An efficient key management system for integrated security gateway system

Abstract

The invention discloses an efficient key management system for an integrated security gateway system, and specifically relates to the technical field of key management, including a payload monitoring module, a key generation module, a key backup and recovery module, and a key signature verification module; the invention uses a deep packet inspection technology to analyze network traffic in real time, uses Wireshark to capture data packets, and performs detailed inspections through a DPI system; the process includes data packet capture, filtering, analysis, and reporting of abnormal traffic; the payload calculation is based on a weight coefficient and a CPU acquisition length, and is compared with a threshold to evaluate the network security status; the key generation module uses a high-intensity algorithm to create a key pair, and performs signature processing to ensure secure transmission; the backup and recovery module is responsible for the secure storage and recovery of the key; and the signature verification module ensures the authenticity of the key and prevents data leakage; the system strengthens network security protection and ensures the integrity and security of data transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of key management, and more particularly to an efficient key management system for an integrated security gateway system. Background Art

[0002] The comprehensive security gateway system simplifies the management and maintenance of security equipment by integrating multiple security functions, reduces security investment costs, and improves the efficiency and reliability of security protection; its core lies in modern cryptographic technology, which provides users with secure remote access services for internal networks or applications, as well as end-to-end data security transmission and secure access between the LANs of various branch offices of the enterprise.

[0003] With the vigorous development of information technology, the network has become an important infrastructure for enterprise operations. As an important part of the enterprise network, the integrated security gateway system plays a key role in protecting internal enterprise data and resisting external network threats. However, network attacks are becoming increasingly cunning and complex, and traditional security protection measures can no longer meet current security needs. Key management is the cornerstone of data security, and its importance is self-evident. The integrated security gateway can not only perform in-depth detection and filtering of network traffic to prevent malicious traffic from entering, but also monitor outbound traffic to prevent the leakage of sensitive information.

[0004] However, it still has some shortcomings in actual use. For example, the existing key management systems often have problems such as insufficient security in generation, storage, transmission and use, and cannot adapt to the rapidly changing network environment and escalating security challenges. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, an embodiment of the present invention provides an efficient key management system for an integrated security gateway system to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] Payload Monitoring Module: used to monitor and analyze payloads in real time through deep packet inspection technology; identifying abnormal payloads and potential attacks;

[0008] Key generation module: used to generate a key pair using a high-strength encryption algorithm, select the key length and sign the key pair, and transmit the signed key to the key backup and recovery module;

[0009] Key backup and recovery module: regularly backs up keys to secure offline storage devices, provides key recovery mechanism, and transmits the backed-up keys to the key exchange module;

[0010] Key signature verification module: used to perform signature verification on the exchanged key and operate according to the instructions after signature verification.

[0011] Preferably, in the payload monitoring module, a network traffic analyzer Wireshark is used to capture and analyze the data packets transmitted through the network interface; then a DPI system is deployed to check the content and payload of the data packets; the methods for capturing and checking the data packets are specifically as follows:

[0012] Start packet capture, monitor the specified network interface in real time, and collect the data packets transmitted through the network; use a filter for traffic screening during the capture process, and the traffic screening includes filtering specific IP addresses, protocols, and ports to reduce the scale of the captured data packets; after the capture is completed, save the data packets as a.pcap file for subsequent analysis; use the packet analysis tool Wireshark to open the captured data packet file; in the tool interface, view the list of captured data packets; each data packet usually contains information such as timestamp, source address, destination address, protocol type, and length; click on a specific data packet to view its detailed information, including: packet header: including Ethernet header, IP header, and transport layer header; the specific data content transmitted in the data packet; perform protocol parsing on the data packet to understand the structure and content of the data packet; during the analysis, the specific meanings and data of each protocol field can be viewed; for the TCP protocol, multiple data packets can be reassembled into a complete stream to help understand the interaction process and content.

[0013] Wireshark provides a "TCP stream reassembly" function; use color highlighting and filtering functions to identify abnormal traffic and abnormal payloads; for specific protocols, view the transmitted content to identify suspicious data and malicious traffic; organize the inspection results into a report, including the problems found, suspicious traffic, and analysis conclusions.

[0014] Preferably, in the key generation module, the method for generating the key is specifically as follows:

[0015] Parameter determination: Parameters need to be determined before key generation, and the parameters include large prime numbers f, h, generator g, and key length; the calculation method of the generator g is specifically as follows:

[0016] , where g represents the generator, f represents the first large prime number, h represents the second large prime number, mod represents the modulo operation, j represents any positive integer less than , and e represents the natural constant;

[0017] Private key and public key generation: After the parameters are determined, generate the private key and public key; randomly select an integer x as the private key through pseudo-randomness, satisfying 0 < x < h; then the calculation method of the public key parameters is as follows:

[0018] , where y represents the public key parameter, g represents the generator, x represents the private key, f represents the first large prime number, and mod represents the modular operation;

[0019] The public key is represented as , the private key is x; the key length is 2048 bits.

[0020] Sign the key. The specific signing method is as follows:

[0021] Select a random integer n, and the calculation method of the first signature element is as follows:

[0022] ,in, represents the first signature element, g represents the generator, n represents an integer, e represents a natural constant, f represents the first large prime number, h represents the second large prime number, and mod represents the modular operation;

[0023] The calculation method of the second signature element is specifically as follows:

[0024] ,in, is represented as the second signature element, n is represented as an integer, Represented as a hashed generator, Represented as a private key, Represented as the first signature element, It is represented as the second large prime number, and mod is represented as the modular operation;

[0025] The first signature element and the second signature element form a signature, and the signature is expressed as .

[0026] Preferably, in the key backup and recovery module, the key backup method is specifically:

[0027] Before performing an incremental backup, perform a complete full backup; a full backup contains all the data in the system and provides a baseline for incremental backups. During each incremental backup, the system needs to detect all changes since the last backup, including new, modified, and deleted data; use the file's timestamp, checksum, and version number to determine which data has changed.

[0028] Back up the detected changed data and store it in the backup medium; record the metadata of the changes so that these changes can be correctly identified and applied during the recovery process; maintain and update the backup index, record the timestamp of each backup, data changes, and backup dependencies.

[0029] Preferably, in the key signature verification module, the signature verification method is specifically:

[0030] After the receiver receives the key with the signature, he verifies and If the value range of The value range is ,and The value range is , then the first verification passes;

[0031] The calculation method of the verification value is as follows:

[0032] , where Z represents the verification value and g represents the generator. is represented as the first verification parameter, y is represented as the public key parameter, represents the second verification parameter, mod represents the modular operation, f represents the first large prime number, and h represents the second large prime number;

[0033] The calculated verification value is compared with the first signature element. If the calculated verification value is equal to the first signature element, the signature verification is successful and the key has not been attacked. If the calculated verification value is not equal to the first signature element, the signature verification fails, the key has been attacked, the data has been leaked, and an early warning is initiated.

[0034] Technical effects and advantages of the present invention:

[0035] The present invention provides an efficient key management system for an integrated security gateway system, which analyzes network traffic in real time through a payload monitoring module and deep packet inspection technology, identifies abnormal loads and potential attacks; uses Wireshark to capture data packets and saves them as .pcap files for subsequent analysis. The payload calculation method includes parameters such as the weight coefficient of historical measurement values ​​and the load judgment factor, and issues corresponding instructions after comparison with a preset threshold; the key generation module uses a high-intensity encryption algorithm to generate a key pair and perform signature processing, which is transmitted to a key backup and recovery module for incremental backup; the key signature verification module is responsible for verifying the exchanged key signature to ensure that the key has not been attacked; through the above modules and steps, a high-intensity encryption algorithm and a strict key management strategy are used to ensure the security of the key during generation, storage, transmission and use, and prevent unauthorized access and tampering. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 It is a schematic diagram of system module connection of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] See also Figure 1 As shown, the present invention provides an efficient key management system for an integrated security gateway system, which includes a payload monitoring module, a key generation module, a key backup and recovery module, and a key signature verification module.

[0039] The effective load monitoring module is connected to the key generation module, the key generation module is connected to the key backup and recovery module, and the key backup and recovery module is connected to the key signature verification module.

[0040] The payload monitoring module is used to monitor and analyze the payload in real time through deep packet inspection technology; identify abnormal payloads and potential attacks;

[0041] In the payload monitoring module, a network traffic analyzer Wireshark is used to capture and analyze data packets transmitted through a network interface; a DPI system is then deployed to check the content and payload of the data packets; the method of capturing and checking data packets is specifically as follows:

[0042] Start packet capture, monitor the specified network interface in real time, and collect data packets transmitted through the network; use filters to filter traffic during the capture process, which includes filtering specific IP addresses, protocols, and ports to reduce the size of captured data packets; after completing the capture, save the data packets as .pcap files for subsequent analysis; use the packet analysis tool Wireshark to open the captured data packet file; in the tool interface, view the captured data packet list; each data packet usually contains timestamp, source address, destination address, protocol type, length and other information; click on a specific data packet to view its detailed information, including: data packet header: including Ethernet header, IP header, transport layer header; specific data content transmitted in the data packet; perform protocol parsing on the data packet to understand the structure and content of the data packet; during the analysis, the specific meaning and data of each protocol field can be viewed; for the TCP protocol, multiple data packets can be reassembled into a complete stream to help understand the interaction process and content;

[0043] Wireshark provides the "TCP stream reassembly" function; uses color highlighting and filtering functions to identify abnormal traffic and abnormal loads; for specific protocols, it can view the content of the transmission to identify suspicious data and malicious traffic; and organizes the inspection results into a report, including the problems found, suspicious traffic, and analysis conclusions;

[0044] The effective load is calculated as follows:

[0045] ,in, Represented as a payload, Expressed as the weight coefficient of historical measurements, It is represented as the gateway performance measurement value at time t, L is the CPU acquisition length, It is expressed as load judgment factor;

[0046] The calculation method of the load judgment factor is as follows:

[0047] ,in, It is expressed as the load judgment factor, L is the CPU acquisition length, It is represented by the load value of the gateway numbered b. It is represented by the number of CPUs with gateway number b;

[0048] The calculation method of the weight coefficient of historical measurement values ​​is as follows:

[0049] ,in, It is represented as the weight coefficient of the historical measurement value, and L is the CPU acquisition length;

[0050] The calculated payload is compared with the preset payload threshold. If the calculated payload is greater than the preset payload threshold, a dangerous instruction is issued, transferred to the key generation module, and the transmitted data is encrypted; if the calculated payload is less than the preset payload threshold, a safe instruction is issued and the operation continues.

[0051] The key generation module is used to generate a key pair using a high-intensity encryption algorithm, select the key length and sign the key pair, and transmit the signed key to the key backup and recovery module;

[0052] In the key generation module, the key generation method is specifically as follows:

[0053] Parameter determination: Parameters need to be determined before key generation. The parameters include large prime numbers f and h, generator g, and key length. The calculation method of generator g is as follows:

[0054] , where g is the generator, f is the first large prime number, h is the second large prime number, mod is the modulo operation, j is any positive integer less than and e is the natural constant;

[0055] Private key and public key generation: After the parameters are determined, generate the private key and public key; randomly select an integer x as the private key through pseudo-randomness, satisfying 0 < x < h; then the calculation method of the public key parameters is specifically:

[0056] , where y represents the public key parameter, g represents the generator, x represents the private key, f represents the first large prime number, and mod represents the modulo operation;

[0057] Then the public key is expressed as , and the private key is x; select a 2048-bit key for the key length.

[0058] Perform signature processing on the key, and the specific method of signature processing is:

[0059] Select a random integer n, and the calculation method of the first signature element is specifically:

[0060] , where represents the first signature element, g represents the generator, n represents the integer, e represents the natural constant, f represents the first large prime number, h represents the second large prime number, and mod represents the modulo operation;

[0061] The calculation method of the second signature element is specifically:

[0062] , where represents the second signature element, n represents the integer, represents the generator after hash processing, represents the private key, represents the first signature element, represents the second large prime number, and mod represents the modulo operation;

[0063] Combine the first signature element and the second signature element to form a signature, and the signature is expressed as .

[0064] The key backup and recovery module is used to periodically perform incremental backup of the key to a secure offline storage device, provide a key recovery mechanism, and transmit the backed-up key to the key exchange module;

[0065] In the key backup and recovery module, the method of key backup is specifically:

[0066] Before performing an incremental backup, perform a complete full backup; a full backup contains all the data in the system and provides a baseline for incremental backups. During each incremental backup, the system needs to detect all changes since the last backup, including new, modified, and deleted data; use the file's timestamp, checksum, and version number to determine which data has changed.

[0067] Back up the detected changed data and store it in the backup medium; record the metadata of the changes so that these changes can be correctly identified and applied during the recovery process; maintain and update the backup index, record the timestamp of each backup, data changes, and backup dependencies;

[0068] The specific method of the recovery process is:

[0069] Import the full backup data into the target system to ensure data integrity; apply all incremental backups one by one in chronological order. Each incremental backup should be applied on the basis of the previous incremental backup; ensure that the order of incremental backups is consistent with the timestamps when the backups were made. When restoring, start with the earliest incremental backup and gradually apply backwards until the latest incremental backup.

[0070] Record the timestamp of each incremental backup for verification during the recovery process; after applying each incremental backup, merge the data to ensure that the new data is correctly integrated with the existing data; then perform a data consistency check to ensure that the restored data is consistent with the data at the time of backup to avoid data loss or inconsistency.

[0071] The key signature verification module is used to perform signature verification on the exchanged key and perform operations according to the instructions after signature verification;

[0072] In the key signature verification module, the signature verification method is specifically as follows:

[0073] After the receiver receives the key with the signature, he verifies and If the value range of The value range is ,and The value range is , then the first verification is passed, and the first verification parameter is calculated. The specific calculation method of the first verification parameter is:

[0074] ,in, Represented as the first verification parameter, It is represented by the hashed generator, u is represented by the first verification parameter influencing factor, Represented as the second largest prime number;

[0075] The calculation method of the first verification parameter influencing factor is specifically as follows:

[0076] , where u represents the verification parameter influencing factor, It represents the second signature element, h represents the second large prime number, and mod represents the modular operation;

[0077] The calculation method of the second verification parameter is specifically as follows:

[0078] ,in, Represented as the second verification parameter, It is represented as the first signature element, u is represented as the verification parameter influencing factor, h is represented as the second large prime number, and mod is represented as the modular operation;

[0079] The calculation method of the verification value is as follows:

[0080] , where Z represents the verification value and g represents the generator. is represented as the first verification parameter, y is represented as the public key parameter, represents the second verification parameter, mod represents the modular operation, f represents the first large prime number, and h represents the second large prime number;

[0081] The calculated verification value is compared with the first signature element. If the calculated verification value is equal to the first signature element, the signature verification is successful and the key has not been attacked. If the calculated verification value is not equal to the first signature element, the signature verification fails, the key has been attacked, the data has been leaked, and an early warning is initiated.

[0082] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An efficient key management system for an integrated security gateway system, characterized in that: Including: Payload monitoring module: used to monitor and analyze the payload in real time through deep packet inspection technology; identify abnormal payloads and potential attacks; In the payload monitoring module, the network traffic analyzer Wireshark is used to capture and analyze the data packets transmitted through the network interface; then the DPI system is deployed to check the content and payload of the data packets; The specific calculation method of the payload is as follows: ,in, Represented as a payload, Expressed as the weight coefficient of historical measurements, It is represented as the gateway performance measurement value at time t, L is the CPU acquisition length, It is expressed as load judgment factor; The specific calculation method of the load judgment factor is as follows: ,in, It is expressed as the load judgment factor, L is the CPU acquisition length, It is represented by the load value of the gateway numbered b. It is represented by the number of CPUs with gateway number b; The specific calculation method of the weight coefficient of the historical measurement value is as follows: ,in, It is represented as the weight coefficient of the historical measurement value, and L is the CPU acquisition length; Compare the calculated payload with the preset payload threshold. If the calculated payload is greater than the preset payload threshold, a danger instruction is issued, and it is transferred to the key generation module, and the transmitted data is encrypted; if the calculated payload is less than the preset payload threshold, a security instruction is issued and the operation continues Key generation module: used to generate a key pair using a high-strength encryption algorithm, select the key length and sign the key pair, and transmit the signed key to the key backup and recovery module; In the key generation module, the specific method of key generation is as follows: Parameter determination: Parameters need to be determined before key generation. The parameters include large prime numbers f, h, generator g, and key length; the specific calculation method of the generator g is as follows: , where g represents the generator, f represents the first large prime number, h represents the second large prime number, mod represents the modular operation, and j represents any number less than A positive integer, e is represented as a natural constant; Private key and public key generation: After the parameters are determined, the private key and public key are generated; a random integer x is pseudo-randomly selected as the private key, satisfying 0 < x < h; then the calculation method of the public key parameters is as follows: , where y represents the public key parameter, g represents the generator, x represents the private key, f represents the first large prime number, and mod represents the modular operation; The public key is represented as , the private key is x; the key length is 2048 bits; Sign the key, and the specific method of signature processing is as follows: Select a random integer n, and the calculation method of the first signature element is as follows: ,in, represents the first signature element, g represents the generator, n represents an integer, e represents a natural constant, f represents the first large prime number, h represents the second large prime number, and mod represents the modular operation; The calculation method of the second signature element is as follows: ,in, is represented as the second signature element, n is represented as an integer, and H(v) is represented as the generator after hash processing. Represented as a private key, Represented as the first signature element, It is represented as the second large prime number, and mod is represented as the modular operation; The first signature element and the second signature element form a signature, and the signature is expressed as ; Key backup and recovery module: used to incrementally back up the key to a secure offline storage device regularly, provide a key recovery mechanism, and transmit the backed-up key to the key exchange module; Key signature verification module: used to verify the signature of the exchanged key and operate according to the instruction after signature verification; In the key signature verification module, the specific method of signature verification is as follows: After the receiver receives the key with the signature, he verifies and If the value range of The value range is ,and The value range is , then the first verification is passed, and the first verification parameter is calculated. The specific calculation method of the first verification parameter is: ,in, is represented as the first verification parameter, H(v) is represented as the generator after hash processing, and u is represented as the influencing factor of the first verification parameter. Represented as the second largest prime number; The calculation method of the second verification parameter is as follows: ,in, Represented as the second verification parameter, It is represented as the first signature element, u is represented as the verification parameter influencing factor, h is represented as the second large prime number, and mod is represented as the modular operation; The calculation method of the verification value is as follows: , where Z represents the verification value and g represents the generator. is represented as the first verification parameter, y is represented as the public key parameter, represents the second verification parameter, mod represents the modular operation, f represents the first large prime number, and h represents the second large prime number; Compare the calculated verification value with the first signature element. If the calculated verification value is equal to the first signature element, the signature verification is successful and the key has not been attacked; if the calculated verification value is not equal to the first signature element, the signature verification fails, the key has been attacked, the data is leaked, and the early warning is started.

2. The efficient key management system for an integrated security gateway system according to claim 1, characterized in that: In the key backup and recovery module, the specific method of key backup is as follows: Before performing incremental backup, a complete full backup is first performed; the full backup contains all the data of the system and provides a benchmark for incremental backup; in each incremental backup, the system needs to detect all changes since the last backup, including newly added, modified, and deleted data; Use the timestamp, checksum, and version number of the file to determine which data has changed; Back up the detected changed data and store it in the backup medium; Record the metadata of the changes so that these changes can be correctly identified and applied during the recovery process; Maintain and update the backup index to record the timestamp of each backup, data changes, and backup dependencies.

Images