the device key R is successfully generated, and the encryption module starts normally; After the power-on authentication is successful, the intranet CPU re-acquires the 32-byte random number, the first 16 bytes are the updated device key component R1, and the last 16 bytes are the device key component R3, and the device key R is recalculated, R=R1xorR2; the device key component Rc is recalculated, Rc is the ciphertext of R3||CRC(R3), the recalculated device key component Rc is stored in the intranet CPU, and the updated device key component R1 is rewritten into the authentication medium as the next power-on authentication, so that the device key component R1 in the authentication medium and the device key component Rc stored in the intranet CPU are different each time the computer is powered on.

2. The network transmission method according to claim 1, characterized in that: In step 2, each time the encryption module is powered on, the AES algorithm in the FPGA module is used to decrypt the working key Wkey using the device key R, and the decrypted working key Wkey is sent to the FPGA module for key negotiation operations; when the device key component R1 and the device key component Rc are updated, the regenerated device key R is used to re-encrypt the working key Wkey, and the working key ciphertext file stored in the FLASH is updated.

3. The network transmission method according to claim 1, characterized in that: In step three, after the master device is powered on, the external network CPU of the master device starts the TCP connection request mode to wait for the connection of the slave device, and the external network CPU of the slave device starts the TCP connection mode to actively connect to the master device; after the master device successfully connects to a slave device, it obtains the IP address information of the slave device and sends the IP address information to the FPGA module of the master device through the SDIO interface; the FPGA module receives the message parsing message and forwards the message to the internal network CPU. After the internal network CPU parses it, it saves the address information and then initiates a key negotiation operation.

4. The network transmission method according to claim 1, characterized in that: The specific contents of step four are: In the master device: the intranet CPU obtains a 16-byte random number Wka, and sends the random number Wka to the FPGA module through the SDIO interface. The FPGA module calls the AES algorithm to encrypt Wka, and the key uses the working key Wkey. The encryption result is recorded as Wkac. The intranet CPU encapsulates the Wkac negotiation message and sends the negotiation message to the external network CPU through the FPGA module. The external network CPU sends the Wkac message to the slave device established with it. In the slave device: the external network CPU receives the message, and the external network CPU sends the message to the FPGA module. The FPGA module parses the message as a session negotiation, calls the AES algorithm of the FPGA module to decrypt the Wkac, and uses the working key Wkey as the key. After decryption, Wka is obtained, and the FPGA module sends the Wka to the internal network CPU, and the internal network CPU saves the Wka; the internal network CPU obtains a 16-byte random number Wkb, and sends the Wkb to the FPGA module through the SDIO interface. The FPGA module uses the working key Wkey to call the AES algorithm to encrypt the Wkb, and obtains the ciphertext Wkbc. After the encryption operation is successful, the ciphertext is returned to the internal network CPU, and the internal network CPU encapsulates the Wkbc negotiation message and sends the negotiation message to the external network CPU through the FPGA module. The external network CPU sends the message Wkbc to the master device; The external network CPU of the master device receives the message Wkbc and sends it to the FPGA module. The FPGA module parses the message as session negotiation and calls the AES algorithm of the FPGA module to decrypt Wkbc. The decryption result is the Wkb. The FPGA module sends the Wkb to the internal network CPU. The internal network CPU synthesizes the session key Wk, Wk=WkaxorWkb, and establishes a mapping relationship between the session key and the connection device address according to the destination address of the slave device connected to the master device. When the connection between the master device and the slave device is disconnected, the intranet CPU actively clears the session key Wk; after the session key is generated, the slave device is notified of the key generation, and the slave device synthesizes the session key Wk after receiving it, and the negotiation ends.

5. The network transmission method according to claim 4, characterized in that: The session key is created each time a device connects to ensure that each connected device has a different session key. The master device stores the session key information of all connected slave devices.

6. The network transmission method according to claim 4, characterized in that: The specific contents of step five are: After the session negotiation is completed, the master device and the slave device communicate over the network, where: The network data transmission process from the server to the PAD terminal is as follows: the server sends a network message to the main device, the FPGA module of the main device receives the message, forwards the message to the intranet CPU through SDIO, the intranet CPU parses the message and parses it into a network message, the intranet processing unit extracts the destination address information of the message, searches for the corresponding session key, calls the commercial AES algorithm interface inside the FPGA to encrypt the entire message, and sends the encrypted message and the destination address information to the external network CPU, the external network CPU re-encapsulates the ciphertext, and sends the encapsulated ciphertext to the slave device according to the destination address information; the slave device's external network CPU receives the data message, removes the encapsulated protocol header, and sends the ciphertext data to the FPGA through the SDIO interface, the FPGA uses the session key Wk to call the commercial AES algorithm to decrypt the message, and the decrypted plaintext is sent to the PAD terminal through the USB network interface to complete the data transmission; The network data transmission process from the PAD terminal to the server is: the PAD terminal sends the network message to the FPGA module through the USB network card module of the configured slave device. The FPGA module uses the session key Wk to call the AES algorithm to encrypt the network message, and sends the encrypted network message to the external network CPU. The external network CPU re-encapsulates the encrypted message, and sends the encapsulated message to the main device. The external network CPU of the main device receives the message and removes the encapsulated protocol header. The external network CPU sends the network address information of the sending end of the encryption module connected to the PAD terminal and the received message to the internal network CPU through the FPGA module. The internal network CPU searches for the corresponding session key Wk according to the network address information, and sends the session key and ciphertext to the FPGA module. The FPGA module calls the AES algorithm to decrypt the ciphertext, and the decrypted message is sent to the server through the USB network card module to complete the data communication.

7. The network transmission method according to any one of claims 1 to 6, wherein the network transmission equipment used comprises a server and a plurality of PAD terminals, characterized in that: The server and PAD terminals are respectively equipped with encryption modules for isolating the internal and external networks, and adopt wireless VPN technology to build a wireless VPN system to form a data tunnel; The encryption module includes a USB network card module, an FPGA module, a power module, an internal network CPU connected to the internal network, and an external network CPU connected to the external network; the USB network card module realizes data exchange between the server or PAD terminal and the FPGA module; the FPGA module is used for protocol message analysis, data forwarding and commercial secret algorithm implementation; the commercial secret algorithm adopts the AES symmetric algorithm, the internal network CPU and the external network CPU are connected to the FPGA module using the SDIO interface, the internal network CPU is used for configuration management, power-on authentication and key information management, and the external network CPU has a wifi module; The encryption module is equipped with an authentication medium; The server and the encryption module equipped therewith are connected via a USB network card module, the network message sent by the server is encrypted by the encryption module equipped therewith, after the network message is encrypted, the external network CPU is connected to the wireless AP via a network cable to send data; at the same time, the network data received from the external network CPU is decrypted by the encryption module, and the decrypted plaintext data is sent to the server; In the PAD terminal and the encryption module it is equipped with: the PAD terminal removes all wireless interfaces and transmits data only through the WIFI module. The PAD terminal and the encryption module are connected to the USB network card module. The network messages transmitted by the PAD terminal are encrypted by the encryption module it is equipped with. After the network messages are encrypted, they are sent to the external network through the wifi module; at the same time, the network messages received from the wifi module are decrypted by the encryption module, and the plain text data is sent to the PAD terminal after decryption.

8. The network transmission method according to claim 7, characterized in that: The USB network card module adopts a PHY chip.

Images