Implementation method of high-speed data secure transmission based on counter mode

Abstract

The invention discloses a method for realizing high-speed data security transmission based on a counter mode, comprising: a security module establishes a two-way authentication connection with a security gateway, the security module initiates a master key request to the security gateway, and simultaneously sends an IP address to the security gateway; the security gateway distributes the master key to the security module; the security module and the security gateway respectively calculate random numbers based on the master key and adopt a counter mode, and then store them in an uplink session key queue and a downlink session key queue; when a terminal accesses a server, the security module extracts a session key from the uplink session key queue, and encrypts and protects the privacy of uplink data; the security gateway retrieves the corresponding master key based on the IP address, extracts the session key from the corresponding uplink session key queue based on the master key, decrypts the uplink data, and forwards the decrypted plaintext data to the server; the invention can ensure the credibility and security of high-speed data transmission, improve throughput and reduce data delay, and is simple to deploy.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method for implementing high-speed data security transmission based on a counter mode. Background Art

[0002] With the promotion of information system construction, large-scale data leakage incidents have occurred frequently. Cryptography technology, as the core and foundation of network security, has become the focus of attention of all parties. At present, there are basically no protection measures for IoT terminal devices in the industry's key information infrastructure, especially data privacy protection. How to ensure the reliability and security of high-speed data transmission, improve throughput, reduce data latency, and deploy simply and easily in a complex network environment where network attacks frequently occur, without changing the original network topology, is an urgent problem to be solved in the industry.

[0003] The current technology usually adopts the solution of deploying VPN on both sides. In the solution of deploying VPN, the cloud server and the terminal device are hidden to protect themselves. At the same time, VPN tunnels are established on both sides, and data is protected through the VPN tunnel. However, the VPN server will have bottlenecks when dealing with a large number of device accesses. The stacking of devices will increase customer costs. At the same time, the data transmission path is modified many times, which reduces the network transmission efficiency and increases the data delay, resulting in the reverse control instructions may not reach the terminal device in time, which leads to unpredictable consequences. Summary of the invention

[0004] The present invention provides a method for implementing high-speed data secure transmission based on a counter mode, which ensures that high-speed data transmission is reliable and secure, improves throughput and reduces data delay, and is simple to deploy.

[0005] The present invention provides a method for implementing high-speed data security transmission based on a counter mode, comprising:

[0006] The security module establishes a two-way authentication connection with the security gateway, wherein the security module is deployed on the terminal side and the security gateway is deployed on the server side;

[0007] The security module initiates a master key request to the security gateway and sends the IP address to the security gateway;

[0008] After receiving the master key request, the security gateway distributes the master key to the security module;

[0009] The security module receives the master key distributed by the security gateway;

[0010] The security module and the security gateway respectively calculate random numbers based on the master key in counter mode and store them in the uplink session key queue and the downlink session key queue;

[0011] When the terminal accesses the server, the security module extracts the session key from the uplink session key queue and encrypts the uplink data for privacy protection;

[0012] The security gateway retrieves the corresponding master key according to the IP address, extracts the session key from the corresponding uplink session key queue according to the master key, decrypts the uplink data, and forwards the decrypted plaintext data to the server.

[0013] Further, after receiving the master key request, the security gateway distributes the master key to the security module, including:

[0014] After the security gateway receives the master key request initiated by the security module, it queries the master key mapping table based on the IP address of the security module; if the network address matches the master key mapping table, the corresponding master key is distributed to the security module; if the network address does not match the master key mapping table, a 16-byte random number is obtained as the master key and distributed to the security module.

[0015] Furthermore, after the security module receives the master key distributed by the security gateway, the method further includes:

[0016] The security module encrypts the master key with a fixed string to obtain ciphertext data, and sends the ciphertext data to the security gateway;

[0017] After receiving the ciphertext data sent by the security module, the security gateway uses the master key assigned to this security module to decrypt the ciphertext data; compares the decrypted data with the fixed string; if the decrypted data is consistent with the fixed string data, the distributed master key is valid, and the security gateway updates the master key mapping table; at the same time, notifies the security module to update the protected network table; if the decrypted data is inconsistent with the fixed string data, the distributed master key is invalid, and a data packet is sent to request the security module to reapply for the master key.

[0018] Furthermore, the security module and the security gateway respectively calculate random numbers based on the master key in counter mode and store them in the uplink session key queue and the downlink session key queue, including:

[0019] After verifying that the master key is valid, the security module and the security gateway calculate random numbers based on the master key using a counter and store them in the uplink session key queue and the downlink session key queue respectively. They also monitor the uplink session key queue and the downlink session key queue to keep them full at all times, and map the uplink session key queue and the downlink session key queue memory of the user space to the kernel space.

[0020] Furthermore, when the terminal accesses the server, the security module extracts the session key from the uplink session key queue and encrypts the uplink data for privacy protection, including:

[0021] The security module registers the HOOK function on NF_IP_PRE_ROUTING, intercepts the uplink data, and calculates whether the payload data length is greater than 0;

[0022] If the payload data length is equal to 0, it means that there is no data to be encrypted and it is directly submitted to the protocol stack for protocol processing;

[0023] If the payload data length is greater than 0, it means that data needs to be encrypted, and a five-tuple is obtained, which includes the source address, destination address, source port, destination port, and protocol; the HASH value is calculated based on the five-tuple, and the session table is retrieved through the HASH value; if the session table is matched, the corresponding session key in this session table is used to perform segmented XOR encryption on the data, and the IP checksum is recalculated and updated; the encrypted data is submitted to the protocol stack for protocol processing, and the timeout time of this session in the session table is updated;

[0024] If it does not match the session table, the protected network table is retrieved based on the source address; if it does not match the protected network table, it is submitted to the protocol stack for protocol processing; if it matches the protected network table, the corresponding master key is obtained from the protected network table, and the session key and the value of the 16-byte counter are extracted from the corresponding uplink session key queue based on the master key. The data is segmented XOR encrypted based on the session key, the value of the 16-byte counter is appended to the end of the encrypted data segment, the payload length is recalculated and updated, the IP message length is recalculated and updated, and the IP checksum is recalculated and updated; the encrypted data is submitted to the protocol stack for protocol processing, the HASH value of the five-element ancestor and the session key are stored in the session table, and the timeout of this session is set.

[0025] Further, the security gateway retrieves the corresponding master key according to the IP address, extracts the session key from the corresponding uplink session key queue according to the master key, and decrypts the uplink data, including:

[0026] The security gateway registers the HOOK function on NF_IP_PRE_ROUTING, intercepts the uplink data, and calculates whether the payload data length is greater than 0;

[0027] If the payload data length is equal to 0, it means that there is no data to be decrypted and it is directly submitted to the protocol stack for protocol processing;

[0028] If the payload data length is greater than 0, it means that there is data that needs to be decrypted. The five-tuple is obtained, the HASH value is calculated based on the five-tuple, and the session table is retrieved through the HASH value. If the session table is matched, the corresponding session key in this session table is used to perform segmented XOR decryption on the data, recalculate and update the IP checksum, submit the decrypted data to the protocol stack for protocol processing, and update the session timeout time in the session table.

[0029] If it does not match the session table, the master key mapping table is retrieved based on the source address. If it does not match the master key mapping table, it is submitted to the protocol stack for protocol processing. If it matches, the corresponding master key is obtained from the master key mapping table, and the last 16 bytes of the payload data segment are taken as the value of the counter. The session key corresponding to the counter value is extracted from the corresponding uplink session key queue based on the master key. The data is segmented and XOR-decrypted based on the session key, the value of the last 16 bytes of the counter is removed, and the payload is updated. The payload length is recalculated and updated, the IP message length is recalculated and updated, the IP checksum is recalculated and updated, and the decrypted data is submitted to the protocol stack for protocol processing. The HASH value of the five-element ancestor and the session key are stored in the session table, and the timeout of this session is set.

[0030] Furthermore, the method further comprises:

[0031] If the session times out, the session is deleted from the session table, and the data transmitted again obtains a new round of session keys to perform XOR encryption and decryption on the data.

[0032] The present invention has the following beneficial effects: A method for implementing high-speed data secure transmission based on a counter mode of the present invention performs pre-calculation based on the counter mode to improve the efficiency of data encryption and decryption. A one-session-one-key approach is adopted, and the session key in the session table will be destroyed when the session timeout occurs, and the session key will be re-extracted in a new round of sessions to resist replay attacks and improve the security strength of the key. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solution of the present invention, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0034] Figure 1 A network deployment diagram of a method for implementing high-speed data secure transmission based on a counter mode provided by the present invention;

[0035] Figure 2 The present invention provides a flowchart of a method for implementing high-speed data security transmission based on a counter mode. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described in conjunction with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. The technical solutions provided by the embodiments of the present invention are described in detail below in conjunction with the drawings.

[0037] See also Figure 1 and Figure 2 The embodiment of the present invention provides a method for implementing high-speed data security transmission based on a counter mode, comprising:

[0038] S101, a security module establishes a two-way authentication connection with a security gateway, wherein the security module is deployed on a terminal side and the security gateway is deployed on a server side.

[0039] Figure 1 This is a network deployment diagram for the implementation method of high-speed data secure transmission based on the counter mode. This method can be transparently connected to the existing network without changing the original network topology. The security module is deployed on the terminal side and the security gateway is deployed on the server side. The two-way authentication connection between the security module and the security gateway ensures the authenticity of the identities of both parties in communication, effectively prevents man-in-the-middle attacks and data tampering, and ensures the confidentiality and integrity of data transmission. The transparent access feature of this solution makes it easy to deploy and maintain. There is no need to make large-scale adjustments to the existing network architecture, which reduces the implementation cost and risk, and also reduces the complexity of subsequent operation and maintenance.

[0040] S102, the security module initiates a master key request to the security gateway and sends the IP address to the security gateway.

[0041] S103, after receiving the master key request, the security gateway distributes the master key to the security module.

[0042] Specifically, after the security gateway receives the master key request initiated by the security module, it queries the master key mapping table based on the IP address of the security module; if the network address matches the master key mapping table, the corresponding master key is distributed to the security module; if the network address does not match the master key mapping table, a 16-byte random number is obtained as the master key and distributed to the security module.

[0043] S104, the security module receives the master key distributed by the security gateway.

[0044] Specifically, the security module uses a fixed string to encrypt the master key to obtain ciphertext data, and sends the ciphertext data to the security gateway; after the security gateway receives the ciphertext data sent by the security module, it selects the master key assigned to this security module to decrypt the ciphertext data; the decrypted data is compared with the fixed string; if the decrypted data is consistent with the fixed string data, the distributed master key is valid, and the security gateway updates the master key mapping table; at the same time, the security module is notified to update the protected network table; if the decrypted data is inconsistent with the fixed string data, the distributed master key is invalid, and a data packet is sent to request the security module to reapply for the master key.

[0045] S105: The security module and the security gateway respectively calculate random numbers based on the master key in a counter mode and store them in an uplink session key queue and a downlink session key queue.

[0046] Specifically, after verifying that the master key is valid, the security module and the security gateway calculate random numbers based on the master key using a counter and store them in the uplink session key queue and the downlink session key queue respectively, and monitor the uplink session key queue and the downlink session key queue to keep the queues always full, and at the same time map the uplink session key queue and the downlink session key queue memory of the user space to the kernel space; when the master key is updated, the random number is calculated again based on the master key using a counter and stored in the uplink session key queue and the downlink session key queue respectively.

[0047] S106, when the terminal accesses the server, the security module extracts the session key from the uplink session key queue and encrypts the uplink data for privacy protection.

[0048] Specifically, the security module registers the HOOK function on NF_IP_PRE_ROUTING, intercepts the uplink data, and calculates whether the payload data length is greater than 0;

[0049] If the payload data length is equal to 0, it means that there is no data to be encrypted and it is directly submitted to the protocol stack for protocol processing;

[0050] If the payload data length is greater than 0, it means that data needs to be encrypted, and the five-tuple is obtained, which includes the source address, destination address, source port, destination port, and protocol; the HASH value is calculated based on the five-tuple, and the session table is retrieved through the HASH value; if the session table is matched, the corresponding session key in this session table is used to perform segmented XOR encryption on the data, and the IP checksum is recalculated and updated. If it is TCP protocol data, the TCP checksum needs to be recalculated and updated; the encrypted data is submitted to the protocol stack for protocol processing, and the timeout time of this session in the session table is updated;

[0051] If it does not match the session table, the protected network table is retrieved based on the source address; if it does not match the protected network table, it is submitted to the protocol stack for protocol processing; if it matches the protected network table, the corresponding master key is obtained from the protected network table, and the session key and the value of the 16-byte counter are extracted from the corresponding uplink session key queue based on the master key. The data is segmented XOR encrypted based on the session key, and the value of the 16-byte counter is appended to the end of the encrypted data segment. The payload length is recalculated and updated, the IP message length is recalculated and updated, and the IP checksum is recalculated and updated. If it is TCP protocol data, the TCP checksum also needs to be recalculated and updated; the encrypted data is submitted to the protocol stack for protocol processing, the HASH value of the five-element ancestor and the session key are stored in the session table, and the timeout of this session is set.

[0052] S107, the security gateway retrieves the corresponding master key according to the IP address, extracts the session key from the corresponding uplink session key queue according to the master key, decrypts the uplink data, and forwards the decrypted plaintext data to the server.

[0053] Specifically, the security gateway registers the HOOK function on NF_IP_PRE_ROUTING, intercepts the uplink data, and calculates whether the payload data length is greater than 0;

[0054] If the payload data length is equal to 0, it means that there is no data to be decrypted and it is directly submitted to the protocol stack for protocol processing;

[0055] If the payload data length is greater than 0, it means that there is data that needs to be decrypted. The five-tuple is obtained, the HASH value is calculated based on the five-tuple, and the session table is retrieved through the HASH value. If the session table is matched, the corresponding session key in this session table is used to perform segmented XOR decryption on the data, and the IP checksum is recalculated and updated. If it is TCP protocol data, the TCP checksum needs to be recalculated and updated. The decrypted data is submitted to the protocol stack for protocol processing, and the session timeout time in the session table is updated.

[0056] If it does not match the session table, the master key mapping table is retrieved based on the source address. If it does not match the master key mapping table, it is submitted to the protocol stack for protocol processing. If it matches, the corresponding master key is obtained from the master key mapping table, and the last 16 bytes of the payload data segment are taken as the value of the counter. The session key corresponding to the counter value is extracted from the corresponding uplink session key queue based on the master key. The data is segmented and XOR-decrypted based on the session key, the value of the counter of the last 16 bytes is removed, and the payload is updated. The payload length is recalculated and updated, the IP message length is recalculated and updated, and the IP checksum is recalculated and updated. If it is TCP protocol data, the TCP checksum needs to be recalculated and updated. The decrypted data is submitted to the protocol stack for protocol processing, the HASH value of the five-element ancestor and the session key are stored in the session table, and the timeout of this session is set.

[0057] The reverse data flow is the same as S106 and S107. If the session times out, the session is deleted from the session table, and the data transmitted again obtains a new round of session keys to perform XOR encryption and decryption on the data. One session, one key, resists replay attacks, and improves the security strength of the key.

[0058] As can be seen from the above embodiments, the present invention can achieve plug-and-play through transparent mode access without changing the existing network topology. The present invention establishes a session table to complete fast data forwarding and improve data forwarding efficiency. The present invention performs pre-calculation based on the counter mode to improve data encryption and decryption efficiency and reduce real-time data delay. The present invention adopts a one-session-one-key approach to resist replay attacks and improve the security strength of the key.

[0059] The above-described embodiments of the present invention do not limit the protection scope of the present invention.

Claims

1. A method for implementing high-speed data security transmission based on counter mode, characterized in that: include: The security module establishes a two-way authentication connection with the security gateway, wherein the security module is deployed on the terminal side and the security gateway is deployed on the server side; The security module initiates a master key request to the security gateway and sends the IP address to the security gateway; After receiving the master key request, the security gateway distributes the master key to the security module; The security module receives the master key distributed by the security gateway; The security module and the security gateway respectively calculate random numbers based on the master key in counter mode and store them in the uplink session key queue and the downlink session key queue; When the terminal accesses the server, the security module extracts the session key from the uplink session key queue and encrypts the uplink data for privacy protection; The security gateway retrieves the corresponding master key according to the IP address, extracts the session key from the corresponding uplink session key queue according to the master key, decrypts the uplink data, and forwards the decrypted plaintext data to the server; After the security module receives the master key distributed by the security gateway, the method further includes: the security module encrypts the master key with a fixed character string to obtain ciphertext data, and sends the ciphertext data to the security gateway; after the security gateway receives the ciphertext data sent by the security module, it selects the master key assigned to the security module to decrypt the ciphertext data; compares the decrypted data with the fixed character string; if the decrypted data is consistent with the fixed character string data, the distributed master key is valid, and the security gateway updates the master key mapping table; and at the same time notifies the security module to update the protected network table; if the decrypted data is inconsistent with the fixed character string data, the distributed master key is invalid, and a data packet is sent to request the security module to reapply for the master key; The security module and the security gateway respectively calculate random numbers based on the master key in a counter mode and store them in an uplink session key queue and a downlink session key queue, including: after verifying that the master key is valid, the security module and the security gateway respectively calculate random numbers based on the master key in a counter mode and store them in an uplink session key queue and a downlink session key queue, and monitor the uplink session key queue and the downlink session key queue to keep the queues always fully loaded, and at the same time map the uplink session key queue and the downlink session key queue memory of the user space to the kernel space; When the terminal accesses the server, the security module extracts the session key from the uplink session key queue and encrypts the uplink data for privacy protection, including: the security module registers the HOOK function on NF_IP_PRE_ROUTING, intercepts the uplink data, and calculates whether the payload data length is greater than 0; if the payload data length is equal to 0, it means that there is no data to be encrypted, and it is directly submitted to the protocol stack for protocol processing; if the payload data length is greater than 0, it means that there is data to be encrypted, and a five-tuple is obtained, the five-tuple includes the source address, the destination address, the source port, the destination port, and the protocol; the HASH value is calculated according to the five-tuple, and the session table is retrieved through the HASH value; if the session table is matched, the corresponding session key in this session table is used to perform segmented XOR encryption on the data, and the data is recalculated and updated IP checksum; submit the encrypted data to the protocol stack for protocol processing, and update the session timeout in the session table; if it does not match the session table, retrieve the protected network table based on the source address; if it does not match the protected network table, submit it to the protocol stack for protocol processing, and if it matches the protected network table, obtain the corresponding master key from the protected network table, extract the session key and the value of the 16-byte counter from the corresponding uplink session key queue based on the master key, perform segmented XOR encryption on the data based on the session key, append the value of the 16-byte counter to the end of the encrypted data segment, recalculate and update the payload length, recalculate and update the IP message length, recalculate and update the IP checksum; submit the encrypted data to the protocol stack for protocol processing, store the HASH value of the quintuple and the session key in the session table, and set the session timeout.

2. The method for implementing high-speed data secure transmission based on counter mode as claimed in claim 1, characterized in that: After receiving the master key request, the security gateway distributes the master key to the security module, including: After the security gateway receives the master key request initiated by the security module, it queries the master key mapping table based on the IP address of the security module; if the network address matches the master key mapping table, the corresponding master key is distributed to the security module; if the network address does not match the master key mapping table, a 16-byte random number is obtained as the master key and distributed to the security module.

3. The method for implementing high-speed data secure transmission based on counter mode as claimed in claim 1, characterized in that: The security gateway retrieves the corresponding master key according to the IP address, extracts the session key from the corresponding uplink session key queue according to the master key, and decrypts the uplink data, including: The security gateway registers the HOOK function on NF_IP_PRE_ROUTING, intercepts the uplink data, and calculates whether the payload data length is greater than 0; If the payload data length is equal to 0, it means that there is no data to be decrypted and it is directly submitted to the protocol stack for protocol processing; If the payload data length is greater than 0, it means that there is data that needs to be decrypted. The five-tuple is obtained, and the HASH value is calculated based on the five-tuple. The session table is retrieved through the HASH value. If the session table matches, the corresponding session key in this session table is used to perform segmented XOR decryption on the data, recalculate and update the IP checksum, submit the decrypted data to the protocol stack for protocol processing, and update the session timeout time in the session table. If it does not match the session table, the master key mapping table is retrieved based on the source address. If it does not match the master key mapping table, it is submitted to the protocol stack for protocol processing. If it matches, the corresponding master key is obtained from the master key mapping table, and the last 16 bytes of the payload data segment are taken as the value of the counter. The session key corresponding to the counter value is extracted from the corresponding uplink session key queue based on the master key. The data is segmented and XOR-decrypted based on the session key, the value of the last 16 bytes of the counter is removed, and the payload is updated. The payload length is recalculated and updated, the IP message length is recalculated and updated, the IP checksum is recalculated and updated, and the decrypted data is submitted to the protocol stack for protocol processing. The HASH value of the quintuple and the session key are stored in the session table, and the timeout of this session is set.

4. The method for implementing high-speed data secure transmission based on counter mode as claimed in claim 3, characterized in that: The method further comprises: If the session times out, the session is deleted from the session table, and the data transmitted again obtains a new round of session keys to perform XOR encryption and decryption on the data.

Images