A Data Security Transmission Method for the Internet of Things to Avoid Repeated Encryption and Decryption

Abstract

The present invention belongs to the field of information security technology, and discloses a method for secure data transmission that avoids repeated encryption and decryption for the Internet of Things. The data sender adds a flag bit to the data packet transmitted over the network, first determines whether the layer where the data is located has a security protocol, and if so, reads the last flag bit. This flag bit represents the operation of the upper layer on the data and is used to determine whether the content encrypted for the layer where the data to be encrypted is located is the header of the upper layer or the header and data of the upper layer; the data receiver performs an inverse operation on the above steps to decrypt. The method described in the present invention avoids repeated encryption of data during transmission and ensures the transmission rate of data during network transmission.

Description

Technical Field

[0001] The present invention belongs to the technical field of information security, and specifically relates to a method for secure data transmission that avoids repeated encryption and decryption for the Internet of Things. Background Art

[0002] In network communication, if the data exchange and transmission is in plain text, it may be eavesdropped and tampered with when passing through physical nodes, thus there is a risk or loss of information loss. Therefore, it is necessary to encrypt the data before transmission to ensure the security of the data.

[0003] In TCP / IP, the PPP protocol in the data link layer defines a method for point-to-point transmission of multi-protocol packets in the link layer, but does not provide protection for the integrity and confidentiality of the data encapsulated by it. In response to this security hidden danger, the MPPE protocol and the DESE protocol are designed to encrypt and protect the data at both ends of the PPP link, thus providing confidentiality protection for PPP communication; in the network layer, in order to resist Dos attacks, replay attacks, etc. in the IP layer and ensure the integrity and confidentiality of the data, the IPSec protocol is designed; the security solution in the transport layer is to adopt the SSL and TLS standards; for WEB security, in the application layer, the S-HTTP solution can be adopted, which is a high-level protocol constructed on top of the HTTP protocol.

[0004] With the development of the Internet of Things technology, the use of various Internet of Things devices increasingly depends on communication and interaction with the server.

[0005] To ensure data security, in the Internet of Things, the Internet of Things devices and the server generally need to encrypt the data during communication. Some traditional data encryption algorithms, such as ssl / tls encryption, have relatively high requirements for computing hardware resources, requiring the processor of the Internet of Things device to have a certain processing capacity and also having certain requirements for the memory of the Internet of Things device; however, the Internet of Things devices with lightweight computing capabilities, such as the processors and memory capabilities of sweeping robots, etc. are limited and cannot integrate the above complex encryption algorithms, which affects the security of Internet of Things data communication.

[0006] Patent application CN108390860A discloses a method and device for encrypting and decrypting data packets. By encrypting the header, it uses simple padding, exclusive OR, and random methods to encrypt the header in the data packet, thereby reducing the encryption calculation overhead at the sending end and improving the processing efficiency of the processor; however, it uses the number of padding bytes and the number of exclusive OR bytes to encrypt the data packet header, which will increase the data length and may cause the data transmission speed to slow down; at the same time, it only encrypts and protects the data packet header and does not process the data part, so there is a risk of data leakage during transmission.

[0007] Based on this, it is necessary to design a data security transmission method for the Internet of Things to ensure the security of IoT data communication without affecting the data transmission rate. Summary of the Invention

[0008] To solve the above technical problems, the present invention provides a data security transmission method for the Internet of Things that avoids repeated encryption and decryption. It not only encrypts and decrypts the control information part of the data packet, but also encrypts and decrypts the transmitted data itself to ensure the security of the data during transmission. In addition, to ensure the data transmission speed, the present invention sets a flag bit in the data packet to mark the encryption status of the data. This avoids the problem of slow data transmission speed due to excessive data length and the problem of reduced transmission rate caused by repeated encryption and decryption of data.

[0009] The present invention provides a data security transmission method for avoiding repeated encryption and decryption for the Internet of Things, the steps are as follows:

[0010] Step 1: The sender sets a flag in the data packet in advance to record whether all data transmitted by the upper layer, including control information, is encrypted;

[0011] Step 2: After the data is transmitted to each layer, the control information of the layer is added to determine whether the layer needs to be encrypted. All data, including the control information of the previous layer and the data to be transmitted, are processed according to the encryption requirements and then transmitted to the next layer;

[0012] Step 3: The processed data is transmitted to the data link layer. In this layer, the control information consists of two parts, which are added to the header H2 and tail T2 of the data unit of this layer respectively. After repeating step 2, the data reaches the physical layer;

[0013] Step 4: The physical layer transmits the data to the receiver through the physical line;

[0014] Step 5: The receiver determines whether the data layer needs to be decrypted based on the flag bit of the data packet, decrypts the data packet and transmits it to the upper layer until it reaches the application layer. The receiver finally receives the complete information.

[0015] Furthermore, in step 2, if the layer where the data is located needs to be encrypted, the number closest to the marker bit of the header is read;

[0016] If the number read from the flag bit is 0 or does not exist, it means that the previous layer has not encrypted the data or the data is still in the first layer. In this case, the header and data transmitted from the previous layer are encrypted according to the security protocol of this layer, and a flag bit is added before the header used by the protocol of this layer, set to 1, and transmitted to the next layer together with the header and the encrypted data of the previous layer;

[0017] If the number of the read flag bit is 1, it means that the upper layer has encrypted the data. Only encrypt the header passed from the upper layer according to the protocol of the layer where the data is located, and then add a flag bit before the first bit of the header used by this layer protocol, set it to 1, and transmit it to the lower layer together with the header and the encrypted upper layer data.

[0018] Further, in step 2, if the layer where the data is located does not require encryption, add a flag bit before the first bit of the header used by this layer protocol, set it to 0, and transmit it to the lower layer together with the header and the upper layer data.

[0019] Further, in step 4, the physical layer is the transmission of bit stream and no control information is added anymore; when the bit stream leaves the sender and is transmitted through the physical medium of the network to the router, it rises from the first layer of the router to the third layer in sequence; each layer needs to perform necessary operations according to the control information. Therefore, before the data reaches the second layer of the router, it is necessary to first judge whether to decrypt the data packet according to the flag bit to obtain the control information and data of the upper layer, and then strip off the control information of the layer where the data is located, and hand over the remaining data unit of this layer to a higher layer; when the packet rises to the third layer, look up the forwarding table in the router according to the destination address in the header, find the interface for forwarding the packet, and then transmit it down to the second layer. After adding a new header and tail, repeat the above encryption steps, and finally transmit it to the bottom first layer, and then send out each bit on the physical medium.

[0020] Further, in step 5, after the receiver receives the data, if it is found that the flag bit of the data packet is 0, it is determined that the layer where the data is located does not need to be decrypted;

[0021] If the flag bit is 1 and the corresponding flag bit of the upper layer is 0, it means that the header and data of the upper layer are encrypted at this layer during transmission and the data is not encrypted at the upper layer. Then decrypt all the header and data of the upper layer using the protocol of this layer and transmit it to the upper layer;

[0022] If the flag bit is 1 and the corresponding flag bit of the upper layer is also 1, it means that only the header of the upper layer is encrypted at this layer during transmission. Then only decrypt the header of the upper layer at this time and then transmit it to the upper layer;

[0023] Repeat the above decryption steps until it is transmitted to the application layer and repeat the above steps. Finally, the receiver receives the complete information.

[0024] The beneficial effects of the present invention are as follows: The method of the present invention adds a flag bit to the data packets transmitted in the network, first determines whether the layer where the data is located has a security protocol, that is, whether data encryption is required in this layer, so as to avoid repeated encryption of data during transmission. This operation ensures the transmission rate of data in network transmission; after the data is transmitted to a certain layer with a security protocol, if it is determined according to the flag bit that the data is not encrypted, then all the data transmitted from the upper layer needs to be encrypted in this layer; if it is determined according to the flag bit that the data has been encrypted in the upper layer, then only the control information transmitted from the upper layer needs to be encrypted in this layer, and decryption is the reverse process of this process. This operation ensures the secure transmission of data in the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 is a transmission process diagram of the computer network data of the present invention;

[0026] Figure 2 is a flowchart of the method for the sender to avoid repeated encryption in the embodiment of the present invention;

[0027] Figure 3 is a data transmission flowchart in the embodiment of the present invention;

[0028] Figure 4 is a flowchart of the method for the receiver to avoid repeated decryption in the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0029] In order to make the content of the present invention easier to be clearly understood, the present invention will be further described in detail below according to specific embodiments and in conjunction with the accompanying drawings.

[0030] A structure for avoiding repeated encryption and decryption of data secure transmission for the Internet of Things includes a flag bit, control information, and data transmitted from the upper layer.

[0031] A network architecture of a method for avoiding repeated encryption and decryption of data secure transmission for the Internet of Things is as Figure 1 shown. The Internet of Things includes an application layer, a presentation layer, a session layer, a transport layer, a network layer, a data link layer, a physical layer, and a router in sequence; a flag bit is added to each layer on the basis of the existing computer network architecture.

[0032] The flag bit is used to determine whether the data has been encrypted. Whether the data has been encrypted means that if the flag bit is 1, it represents that the data has been encrypted, and if the flag bit is 0, it represents that the data has not been encrypted.

[0033] Control information refers to information used by the protocol. At the application, presentation, session, transport, and network layers, control information consists of only a header. At the data link layer, control information includes both a header and a trailer. The structure of these headers and trailers is defined in detail by the protocol's specifications. The control information in a packet clearly indicates how the protocol should read the data.

[0034] The data transmitted from the upper layer refers to all data including the control information and data used by the upper layer protocol. The control information used by the upper layer must not be encrypted.

[0035] like Figures 2 - 4 As shown, the steps of data sending, forwarding, and receiving in a data secure transmission method for avoiding repeated encryption and decryption for the Internet of Things are as follows:

[0036] Step 1: Figure 2 As shown in Figure 2, two hosts in the same network segment perform file transfer: the sending host sets a flag bit in the data packet in advance to record whether the data is encrypted;

[0037] Step 2: After the file data is transferred to each layer, the control information of the layer is added and it is determined whether the layer where the data is located has a security protocol that requires encryption of the file data. In other words, it is determined whether the layer needs to be encrypted: if yes, go to step 3; if not, go to step 6;

[0038] Step 3: Read the number closest to the header’s mark bit. If the number is 0 or does not exist, go to step 4; if the number is 1, go to step 5.

[0039] In step 4, if the flag bit read in step 3 is 0 or does not exist, it means that the previous layer has not encrypted the data or the data is still in the first layer. Then, the header and file data transmitted from the previous layer are encrypted according to the security protocol of this layer, and a flag bit is added before the header used by the protocol of this layer, set to 1, and transmitted to the next layer together with the control information of this layer and all the encrypted data transmitted from the previous layer;

[0040] In step 5, if the flag bit read in step 3 is 1, it means that the previous layer has already encrypted the file data. It is only necessary to encrypt the control information transmitted from the previous layer according to the protocol of the layer where the data is located, and then add a flag bit before the header used by the protocol of this layer, set it to 1, and transmit it to the next layer together with the control information of this layer and all the encrypted data transmitted from the previous layer;

[0041] Step 6: If the data layer does not require encryption, a flag bit is added before the header used by the protocol layer, set to 0, and transmitted to the next layer together with the control information of the layer and all data transmitted by the previous layer;

[0042] Step 7: Repeat the above Steps 2, 3, 4, 5, and 6 until all data is transmitted to the physical link layer. The control information is divided into two parts and added to the header (H2) and trailer (T2) of the data unit at this layer respectively. Repeat the above steps to check whether the data is encrypted before transmitting it to the physical layer. Since the physical layer transmits bit streams, no control information is added anymore;

[0043] Step 8: As Figure 3 shown, the data enters the forwarding stage; when the above bit stream leaves the sending host and is transmitted through the physical medium of the network to the router, it ascends from the first layer to the third layer of the router in sequence; each layer first determines whether to decrypt the data packet according to the flag bits of the data packet, and then performs necessary operations according to the control information corresponding to each layer in the data packet, and then strips off the control information and hands over the remaining data unit of this layer to a higher layer; when the packet ascends to the third layer, it looks up the forwarding table in the router according to the destination address in the header, finds the interface for forwarding the packet, and then transmits it down to the second layer. After adding a new header and trailer, it encrypts the header and data accordingly according to the above encryption steps, and then goes to the bottom first layer, and then sends out each bit on the physical medium;

[0044] Step 9: As Figure 4 shown, the receiving host determines whether the layer where the data is located needs to be decrypted according to the flag bits of the data packet. If the flag bit corresponding to this layer is 0, no decryption is required; if the flag bit is 1 and the flag bit corresponding to the upper layer is 0, the protocol of this layer is used to decrypt all the header and data of the upper layer and transmit it to the upper layer; if the flag bit is 1 and the flag bit corresponding to the upper layer is also 1, only the header of the upper layer needs to be decrypted and then transmitted to the upper layer until it is transmitted to the application layer, and the receiving party finally receives the complete file data.

[0045] Through the above steps, the data sender host adds a flag bit to the file data packet transmitted over the network. First, it determines whether the layer where the file data is located has a security protocol, that is, whether data encryption is required at this layer. If so, it reads the last flag bit. This flag bit represents the operation of the upper layer on the data and is used to determine whether the content encrypted at the layer where the data to be encrypted is located is the header of the upper layer or the header and data of the upper layer: if the value is 1, only the header needs to be encrypted; if the value is 0, the header and data need to be encrypted. The data receiver needs to perform an inverse operation on the above steps. If the value of the flag bit at this layer is 1, it means decryption is required, and then combined with the flag bit of the upper layer to determine whether the content decrypted at the layer where the data is located is the header of the upper layer or the header and data of the upper layer: if the value is 1, only the header of the upper layer needs to be decrypted; if the value is 0, the header and data need to be decrypted. After completing all the steps, the security of the file data during transmission in the computer network is ensured through encryption and decryption, and the duplication of data encryption is avoided to ensure the data transmission rate, realizing efficient and secure network data transmission.

[0046] The above description is only the preferred solution of the present invention and is not intended as a further limitation of the present invention. All equivalent changes made by using the content of the specification and drawings of the present invention are within the protection scope of the present invention.

Claims

1. A data security transmission method for the Internet of Things that avoids repeated encryption and decryption, characterized in that, The method steps are as follows: Step 1: The sender pre-sets a flag bit in the data packet to record whether all the data including control information transmitted from the upper layer is encrypted; Step 2: After the data is transmitted to each layer, the control information of that layer is added, and it is judged whether that layer needs to be encrypted. When encryption is required, all the data including the control information of the upper layer and the data to be transmitted itself is processed correspondingly according to the encryption requirements and then transmitted to the next layer; Step 3: Until the processed data is transmitted to the data link layer, in this layer, the control information contains two parts, which are added to the header H2 and the tail T2 of the data unit of this layer respectively. After repeating Step 2 once, the data reaches the physical layer; Step 4: The physical layer transmits the data to the receiver through the physical line; Step 5: The receiver determines whether the data at the layer needs to be decrypted according to the flag bit of the data packet. When decryption is required, the data packet is decrypted and then transmitted to the upper layer until it is transmitted to the application layer, and the receiver finally receives the complete information.

2. The secure data transmission method for the Internet of Things according to claim 1, which is characterized in that In Step 2, if the layer where the data is located needs to be encrypted, the number of the flag bit closest to the header is read; If the flag bit does not exist, it means the data is still in the first layer. Then the data is encrypted according to the security protocol of this layer, and a flag bit is added before the first bit of the header used by this layer protocol, and it is set to 1, and then transmitted to the next layer together with the header and the encrypted data; If the number of the flag bit read is 0, it means the upper layer has not encrypted the data. Then the header and data transmitted from the upper layer are encrypted according to the security protocol of this layer, and a flag bit is added before the first bit of the header used by this layer protocol, and it is set to 1, and then transmitted to the next layer together with the header and the encrypted upper layer data; If the number of the flag bit read is 1, it means the upper layer has already encrypted the data. Only the header transmitted from the upper layer needs to be encrypted according to the protocol of the layer where the data is located, and then a flag bit is added before the first bit of the header used by this layer protocol, and it is set to 1, and then transmitted to the next layer together with the header and the encrypted upper layer data.

3. The secure data transmission method for the Internet of Things that avoids repeated encryption and decryption according to claim 1, characterized in that In Step 2, if the layer where the data is located does not need to be encrypted, a flag bit is added before the first bit of the header used by this layer protocol, and it is set to 0, and then transmitted to the next layer together with the header and the upper layer data.

4. A method for secure data transmission that avoids repeated encryption and decryption for the Internet of Things according to claim 1, characterized in that, In Step 4, the physical layer transmits the bit stream and no longer adds control information; when the bit stream leaves the sender and is transmitted through the physical medium of the network to the router, it rises from the first layer to the third layer of the router in turn; each layer needs to perform necessary operations according to the control information. Therefore, before the data reaches the second layer of the router, it is necessary to judge whether the data packet needs to be decrypted according to the flag bit to obtain the control information and data of the upper layer, and then strip the control information of the layer where the data is located, and hand over the remaining data unit of this layer to a higher layer; when the packet rises to the third layer, the forwarding table in the router is searched according to the destination address in the header to find the interface for forwarding the packet, and then it is transmitted down to the second layer, and after adding a new header and tail, the above encryption steps are repeated, and finally it is transmitted to the bottom first layer, and then each bit is sent out on the physical medium.

5. A method for secure data transmission in the Internet of Things that avoids repeated encryption and decryption according to claim 1, characterized in that, In step 5, after the receiver receives the data, if it is found that the flag bit of the data packet is 0, it is determined that the layer where the data is located does not need to be decrypted; If the flag bit is 1 and the corresponding flag bit of the upper layer is 0, it means that the header and data of the upper layer were encrypted at this layer during transmission and the data was not encrypted at the upper layer. Then, use the protocol of this layer to decrypt all the header and data of the upper layer and transmit them to the upper layer; If the flag bit is 1 and the corresponding flag bit of the upper layer is also 1, it means that only the header of the upper layer was encrypted at this layer during transmission. In this case, only decrypt the header of the upper layer and then transmit it to the upper layer; Repeat the above decryption steps until it is transmitted to the application layer and the above steps are repeated. Finally, the receiver receives the complete information.

Images