Lightweight authentication, encryption and decryption method and device for resource-constrained device communication

Abstract

The present invention discloses a lightweight authentication and encryption method and apparatus for resource-constrained device communications. The proposed authentication and encryption method for resource-constrained device communications, BAMBOO-64, is a lightweight authentication and encryption method that simultaneously ensures data confidentiality and integrity. The Sponge structure employed by BAMBOO-64 is a mature authentication and encryption algorithm design framework with strong security. Internal permutations utilize a three-dimensional structure, and all operations are general logic operations, requiring no special instructions. Compared to existing authentication and encryption algorithms, the BAMBOO-64 algorithm has a smaller state, smaller implementation footprint, lower energy consumption, and is advantageous for processing short data.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and specifically relates to a lightweight authentication and encryption method and device for a unified identity authentication platform of the industrial Internet, specifically a lightweight authentication and encryption method and device for resource-constrained device communications. Background Art

[0002] With the rapid development of information security technology, new application environments are placing new demands on the security strength and functionality of algorithms, leading to traditional algorithms struggling to adapt to these new environments. Authentication and data encryption technologies are primarily designed for traditional IT networks, and they lack consideration for the massive user base and limited computing resources of systems in the Industrial Internet, the heterogeneity of device models and services, and the high real-time requirements. Authenticated encryption is a growing concept, with varying requirements at different stages and in different environments, and a definitive consensus remains to be reached. Directly designed authenticated encryption algorithms offer a wide variety and high efficiency, making them a promising future development trend. However, their security foundations are weak, and security analysis and assessment require further research. Furthermore, research on lightweight authenticated encryption algorithms is limited. Designing secure and efficient authenticated encryption algorithms within extremely resource-constrained environments is a hot topic internationally. Therefore, designing secure and efficient authenticated encryption algorithms for the Industrial Internet is imperative. Summary of the Invention

[0003] The first purpose of the present invention is to address the shortcomings of the existing technology and provide a secure, efficient and lightweight authentication and encryption and decryption device suitable for communication between resource-constrained devices in an industrial Internet environment, which can realize encryption and decryption processing of any relevant data and any plaintext with low resource consumption, thereby improving the efficiency and security of encryption, decryption and authentication.

[0004] The BAMBOO-64 lightweight authentication encryption and decryption method of the present invention includes a data transformation (abbreviated as: Perm) process, an intermediate state preprocessing process, an encryption process, and a decryption process;

[0005] The data transformation process is used to transform data, and specifically includes the following processing steps:

[0006] Step S11: 3D data

[0007] Given a one-dimensional data string D, a 3×16×4 three-dimensional data matrix S is constructed according to the coordinate mapping relationship of formula (1): D :

[0008] S D [x,y,z]=D[48z+3y+x] (1)

[0009] Among them, x, y, z represent the three-dimensional matrix S D The three-axis coordinates of a data in the original one-dimensional data; D[] represents the position of the data in the original one-dimensional data.

[0010] Step S12: 3D data matrix transformation processing

[0011] Step S121: Initialize the number of data transformations r to 0

[0012] Step S122: Calculate the three-dimensional data matrix S D Transform along the x-axis:

[0013] Traverse the y and z axes in turn, each time for the data matrix S D The three data with the same y and z coordinates are transformed and calculated according to formula (2). After the traversal is completed, the data matrix S after the x-axis transformation is obtained. x ;

[0014]

[0015] in, Indicates S D The data with coordinates [x, y, z] is inverted, and mod means remainder operation. Represents the exclusive OR operation.

[0016] Step S123: transform the matrix S along the x-axis x Transform along the y-axis:

[0017] Traverse the x and z axes in turn, each time for the matrix S x The 16 data with the same x and z coordinates are arranged in ascending order of y coordinates into a data string R. The following operations are performed based on the value of the x coordinate of this set of data:

[0018] If x=0, then

[0019] If x=1 then

[0020] If x=2, then

[0021] Among them, <<< means circular left shift, Represents bitwise exclusive OR;

[0022] After performing the above operation on R, use R to x The 16 data in the original position are updated and replaced. After the traversal is completed, the matrix S after the transformation along the x-axis and y-axis is obtained. xy .

[0023] Step S124: transform the matrix S along the x-axis and y-axis xyTransform along the z-axis:

[0024] Traverse the x and y axes in turn, each time for the matrix S xy The four data with the same x and y coordinates are translated and transformed according to formula (3). After the traversal is completed, the data S after the transformation of a group of three data is obtained. xyz ;

[0025] S xyz [x,y,z]=S xy [x,3y,(z+x)mod4] (3)

[0026] Step S125: According to formula (4), S xyz The data with x,y coordinates of 0 and the zth bit of the four-bit binary representation of the number of data transformations r are XORed one by one to obtain the updated data S xyz ;

[0027]

[0028] Step S126: Update the original data

[0029] Determine whether the maximum number of data transformations has been reached. If so, output the current number of data transformations. The updated data S in step S214 is xyz , if otherwise update S D The data S updated in step S214 is the number of times the current data is transformed. xyz , update r=r+1, and repeat steps S122-S126;

[0030] Preferably, the maximum number of data transformations in this embodiment is 12.

[0031] Step S13: Data S xyz The data coordinate correspondence of the original one-dimensional data string D is updated to obtain the transformed data Perm(D).

[0032] Perm(D)[48z+3y+x]=S xyz [x,y,z]

[0033] The intermediate state preprocessing process is used to combine the initialization vector, key, and freshness value pre-determined by the communicating devices with the relevant data A set by the communication initiator, and generate a third intermediate state G3 for the encryption process and decryption process of each communicating device. Specifically, the process steps include:

[0034] Step S21: The two communicating devices publicly agree on an a-bit initialization vector IV, a b-bit freshness value N, and secretly negotiate a c-bit key K. Where a, b, and c satisfy a + b + c = 192, and c is greater than or equal to 64. The message initiator also discloses plaintext additional information (such as packet header information) as communication data A.

[0035] The initial vector IV, the fresh value N, and the key K are concatenated into a 192-bit initial intermediate state G0 in the order IV||K||N, where the symbol || indicates concatenation of the data on both sides.

[0036] Step S22: The communication devices of both parties respectively transform the initial intermediate state G0 using the data transformation process to obtain the transformed initial intermediate state Perm(G0); then the transformed initial intermediate state Perm(G0) is XORed with the key K expanded from zero to 192 bits according to formula (5), so that the sender Se and the receiver Re can obtain the same first intermediate state G1:

[0037]

[0038] Step S23: Block processing of communication data A:

[0039] Determine whether the communication data A is 0. If so, the communication data A is considered empty. Otherwise, continue to determine whether A is a relevant multiple of 64. If the length of A is not a multiple of 64, append a 1 and several 0s to the end of A to make the length of A a multiple of 64. Otherwise, do not process A.

[0040]

[0041] The communication data A after the above processing is divided into m blocks A i (i=1,…,m).

[0042] Step S24: The two communication devices perform an XOR operation on the first intermediate state G1 according to formula (7) with the constant 1 padded to 192 bits with zeros, so that the sender Se and the receiver Re can obtain the same second intermediate state G2;

[0043]

[0044] Step S25: Use the data transformation process to transform the second intermediate state G2 to obtain the intermediate state Perm(G2) after data transformation; for each block A i (i=1,…,m), according to formula (8) in A i The tail is padded with 128 zeros and bitwise XORed with the intermediate state Perm(G2) after data transformation to obtain the third intermediate state G3.

[0045]

[0046] The encryption process is for the resource-constrained sender device Se to encrypt data (i.e., plaintext P) to be sent to the resource-constrained sender device Se based on the third intermediate state G3 obtained from the intermediate state preprocessing process, and simultaneously obtain an authentication tag. Specifically,

[0047] Step S31: The sender device Se determines whether the length of the encrypted plaintext P is 0 according to formula (9). If so, the plaintext P is considered to be empty. Otherwise, it continues to determine whether the length of the plaintext P is a relevant multiple of 64. If the length of the plaintext P is not a multiple of 64, a 1 and several 0s are added to the end of the plaintext P to make the length of P a multiple of 64. If the length of the plaintext P is a multiple of 64, the plaintext P is not processed. Finally, the plaintext P whose length is a multiple of 64 is divided into blocks to obtain t blocks of plaintext P1, ..., P t :

[0048]

[0049] Step S32: The sending device Se uses the initial vector IV, the fresh value N, the key K, and the communication data A to obtain a third intermediate state G3 using the intermediate state preprocessing process, and XORs G3 with the constant 2 padded to 192 bits with zeros according to formula (10), thereby obtaining a fourth intermediate state S0:

[0050]

[0051] Step S33: The sender device Se divides the first t-1 plaintext blocks P i Get the intermediate state S i and ciphertext block C i ;

[0052] Step S331: Initialize the data transformation of the fourth intermediate state S0 using the data transformation process to obtain the fourth intermediate state Perm(S0) after data transformation;

[0053] Step S332: The sender device Se processes each plaintext block P i The tail is filled with 128 zeros, and then the fourth intermediate state Perm (S i-1 ) XOR, get the current plaintext block P i The corresponding updated fourth intermediate state S i ;

[0054] Step S333: Intercept the updated fourth intermediate state S iThe highest 64 bits of data are used as ciphertext block C i (i=1,…,t-1);

[0055]

[0056] Among them, mbs 64 (S i ) means to take the cut-off S i The highest 64 bits;

[0057] Step S34: The sender device Se processes the last plaintext block P t Get the intermediate state S t and ciphertext block C t ;

[0058] Step S341: To obtain the last ciphertext block C of the data that the sender device Se needs to send t , the sending device Se obtains the intermediate state S according to formula (12) t ;

[0059]

[0060] Step S342: Determine P t Is the length of 64 a relevant multiple? If so, intercept the intermediate state S t The highest |P| mod 64 bits of data are used as the last ciphertext block C t , otherwise intercept the intermediate state S t The highest 64 bits of data are used as the last ciphertext block C t , that is, formula (13).

[0061]

[0062] Step S35: The intermediate state S t After processing according to formula (14), the authentication tag T is obtained.

[0063]

[0064] Step S36: The ciphertext blocks obtained by steps S33 and S34 are sequentially spliced ​​to obtain the ciphertext C after the encrypted data to be sent by the sender device Se, and finally the ciphertext C and the authentication tag T are sent to the receiver device Re in a certain manner.

[0065] The decryption module is used by the receiver Re to decrypt the ciphertext C received from the sender Se using the third intermediate state G3 obtained by the intermediate state initialization module, and to determine whether the received information is correct based on whether the received authentication tag T is correct. The specific processing steps include the following:

[0066] Step S41: The receiving device Re determines whether the length of the received ciphertext C is 0 according to formula (15). If so, the ciphertext C is considered to be empty. Otherwise, it continues to determine whether the length of the ciphertext C is a relevant multiple of 64. If the length of the ciphertext C is not a multiple of 64, a 1 and several 0s are appended to the end of the ciphertext C to make the length of the ciphertext C a multiple of 64. If the length of the ciphertext C is a multiple of 64, the ciphertext C is not processed. Finally, the ciphertext C whose length is a multiple of 64 after processing is divided into blocks to obtain r plaintext blocks C1, ..., C r :

[0067]

[0068] Step S42: The receiver Re uses the initial vector IV, the fresh value N, the key K, and the communication data A to obtain the third intermediate state G3 using the intermediate state initialization module, and performs bitwise XOR processing on the third intermediate state G3 with the constant 2 padded to 192 bits with zeros according to formula (16) to obtain the fourth intermediate state S0.

[0069]

[0070] Step S43: According to formula (17), except for the last ciphertext block, each ciphertext block is padded with 128 zeros at the end and then combined with the fourth intermediate state Perm (S i-1 ) and intercept the highest 64 bits of S as the plaintext block P i (i=1,…,r-1);

[0071]

[0072] Step S44: The receiver Re processes the last ciphertext block C r Get the intermediate state S r and plaintext block P r :

[0073] Step S441: The receiver Re obtains the intermediate state S according to formula (18) r ;

[0074]

[0075] Step S44: Determine whether the length of C is a relevant multiple of 64, if so, intercept the intermediate state S r The highest |C| mod 64 bits of data are taken as the last plaintext block P r , otherwise intercept the intermediate state S r The highest 64 bits of data are used as the last plaintext block P r , that is, formula (19);

[0076]

[0077] Step S45: The intermediate state S r After processing according to formula (20), we get an authentication tag T * , compare it with the authentication tag T sent by the sender device Se to obtain the authentication result. If they are the same, the authentication is passed and go to step S46, otherwise it is rejected.

[0078]

[0079] Step S46: The plaintext blocks of step S43 and step S44 are sequentially spliced ​​together to obtain the data sent by the sender device Se.

[0080] The second object of the present invention is to provide a lightweight authentication encryption and decryption system, which includes a data transformation module, an intermediate state preprocessing module, an encryption processing module, and a decryption processing module.

[0081] The third object of the present invention is to provide a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the lightweight authentication encryption and decryption method.

[0082] The fourth object of the present invention is to provide a computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the lightweight authentication encryption and decryption method is implemented.

[0083] The BAMBOO-64 authentication and encryption method proposed in this paper for communication between resource-constrained devices is a lightweight authentication and encryption method that simultaneously ensures data confidentiality and integrity. BAMBOO-64 utilizes the Sponge structure, a mature authentication and encryption algorithm design framework with strong security. Its internal permutations utilize a three-dimensional structure, and all operations are general logic operations, requiring no special instructions. Compared to existing authentication and encryption algorithms, BAMBOO-64 boasts a smaller state, smaller implementation footprint, lower energy consumption, and is more suitable for processing short data. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below.

[0085] Figure 1 This is a structural diagram of the Perm data conversion provided by the present invention.

[0086] Figure 2 The figure is a flow chart of an encryption process and a decryption process of the present invention. DETAILED DESCRIPTION

[0087] To make the objectives, technical solutions and advantages of the present invention more clearly understood, the following describes the embodiments of the present invention in further detail with reference to the accompanying drawings and specific embodiments.

[0088] The lightweight authentication encryption and decryption method of the present invention includes a data transformation (abbreviated as: Perm) module, an intermediate state preprocessing process, an encryption process, and a decryption process;

[0089] The data transformation process is used to transform the data Figure 1 Data transformation includes the following processing steps:

[0090] Step S11: 3D data

[0091] Given a one-dimensional data string D, press S D The coordinate mapping relationship of [x, y, z] = D[48z+3y+x] constructs a 3×16×4 three-dimensional data matrix S D :

[0092] S D [x,y,z]=D[48z+3y+x]

[0093] Among them, x, y, z represent the three-dimensional matrix S D The three-axis coordinates of a data in the original one-dimensional data, where 0≤x<3,0≤y<16,0≤z<4; D[] represents the position of the data in the original one-dimensional data.

[0094] Step S12: 3D data matrix transformation processing; specifically:

[0095] Step S121: Initialize the number of data transformations r to 0;

[0096] Step S122: Calculate the three-dimensional data matrix S D Transform along the x-axis:

[0097] Traverse the y and z axes in turn, each time for the data matrix S D The three data with the same y and z coordinates are Perform transformation calculations and obtain the data matrix S after x-axis transformation after traversal x ;

[0098]

[0099] in, Indicates S D The data with coordinates [x, y, z] is inverted, and mod means remainder operation. Represents the exclusive OR operation.

[0100] Step S123: transform the matrix S along the x-axis x Transform along the y-axis:

[0101] Traverse the x and z axes in turn, each time for the matrix S x The 16 data with the same x and z coordinates are arranged in ascending order of y coordinates into a data string R. According to the different values ​​of the x coordinates of this set of data, the following operations are performed:

[0102] If x=0, then

[0103] If x=1 then

[0104] If x=2, then

[0105] Among them, <<< means circular left shift, Represents bitwise exclusive OR;

[0106] After performing the above operation on R, use R to x The 16 data in the original position are updated and replaced. After the traversal is completed, the matrix S after the transformation along the x-axis and y-axis is obtained. xy .

[0107] Step S124: transform the matrix S along the x-axis and y-axis xy Transform along the z-axis:

[0108] Traverse the x and y axes in turn, each time for the matrix S xy Press S for the four data with the same x and y coordinates. xyz [x,y,z]=S xy [x, 3y, (z+x) mod 4] is used to calculate the translation transformation. After the traversal is completed, the data S after the transformation of a set of three data is obtained. xyz ;

[0109] Step S125: Press (where z=0,1,2,3) xyz The data with x,y coordinates of 0 and the zth bit of the four-bit binary representation of the number of data transformations r are XORed one by one to obtain the updated data S xyz ;

[0110] Step S126: Update the original data

[0111] Determine whether the maximum number of data transformations has been reached. If so, output the current number of data transformations. The updated data S in step S214 is xyz , if otherwise update S D The data S updated in step S214 is the number of times the current data is transformed. xyz, update r=r+1, and repeat steps S122-S126;

[0112] In this embodiment, the maximum number of data transformations is 12.

[0113] Step S13: Data S xyz The data coordinate correspondence of the original one-dimensional data string D is updated to obtain the transformed data Perm(D).

[0114] Perm(D)[48z+3y+x]=S xyz [x,y,z]

[0115] The intermediate state preprocessing process is used to combine the initialization vector, key, and freshness value pre-determined by the communicating devices with the relevant data A set by the communication initiator, and generate the intermediate state G3 used for the encryption process and decryption process of each communicating device. Specifically, it includes the following processing steps:

[0116] Step S21: The two communicating devices publicly agree on an a-bit initialization vector (IV), a b-bit freshness value (N), and secretly negotiate a c-bit key (K). Where a, b, and c satisfy a + b + c = 192, and c is greater than or equal to 64. Setting C to be greater than or equal to 64 enhances the security of both communicating parties and significantly increases the difficulty of decrypting the sent information. The message initiator also discloses plaintext additional information (e.g., packet header information) as communication data A.

[0117] Preferably, this embodiment sets a=b=c=64.

[0118] The initial vector IV, the fresh value N, and the key K are concatenated into a 192-bit initial intermediate state G0 in the order IV||K||N, where the symbol || indicates concatenation of the data on both sides.

[0119] Step S22: The communication devices of both parties respectively transform the initial intermediate state G0 using the data transformation process to obtain a transformed initial intermediate state Perm(G0); then the transformed initial intermediate state Perm(G0) is XORed with the key K expanded to 192 bits by zero according to the following method, so that the sender Se and the receiver Re can obtain the same first intermediate state G1:

[0120]

[0121] Step S23: Block processing of communication data A:

[0122] Determine whether the communication data A is 0. If so, the communication data A is considered empty. Otherwise, continue to determine whether A is a relevant multiple of 64. If the length of A is not a multiple of 64, append a 1 and several 0s to the end of A to make the length of A a multiple of 64. Otherwise, do not process A.

[0123]

[0124] The communication data A after the above processing is divided into m blocks A i (i=1,…,m).

[0125] Step S24: The two communication devices XOR the first intermediate state G1 with the constant 1 padded to 192 bits with zeros according to the following formula, so that the sender Se and the receiver Re can obtain the same second intermediate state G2;

[0126]

[0127] Step S25: Use the data transformation process to transform the second intermediate state G2 to obtain the intermediate state Perm(G2) after data transformation; for each block A i (i=1,…,m), press the formula in A i The tail is padded with 128 zeros and bitwise XORed with the intermediate state Perm(G2) after data transformation to obtain the third intermediate state G3.

[0128]

[0129] The encryption process is for the resource-constrained sender device Se to encrypt data (i.e., plaintext P) to be sent to the resource-constrained sender device Se based on the third intermediate state G3 obtained from the intermediate state preprocessing process, and simultaneously obtain an authentication tag. Specifically,

[0130] Step S31: The sender device Se determines whether the length of the plaintext P to be encrypted and sent is 0 according to formula (9). If so, the plaintext P is considered to be empty. Otherwise, it continues to determine whether the plaintext P is a relevant multiple of 64. If the length of the plaintext P is not a multiple of 64, a 1 and several 0s are added to the end of the plaintext P to make the length of AP a multiple of 64. If the length of the plaintext P is a multiple of 64, the plaintext P is not processed. Finally, the plaintext P whose length is a multiple of 64 is divided into blocks to obtain t blocks of plaintext blocks P1, ..., P t :

[0131]

[0132] Step S32: The sending device Se uses the agreed initial vector IV, the fresh value N, the secret key K, and the public communication data A to obtain a third intermediate state G3 using the intermediate state preprocessing process, and then XORs G3 with the constant 2 padded to 192 bits with zeros according to the following formula to obtain the fourth intermediate state S0:

[0133]

[0134] Step S33: The sender device Se divides the first t-1 plaintext blocks P i Get the intermediate state S i and ciphertext block C i ;

[0135] Step S331: Initialize the data transformation of the fourth intermediate state S0 using the data transformation process to obtain the fourth intermediate state Perm(S0) after data transformation;

[0136] Step S332: The sender device Se processes each plaintext block P i The tail is filled with 128 zeros, and then the fourth intermediate state Perm (S i-1 ) XOR, get the current plaintext block P i The corresponding updated fourth intermediate state S i ;

[0137] Step S333: Intercept the updated fourth intermediate state S i The highest 64 bits of data are used as ciphertext block C i (i=1,…,t-1);

[0138]

[0139] Among them, mbs 64 (S i ) means to take the cut-off S i The highest 64 bits;

[0140] Step S34: The sender device Se processes the last plaintext block P t Get the intermediate state S t and ciphertext block C t :

[0141] Step S341: To obtain the last ciphertext block C of the data that the sender device Se needs to send t , the sending device Se can obtain the intermediate state S by the following formula t ;

[0142]

[0143] Step S342: Determine P t Is the length of 64 a relevant multiple? If so, intercept the intermediate state S t The highest |P| mod 64 bits of data are used as the last ciphertext block C t , otherwise intercept the intermediate state S t The highest 64 bits of data are used as the last ciphertext block C t , that is, the following formula.

[0144]

[0145] Step S35: The intermediate state S t The authentication tag T is obtained after processing according to the following formula.

[0146]

[0147] Step S36: The ciphertext blocks obtained by steps S33 and S34 are sequentially spliced ​​to obtain the ciphertext C after the encrypted data to be sent by the sender device Se, and finally the ciphertext C and the authentication tag T are sent to the receiver device Re in a certain manner.

[0148] The decryption module is used by the receiver Re to decrypt the ciphertext C received from the sender Se using the third intermediate state G3 obtained by the intermediate state initialization module, and to determine whether the received information is correct based on whether the received authentication tag T is correct. The specific processing steps include the following:

[0149] Step S41: The receiving device Re determines whether the length of the received ciphertext C is 0 according to formula (15). If so, the ciphertext C is considered to be empty. Otherwise, the receiving device Re continues to determine whether the ciphertext C is a relevant multiple of 64. If the length of the ciphertext C is not a multiple of 64, a 1 and several 0s are added to the end of the ciphertext C to make the length of the ciphertext C a multiple of 64. If the length of the ciphertext C is a multiple of 64, the ciphertext C is not processed. Finally, the ciphertext C whose length is a multiple of 64 is divided into blocks to obtain r plaintext blocks C1, ..., C r

[0150]

[0151] Step S42: The recipient Re uses the initial vector IV, the fresh value N, the secret key K agreed upon by both parties, and the public communication data A to obtain the third intermediate state G3 using the intermediate state initialization module. The third intermediate state G3 is bitwise XORed with the constant 2 padded to 192 bits with zeros according to the following formula to obtain the fourth intermediate state S0.

[0152]

[0153] Step S43: Except for the last ciphertext block, each ciphertext block is padded with 128 zeros at the end and then XORed with the transformed S, and the highest 64 bits of S are intercepted as the plaintext block P. i (i=1,…,r-1), expressed as follows:

[0154]

[0155] Step S44: The receiver Re processes the last ciphertext block C r Get the intermediate state S r and plaintext block P r :

[0156] Step S441: The receiver Re obtains the intermediate state S according to the following formula r ;

[0157]

[0158] Step S44: Determine whether the length of C is a relevant multiple of 64, if so, intercept the intermediate state S r The highest |C| mod 64 bits of data are taken as the last plaintext block P r , otherwise intercept the intermediate state S r The highest 64 bits of data are used as the last plaintext block P r , expressed as follows:

[0159]

[0160] Step S45: The intermediate state S r After the following processing, we get an authentication tag T * , compare it with the authentication tag T sent by the sender device Se to obtain the authentication result. If they are the same, the authentication is passed and go to step S46, otherwise it is rejected.

[0161]

[0162] Step S46: The plaintext blocks of step S43 and step S44 are sequentially spliced ​​together to obtain the data sent by the sender device Se.

[0163] According to the method in the above specific implementation mode, the steps are as follows:

[0164] Step 1: Initialization of both communication parties

[0165] (1) The communicating parties agree to set the initial 64-bit initial vector IV to IV = 0x0123456789abcdef, the 64-bit key K to K = 0xfedcba9876543210, the 64-bit fresh value N to be randomly generated N = 0x01fe23dc45ba6798, and the associated data A of length 72 bits to be A = 0x616263646566676869. The sending device Se sets the data P to be sent to P = 0x313233343536373839 of length 72 bits. The receiving device Re decrypts the data using the encrypted data sent by the sending device.

[0166] (2) 64-bit data initial vector IV, 64-bit key K, and 64-bit fresh value N are concatenated into the initial intermediate state G0 = 0x0123456789abcdeffedcba987654321001fe23dc45ba6798;

[0167] (3) The initial intermediate state G0 of 192 data is transformed through the data transformation process to obtain a data string of 192 data length Perm(G0) = 0xb441887ebba9fc32ff13733c134a8b2c3e95c85496de4c2a, which is XORed with the key K expanded to 192 bits to obtain the first intermediate state

[0168] (4) The relevant data A is appended with a 1 and 55 0s at the end to make the length of A a multiple of 64, and is divided into two blocks A1 and A2 of 64 data each.

[0169] (5) The intermediate state S1 is expanded to 192 constant 1 and XORed to obtain the state For each block A i (i=1,2), in A i Add 128 zeros to the end and press Formula G2 is updated to obtain state G3, G3 = 0x0d8ba8a9bbdf67d24c1c9d1e35fd47f65ac3bb6d62478d1b. Thus, both communicating parties can obtain the same intermediate state G3.

[0170] Step 2: The sender device Se encrypts the data to be sent and obtains the relevant authentication tag:

[0171] (1) Add a 1 and 55 0s to the end of the plaintext P to make the length of P a multiple of 64, and divide it into two blocks P1 and P2 with a size of 64 data.

[0172] (2) The sending device Se will XOR the initialized constant 2 with the length 192 data to obtain the state

[0173] (3) For each plaintext P i The blocks are filled with 128 zeros at the end, P i =P i ||0 128 (i=1,2).

[0174] (4) Starting from P1, for each P i renew At the same time, intercept S i The highest 64 bits of data are used as ciphertext block C i =mbs 64 (S i )(i=1,…,2)

[0175] (5) For the last ciphertext block C t Discarding a portion of the low-order data, the length is the same as the number of bits added to P in step (3), which is 56 data. After splicing the ciphertext blocks in order, the 72-bit ciphertext C = 0x7f371cc3139856719f is obtained.

[0176] (6) The recipient processes its intermediate state S2 using the following formula to obtain the authentication tag

[0177] Step 2: The recipient Re decrypts the ciphertext obtained in step 1:

[0178] (1) Append a 1 and 55 zeros to the end of the ciphertext C to make the length of C a multiple of 64

[0179] (2) XOR the state S0 with the constant 2 of length 192 data to obtain the state

[0180] (3) For each ciphertext C i The blocks are filled with 128 zeros at the end, C i =C i ||0 128 (i=1,2)

[0181] (4) Starting from C1, for each C i renew At the same time, intercept S i The highest 64 data as the plaintext block P i =mbs 64 (S i )(i=1,…,r)

[0182] (5) For the last plaintext block P r Discard the low-order part of the data, and the length is the same as the number of bits added by C in step (3). After splicing in order, we get the plaintext P = 0x313233343536373839

[0183] (6) The recipient processes its intermediate state S2 according to the above formula to obtain the verification tag T * =0x728a7ae6f2ff1bef, now T=T * , the trusted party's device verifies that the verification is successful.

Claims

1. A lightweight authentication and encryption method for resource-constrained device communications, characterized in that Including data transformation process, intermediate state preprocessing process, encryption process, and decryption process; The data transformation process is used to transform the data, specifically: Step S11: 3D data Given a one-dimensional data string D, a 3×16×4 three-dimensional data matrix S is constructed according to the coordinate mapping relationship of formula (1): D : S D [x,y,z]=D[48z+3y+x] (1) Among them, x, y, z represent the three-dimensional matrix S D The three-axis coordinates of a data in the original one-dimensional data; D[ ] represents the position of the data in the original one-dimensional data; Step S12: 3D data matrix transformation processing; Step S13: Data S xyz Update according to the data coordinate correspondence of the original one-dimensional data string D to obtain the transformed data Perm(D); The intermediate state preprocessing process is used to combine the initialization vector, key, and freshness value pre-determined by the communicating devices with the relevant data A set by the communication initiator, and generate a third intermediate state G3 for the encryption process and decryption process of each communicating device; specifically: Step S21: The two communication devices publicly agree on an a-bit initialization vector IV, a b-bit freshness value N, and secretly negotiate a c-bit key K, where a, b, and c satisfy a+b+c=192, and c is greater than or equal to 64. At the same time, the message initiator discloses the plaintext additional information as communication data A. Concatenate the initial vector IV, the fresh value N, and the key K into a 192-bit initial intermediate state G0 in the order IV||K||N, where the symbol || indicates concatenation of the data on both sides; Step S22: The communication devices of both parties respectively transform the initial intermediate state G0 using the data transformation process to obtain the transformed initial intermediate state Perm(G0); then the transformed initial intermediate state Perm(G0) is XORed with the key K expanded from zero to 192 bits according to formula (5), so that the sender Se and the receiver Re obtain the same first intermediate state G1: Step S23: Block processing of communication data A: Determine whether the communication data A is 0. If so, it is considered that the communication data A is empty. Otherwise, continue to determine whether A is a relevant multiple of 64. If the length of A is not a multiple of 64, append a 1 and several 0s to the end of A to make the length of A a multiple of 64. If the length of A is a multiple of 64, do not process A. The communication data A after the above processing is divided into m blocks A i (i=1,…,m); Step S24: The two communication devices perform an XOR operation on the first intermediate state G1 according to formula (7) with the constant 1 padded to 192 bits with zeros, so that the sender Se and the receiver Re obtain the same second intermediate state G2; Step S25: Use the data transformation process to transform the second intermediate state G2 to obtain the intermediate state Perm(G2) after data transformation; for each block A i (i=1,…,m), according to formula (8) in A i The tail is padded with 128 zeros and bitwise XORed with the intermediate state Perm(G2) after data transformation to obtain the third intermediate state G3; The encryption process is for the resource-constrained sender device Se to encrypt data to be sent to the resource-constrained sender device Se based on the third intermediate state G3 obtained from the intermediate state pre-processing process, and to obtain an authentication tag. Specifically, Step S31: The sender device Se determines whether the length of the plaintext P to be encrypted and sent is 0 according to formula (9). If so, the plaintext P is considered to be empty. Otherwise, it continues to determine whether the plaintext P is a relevant multiple of 64. If the length of the plaintext P is not a multiple of 64, a 1 and several 0s are added to the end of the plaintext P to make the length of P a multiple of 64. If the length of the data P is a multiple of 64, the data P is not processed. Finally, the plaintext P whose length is a multiple of 64 after processing is divided into blocks to obtain t blocks of plaintext blocks P1, ..., P t : Step S32: The sending device Se uses the initial vector IV, the fresh value N, the key K, and the communication data A to obtain a third intermediate state G3 using the intermediate state preprocessing process, and XORs G3 with the constant 2 padded to 192 bits with zeros according to formula (10), thereby obtaining a fourth intermediate state S0: Step S33: The sender device Se divides the first t-1 plaintext blocks P i Get the intermediate state S i and ciphertext block C i ; Step S331: Initialize the data transformation of the fourth intermediate state S0 using the data transformation process to obtain the fourth intermediate state Perm(S0) after data transformation; Step S332: The sender device Se processes each plaintext block P i The tail is filled with 128 zeros, and then the fourth intermediate state Perm (S i-1 ) XOR, get the current plaintext block P i The corresponding updated fourth intermediate state S i ; Step S333: Intercept the updated fourth intermediate state S i The highest 64 bits of data are used as ciphertext block C i (i=1,…,t-1); Among them, mbs 64 (S i ) means to take the cut-off S i The highest 64 bits; Step S34: The sender device Se processes the last plaintext block P t Get the intermediate state S t and ciphertext block C t ; Step S341: To obtain the last ciphertext block C of the data that the sender device Se needs to send t , the sending device Se obtains the intermediate state S according to formula (12) t ; Step S342: Determine P t Is the length of 64 a relevant multiple? If so, intercept the intermediate state S t The highest |P t |mod64-bit data as the last ciphertext block C t , otherwise intercept the intermediate state S t The highest 64 bits of data are used as the last ciphertext block C t , that is, formula (13); Step S35: The intermediate state S t After processing according to formula (14), the authentication tag T is obtained; Step S36: Sequentially concatenate the ciphertext blocks obtained in steps S33 and S34 to obtain the encrypted ciphertext C required to be sent by the sender device Se, and finally send the ciphertext C and the authentication tag T to the receiver device Re; The decryption module is used by the receiver Re to decrypt the ciphertext C received from the sender Se using the third intermediate state G3 obtained by the intermediate state initialization module, and to determine whether the received information is correct based on whether the received authentication tag T is correct. Specifically: Step S41: The receiving device Re determines whether the length of the received ciphertext C is 0 according to formula (15). If so, the ciphertext C is considered to be empty. Otherwise, it continues to determine whether the length of the ciphertext C is a relevant multiple of 64. If the length of the ciphertext C is not a multiple of 64, a 1 and several 0s are appended to the end of the ciphertext C to make the length of the ciphertext C a multiple of 64. If the length of the ciphertext C is a multiple of 64, the ciphertext C is not processed. Finally, the ciphertext C whose length is a multiple of 64 after processing is divided into blocks to obtain r plaintext blocks C1,…,C r : Step S42: The receiver Re uses the initial vector IV, the fresh value N, the key K, and the communication data A to obtain the third intermediate state G3 from the intermediate state initialization module, and performs bitwise XOR processing on the third intermediate state G3 with the constant 2 padded to 192 bits with zeros according to formula (16) to obtain the fourth intermediate state S0; Step S43: According to formula (17), except for the last ciphertext block, each ciphertext block is padded with 128 zeros at the end and then combined with the fourth intermediate state Perm (S i-1 ) and intercept the highest 64 bits of S as the plaintext block P i (i=1,…,r-1); Step S44: The receiver Re processes the last ciphertext block C r Get the intermediate state S r and plaintext block P r : Step S441: The receiver Re obtains the intermediate state S according to formula (18) r ; Step S44: Determine whether the length of C is a relevant multiple of 64, if so, intercept the intermediate state S r The highest |C|mod 64 bits of data are used as the last plaintext block P r , otherwise intercept the intermediate state S r The highest 64 bits of data are used as the last plaintext block P r , that is, formula (19); Step S45: The intermediate state S r After processing according to formula (20), we get an authentication tag T * , compare it with the authentication tag T sent by the sender device Se to obtain the authentication result. If they are the same, the authentication is passed and the process goes to step S46. Otherwise, it is rejected. Step S46: The plaintext blocks of step S43 and step S44 are sequentially spliced ​​together to obtain the data sent by the sender device Se.

2. The method according to claim 1, characterized in that Step S12 specifically includes the following steps: Step S121: Initialize the number of data transformations r to 0; Step S122: Calculate the three-dimensional data matrix S D Transform along the x-axis: Traverse the y and z axes in turn, each time for the data matrix S D The three data with the same y and z coordinates are transformed and calculated according to formula (2). After the traversal is completed, the data matrix S after the x-axis transformation is obtained. x ; in, Indicates S D The data with coordinates [x, y, z] is inverted, and mod means remainder operation. Represents exclusive OR operation; Step S123: transform the matrix S along the x-axis x Transform along the y-axis: Traverse the x and z axes in turn, each time for the matrix S x The 16 data with the same x and z coordinates are arranged in ascending order of y coordinates into a data string R. The following operations are performed based on the value of the x coordinate of this set of data: If x=0 then If x=1 then If x=2, then Among them, <<< means circular left shift, Represents bitwise exclusive OR; After performing the above operation on R, use R to x The 16 data in the original position are updated and replaced. After the traversal is completed, the matrix S after the transformation along the x-axis and y-axis is obtained. xy ; Step S124: transform the matrix S along the x-axis and y-axis xy Transform along the z-axis: Traverse the x and y axes in turn, each time for the matrix S xy The four data with the same x and y coordinates are translated and transformed according to formula (3). After the traversal is completed, the data S after the transformation of a group of three data is obtained. xyz ; S xyz [x,y,z]=S xy [x,3y,(z+x)mod4] (3) Step S125: According to formula (4), S xyz The data with x,y coordinates of 0 and the zth bit of the four-bit binary representation of the number of data transformations r are XORed one by one to obtain the updated data S xyz ; Step S126: Update the original data Determine whether the maximum number of data transformations has been reached. If so, output the current number of data transformations. The updated data S in step S214 is xyz , if otherwise update S D The data S updated in step S214 is the number of times the current data is transformed. xyz , update r=r+1, and repeat steps S122-S126.

3. The method according to claim 1, characterized in that In step S21, the plaintext additional information includes packet header information.

4. A lightweight authentication and encryption system for implementing the method described in any one of claims 1 to 3, characterized in that It includes a data transformation module, an intermediate state preprocessing module, an encryption processing module, and a decryption processing module.

5. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 3.

6. A computing device comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 3 is implemented.

Images