A communication encryption method, system, storage medium and electronic device
By using TPM chips in the telecommunications transmission network to establish root CA and sub-CA, calculate HMAC values and perform two-way authentication, the problems of identity fraud and cumbersome verification are solved, and a secure and efficient connection between the device and the management system and the device is realized.
Patent Information
- Application Number
- CN202410974736.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-07-19
- Publication Date
- 2026-02-06
- Estimated Expiration
- 2044-07-19
AI Technical Summary
In the process of network management and control of telecommunications transmission networks, when the management and control system connects with equipment and equipment connects with equipment, the methods of identity theft and verification become cumbersome, leading to a decrease in security.
Using a TPM chip as the root of trust, a root CA certificate and sub-CA are established. The TPM chip is used to create a symmetric key and calculate the HMAC value. By comparing the HMAC values, two-way authentication is performed, realizing a secure connection between the device and the management system and between the device and the management system.
It improves the security of connections between the control system and devices, and between devices themselves, simplifies the authentication process, and increases connection efficiency.
Smart Images
Figure CN118764282B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present disclosure belongs to the technical field of communication, and particularly relates to a communication encryption method, system, storage medium and electronic device. BACKGROUND
[0002] In the network management and control process of a telecommunication transmission network, the management and control system manages and controls the devices, and the connection between the devices needs to be established through broadcasting and responding. Specifically, the management and control system broadcasts a message to a specific IP segment, and the device will send a response to the IP of the management and control system after receiving the message. The management and control system receives the response of the device, and establishes a TCP connection with the device, thereby realizing the connection and management and control of the device. Similarly, the connection between the devices is established by establishing a TCP connection between the two devices through broadcasting and responding.
[0003] In the above process, the following problems may be encountered:
[0004] 1. Identity impersonation: When the management and control system and the device, and the device and the device are connected, the identity of the device and the identity of the management and control system may be impersonated, resulting in a decrease in security when the management and control system and the device, and the device and the device are connected.
[0005] 2. Complicated verification method: In the verification process, the certificate chain needs to be verified, and the certificate of the leaf node is searched layer by layer upwards until the same root node is found in the two certificate chains of the management and control system and the device, so as to determine whether the identity of the management and control system and the device is legal.
[0006] Therefore, there is an urgent need for a communication encryption method, system, storage medium and electronic device for improving security and identity verification efficiency during the connection process of the management and control system and the device, and the device and the device. SUMMARY
[0007] To solve the above problems, the present disclosure provides a communication encryption method, system, storage medium and electronic device, which can improve security and connection efficiency when establishing a connection between the management and control system and the device, and the device and the device.
[0008] The present disclosure is implemented by the following technical solutions:
[0009] In a first aspect, the present disclosure provides a communication encryption method, which comprises:
[0010] establishing a root CA certificate with a TPM chip as a root of trust, establishing a sub-CA under the root CA, creating a symmetric key using the TPM chip, and calculating the HMAC value of the root CA and the HMAC value of all sub-CAs;
[0011] According to the sub-CA to which the management and control system or device belongs, the corresponding terminal certificate and the HMAC value of the terminal certificate are sent to the management and control system or device;
[0012] The HMAC value of the device certificate required to establish a connection is received, and is compared with the theoretical HMAC value of the device certificate calculated or saved, and when the comparison result meets the preset condition, the management and control system certificate and the HMAC value of the management and control system certificate are sent to the device;
[0013] The HMAC value of the management and control system certificate returned by the management and control system is received, and is compared with the theoretical HMAC value of the management and control system certificate calculated or saved, and when the comparison result meets the preset condition, the device successfully establishes a connection.
[0014] Further,
[0015] A first public-private key pair is generated, the first public-private key pair includes a first private key and a first public key, the first private key is stored in the TPM chip and cannot be taken out; certificate information sent by the root CA is received, the first private key stored in the TPM chip is used to sign the certificate information; the signature and the first public key are sent to the root CA, and the root CA assembles the certificate information and the received signature and first public key to obtain the root CA certificate;
[0016] The first-level sub-CAs are divided under the root CA, and the second-level sub-CAs are divided under each first-level sub-CA;
[0017] The TPM chip is used to create the symmetric key, calculate the HMAC value of the root CA, the HMAC value of all first-level sub-CAs, and the HMAC value of all second-level sub-CAs.
[0018] Further,
[0019] A second public-private key pair is generated, the second public-private key pair includes a second public key and a second private key, the second private key is reserved, and the second public key is passed to the root CA, the root CA encrypts the symmetric key using the received second public key, and returns the ciphertext to the management and control system or device;
[0020] The root CA is applied for a certificate, and the HMAC value of the management and control system certificate or the HMAC value of the device certificate is calculated according to the sub-CA to which the management and control system or device belongs;
[0021] The symmetric key is used to encrypt the HMAC value of the sub-CA corresponding to the management and control system or device applying for the certificate and send it to the management and control system or device, and the management and control system certificate and the HMAC value of the management and control system certificate or the device certificate and the HMAC value of the device certificate are sent to the management and control system or device applying for the certificate.
[0022] Further,
[0023] The device is found and a TCP connection is established, and the device certificate and the HMAC value of the device certificate sent by the device are received;
[0024] The theoretical HMAC value of the device certificate is calculated and compared with the received HMAC value of the device certificate;
[0025] When the comparison result of the theoretical HMAC value of the device certificate and the received HMAC value of the device certificate is the same, the corresponding management system certificate and the HMAC value of the management system certificate are sent to the device.
[0026] Further,
[0027] The theoretical HMAC value of the management system certificate is calculated or called, and the theoretical HMAC value of the management system certificate is compared with the received HMAC value of the management system certificate;
[0028] When the comparison result of the theoretical HMAC value of the management system certificate and the received HMAC value of the management system certificate is the same, the device successfully establishes a connection.
[0029] Further,
[0030] The first device discovers the second device and establishes a TCP connection, and the first device receives the HMAC value of the management system sub-CA sent by the second device;
[0031] It is judged whether the HMAC value of the management system sub-CA corresponding to the second device and the HMAC value of the management system sub-CA corresponding to the first device meet a preset condition, and when the preset condition is met, the first device sends a second device connection request to the corresponding management system.
[0032] Further,
[0033] The HMAC value of the root CA certificate is set as HMAC0; wherein HMAC0=(K, root CA certificate);
[0034] The HMAC value of the first-level sub-CA is set as HMAC1 x; wherein HMAC1 x=(K, HMAC0+first-level sub-CA certificate), x=1, 2, …, n, wherein n is the number of first-level sub-CAs;
[0035] The HMAC value of the second-level sub-CA is set as HMAC2 y; wherein HMAC2 y=(K, HMAC1 x+second-level sub-CA certificate), y=1, 2, 3, …, m, wherein m is the number of second-level sub-CAs;
[0036] Wherein, K is the symmetric key.
[0037] In a second aspect, the embodiments of the present disclosure provide a communication encryption system, comprising: a root CA and a TPM chip;
[0038] the root CA, used for assembling a root CA certificate, establishing a sub-CA, and creating a first public-private key pair and a symmetric key using the TPM chip;
[0039] the TPM chip, used as a trust root of the root CA, storing a first private key of the first public-private key pair in the TPM chip and being inextractable, and calculating an HMAC value of the root CA and HMAC values of all sub-CAs.
[0040] In a third aspect, the embodiments of the present disclosure provide a computer storage medium, storing one or more programs, wherein,
[0041] When the one or more programs are executed, the communication encryption method described in any one of the above can be implemented.
[0042] In a fourth aspect, the embodiments of the present disclosure provide an electronic device, comprising a processor, a communication interface, a computer readable storage medium described above, and a communication bus; wherein the processor, the communication interface, and the computer readable storage medium communicate with each other through the communication bus.
[0043] The processor is configured to execute the program stored in the computer readable storage medium.
[0044] The processor is configured to execute the program stored in the computer readable storage medium.
[0045] Compared with the prior art, the present disclosure has the following advantages:
[0046] 1. The management and control system and the device, and the device and the device, when establishing a connection, compare the HMAC value corresponding to the management and control system and the HMAC value corresponding to the device to determine whether the condition for establishing a connection is met, thereby improving security and eliminating the cumbersome process of searching from the certificate of a leaf node to an upper layer in the traditional mode.
[0047] 2. The TPM chip is used as a trust root of the root CA, and the TPM chip is used to store the private key of the asymmetric key, calculate and store the symmetric key, calculate the HMAC value corresponding to the management and control system and the HMAC value corresponding to the device, thereby improving the security of the hardware environment in the communication encryption process.
[0048] Other features and advantages of the present disclosure will be described in the following description, and some will become apparent from the description, or will be learned through implementation of the present disclosure. The purpose and other advantages of the present disclosure can be achieved and obtained through the structure indicated in the specification, claims, and drawings. BRIEF DESCRIPTION OF DRAWINGS
[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative effort based on these drawings.
[0050] Figure 1 The flowchart of the communication encryption method in the embodiments of the present disclosure is shown in FIG. 1.
[0051] Figure 2 The flowchart of establishing the root CA certificate in the embodiments of the present disclosure is shown in FIG. 2.
[0052] Figure 3 The structural diagram of the root CA and the sub-CA in the embodiments of the present disclosure is shown in FIG. 3.
[0053] Figure 4 The flowchart of the device and the management system obtaining the certificate and the HMAC value in the embodiments of the present disclosure is shown in FIG. 4.
[0054] Figure 5 The flowchart of the device and the management system establishing connection in the embodiments of the present disclosure is shown in FIG. 5.
[0055] Figure 6 The flowchart of the device and the device establishing connection in the embodiments of the present disclosure is shown in FIG. 6. DETAILED DESCRIPTION
[0056] In order to make the objects, technical solutions and advantages of the embodiments of the present disclosure clearer, the following will combine the drawings in the embodiments of the present disclosure to make a clear and complete description of the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are some of the embodiments of the present disclosure, but not all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the present disclosure.
[0057] Figure 1 The flowchart of the communication encryption method in the embodiments of the present disclosure is shown in FIG. 1. Figure 1 As shown in FIG. 1, the communication encryption method in the embodiments of the present disclosure comprises:
[0058] S1: Establishing the root CA certificate with the TPM chip as the root of trust; establishing the sub-CA under the root CA; creating the symmetric key using the TPM chip, and calculating the HMAC value of the root CA and the HMAC value of all sub-CA.
[0059] Specifically, the root CA takes the TPM chip as a root of trust, and creates a symmetric key using the TPM chip, thereby improving the security in the communication encryption process. The root CA is a highest-level certificate authority (CA), and can be regarded as a logical entity. In actual work, the construction of the root CA, the root CA issuing a root CA certificate, and the establishment of a sub-CA under the root CA, etc. usually need to be completed in combination of hardware and software, for example, a server in combination with a certificate authority software.
[0060] S2: According to the sub-CA to which the management and control system or device belongs, the corresponding terminal certificate and the HMAC value of the terminal certificate are sent to the management and control system or device.
[0061] Specifically, the management and control system and the device correspond to respective sub-CAs, and when the management and control system and the device apply for a certificate, the certificate needs to be applied for under the corresponding sub-CA. The root CA sends the corresponding terminal certificate and the HMAC value of the terminal certificate to the management and control system and the device. The management and control system receives the terminal certificate and the HMAC value of the terminal certificate thereof, and the device receives the terminal certificate and the HMAC value of the terminal certificate thereof. Meanwhile, the device can also receive and save the HMAC value of the sub-CA of the management and control system corresponding thereto, and when the device is connected with another device, whether to establish a connection can be determined by judging the HMAC value of the sub-CA of the management and control system.
[0062] S3: The HMAC value of the certificate of the device needing to establish a connection is received, and is compared with the theoretical HMAC value of the certificate of the device calculated or saved. When the comparison result meets a preset condition, the management and control system certificate and the HMAC value of the management and control system certificate are sent to the device.
[0063] Specifically, in order to improve the security in the communication process, two-way authentication is implemented in the embodiment of the disclosure. The management and control system receives the HMAC value of the certificate of the device needing to establish a connection, judges, and when the comparison result meets a preset condition, the management and control system sends the HMAC value of the management and control system certificate to the device applying for establishing a connection.
[0064] S4: The HMAC value of the management and control system certificate returned by the management and control system is received, and is compared with the theoretical HMAC value of the management and control system certificate calculated or saved. When the comparison result meets a preset condition, the device successfully establishes a connection.
[0065] Specifically, the device receives the management system certificate and its HMAC value. The device calculates the theoretical HMAC value of the management system certificate and compares it with the received HMAC value. If the comparison results are the same, bidirectional authentication between the device and the management system is completed, and a secure connection is established. If the device has the corresponding HMAC value of the management system certificate stored, it can directly use the stored HMAC value without calculation. Steps S3 and S4 are also required when connecting devices.
[0066] In some examples, a root CA certificate is established using a TPM chip as the root of trust; sub-CAs are established under the root CA; a symmetric key is created using the TPM chip, and the HMAC value of the root CA and all sub-CAs are calculated, specifically including:
[0067] S11: Generate the first public-private key pair, which includes a first private key and a first public key. Store the first private key in the TPM chip and do not remove it. Receive the certificate information sent by the root CA and sign the certificate information using the first private key stored in the TPM chip. Send the signature and the first public key to the root CA, and the root CA will assemble the certificate information and the received signature and the first public key to obtain the root CA certificate.
[0068] Specifically, Figure 2 This is a schematic diagram of the process for establishing a root CA certificate in an embodiment of this disclosure, as follows: Figure 2 As shown, the root CA sends certificate information to the TPM chip. This certificate information may include information about the certificate authority, the certificate holder, and the certificate's validity period. The TPM chip generates an asymmetric key consisting of a first public-private key pair (P, V). The first private key V is stored in the TPM chip and cannot be retrieved; the first public key P can be retrieved and used in the subsequent root CA certificate creation process. The TPM chip uses the stored first private key V to sign the certificate information and sends the signature and the first public key P to the root CA. The signature using the first private key V verifies the root CA certificate holder's identity, and the first public key P verifies the authenticity of the signature using the first private key V. The root CA assembles the certificate information, the received signature, and the first public key P to obtain an X.509 certificate, which is the root CA certificate.
[0069] S12: Divide the root CA into first-level sub-CAs, and divide each first-level sub-CA into second-level sub-CAs.
[0070] Specifically, when establishing a Level 1 sub-CA, the division is based on hardware and software. In this embodiment, the Level 1 sub-CA is divided into a management system sub-CA and a device sub-CA. Both management system sub-CAs and device sub-CAs are established, and certificates for each are applied for. When establishing a Level 2 sub-CA, the division is based on the business model. In this embodiment, the management system sub-CA is further divided into OTN management system sub-CAs, PTN management system sub-CAs, and hybrid management system sub-CAs as Level 2 sub-CAs. Certificates for each are applied for. Similarly, the device sub-CA is divided into OTN device sub-CAs, PTN device sub-CAs, and hybrid device sub-CAs as Level 2 sub-CAs. Certificates for each are applied for. It is understood that the number and level of sub-CAs can be changed depending on the actual situation.
[0071] S13: Use the TPM chip to create a symmetric key and calculate the HMAC value of the root CA, the HMAC values of all first-level sub-CAs, and the HMAC values of all second-level sub-CAs.
[0072] Specifically, the root CA uses a TPM chip to create a symmetric key. First, the HMAC value of the root CA is calculated, and then the HMAC values of the sub-CAs are calculated level by level. The HMAC value of the root CA certificate is set as HMAC0, where HMAC0 = (K, root CA certificate); the HMAC value of the first-level sub-CA is set as HMAC1x, where HMAC1x = (K, HMAC0 + first-level sub-CA certificate), and x = 1, 2 to n, where n is the actual number of first-level sub-CAs; the HMAC value of the second-level sub-CA is set as HMAC2y, where HMAC2y = (K, HMAC1x + second-level sub-CA certificate), and y = 1, 2, 3 to m, where m is the actual number of second-level sub-CAs. This process continues, calculating the HMAC value of each sub-CA level starting from the root CA. Here, K is the symmetric key.
[0073] Figure 3 This is a schematic diagram of the structure of the root CA and sub-CA in an embodiment of this disclosure, as shown below. Figure 3 As shown in this embodiment, it includes a primary sub-CA and a secondary sub-CA. The primary sub-CA includes a control system sub-CA and a device sub-CA. The secondary sub-CA includes an OTN control system sub-CA, a PTN control system sub-CA, and a hybrid control system sub-CA, as well as an OTN device sub-CA, a PTN device sub-CA, and a hybrid device sub-CA. The specific calculation method for the HMAC value of each sub-CA, starting from the root CA and calculating layer by layer, is as follows:
[0074] Firstly, the HMAC value of the root CA certificate is calculated, and the HMAC value of the root CA is HMAC0, HMAC0 = HMAC(K, root CA certificate).
[0075] Then, the HMAC value of each first-level sub-CA is calculated, the HMAC value of the management system sub-CA is HMAC11, HMAC11 = HMAC(K, HMAC0 + management system sub-CA certificate); the HMAC value of the device sub-CA is HMAC12, HMAC12 = HMAC(K, HMAC0 + device sub-CA certificate).
[0076] Finally, the HMAC value of the second-level sub-CA is calculated, the HMAC value of the OTN management system sub-CA is HMAC21, HMAC21 = HMAC(K, HMAC11 + OTN management system sub-CA certificate); the HMAC value of the PTN management system sub-CA is HMAC22, HMAC22 = HMAC(K, HMAC11 + PTN management system sub-CA certificate); the HMAC value of the mixed management system sub-CA is HMAC23, HMAC23 = HMAC(K, HMAC11 + mixed management system sub-CA certificate); the HMAC value of the OTN device second-level sub-CA is HMAC24, HMAC24 = HMAC(K, HMAC12 + OTN device sub-CA certificate); the HMAC value of the PTN device second-level sub-CA is HMAC25, HMAC25 = HMAC(K, HMAC12 + PTN device sub-CA certificate); and the HMAC value of the mixed device second-level sub-CA is HMAC26, HMAC26 = HMAC(K, HMAC12 + mixed device sub-CA certificate). Wherein, K is a symmetric key.
[0077] In some examples, Figure 4 The flowchart for obtaining the certificate and the HMAC value of the device and the management system in the embodiment of the present disclosure is shown in FIG. 2. Figure 4 As shown in FIG. 2, according to the sub-CA to which the management system or the device belongs, the corresponding terminal certificate and the HMAC value of the terminal certificate are sent to the management system or the device, which specifically includes:
[0078] S21: generating a second public-private key pair, the second public-private key pair including a second public key and a second private key, reserving the second private key, and passing the second public key to the root CA, the root CA encrypting the symmetric key using the received second public key and returning the ciphertext to the management system or the device.
[0079] Specifically, the device or the management system applying for the certificate generates a respective second public-private key pair, and obtains the symmetric key through the second public key in the interaction between the device and the root CA and the interaction between the management system and the root CA.
[0080] It should be noted that the first public key and the first private key are included in the first public-private key pair, and the first public-private key pair is used in establishing the root CA certificate. The second public key and the second private key are included in the second public-private key pair, and the second public-private key pair is used in applying for the management system certificate by the management system and in applying for the device certificate by the device.
[0081] S22: Apply for a certificate to the root CA, and calculate the HMAC value of the management system certificate or the HMAC value of the device certificate according to the sub-CA to which the management system or the device belongs.
[0082] Specifically, after obtaining the symmetric key, the management system and the device applying for the certificate apply for a certificate to the root CA. The root CA calculates the HMAC value of the management system certificate or the HMAC value of the device certificate according to the sub-CA to which the management system or the device belongs. With reference to Figure 3 , the calculation method of the HMAC value of the management system certificate and the HMAC value of the device certificate is similar to the HMAC value of the sub-CA described above. The management system certificate and the device certificate are both terminal certificates, and the HMAC value of the terminal certificate is set as HMAC3z, HMAC3z=(K, HMAC value of the sub-CA corresponding to the terminal certificate + terminal certificate), z=1, 2, 3, …, j, where j is the actual number of terminal certificates. Taking the calculation of the HMAC value of the OTN management system certificate and the HMAC value of the OTN device certificate as an example, the HMAC value of the OTN management system certificate is HMAC31, HMAC31=(K, HMAC21+OTN management system certificate), and the HMAC value of the OTN device certificate is HMAC32, HMAC32=(K, HMAC24+OTN device certificate), where K is the symmetric key.
[0083] S23: Use the symmetric key to encrypt the HMAC value of the sub-CA corresponding to the management system or the device applying for the certificate and send it to the management system or the device, and send the management system certificate and the HMAC value of the management system certificate or the device certificate and the HMAC value of the device certificate to the management system or the device applying for the certificate.
[0084] Specifically, the root CA uses the symmetric key to encrypt the HMAC value of the sub-CA corresponding to the management system or the device applying for the certificate, and sends the management system certificate and the HMAC value of the management system certificate or the device certificate and the HMAC value of the device certificate to the management system or the device applying for the certificate. The management system or the device applying for the certificate decrypts the symmetric key obtained in step S21 to obtain the HMAC value of the corresponding sub-CA.
[0085] In order to make the step S2 more clear, the following is an example of the process of the management system and the device corresponding to the second-level sub-CA applying for a certificate to the root CA, which is further described in detail.
[0086] With reference toFigure 4 The secondary sub-CA included in the embodiments of the present disclosure includes an OTN management system sub-CA and an OTN device sub-CA.
[0087] When the OTN management system wants to obtain the certificate, the OTN management system generates a second public-private key pair (P2, V2), the second private key V2 is saved by the OTN management system itself, and the second public key P2 is sent to the root CA. After the root CA encrypts the symmetric key K using the received second public key P2, the ciphertext is sent to the OTN management system, the OTN management system decrypts the ciphertext using the second private key V2 to obtain the symmetric key K and saves it. The OTN management system applies for a certificate to the root CA, the root CA determines the secondary sub-CA to which the management system belongs according to the business form of the management system, and the OTN management system applies for a certificate under the OTN management system sub-CA; the root CA calculates the HMAC value of the OTN management system certificate, and sends the HMAC value of the OTN management system sub-CA, the OTN management system certificate and the HMAC value of the OTN management system certificate to the OTN management system. At this time, the HMAC value of the OTN management system certificate is HMAC31; after the OTN management system receives the HMAC value of the OTN management system sub-CA encrypted by the symmetric key K, the symmetric key K is decrypted using the previously saved symmetric key K to obtain HMAC21.
[0088] When the OTN device wants to obtain the certificate, the OTN device generates a second public-private key pair (P1, V1), the second private key V1 is saved by the OTN device itself, and the second public key P1 is sent to the root CA. After the root CA encrypts the symmetric key K using the received second public key P1, the ciphertext is sent to the OTN device, the OTN device decrypts the ciphertext using the second private key V1 to obtain the symmetric key K and saves it. The OTN device applies for a certificate to the root CA, the root CA determines the secondary sub-CA to which the device belongs according to the business form of the device, and the OTN device applies for a certificate under the OTN device sub-CA. Fill in the SN number of the device in the applied certificate; the root CA calculates the HMAC value of the OTN device certificate, and sends the HMAC value of the OTN device sub-CA, the OTN device certificate and the HMAC value of the OTN device certificate to the OTN device. At this time, the HMAC value of the OTN device certificate is HMAC32; after the OTN device receives the HMAC value of the OTN device sub-CA encrypted by the symmetric key K, the symmetric key K is decrypted using the previously saved symmetric key K to obtain HMAC24.
[0089] In some examples, as shown in Figure 5 the HMAC value of the device certificate required to establish a connection is received, and compared with the theoretical HMAC value of the device certificate calculated or saved, and when the comparison result meets the preset condition, the management system certificate and the HMAC value of the management system certificate are sent to the device, specifically including:
[0090] S31: discover the device and establish a TCP connection, receive the device certificate and the HMAC value of the device certificate sent by the device.
[0091] Specifically, the management and control system discovers the device that needs to establish a connection, establishes a TCP connection, and receives the device certificate and the HMAC value of the device certificate sent by the device.
[0092] S32: calculate the theoretical HMAC value of the device certificate and compare it with the received HMAC value of the device certificate.
[0093] Specifically, the management and control system verifies the received device certificate, calculates the theoretical HMAC value of the device certificate, and compares the received HMAC value of the device certificate with the calculated theoretical HMAC value of the device certificate.
[0094] S33: when the comparison result of the theoretical HMAC value of the device certificate and the received HMAC value of the device certificate is the same, send the corresponding management and control system certificate and the HMAC value of the management and control system certificate to the device.
[0095] Specifically, after comparing the calculated theoretical HMAC value of the device certificate with the received HMAC value of the device certificate, the management and control system obtains the same comparison result, and sends its own management and control system certificate and the HMAC value of the device certificate to the device; if the comparison result is different, the management and control system and the device fail to establish a connection.
[0096] In some examples, as shown in Figure 5 the HMAC value of the management and control system certificate returned by the management and control system is received and compared with the calculated or saved theoretical HMAC value of the management and control system certificate, and when the comparison result meets the preset condition, the device successfully establishes a connection, specifically including:
[0097] S41: calculate or call the theoretical HMAC value of the management and control system certificate, and compare the theoretical HMAC value of the management and control system certificate with the received HMAC value of the management and control system certificate.
[0098] Specifically, the device calculates or directly calls the saved theoretical HMAC value of the management and control system certificate, and compares the theoretical HMAC value of the management and control system certificate with the received HMAC value of the management and control system certificate.
[0099] S42: when the comparison result of the theoretical HMAC value of the management and control system certificate and the received HMAC value of the management and control system certificate is the same, the device successfully establishes a connection.
[0100] Specifically, when the comparison result of the theoretical HMAC value of the management system certificate and the received HMAC value of the management system certificate is the same, the bidirectional authentication of the device and the management system is completed, at this time, the device and the management system establish a secure connection, and can connect with other devices under the management system.
[0101] In order to make the steps S3 and S4 more clear, in the embodiment of the disclosure, the OTN management system and the OTN device are taken as examples for specific description.
[0102] The OTN management system corresponds to the second-level sub-CA of the management system, and the HMAC value of the OTN management system sub-CA is HMAC21; the OTN device corresponds to the second-level sub-CA of the device, and the HMAC value of the OTN device sub-CA is HMAC24. The HMAC value of the OTN management system certificate is HMAC31, and the HMAC value of the OTN device certificate is HMAC32.
[0103] The OTN management system discovers the OTN device, and the OTN management system receives the OTN device certificate and HMAC32 sent by the OTN device. The OTN management system calculates the theoretical HMAC value of the OTN device certificate, compares the calculated theoretical HMAC value of the OTN device certificate with the received HMAC32, and when the comparison result is the same, the OTN management system sends the certificate of the OTN management system and HMAC31 to the OTN device. The OTN device calculates the theoretical HMAC value of the OTN management system certificate, compares the calculated theoretical HMAC value of the OTN management system certificate with the received HMAC31, and when the comparison result is the same, the bidirectional authentication is successful, and the device successfully establishes a connection with the management system. It can be understood that the management system can save the theoretical HMAC value of the corresponding device certificate, and the device can also save the theoretical HMAC value of the management system certificate, so as to save the calculation step, when the saved theoretical HMAC value is the same as the received HMAC value, and the bidirectional authentication is completed, the connection is allowed to be established.
[0104] In some examples, when the device connects with the device, the HMAC value is also used for bidirectional authentication to determine whether it meets the condition for establishing a connection. When the second device connects with the first device, the first device and the second device first determine whether it meets the condition for establishing a connection, when it meets the condition for establishing a connection, the second device applies to the management system corresponding to the first device to establish a connection, and then the first device and the second device complete the connection.
[0105] In some examples, as Figure 6As shown, the device sub-CA receiving the HMAC value of the device requiring to establish a connection, and compared with the calculated or saved device sub-CA theoretical HMAC value, when the comparison result meets the preset condition, the device sends the management system certificate and the management system sub-CA HMAC value before, also includes:
[0106] S31': the first device discovers the second device and establishes a TCP connection, and the first device receives the HMAC value of the management system sub-CA sent by the second device.
[0107] Specifically, when the second device wants to connect with the first device, the first device discovers the second device and establishes a TCP connection. The second device sends the HMAC value of the management system sub-CA corresponding to the second device to the first device. Among them, the first device and the second device save the HMAC value of the management system sub-CA corresponding to each other.
[0108] S32': determine whether the HMAC value of the management system sub-CA corresponding to the second device meets the preset condition with the HMAC value of the management system sub-CA corresponding to the first device, and when the preset condition is met, the first device sends a connection request of the second device to the corresponding management system.
[0109] Specifically, the first device receives the HMAC value of the management system sub-CA sent by the second device, and compares it with the HMAC value of the management system sub-CA corresponding to the first device. When the comparison result meets the preset condition, the first device sends a connection request of the second device to the corresponding management system. When the comparison result does not meet the preset condition, the second device fails to establish a connection. Among them, the preset condition includes the same, also includes some specific conditions.
[0110] In the embodiment of the present disclosure, the device also needs to be controlled by the corresponding management system when the device is connected with the device. During the process of device and device communication, the HMAC value is also judged, and the bidirectional authentication is realized. The following is a further specific description taking the first device as an OTN device as an example.
[0111] As Figure 6As shown, taking the first device as an OTN device and the second device as a PTN device as an example, wherein the OTN device corresponds to an OTN management system, and the HMAC value of the CA of the OTN management system is HMAC21; the PTN device corresponds to a PTN management system, and the HMAC value of the CA of the PTN management system is HMAC22. The OTN device discovers the PTN device and establishes a TCP connection. The OTN device receives the HMAC22 of the CA of the PTN management system sent by the PTN device. The OTN device compares the received HMAC22 sent by the PTN device with the HMAC21 of the CA of the OTN management system saved by the OTN device. Since the PTN device and the OTN device are two types of services, the HMAC values of the corresponding management system CAs are different, and thus the two do not meet the preset condition. Therefore, the PTN device, i.e., the second device, fails to establish a connection.
[0112] With reference to the foregoing Figure 6 As shown, taking the first device as an OTN device and the second device as a hybrid device as an example, wherein the OTN device corresponds to an OTN management system, and the HMAC value of the CA of the OTN management system is HMAC21; the hybrid device corresponds to a hybrid management system, and the HMAC value of the CA of the hybrid management system is HMAC23. The OTN device discovers the hybrid device and establishes a TCP connection. The OTN device receives the HMAC23 of the CA of the hybrid management system sent by the hybrid device. The OTN device compares the received HMAC23 sent by the hybrid device with the HMAC21 of the CA of the OTN management system saved by the OTN device. Since the service of the hybrid device contains the service of the OTN device, the two meet the preset condition, and thus the hybrid device, i.e., the second device, successfully establishes a connection. When the hybrid device is connected with the OTN device, the hybrid device and the OTN device determine that the condition for establishing a connection is met. The hybrid device applies to the OTN management system corresponding to the OTN device for establishing a connection, and thus the OTN device and the hybrid device complete the connection.
[0113] The communication encryption method in the embodiments of the present disclosure has the following advantages:
[0114] 1. When the management system and the device, or the device and the device establish a connection, the corresponding HMAC value of the management system and the corresponding HMAC value of the device are compared to determine whether the condition for establishing a connection is met, thereby improving the security and saving the cumbersome process of searching from the certificate of a leaf node to an upper layer in the traditional mode.
[0115] 2. The TPM chip is used as a root CA of trust, and the TPM chip is used to store the private key of an asymmetric key, calculate and store a symmetric key, and calculate the corresponding HMAC value of the management system and the corresponding HMAC value of the device, thereby improving the security of the hardware environment in the communication encryption process.
[0116] In a second aspect, based on the same inventive concept, the embodiments of the present disclosure further provide a communication encryption system corresponding to the above method, the communication encryption system comprising: a root CA and a TPM chip. The root CA is configured to assemble a root CA certificate, establish a sub-CA, and create a first public-private key pair and a symmetric key using the TPM chip. The TPM chip is configured to act as a root of trust of the root CA, store a first private key of the first public-private key pair in the TPM chip and be inextractable, and calculate an HMAC value of the root CA and HMAC values of all sub-CAs.
[0117] In a third aspect, based on the same inventive concept, the embodiments of the present disclosure further provide a computer-readable storage medium storing one or more programs, which when executed, can implement the above communication encryption method.
[0118] In a fourth aspect, based on the same inventive concept, the embodiments of the present disclosure further provide a device comprising a processor, a communication interface, a memory and a communication bus. The processor, the communication interface and the memory communicate with each other through the communication bus. The processor is configured to execute the program stored in the computer-readable storage medium.
[0119] It should be noted that the electrical connection between the above-mentioned various units does not necessarily mean the connection between the lines, the indirect connection mode, as long as the purpose of the present disclosure can be achieved, which is applicable to the embodiments of the present disclosure.
[0120] Although the present disclosure has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalent replacements; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present disclosure.
Claims
1. A method of communication encryption, characterized by, The method comprises: The method comprises: According to the sub-CA to which the management system or device belongs, the corresponding terminal certificate and the HMAC value of the terminal certificate are sent to the management system or device; The HMAC value of the device certificate required for connection establishment is received, and the theoretical HMAC value of the device certificate calculated or saved is compared, and when the comparison result meets the preset condition, the management system certificate and the HMAC value of the management system certificate are sent to the device; The HMAC value of the management system certificate returned by the management system is received, and the theoretical HMAC value of the management system certificate calculated or saved is compared, and when the comparison result meets the preset condition, the device successfully establishes a connection; The method comprises: A first public-private key pair is generated, the first public-private key pair comprising a first private key and a first public key, the first private key is stored in the TPM chip and cannot be taken out, certificate information sent by the root CA is received, the first private key stored in the TPM chip is used to sign the certificate information, and the signature and the first public key are sent to the root CA, and the root CA assembles the certificate information and the received signature and first public key to obtain the root CA certificate; The first-level sub-CAs are divided under the root CA, and the second-level sub-CAs are divided under each first-level sub-CA; The symmetric key is created using the TPM chip, and the HMAC value of the root CA, the HMAC value of all first-level sub-CAs, and the HMAC value of all second-level sub-CAs are calculated.
2. The method of claim 1, wherein, The method comprises: A second public-private key pair is generated, the second public-private key pair comprising a second public key and a second private key, the second private key is reserved, and the second public key is passed to the root CA, the root CA encrypts the symmetric key using the received second public key, and returns the ciphertext to the management system or device; The certificate is applied to the root CA, and the HMAC value of the management system certificate or the HMAC value of the device certificate is calculated according to the sub-CA to which the management system or device belongs; The symmetric key is used to encrypt the HMAC value of the sub-CA corresponding to the management system or device applying for the certificate and send it to the management system or device, and the management system certificate and the HMAC value of the management system certificate or the device certificate and the HMAC value of the device certificate are sent to the management system or device applying for the certificate.
3. The method of claim 1, wherein, The method comprises: The device is found and a TCP connection is established, a device certificate and an HMAC value of the device certificate sent by the device are received; A theoretical HMAC value of the device certificate is calculated and compared with the received HMAC value of the device certificate; When the comparison result of the theoretical HMAC value of the device certificate and the received HMAC value of the device certificate is the same, the corresponding management system certificate and the HMAC value of the management system certificate are sent to the device.
4. The method of claim 1, wherein, The received HMAC value of the management system certificate returned by the management system is compared with the calculated or saved theoretical HMAC value of the management system certificate, and when the comparison result meets the preset condition, the device successfully establishes a connection, including: The theoretical HMAC value of the management system certificate is calculated or called, and the theoretical HMAC value of the management system certificate is compared with the received HMAC value of the management system certificate; When the comparison result of the theoretical HMAC value of the management system certificate and the received HMAC value of the management system certificate is the same, the device successfully establishes a connection.
5. The method of claim 1, wherein, The received HMAC value of the device sub-CA needing to establish a connection is compared with the calculated or saved theoretical HMAC value of the device sub-CA, and when the comparison result meets the preset condition, before sending the management system certificate and the HMAC value of the management system sub-CA to the device, it further includes: The first device discovers the second device and establishes a TCP connection, and the first device receives the HMAC value of the management system sub-CA sent by the second device; It is judged whether the HMAC value of the management system sub-CA corresponding to the second device meets the preset condition with the HMAC value of the management system sub-CA corresponding to the first device, and when the preset condition is met, the first device sends a connection request of the second device to the corresponding management system.
6. The method of claim 1, wherein, The HMAC value of the root CA, the HMAC value of all first-level sub-CAs and the HMAC value of all second-level sub-CAs are calculated, including: The HMAC value of the root CA certificate is set as HMAC0; wherein HMAC0=(K, root CA certificate); The HMAC value of the first-level sub-CA is set as HMAC1x; wherein HMAC1x=(K, HMAC0+first-level sub-CA certificate), x=1, 2, …, n, wherein n is the number of first-level sub-CAs; The HMAC value of the second-level sub-CA is set as HMAC2y; wherein HMAC2y=(K, HMAC1x+second-level sub-CA certificate), y=1, 2, 3, …, m, wherein m is the number of second-level sub-CAs; Wherein K is the symmetric key.
7. A communication encryption system for implementing the method of any one of claims 1 to 6, characterized in that, The communication encryption system includes a root CA and a TPM chip; The root CA is used to assemble a root CA certificate, establish a sub-CA, and create a first public-private key pair and a symmetric key using the TPM chip; The TPM chip is used as the root of trust of the root CA, stores the first private key of the first public-private key pair in the TPM chip and cannot be taken out, and calculates the HMAC value of the root CA and the HMAC value of all sub-CAs.
8. A computer storage medium storing one or more programs, wherein when the one or more programs are executed, the communication encryption method of any one of claims 1-6 can be implemented. 9.An electronic device comprising a processor, a communication interface, the computer readable storage medium of claim 8, and a communication bus; wherein, The processor, the communication interface and the computer readable storage medium communicate with each other through a communication bus. It is characterized in that, The processor is configured to execute the program stored in the computer readable storage medium.
Citation Information
Patent Citations
Digital certificate verification method, apparatus and device, and computer readable storage medium
CN116938466A
Method and system for creating and checking the validity of device certificates
US20170054566A1