Rail transit communication method and system based on national secret algorithm and identity authentication

Abstract

The present invention relates to a rail transit communication method and system based on a national secret algorithm and identity authentication. When communicating, the device to be communicated establishes an SSL connection with a central service through a national secret personal certificate and a communication private key generated by its local IP address and hardware information. The device to be communicated and the central service then use the hardware information of other broadcast control devices in the group where the device to be communicated is located to form a first identity authentication private key and a second identity authentication private key, and encrypt the original text of the verification data to form a first ciphertext and a second ciphertext. The central service performs consistency verification on the first ciphertext and the second ciphertext to achieve identity authentication of the device to be communicated. After completing an SSL connection based on a national secret algorithm with the device to be communicated, the present invention uses the hardware information of the online device in the group during communication to form an identity authentication private key, performs secondary authentication on the identity authenticity of the device to be communicated, and avoids rail transit communication security risks caused by the leakage of the national secret certificate on the device.

Description

Technical Field

[0001] The present invention relates to the field of rail transit data security technology, and in particular to a rail transit communication method and method based on national secret algorithm and identity authentication. Background Art

[0002] Rail transit data security is an important part of ensuring the normal operation of urban rail transit systems.

[0003] Currently, on rail transit lines, data is exchanged between the central service of the passenger service system and the broadcast control equipment at stations and trains using TCP. The broadcast control equipment acts as a TCP server to receive data. When the central service needs to issue a service instruction, it connects to the broadcast control equipment as a TCP client. After completing the TCP handshake, the central service sends the data instruction to the broadcast control equipment. Currently, during the TCP data exchange between the central service and the broadcast control equipment at stations and trains, data is not processed and is transmitted in plain text, making it virtually insecure.

[0004] While traditional SSL communication enhances TCP and provides data security, the broadcast control device, acting as a TCP server, persistently stores the certificates and private keys necessary for establishing SSL connections. If the device is compromised, these certificates and private keys are at risk of being stolen. If stolen, the entire passenger service system's communication system becomes insecure.

[0005] Therefore, the current data transmission in rail transit still has problems such as data transmission using plain text, poor security, and the easy leakage of certificates and private keys during identity authentication, which may lead to security risks in the communication system. Summary of the Invention

[0006] In order to solve the technical problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a rail transit data exchange method based on national secret algorithm and identity authentication to ensure the data exchange security of broadcast control equipment in the rail transit system.

[0007] To achieve the above-mentioned purpose, the present invention provides a rail transit communication method based on a national secret algorithm and identity authentication, comprising the following steps:

[0008] Step S1: Group multiple broadcast control devices, obtain the IP address and hardware information of the broadcast control devices in each group, and save them in the central service;

[0009] Step S2: When the broadcast control device needs to communicate with the central service, the communication device obtains the IP addresses and hardware information of other broadcast control devices in the group;

[0010] Step S3: The device to be communicated generates a communication private key using its local IP address and hardware information;

[0011] Step S4: The communication device establishes SSL communication with the central service through the communication private key and the national secret personal certificate;

[0012] Step S5: The communication device generates a first identity authentication private key based on the IP addresses and hardware information of other broadcast control devices in the group;

[0013] Step S6: The communication device encrypts the original verification data according to the first identity authentication private key to generate a first ciphertext, and sends the original verification data and the first ciphertext to the central service;

[0014] Step S7: The central service obtains the IP addresses and hardware information of other broadcast control devices in the group based on the IP address of the device to be communicated and the IP address and hardware information of the broadcast control device stored by the central service, generates a second identity authentication private key, and encrypts the original verification data to generate a second ciphertext;

[0015] Step S8: The central service verifies the consistency of the first ciphertext and the second ciphertext;

[0016] Step S9: When the first ciphertext and the second ciphertext are consistent, the central service returns the verification result to the device to be communicated, and the device to be communicated and the central service perform data transmission based on the national secret algorithm; otherwise, the connection between the central service and the device to be communicated is disconnected.

[0017] According to a technical solution of the present invention, in step S2, the device to be communicated sends an ARP broadcast to other broadcast control devices in its group, and the other broadcast control devices in the group of the device to be communicated return their IP addresses and hardware information to the device to be communicated.

[0018] According to a technical solution of the present invention, the IP address and hardware information of the broadcast control device are unique.

[0019] According to a technical solution of the present invention, the generation rule of the communication private key is: splicing the IP address and hardware information of the device to be communicated, performing SHA256 calculation on the spliced string to form a string with a length of 32 bytes; if the length of the spliced string exceeds 32 bytes, the first 32 characters are taken; if the length of the spliced string is less than 32 characters, it is padded with 0.

[0020] According to a technical solution of the present invention, the generation rule of the identity authentication private key is: the IP addresses and hardware information of other broadcast control devices in the group where the communication device is located are spliced in sequence, and the SHA256 calculation is performed on the spliced string to form a string with a length of 32 bytes; if the length of the spliced string exceeds 32 bytes, the first 32 characters are taken; if the length of the spliced string is less than 32 characters, the group is filled with 0.

[0021] According to a technical solution of the present invention, the original verification data is a random character string.

[0022] According to one aspect of the present invention, a system is provided for implementing the above-mentioned rail transit communication method based on national encryption algorithm and identity authentication, including the broadcast control device, the station and the central service, the broadcast control device is communicatively connected to the station, and the station is communicatively connected to the central service.

[0023] According to a technical solution of the present invention, the central service includes:

[0024] Business service, used to obtain the IP addresses and hardware information of other broadcast control devices in the group according to the IP address of the device to be communicated, and generate the second identity authentication private key;

[0025] The national encryption back-end service is used to establish SSL communication with the device to be communicated through the national encryption personal certificate and the communication private key, use the second identity authentication private key to encrypt the original text of the verification data to generate a second ciphertext, verify the consistency of the first ciphertext and the second ciphertext, return the verification result to the device to be communicated based on the consistency of the verification result, and disconnect from the device to be communicated based on the inconsistency of the verification result.

[0026] Compared with the prior art, the present invention has the following beneficial effects:

[0027] The present invention proposes a rail transit communication method and system based on national secret algorithm and identity authentication. By grouping multiple broadcast control devices under the station into the same group, when the communication device is connected to the central service, a communication private key is first generated according to the hardware information and IP address of the communication device itself, and the national secret personal certificate and communication private key are used to establish an SSL connection based on the national secret certificate with the central service. Then, the hardware information and IP address of other devices in the group are used to generate an identity authentication private key, and the identity authenticity of the communication device is secondary authenticated, thereby enhancing the security of SSL communication, avoiding the security risk of the rail transit communication system caused by the leakage of the national secret certificate and private key of the broadcast control device, and thus improving the data security of rail transit.

[0028] The present invention obtains the IP address and hardware information of the online device in the group through ARP broadcast before the communication device exchanges with the central service, realizes the device address information exchange mechanism in the group, relies on the information of other devices in the group during identity authentication to generate a temporary identity authentication private key, forms an identity authentication private key tamper-proof mechanism, and ensures the security of the identity authentication private key. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be derived from these drawings without inventive effort.

[0030] Figure 1 Schematically showing a flow chart of a rail transit communication method based on a national secret algorithm and identity authentication according to one embodiment of the present invention;

[0031] Figure 2 A timing diagram schematically illustrates a rail transit communication method based on a national encryption algorithm and identity authentication according to an embodiment of the present invention;

[0032] Figure 3 The figure schematically shows the structure of a rail transit communication system based on national encryption algorithm and identity authentication according to one embodiment of the present invention. DETAILED DESCRIPTION

[0033] The description of the embodiments in this specification should be combined with the corresponding drawings, which should be considered a complete part of this specification. In the drawings, the shapes and thicknesses of the embodiments may be exaggerated and indicated for simplicity or convenience. Furthermore, the various structural components in the drawings will be described separately. It is worth noting that components not shown in the drawings or not described in words are known to those of ordinary skill in the art.

[0034] The description of the embodiments herein and any references to directions and orientations are for ease of description only and are not to be construed as limiting the scope of the present invention. The following description of the preferred embodiments may involve combinations of features, which may exist independently or in combination. The present invention is not specifically limited to the preferred embodiments. The scope of the present invention is defined by the claims.

[0035] like Figure 1 As shown, a rail transit communication method based on a national secret algorithm and identity authentication of the present invention includes the following steps:

[0036] Step S1: Group multiple broadcast control devices, obtain the IP address and hardware information of the broadcast control devices in each group, and save them in the central service;

[0037] Step S2: When the broadcast control device needs to communicate with the central service, the communication device obtains the IP addresses and hardware information of other broadcast control devices in the group;

[0038] Step S3: The communication device generates a communication private key using its local IP address and hardware information;

[0039] Step S4: The communication device establishes SSL communication with the central service through the communication private key and the national secret personal certificate;

[0040] Step S5: The communication device generates a first identity authentication private key based on the IP addresses and hardware information of other broadcast control devices in the group;

[0041] Step S6: The communication device encrypts the original verification data using the first identity authentication private key to generate a first ciphertext, and sends the original verification data and the first ciphertext to the central service;

[0042] Step S7: The central service obtains the IP addresses and hardware information of other broadcast control devices in the group based on the IP address of the device to be communicated and the IP address and hardware information of the broadcast control device stored by the central service, generates a second identity authentication private key, and encrypts the original verification data to generate a second ciphertext;

[0043] Step S8: The central service verifies the consistency of the first ciphertext and the second ciphertext;

[0044] Step S9: When the first ciphertext and the second ciphertext are consistent, the central service returns the verification result to the device to be communicated, and the device to be communicated and the central service perform data transmission based on the national secret algorithm; otherwise, the connection between the central service and the device to be communicated is disconnected.

[0045] This invention utilizes the IP addresses and hardware information of the broadcast control device and its grouped devices to add an ARP protocol to the SSL communication process to obtain information exchange mechanisms from other devices within the group. Furthermore, after the broadcast control device and the central service successfully establish a connection and handshake via SSL communication, a secondary identity verification of the broadcast control device is added. This enhances the security of SSL communication and effectively avoids rail transit communication system security risks caused by the leakage of the broadcast control device's national secret certificate and private key. Furthermore, identity verification relies on the generation of temporary private keys from other devices within the group, providing a tamper-proof mechanism for the private key used during identity verification and ensuring the security of the authentication private key.

[0046] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0047] like Figure 2 and Figure 3 As shown, this embodiment provides a system for implementing a rail transit communication method based on a national secret algorithm and identity authentication, including broadcast control equipment, stations and central services, the broadcast control equipment is communicatively connected to the stations, and the stations are communicatively connected to the central services.

[0048] Specifically, the central service includes business services and national encryption backend services. The business service is used to obtain the hardware information of other broadcast control devices in the group based on the IP address of the device to be communicated, generate a second authentication private key, and encrypt the original verification data to generate a second ciphertext. The national encryption backend service is used to establish SSL communication with the device to be communicated using the national encryption personal certificate and the national encryption communication private key, verify the consistency of the first and second ciphertexts, and return the verification result to the device to be communicated if the verification results are consistent. If the verification results are inconsistent, the connection with the device to be communicated is disconnected.

[0049] By connecting with the communication equipment through the national secret back-end service, the broadcast control equipment that has not undergone identity authentication can be prevented from directly accessing the business services of the central service. The national secret back-end service forms a data security protection barrier, further improving the security of rail transit data transmission.

[0050] The rail transit communication method based on the national secret algorithm and identity authentication provided in this embodiment specifically includes the following steps:

[0051] Step S1: Group multiple broadcast control devices, obtain the IP address and hardware information of the broadcast control devices in each group, and save them in the central service;

[0052] The central service organizes multiple broadcast control devices into the same group based on the fact that they belong to the same station. The central service obtains the IP addresses and hardware information of the multiple broadcast control devices as well as the grouping status and saves them.

[0053] The hardware information of the broadcast control device includes the system name, hard disk number, network card MAC address, and CPU number. The IP address and hardware information of the broadcast control device are unique. That is, each broadcast control device has a unique IP address and system name, hard disk number, network card MAC address, and CPU number.

[0054] The central service stores the IP addresses and hardware information of all broadcast control devices, and updates their online status in real time based on the working conditions of the broadcast control devices in each station.

[0055] Step S2: When the broadcast control device needs to communicate with the central service, the communication device obtains the IP addresses and hardware information of other broadcast control devices in the group;

[0056] Specifically, when a broadcast control device needs to establish communication with the central service, the broadcast control device in need of communication (called the target device) sends an ARP broadcast to the other broadcast control devices in its group. The other broadcast control devices in the target device's group then return their IP addresses and hardware information to the target device. The hardware information returned by the other broadcast control devices in the group can be one or more of the system name, hard drive number, network card MAC address, and CPU number. In this embodiment, only the MAC address is returned.

[0057] Step S3: The communication device generates a communication private key using its local IP address and hardware information;

[0058] The rules for generating the communication private key are as follows: concatenate the IP address and hardware information of the communication device, perform SHA256 calculation on the concatenated string to form a 32-byte string; if the concatenated string is longer than 32 bytes, take the first 32 characters; if the concatenated string is less than 32 characters, fill it with 0.

[0059] Step S4: The communication device establishes SSL communication with the central service through the communication private key and the national secret personal certificate;

[0060] Each broadcast control device permanently retains its own exclusive national secret personal certificate. The national secret personal certificate can be used together with the generated communication private key to establish a national secret-level SSL communication connection between the communication device and the national secret back-end service of the central service, and to shake hands with the national secret back-end service.

[0061] Step S5: The communication device generates a first identity authentication private key based on the IP addresses and hardware information of other broadcast control devices in the group;

[0062] The rules for generating the authentication private key are as follows: the IP addresses and hardware information of other broadcast control devices in the group where the communication device is located are concatenated in sequence, and the SHA256 calculation is performed on the concatenated string to form a string with a length of 32 bytes; if the length of the concatenated string exceeds 32 bytes, the first 32 characters are taken; if the length of the concatenated string is less than 32 characters, the group is padded with 0.

[0063] The device to be communicated sequentially concatenates the IP addresses and MAC addresses received from other devices in the group through ARP broadcast to obtain a first authentication private key;

[0064] Step S6: The communication device encrypts the original verification data using the first identity authentication private key to generate a first ciphertext, and sends the original verification data and the first ciphertext to the central service;

[0065] The communication device uses the first identity authentication private key to encrypt the original verification data to generate a first ciphertext. The original verification data is a constant character string with randomness and can be randomly generated by a data generation algorithm.

[0066] Step S7: The central service obtains the IP addresses and hardware information of other broadcast control devices in the group based on the IP address of the device to be communicated and the IP address and hardware information of the broadcast control device stored by the central service, generates a second identity authentication private key, and encrypts the original verification data to generate a second ciphertext;

[0067] The central service sends the first ciphertext and original verification data from the device to be communicated to the National Cryptography Backend Service and Business Service, respectively, and synchronizes the IP address of the device to be communicated with the Business Service. Based on the IP address of the device to be communicated and the IP address, hardware information, and grouping of the broadcast control devices stored by the central service, the Business Service obtains the IP addresses and hardware information of other broadcast control devices in the group of the device to be communicated. Based on the authentication private key generation rules, the Business Service generates a second authentication private key, encrypts the original verification data, generates a second ciphertext, and synchronizes the second ciphertext to the National Cryptography Backend Service.

[0068] Step S8: The central service verifies the consistency of the first ciphertext and the second ciphertext;

[0069] The national cryptography backend service verifies the consistency of the first ciphertext and the second ciphertext.

[0070] Step S9: When the first ciphertext and the second ciphertext are consistent, the central service returns the verification result to the device to be communicated, and the device to be communicated and the central service perform data transmission based on the national secret algorithm; otherwise, the connection between the central service and the device to be communicated is disconnected.

[0071] When the first ciphertext and the second ciphertext are consistent, the national cryptographic backend service returns the verification result to the device to be communicated, and the device to be communicated transmits data with the business service; otherwise, the national cryptographic backend service actively disconnects from the device to be communicated to prevent the device to be communicated from invading the rail transit system through the connection with the central service, thereby ensuring the communication and data security of the rail transit system.

[0072] Furthermore, it should be noted that the present invention may be provided as a method, apparatus, or computer program product. Thus, embodiments of the present invention may take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention may take the form of a computer program product embodied on one or more computer-usable storage media containing computer-usable program code.

[0073] The embodiments of the present invention are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0074] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device, so that a series of operation steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0075] It should also be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or terminal device comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or terminal device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or terminal device comprising the element.

[0076] Finally, it should be noted that the above is a preferred embodiment of the present invention. It should be noted that although the preferred embodiment of the present invention has been described, it is clear that those skilled in the art, once they understand the basic inventive concept of the present invention, can make various improvements and modifications without departing from the principles of the present invention. Such improvements and modifications should also be considered as within the scope of protection of the present invention. Therefore, the appended claims are intended to be interpreted as including the preferred embodiment and all changes and modifications that fall within the scope of the embodiments of the present invention.

Claims

1. A rail transit communication method based on national secret algorithm and identity authentication, characterized in that: The following steps are involved: Step S1: Group multiple broadcast control devices, obtain the IP address and hardware information of the broadcast control devices in each group, and save them in the central service; Step S2: When the broadcast control device needs to communicate with the central service, the communication device obtains the IP addresses and hardware information of other broadcast control devices in the group; Step S3: The device to be communicated generates a communication private key using its local IP address and hardware information; Step S4: The communication device establishes SSL communication with the central service through the communication private key and the national secret personal certificate; Step S5: The communication device generates a first identity authentication private key based on the IP addresses and hardware information of other broadcast control devices in the group; Step S6: The communication device encrypts the original verification data according to the first identity authentication private key to generate a first ciphertext, and sends the original verification data and the first ciphertext to the central service; Step S7: The central service obtains the IP addresses and hardware information of other broadcast control devices in the group based on the IP address of the device to be communicated and the IP address and hardware information of the broadcast control device stored by the central service, generates a second identity authentication private key, and encrypts the original verification data to generate a second ciphertext; Step S8: The central service verifies the consistency of the first ciphertext and the second ciphertext; Step S9: When the first ciphertext and the second ciphertext are consistent, the central service returns a verification result to the communication device, and the communication device and the central service perform data transmission based on the national secret algorithm; Otherwise, disconnect the central service from the device to be communicated; The generation rule of the communication private key is as follows: the IP address and hardware information of the device to be communicated are concatenated, and the concatenated string is subjected to SHA256 calculation to form a string with a length of 32 bytes; if the length of the concatenated string exceeds 32 bytes, the first 32 characters are taken; if the length of the concatenated string is less than 32 characters, it is padded with 0; The authentication private key generation rules of the first authentication private key and the second authentication private key are: the IP addresses and hardware information of the other broadcast control devices in the group where the communication device is located are spliced in sequence, and the SHA256 calculation is performed on the spliced string to form a string with a length of 32 bytes; if the length of the spliced string exceeds 32 bytes, the first 32 characters are taken; if the length of the spliced string is less than 32 characters, the group is filled with 0.

2. The rail transit communication method based on national secret algorithm and identity authentication according to claim 1 is characterized in that: In step S2, the device to be communicated sends an ARP broadcast to the other broadcast control devices in its group, and the other broadcast control devices in the group of the device to be communicated return their IP addresses and hardware information to the device to be communicated.

3. The rail transit communication method based on national secret algorithm and identity authentication according to claim 1 is characterized in that: The IP address and hardware information of the broadcast control device are unique.

4. The rail transit communication method based on national secret algorithm and identity authentication according to claim 1 is characterized in that: The original text of the verification data is a random character string.

5. A system for implementing the rail transit communication method based on national secret algorithm and identity authentication as described in any one of claims 1 to 4, characterized in that: It includes the broadcast control equipment, stations and the central service. Since each station has multiple broadcast control equipment, multiple broadcast control equipment at the same station are grouped together. The broadcast control equipment is communicated with the station, and the station is communicated with the central service.

6. The system according to claim 5, characterized in that The center's services include: Business service, used to obtain the IP addresses and hardware information of other broadcast control devices in the group according to the IP address of the device to be communicated, and generate the second identity authentication private key; The national encryption back-end service is used to establish SSL communication with the device to be communicated through the national encryption personal certificate and the communication private key, use the second identity authentication private key to encrypt the original text of the verification data to generate a second ciphertext, verify the consistency of the first ciphertext and the second ciphertext, return the verification result to the device to be communicated based on the consistency of the verification result, and disconnect from the device to be communicated based on the inconsistency of the verification result.

Images