A data transmission method based on symmetric key pool

Abstract

The present application discloses a data transmission method based on a symmetric key pool, including: first, the sending end and the receiving end are both preset with the same total key pool and hash algorithm; the sending end then uses the preset hash algorithm to perform hash calculation on the identity identifier, the location information of the first authentication key, and the number of the first load key to obtain a hash value, and encrypts it to obtain a signature file; the load data is encrypted by the first load key to obtain a ciphertext load, the ciphertext load is CRC-checked, and a first CRC check code is generated; finally, the sending end composes a quantum security data packet and sends it to the receiving end. The two ends of the present invention use a key pool as a resource pool for bilateral authentication communication, and use data authentication methods such as hash values, ciphertexts, and CRC check codes to ensure data transmission integrity and non-repudiation; and the load key is obtained in a one-industry-one-key manner or a one-time-one-key manner, and the privacy protection of user data can be improved by encrypting data with it.

Description

Technical Field

[0001] The present application relates to the field of data communication technology, and in particular to a data transmission method based on a symmetric key pool. Background Art

[0002] In a global quantum security environment, both the sender and the receiver have a key pool with the same key, which is securely distributed to the sender and the receiver online or offline. The following operations can be performed using the same key pool:

[0003] Key management: Since symmetric encryption algorithms use the same key for encryption and decryption, the key must be kept secure. Key pools can help securely store and manage these keys to prevent them from being leaked to unauthorized users.

[0004] Dynamic update: When a key may have been leaked or is changed regularly to improve security, a new key can be dynamically obtained from the key pool and the old key can be discarded to maintain the security of communication.

[0005] Improve encryption and decryption efficiency: Symmetric encryption algorithms are usually faster than asymmetric encryption algorithms and are suitable for processing large amounts of data. Using a key pool can quickly select keys for data encryption and decryption operations, improving efficiency.

[0006] Of course, the key pool also has functions such as key distribution and key quantity reduction. It can be seen that the key pool is very powerful, but there is currently no solution for secure communication based on the key pool, and the characteristics of the key pool cannot be better utilized. Summary of the invention

[0007] Purpose of the invention: In order to solve the relevant technical problems raised in the background technology, the present invention provides a data transmission method based on a symmetric key pool, which adopts the key pool as a resource pool for bilateral authentication communication and utilizes a specific data authentication method to ensure data integrity and non-repudiation.

[0008] Technical solution: The present invention provides a data transmission method based on a symmetric key pool, comprising the following steps:

[0009] (1) The sending end and the receiving end are both pre-set with the same total key pool and hash algorithm, and the sending end and the receiving end divide their respective total key pools into an authentication sub-key pool and a payload sub-key pool in the same proportion; the sending end and the receiving end then divide the payload key in the payload sub-key pool into equal parts according to a preset size to form a plurality of payload key blocks, and then number the plurality of payload key blocks;

[0010] (2) The sending end obtains the payload data, its own identity identifier DID, the first authentication key in the authentication subkey pool, and the first payload key in the payload subkey pool, and then uses a preset hash algorithm to perform a hash calculation on the identity identifier DID, the location information of the first authentication key, and the number of the first payload key to obtain a hash value H, and then uses the first authentication key to encrypt the hash value H to obtain a signature file M; then the payload data is encrypted using the first payload key to obtain a ciphertext payload, and a CRC check is performed on the ciphertext payload to generate a first CRC check code; finally, the sending end sends the identity identifier DID, the location information of the first authentication key, the number of the first payload key, the signature file M, the ciphertext payload, and the first CRC check code to form a quantum secure data packet and sends it to the receiving end;

[0011] (3) After receiving the quantum secure data packet, the receiving end parses and obtains the identity identifier DID, the location information of the first authentication key, the number of the first payload key, the signature file M, the ciphertext payload and the first CRC check code, and then uses a preset hash algorithm to perform hash calculation on the parsed identity identifier DID, the location information of the first authentication key and the number of the first payload key to obtain a hash value H′; then, the receiving end obtains the corresponding second authentication key from the local authentication subkey pool according to the parsed location information of the first authentication key, and uses the second authentication key to decrypt the parsed signature file M to obtain a hash value H″; compares the hash value H″ with the hash value H′ to see if they are the same, compares the parsed identity identifier DID with the sender identity identifier DID stored locally at the receiving end to see if they are the same, and compares the parsed first CRC check code with the second CRC check code generated by the receiving end using the same verification method as the sender to perform CRC verification on the parsed ciphertext payload to see if they are the same; if all three are the same, the parsed ciphertext payload is decrypted using the number of the first payload key to obtain the payload data; otherwise, it is returned and retransmitted.

[0012] Furthermore, the hash algorithm is a traditional hash algorithm, including one of MD4, MD5, SHA2, SHA3, RIPEMD, and MASH-1 algorithms.

[0013] Furthermore, the hash algorithm is a hash function based on a linear feedback shift register obtained by selecting an irreducible polynomial and inputting a random number.

[0014] Furthermore, the location information of the first authentication key includes an offset of the first authentication key and a length of the first authentication key to be used during encryption.

[0015] Furthermore, the specific process of encrypting the payload data using the first payload key to obtain the ciphertext payload is:

[0016] First, obtain the length of the first payload key and record it as L1, and the length of the payload data and record it as L2; ​​then, determine whether the length of the first payload key L1 is greater than or equal to the length of the payload data L2. If so, directly select a payload key with the same length as the payload data from the first payload key in order from the front to the back for 1:1 XOR encryption, so as to obtain the ciphertext payload; if not, first expand the length of the first payload key from L1 to L3 through the AES expansion algorithm, and the expanded payload key length L3 is greater than or equal to the payload data length L2, and then select a payload key with the same length as the payload data from the expanded payload key in order from the front to the back for 1:1 XOR encryption, so as to obtain the ciphertext payload.

[0017] Furthermore, the specific process of decrypting the parsed ciphertext payload using the serial number of the first payload key to obtain the payload data is:

[0018] First, the receiving end obtains the corresponding second payload key from the local payload subkey pool according to the serial number of the first payload key, obtains the length of the second payload key and records it as L4, and obtains the length of the parsed ciphertext payload and records it as L5; then, it is determined whether the second payload key length L4 is greater than or equal to the ciphertext payload length L5. If so, a payload key with the same length as the ciphertext payload is directly selected from the second payload key in order from front to back for 1:1 decryption, thereby obtaining the payload data; if not, the same AES expansion algorithm as the sending end is first used to expand the length of the second payload key from L4 to L6, and the expanded payload key length L6 is greater than or equal to the ciphertext payload length L5, and then a payload key with the same length as the ciphertext payload is selected from the expanded payload key in order from front to back for 1:1 decryption, thereby obtaining the payload data.

[0019] Furthermore, in the step (2), the sending end obtains the first payload key from the payload subkey pool in a one-industry-one-key manner or a one-time-one-key manner.

[0020] Furthermore, the preset size is one of 64 bits, 128 bits, 256 bits, 512 bits, and 1024 bits.

[0021] Beneficial effects: The sending end and the receiving end of the present invention use a key pool as a resource pool for authentication communication between the two parties, and use data authentication methods such as hash value, ciphertext and CRC check code to ensure data transmission integrity and non-repudiation; and the load key is obtained in a one-industry-one-key manner or a one-time-one-key manner. By encrypting data with it, the confidentiality and integrity of the data can be further guaranteed, and the privacy protection of user data can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0023] Figure 1 It is a structural schematic diagram of the total key pool of the present invention;

[0024] Figure 2 A flow chart of sending a quantum secure data packet by a transmitting end of the present invention;

[0025] Figure 3 This is a schematic diagram of the structure of a quantum secure data packet of the present invention;

[0026] Figure 4 This is a flow chart of a receiving end receiving load data according to the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0028] At present, the functions of the key pool are very powerful, such as: key management, dynamic update, improving encryption and decryption efficiency, key distribution, reducing the number of keys, etc. It can be seen that the functions of the key pool are very powerful, but there is currently no solution for secure communication based on the key pool, and the characteristics of the key pool cannot be better utilized. The present invention is to solve this technical problem.

[0029] In view of this, an embodiment of the present invention proposes a data transmission method based on a symmetric key pool. The method uses a key pool as a resource pool for authentication communication between the sending end and the receiving end, and uses data authentication methods such as hash value, ciphertext and CRC check code to ensure data transmission integrity and non-repudiation. The method specifically includes the following steps:

[0030] (1) Both the sending end and the receiving end are preset with the same total key pool and hash algorithm. The hash algorithm can be a traditional hash algorithm, including one of MD4, MD5, SHA2, SHA3, RIPEMD, and MASH-1 algorithms; of course, it can also be a hash function based on a linear feedback shift register obtained by selecting an irreducible polynomial and inputting a random number. The security of this hash function is determined by Increase to The hash value generated by the hash function has higher security. Then, the sending end and the receiving end divide their respective total key pools into the authentication sub-key pool and the load sub-key pool in the same proportion, such as Figure 1 As shown, the total key pool can be divided according to the actual scenario, for example: 20% as the authentication sub-key pool, 80% as the load sub-key pool, of course, it can also be divided according to the business volume, other proportions are also possible; then, the sending end and the receiving end divide the load key in the load sub-key pool into equal parts according to the preset size to form multiple load key blocks, and then number the multiple load key blocks. The purpose of the load key block numbering is to have one key for one session; the preset size is one of 64 bits, 128 bits, 256 bits, 512 bits, and 1024 bits.

[0031] (2) Figure 2 As shown, the sending end obtains the payload data, its own identity identifier DID, the first authentication key in the authentication subkey pool and the first payload key in the payload subkey pool, obtains the first payload key in the payload subkey pool in a one-industry-one-key manner or a one-time-one-key manner, and uses the payload key obtained in this manner to encrypt data, which can further ensure the confidentiality and integrity of the data and improve the privacy protection of user data; then, a preset hash algorithm is used to perform a hash calculation on the identity identifier DID, the location information of the first authentication key and the number of the first payload key to obtain a hash value H, the location information of the first authentication key includes the offset of the first authentication key and the length of the first authentication key to be used for encryption, and then the hash value H is encrypted using the first authentication key to obtain a signature file M; a general signature file is original data + key (hash), while the signature file M of the present invention adopts DID + location information of the authentication key + number of the payload key + key (hash);

[0032] Then, the payload data is encrypted by the first payload key to obtain the ciphertext payload. The specific process is as follows: first, the length of the first payload key is obtained and recorded as L1, and the length of the payload data is recorded as L2; ​​then, it is determined whether the length of the first payload key L1 is greater than or equal to the length of the payload data L2. If so, a payload key with the same length as the payload data is directly selected from the first payload key in order from the front to the back for 1:1 XOR encryption, thereby obtaining the ciphertext payload; if not, the length of the first payload key is first expanded from L1 to L3 by the AES expansion algorithm, and the expanded payload key length L3 is greater than or equal to the payload data length L2, and then a payload key with the same length as the payload data is selected from the expanded payload key in order from the front to the back for 1:1 XOR encryption, thereby obtaining the ciphertext payload. The length of the payload key is expanded by AES to achieve one-session-one-key.

[0033] Finally, the sending end performs CRC check on the ciphertext payload to generate a first CRC check code. CRC check is an existing technology and will not be described again. Figure 3 As shown, finally, the sending end sends the quantum security data packet composed of the identity identifier DID, the location information of the first authentication key, the number of the first payload key, the signature file M, the ciphertext payload and the first CRC check code to the receiving end;

[0034] (3) Figure 4 As shown, after receiving the quantum security data packet, the receiving end parses and obtains the identity identifier DID, the location information of the first authentication key, the number of the first load key, the signature file M, the ciphertext load and the first CRC check code; then uses the same hash algorithm as the sending end, that is, the preset hash algorithm, to perform hash calculation on the parsed identity identifier DID, the location information of the first authentication key and the number of the first load key to obtain a hash value H′; then, the receiving end obtains the corresponding second authentication key in the local authentication sub-key pool according to the location information of the parsed first authentication key. Since the authentication sub-key pools are the same, the second authentication key obtained according to the location information of the first authentication key is the same as the first authentication key. , and then use the second authentication key to decrypt the parsed signature file M to obtain a hash value H″; compare the hash value H″ with the hash value H′ to see if they are the same, compare the identity identifier DID of the sender obtained by parsing with the identity identifier DID of the sender stored locally by the receiving end to see if they are the same, and compare the first CRC check code obtained by parsing with the second CRC check code generated by the receiving end using the same check method as the sending end to perform a CRC check on the parsed ciphertext payload to see if they are the same. These three comparison methods can confirm the integrity and non-repudiation of data transmission; if all three are the same, the comparison is passed, and then the parsed ciphertext payload is decrypted by the number of the first payload key to obtain the payload data, otherwise it returns and retransmits;

[0035] The specific process of decrypting the parsed ciphertext payload by the serial number of the first payload key to obtain the payload data is as follows: first, the receiving end obtains the corresponding second payload key from the local payload subkey pool by the serial number of the first payload key. Since the payload subkey pool is the same, the second payload key obtained by the serial number of the first payload key is the same as the first payload key. Then, the length of the second payload key is obtained and recorded as L4, and the length of the parsed ciphertext payload is obtained and recorded as L5; then, it is determined whether the length L4 of the second payload key is greater than or equal to the length L5 of the ciphertext payload. If so, the second payload key is directly obtained by pressing the second payload key from the second payload key. Select a load key of the same length as the ciphertext load from the front to the back order for 1:1 decryption, so as to obtain the load data; if not, first use the same AES expansion algorithm as the sending end to expand the length of the second load key from L4 to L6, the expanded load key length L6 of the receiving end is the same as the expanded load key length L3 of the sending end, and the expanded load keys at both ends are also the same, and the expanded load key length L6 is greater than or equal to the ciphertext load length L5, and then select a load key of the same length as the ciphertext load from the expanded load key in the order from the front to the back for 1:1 decryption, so as to obtain the load data. It can be seen that the sending end and the receiving end of the present invention use a key pool as a resource pool for authentication communication between the two parties, and use data authentication methods such as hash value, ciphertext and CRC check code to ensure data transmission integrity and non-repudiation.

Claims

1. A data transmission method based on a symmetric key pool, characterized in that: The following steps are involved: (1) The sending end and the receiving end are both preset with the same total key pool and hash algorithm, and the sending end and the receiving end divide their respective total key pools into authentication sub-key pools and payload sub-key pools in the same proportion; the sending end and the receiving end then divide the payload key in the payload sub-key pool into equal parts according to a preset size to form multiple payload key blocks, and then number the multiple payload key blocks; (2) The sending end obtains the payload data, its own identity identifier DID, the first authentication key in the authentication subkey pool, and the first payload key in the payload subkey pool, and then uses a preset hash algorithm to perform a hash calculation on the identity identifier DID, the location information of the first authentication key, and the number of the first payload key to obtain a hash value H, and then uses the first authentication key to encrypt the hash value H to obtain a signature file M; then the payload data is encrypted using the first payload key to obtain a ciphertext payload, and the ciphertext payload is subjected to a CRC check to generate a first CRC check code; finally, the sending end sends a quantum secure data packet consisting of the identity identifier DID, the location information of the first authentication key, the number of the first payload key, the signature file M, the ciphertext payload, and the first CRC check code to the receiving end; wherein, the sending end obtains the first payload key in the payload subkey pool in a one-industry-one-key manner or a one-time-one-key manner; (3) After receiving the quantum secure data packet, the receiving end parses and obtains the identity identifier DID, the location information of the first authentication key, the number of the first payload key, the signature file M, the ciphertext payload and the first CRC check code, and then uses a preset hash algorithm to perform a hash calculation on the parsed identity identifier DID, the location information of the first authentication key and the number of the first payload key to obtain a hash value H; then, the receiving end obtains the corresponding second authentication key from the local authentication subkey pool according to the parsed location information of the first authentication key, and uses the second authentication key to decrypt the parsed signature file M to obtain a hash value H; Compare the hash value H with the hash value H to see if they are the same, compare the identity identifier DID obtained by the analysis with the sender identity identifier DID stored locally at the receiving end to see if they are the same, and compare the first CRC check code obtained by the analysis with the second CRC check code generated by the receiving end using the same verification method as the sending end to perform CRC check on the parsed ciphertext payload to see if they are the same. If all three are the same, decrypt the parsed ciphertext payload using the number of the first payload key to obtain the payload data, otherwise return and retransmit.

2. A data transmission method based on a symmetric key pool according to claim 1, characterized in that: The hash algorithm is a traditional hash algorithm, including one of MD4, MD5, SHA2, SHA3, RIPEMD, and MASH-1 algorithms.

3. A data transmission method based on a symmetric key pool according to claim 1, characterized in that: The hash algorithm is a hash function based on a linear feedback shift register obtained by selecting an irreducible polynomial and inputting a random number.

4. A data transmission method based on a symmetric key pool according to claim 1, characterized in that: The location information of the first authentication key includes an offset of the first authentication key and a length of the first authentication key to be used during encryption.

5. The data transmission method based on a symmetric key pool according to claim 1, characterized in that: The specific process of encrypting the payload data using the first payload key to obtain the ciphertext payload is as follows: First, obtain the length of the first payload key and record it as L1, and the length of the payload data and record it as L2; ​​then, determine whether the length of the first payload key L1 is greater than or equal to the length of the payload data L2. If so, directly select a payload key with the same length as the payload data from the first payload key in order from the front to the back for 1:1 XOR encryption, so as to obtain the ciphertext payload; if not, first expand the length of the first payload key from L1 to L3 through the AES expansion algorithm, and the expanded payload key length L3 is greater than or equal to the payload data length L2, and then select a payload key with the same length as the payload data from the expanded payload key in order from the front to the back for 1:1 XOR encryption, so as to obtain the ciphertext payload.

6. A data transmission method based on a symmetric key pool according to claim 5, characterized in that: The specific process of decrypting the parsed ciphertext payload using the serial number of the first payload key to obtain the payload data is as follows: First, the receiving end obtains the corresponding second payload key from the local payload subkey pool according to the serial number of the first payload key, obtains the length of the second payload key and records it as L4, and obtains the length of the parsed ciphertext payload and records it as L5; then, it is determined whether the second payload key length L4 is greater than or equal to the ciphertext payload length L5. If so, a payload key with the same length as the ciphertext payload is directly selected from the second payload key in order from front to back for 1:1 decryption, thereby obtaining the payload data; if not, the same AES expansion algorithm as the sending end is first used to expand the length of the second payload key from L4 to L6, and the expanded payload key length L6 is greater than or equal to the ciphertext payload length L5, and then a payload key with the same length as the ciphertext payload is selected from the expanded payload key in order from front to back for 1:1 decryption, thereby obtaining the payload data.

7. A data transmission method based on a symmetric key pool according to claim 1, characterized in that: The preset size is one of 64 bits, 128 bits, 256 bits, 512 bits, and 1024 bits.

Images