A network isolation device based on backward hash chain source authentication

Abstract

This invention discloses a network isolation device based on backward hash chain source authentication, belonging to the field of network information security. Based on the existing three-host architecture, this invention adds a source authentication module to the application layer of the isolation authentication unit. This module digitally signs and verifies only the MAC value of the first packet to achieve source authentication and non-repudiation. Based on the backward hash chain data structure and technology, it sequentially sends the encrypted business data of the i-th packet and the MAC value of the (i+1)-th packet, comparing the received MAC value of the i-th packet with the calculated MAC value of the i-th packet. By integrating digital signatures and message authentication codes, it achieves protection of information confidentiality and integrity, as well as source non-repudiation and non-repudiation authentication. It has low computational overhead and low space occupancy, effectively improving the security strength of network boundaries.

Description

Technical Field

[0001] This invention belongs to the field of network information security, and more specifically, relates to a network isolation device based on backward hash chain source authentication. Background Technology

[0002] To address the business needs of interconnecting and integrating multiple network systems, information business systems deployed in different network environments need to be interconnected, integrated, and collaborate. Technically, this requires solving the problem of secure cross-network access for multiple network systems. This involves using dedicated hardware for physical isolation, protocol conversion, IP encryption, and source authentication at network boundaries to eliminate potential security risks such as the introduction of viruses, intrusion attacks, and information leakage that may occur when heterogeneous networks communicate with each other.

[0003] Existing isolation devices, such as CN204392296U and CN112073375A, are all three-host devices, including: an internal network processing unit, an isolation unit, and an external network processing unit.

[0004] However, the above isolation devices all have the following defects and shortcomings: 1) low security, unable to cope with situations where the static load is illegal and the data itself is illegal; 2) all IPs can request data transmission, making them unable to resist spoofing attacks. Summary of the Invention

[0005] In view of the shortcomings of the prior art, the purpose of this invention is to provide a network isolation device based on backward hash chain source authentication, which aims to solve the problem of insufficient security of existing network isolation devices.

[0006] To achieve the above objectives, the present invention provides a network isolation device based on backward hash chain source authentication. The device includes: an internal network processing unit, an isolation authentication unit, and an external network processing unit. The isolation authentication unit includes: a source authentication module located at the application layer.

[0007] When the device is at the sending end, the source authentication module performs the following method based on the backward hash chain:

[0008] After obtaining the encrypted business data and the MAC value, digitally sign the MAC value of the first packet;

[0009] The MAC value and digital signature of the first packet are sent to the network isolation device located at the receiving end;

[0010] The encrypted business data of the first packet and the MAC value of the second packet are sent to the network isolation device located at the receiving end;

[0011] The encrypted service data of the second packet and the MAC value of the third packet are sent to the network isolation device located at the receiving end;

[0012] And so on, each data packet carrying the hash value of the next packet is sent in sequence, and the last packet sent is the ciphertext of the last packet's business data;

[0013] When the device is at the receiving end, the source authentication module performs the following method based on the backward hash chain:

[0014] After receiving the MAC value and digital signature of the first packet, the digital signature is verified. If the verification is successful, subsequent data will be received; otherwise, data transmission will be rejected.

[0015] For subsequently received data, the following verification is performed:

[0016] Calculate the MAC value of the i-th packet, where i = 1, 2, 3...N, and N represents the number of service data packets;

[0017] Compare the received MAC value of packet i with the calculated MAC value of packet i. If they match, the data in packet i is normal; otherwise, it is abnormal.

[0018] Preferably, the digital signature uses a public-key algorithm.

[0019] Preferably, the MAC value is calculated using the SHA-1 algorithm.

[0020] Preferably, the external network processing unit includes:

[0021] The IPSec negotiation module located at the application layer is used to initiate negotiation to obtain the session key required for this IP network information transmission when the device is at the sending end; and to receive the negotiation to obtain the session key required for this IP network information transmission when the device is at the receiving end.

[0022] The IPsec encryption / decryption module located at the network layer is used to encrypt the IP header using a negotiated key and send it when the device is at the sending end; when the device is at the receiving end, it receives the encrypted IP header, decrypts it using the negotiated key, and authenticates the other party's identity. If the authentication is successful, a data transmission channel is established; otherwise, the request is rejected.

[0023] Preferably, the key negotiation message consists of an IP header, a cryptographic header, a custom protocol header, a negotiation payload, and an authentication code field;

[0024] The ciphertext header is the payload for information exchange and synchronization, including security policy, sequence number, key base version, padding length, and IV field;

[0025] The customized protocol header is a user-defined special protocol header for key negotiation;

[0026] The negotiated payload represents the payload data during the protocol customization process;

[0027] The authentication code calls a hash algorithm to calculate the HMAC value of the secret header, custom protocol header, and negotiation payload field, and extracts the high 16 bytes as the authentication code.

[0028] Preferably, the IPsec encryption / decryption module encrypts the IP header in the following way:

[0029] Encrypt the entire network layer IP packet;

[0030] Integrity calculations are performed on the added ciphertext header and ciphertext data, and the resulting integrity verification data is appended to the end of the message.

[0031] A new IP header is added before the encryption header. The source address of the new IP header is the encapsulation address of the sender, and the destination address is the encapsulation address of the receiver. This is used to protect the internal network topology.

[0032] Preferably, the intranet processing module is divided into three layers: the interface layer, the business layer, and the interface layer.

[0033] The interface layer is used to centrally display business management, VPN management, and the management of the isolation device itself;

[0034] The service layer is used to centrally manage all modules, including service configuration management, device configuration management, access authentication, network cable isolation, and service redirection.

[0035] The interface layer is used to provide the upper layer with a running platform, data storage space and management service interface.

[0036] Preferably, the external network processing module is divided into three layers: a service layer, a transport layer, and an interface layer.

[0037] The business layer is used to centrally manage all modules, including network isolation and outbound / inbound authentication;

[0038] The transport layer is used to perform encryption and decryption processing and security policy lookup for both inbound and outbound directions.

[0039] The interface layer is used to provide the upper layer with a running platform and data storage space. Basic data information, security business information and various business processing information are all stored in the database.

[0040] In summary, the technical solutions conceived by this invention have the following beneficial effects compared with the prior art:

[0041] This invention proposes a network isolation device based on backward hash chain source authentication. Building upon existing three-host architectures, a source authentication module is added to the application layer of the isolation authentication unit. This module digitally signs and verifies only the MAC value of the first packet to determine integrity and confidentiality. Based on backward hash chain technology, the ciphertext of the service data in packet i and the MAC value of packet i+1 are sent sequentially, and the received MAC value of packet i is compared with the calculated MAC value of packet i. By integrating digital signatures and message authentication codes, it achieves protection of information confidentiality and integrity, as well as source non-repudiation and non-denial authentication. It features low computational overhead and low space occupancy, effectively improving the security strength of network boundaries. Attached Figure Description

[0042] Figure 1 This is a hardware logic structure design diagram provided by the present invention.

[0043] Figure 2 This is the software logic structure design diagram provided by the present invention.

[0044] Figure 3 This is a schematic diagram of the security protection system provided by the present invention.

[0045] Figure 4 This is a schematic diagram of the system deployment provided by the present invention.

[0046] Figure 5 This is a schematic diagram of the key negotiation message encapsulation format provided by the present invention.

[0047] Figure 6 This is a schematic diagram of the tunnel encryption authentication message encapsulation format provided by the present invention.

[0048] Figure 7 This is a schematic diagram of the backward hash chain data structure provided by the present invention. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0050] The inventive concept of this invention is as follows: Based on a three-host hardware architecture design, it comprehensively utilizes network blocking and protocol conversion, IPSec transmission encryption, source authentication, service redirection and other technical means to achieve the application requirements for secure and controllable data exchange between multiple networks without affecting the security and transmission performance of the business systems of each network user.

[0051] (1) Hardware structure design

[0052] like Figure 1As shown, the hardware architecture adopts a three-host design, mainly consisting of an internal network processing unit, an external network processing unit, and an isolation and authentication unit. The isolation and authentication unit is responsible for source authentication and exchange control. The internal network processing unit and the external network processing unit communicate via a fiber optic link, achieving secure isolation between the internal and external networks.

[0053] (2) Software framework design

[0054] like Figure 2 As shown, the software module mainly consists of three parts: the external network processing module, the isolation and authentication module, and the internal network processing module.

[0055] 1) The intranet processing module is divided into three layers: the interface layer, the business layer, and the interface layer. The interface layer centrally displays business management, VPN management, and the management of the isolation devices themselves. The business layer centrally manages all modules, including business configuration management, device configuration management, access authentication, network cable isolation, and business redirection. The interface layer provides the upper layers with a running platform, data storage space, and management service interfaces.

[0056] 2) The isolation authentication module consists of three layers: the operation and maintenance layer, the service layer, and the business control layer. The operation and maintenance layer is mainly responsible for security auditing functions such as device status and log information; the service layer completes service management functions through source authentication; and the business control layer performs source authentication and protocol exchange on business data entering and leaving the isolation authentication module.

[0057] 3) The external network processing module is divided into three layers: the service layer, the transport layer, and the interface layer. The service layer centrally manages all modules, mainly including network isolation and outbound / inbound authentication. The transport layer completes encryption and decryption processing and security policy lookup for both inbound and outbound traffic. The interface layer provides the operating platform and data storage space for the upper layers. Basic data information, security business information, and various business processing information are all stored in the database.

[0058] (i) Design of security protection system

[0059] The design fully considers the security risks of various business networks under cross-network access. It conducts in-depth analysis and targeted design for different security risks, proposes different security protection measures from the physical layer, network layer and application layer, and builds a security protection system to shield the security risks introduced by cross-network access that destroys the existing physical isolation.

[0060] After network isolation equipment is deployed, IPSec encryption and source authentication, combined with the isolation equipment's own protection mechanisms, construct a three-dimensional, layered protection system from the physical layer to the application layer between various service networks. The security protection system after equipment deployment is as follows: Figure 3 As shown.

[0061] (ii) Equipment deployment

[0062] Network isolation devices are deployed at the boundary of the user's private network (a network where user business systems operate independently). Without compromising the security of the user's business systems, they meet the secure exchange requirements for cross-network access services, enable online management of devices within the private network, and provide security protection functions such as access authentication, secure isolation, transmission encryption, service redirection, and network attack detection. The system deployment model is as follows: Figure 4 As shown.

[0063] (iii) Working principle

[0064] The cross-network isolation device employs a secure isolation hardware architecture that cannot be bypassed. It integrates secure authentication and isolation mechanisms with communication separation technology. Through core mechanisms such as IPSec transmission encryption, source authentication, service isolation, and service redirection, it ensures service isolation and secure, controllable information exchange between independent private networks. The working principle of the cross-network isolation device is as follows: Figure 4 As shown.

[0065] IPSec transmission encryption: Implemented at the network layer, it primarily establishes a secure transmission channel between isolated devices by negotiating a temporary session key using IPSec. This channel offers protection for information confidentiality and integrity, address protocol hiding, and resistance to network replay attacks. It mainly includes two processes: key negotiation and IP encrypted transmission.

[0066] Key negotiation: Initiated by the data connection initiator, negotiation is conducted to obtain the session key required for this IP network information transmission. The key negotiation message consists of fields such as IP header, cryptographic header, custom protocol header, negotiation payload, and authentication code. The authentication scope and specific encapsulation format are as follows... Figure 5 As shown. The encryption header is the payload for information exchange and synchronization, including security policy, sequence number, key base version, padding length, and IV field. The custom protocol header is a user-defined protocol header for key negotiation, distinct from the TCP or UDP headers that may be carried in ordinary IP packets. The payload represents the payload data during the custom protocol process. The authentication code calls a hash algorithm to calculate the HMAC values ​​of the encryption header, custom protocol header, and negotiation payload fields, extracting the high 16 bytes as the authentication code.

[0067] IP transmission encryption: The network layer IP packet is encrypted as a whole. Then, an integrity check is performed on the added ciphertext header and ciphertext data, and the resulting integrity verification data is appended to the end of the packet. A new IP header is added before the ciphertext header, and the header data is filled in according to the actual situation. The new IP header uses the sender's encapsulation address as the source address and the receiver's encapsulation address as the destination address. This is used to protect the internal network topology and achieve network logical isolation at the IP network layer through cryptography, thus encrypting and protecting IP data packets. The IP encrypted transmission encapsulation format is as follows: Figure 6 As shown.

[0068] Different encryption and authentication keys are used for different data transmission directions. The following explanation uses the example of party A sending and party B receiving, and the reverse is the same.

[0069] Initiator (A): a) Select the cryptographic algorithm, parameters, key, and encapsulation format according to the agreement in the negotiation phase; b) Organize the cryptographic header and extract the high 128 bits as the initialization vector (IV); c) Encrypt and authenticate the IP header, the scope of which is specified in the encapsulation format; d) Encapsulate the message and send it.

[0070] Receiver (B): a) Selects the cryptographic algorithm, parameters, key, and encapsulation format according to the agreement reached during the negotiation phase; b) Parses the received data packet and extracts the high 128 bits of the cryptographic header as the initialization vector (IV); c) Decrypts and authenticates the IP header to obtain the plaintext. If authentication fails, the plaintext is discarded.

[0071] Source authentication: Source authentication is implemented at the application layer. For all sent and received business data that traverses the isolation device, digital signature and message authentication code fusion technology is used to perform source authentication based on a backward hash chain to achieve confidentiality, integrity and non-repudiation, and to prevent unauthorized devices and user services from accessing the communication boundary between the independent private network and the external network to the greatest extent.

[0072] Authentication codes and digital signatures are two methods of source authentication. Authentication codes require the sender and receiver to share a key set. The sender generates a Message Authentication Code (MAC) value based on the receiver's key and appends it to the source. The receiver verifies the MAC value using their key. This provides information integrity services in network communication applications but does not provide identity authentication or non-repudiation. Digital signatures, on the other hand, digitally sign each data packet sequentially. While this is the simplest and most secure source authentication method, the significant public key computation and communication overhead limit its effectiveness and practicality. Therefore, this invention proposes a source authentication method based on a backward hash chain data structure that integrates digital signatures and authentication codes, fully utilizing their respective advantages to achieve confidentiality and integrity protection, as well as non-repudiation authentication.

[0073] Specific implementation method: a) The sender first sends the hash signature packet of the first data packet P1, and then sends each data packet carrying the hash value of the next packet in sequence, with the last packet not carrying a hash value. For example... Figure 7As shown in the diagram. b) Upon receiving the first packet P1, the receiver performs signature verification (to improve access authentication efficiency) and completes source identity verification. If the verification passes, the P1 source is valid, and the validity of the hash value of P2 is also verified. c) Then, the hash value of the second packet P2 is calculated, and the integrity of the source is verified by comparison. This process is repeated to verify the validity and integrity of the sources of P3, ..., Pn.

[0074] The backward source authentication method requires only one digital signature (approximately 128B storage space if using a public key algorithm) and signature authentication calculation and n hash calculations (approximately n*32B storage space if using SHA-1) for each sender and receiver. The computational overhead and space usage are low. In addition to verifying the confidentiality and integrity of the source, it also provides non-repudiation and non-denial of the source authentication.

[0075] Source authentication is a high-efficiency real-time source authentication technology based on a backward hash chain data structure. It integrates digital signatures and message authentication codes to protect the confidentiality and integrity of information, as well as to authenticate the non-repudiation and non-denial of the source. It has low computational overhead and low space occupancy, and can effectively improve the security of network boundaries.

[0076] Business isolation: Implemented at the application layer, mainly within the isolation device, it enables network protocol stripping and reassembly, application protocol format checking, business packet isolation and authentication, and hiding of the application deployment structure within the internal network. This blocks network attacks between the connected internal and external networks and ensures secure and controllable exchange of application services.

[0077] Business redirection: Implemented at the application layer, this mainly involves redirecting the business data received by the isolation device to the corresponding business server and business application on the intranet side, ensuring that the application deployment structure of the intranet is hidden from the outside world.

[0078] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A network isolation device based on backward hash chain source authentication, characterized in that, The device includes: an intranet processing unit, an isolation and authentication unit, and an extranet processing unit; The isolation authentication unit includes: a source authentication module located at the application layer; When the device is at the sending end, the source authentication module performs the following method based on the backward hash chain: After obtaining the encrypted business data and the MAC value, digitally sign the MAC value of the first packet; The MAC value and digital signature of the first packet are sent to the network isolation device located at the receiving end; The encrypted business data of the first packet and the MAC value of the second packet are sent to the network isolation device located at the receiving end; The encrypted service data of the second packet and the MAC value of the third packet are sent to the network isolation device located at the receiving end; And so on, each data packet carrying the MAC value of the next packet is sent in sequence, and the last packet sent is the encrypted business data of the last packet; When the device is at the receiving end, the source authentication module performs the following method based on the backward hash chain: After receiving the MAC value and digital signature of the first packet, the digital signature is verified. If the verification is successful, subsequent data will be received; otherwise, data transmission will be rejected. For subsequently received data, the following verification is performed: Calculate the MAC value of the i-th packet, where i = 1, 2, 3…N, and N represents the number of service data packets; Compare the received MAC value of packet i with the calculated MAC value of packet i. If they match, the data in packet i is normal; otherwise, it is abnormal.

2. The device as described in claim 1, characterized in that, The digital signature uses a public-key algorithm.

3. The device as described in claim 1, characterized in that, The MAC value is calculated using the SHA-1 algorithm.

4. The device as described in claim 3, characterized in that, The external network processing unit includes: The IPSec negotiation module located at the application layer is used to initiate negotiation to obtain the session key required for this IP network information transmission when the device is at the sending end; and to receive the negotiation to obtain the session key required for this IP network information transmission when the device is at the receiving end. The IPSec encryption / decryption module located at the network layer is used to encrypt the IP header using a negotiated key and send it when the device is at the sending end; when the device is at the receiving end, it receives the encrypted IP header, decrypts it using the negotiated key, and authenticates the other party's identity. If the authentication is successful, a data transmission channel is established; otherwise, the request is rejected.

5. The device as described in claim 3, characterized in that, The key negotiation message consists of an IP header, a key header, a custom protocol header, a negotiation payload, and an authentication code field. The ciphertext header is the payload for information exchange and synchronization, including security policy, sequence number, key base version, padding length, and IV field; The customized protocol header is a user-defined special protocol header for key negotiation; The negotiated payload represents the payload data during the protocol customization process; The authentication code calls a hash algorithm to calculate the HMAC value of the secret header, custom protocol header, and negotiation payload field, and extracts the high 16 bytes as the authentication code.

6. The device as described in claim 4, characterized in that, The IPSec encryption / decryption module encrypts the IP header in the following way: Encrypt the entire network layer IP packet; Integrity calculations are performed on the added ciphertext header and ciphertext data, and the resulting integrity verification data is appended to the end of the message. A new IP header is added before the encryption header. The source address of the new IP header is the encapsulation address of the sender, and the destination address is the encapsulation address of the receiver. This is used to protect the internal network topology.

7. The device according to any one of claims 1 to 6, characterized in that, The intranet processing unit is divided into three layers: the interface layer, the business layer, and the interface layer. The interface layer is used to centrally display business management, VPN management, and the management of the isolation device itself; The service layer is used to centrally manage all modules, including service configuration management, device configuration management, access authentication, network cable isolation, and service redirection. The interface layer is used to provide the upper layer with a running platform, data storage space and management service interface.

8. The device according to any one of claims 1 to 6, characterized in that, The external network processing unit is divided into three layers: the service layer, the transport layer, and the interface layer. The business layer is used to centrally manage all modules, including network isolation and outbound / inbound authentication; The transport layer is used to perform encryption and decryption processing and security policy lookup for both inbound and outbound directions. The interface layer is used to provide the upper layer with a running platform and data storage space. Basic data information, security business information and various business processing information are all stored in the database.

Images