A multi-point secure transmission method and system with hidden services

Abstract

The present invention relates to a multi-point secure transmission method and system with service concealment, and belongs to the field of network security technology. The present invention deploys an independent software shield as the identification key of system communication for each gateway device through an identification key distribution management system, and the gateway devices perform the following point-to-point communication between each other to perform data encryption transmission: device B verifies the single-package authentication message as the initiator of the communication request based on the identification key information of device A; after the single-package authentication is passed, A and B negotiate the identity authentication key based on the identification key information of both parties to obtain a data transmission shared key; A and B construct an encrypted UDP channel based on the shared key to realize data encryption transmission. The present invention constructs a secure communication transmission channel based on a complex network environment of the Internet for data encryption transmission, which can not only ensure the security of data transmission and avoid attacks from hostile parties, but also solve the uncertainty and anonymity problems in the prior art.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a multi-point secure transmission method and system for concealing services. Background Art

[0002] At present, in terms of secure communications in multiple locations of enterprises, dedicated data lines are usually used or enterprise VPN networks are built with the help of existing Internet infrastructure to ensure the security of enterprise business. The communication security transmission technologies used include VPN communication, TOR network, etc., relying on anti-virus, firewall and other systems and other tools to detect and block malicious attack networks transmitted through the network, forming a series of security protection technical means.

[0003] Traditional virtual private networks (VPNs) connect remote users to corporate internal networks by creating encrypted channels on public networks. They use tunneling protocols (such as IPSec, SSL / TLS, etc.) to encrypt data and ensure the confidentiality and integrity of data during transmission. Remote users can establish a secure connection with the corporate network through the VPN client to gain access to internal resources. Although traditional VPNs are a common method for remote access to corporate networks, they have some security limitations, mainly including: First, the problem of external attacks. The application system access interface has been directly exposed to the Internet for a long time, which is prone to scanning and detection, forming a specific network device fingerprint, the entrance to the company's important assets, and becoming a key target for hacker attacks; second, the vulnerability threat problem. General network security equipment often uses standard SSL, IPSec and other encrypted communication protocols, general basic encryption components, and components are interdependent. These standard protocols and components have been widely studied and are more vulnerable to 0Day vulnerabilities and supply chain attack threats.

[0004] The Tor network protects data through a combination of symmetric and asymmetric encryption. When a data packet is transmitted through the Tor network, it will be decrypted layer by layer at each node until it reaches the final destination. The security of Tor communication is mainly reflected in the following aspects: first, each Tor node can only decrypt enough information to determine the next node, but cannot know the original source and the final destination, which is like peeling the layers of an onion; second, the key exchange between Tor nodes usually uses asymmetric encryption to ensure that even if the key exchange process is monitored, the communication content will not be leaked. However, Tor nodes are maintained by many volunteers around the world. This decentralized network structure further enhances anonymity. For enterprises, this anonymity and uncertainty are not what enterprises want to see. Summary of the invention

[0005] In view of the above analysis, the present invention aims to provide a multi-point secure transmission method and system with hidden services. Users can realize data encryption transmission in a complex network environment based on the method and system of the present invention, which can not only ensure the security of data transmission and avoid attacks from hostile parties, but also solve the uncertainty and anonymity problems in the prior art.

[0006] On the one hand, the present invention provides a multi-point secure transmission method with service anonymity, which deploys an independent software shield as the identification key of system communication for each gateway device through the identification key distribution management system, and the gateway devices perform the following point-to-point communication between each other to perform data encryption transmission:

[0007] Device B, as the communication request receiver, verifies the single-package authentication message of device A, as the communication request initiator, based on the identification key information of device A;

[0008] After the single packet authentication is passed, device A and device B negotiate the identity authentication key based on the identification key information of both parties to obtain the data transmission shared key;

[0009] Device A and device B construct an encrypted UDP channel based on the shared key to achieve encrypted data transmission.

[0010] Further, the single-package authentication message in which the device B verifies the device A as the initiator of the communication request based on the identification key information of the device A includes:

[0011] Device A uses its private key to digitally sign the single-package authentication message to obtain first signature data;

[0012] Device A constructs a single-package authentication message based on the single-package authentication message and the first signature data and sends it to device B;

[0013] Device B obtains the first signature data based on the single-package authentication message, and verifies the single-package authentication message of device A based on the first signature data.

[0014] Further, the single-packet authentication message includes a device identifier, a timestamp, a protocol version, and a random packet sequence number;

[0015] The digitally signing the single-package authentication message using its private key to obtain the signature data includes:

[0016] ;

[0017] Among them, SignA represents the first signature data, Signature represents the digital signature algorithm based on public key encryption technology, Apriv represents A's private key, Hash represents the hash algorithm, IDA represents A's identification, Timestamp represents the timestamp, Version represents the protocol version, RandId represents the random packet number, and "||" represents the data connection symbol.

[0018] Furthermore, the device A and the device B perform identity authentication key negotiation based on the identification key information of both parties, and obtain the data transmission shared key including:

[0019] Device A and device B respectively calculate a first shared key based on their own private keys and the other party's public key;

[0020] Device A and device B exchange respective identity authentication messages based on the first shared key, including the random numbers generated by each.

[0021] Device A and device B respectively calculate a second shared key based on the random numbers generated by both parties, that is, a data transmission shared key.

[0022] Furthermore, the method for calculating the first shared key by device A and device B based on their own private keys and the other party's public key is:

[0023] ;

[0024] Among them, Skey1 represents the first shared key, Apriv and Bpriv represent the private key of A and the private key of B respectively, Apub and Bpub represent the public key of A and the public key of B respectively; Ecdh represents the ECDH algorithm.

[0025] Further, the device A and the device B exchange respective identity authentication messages based on the first shared key including:

[0026] One of the devices A and B signs its own identity authentication message data using its private key to obtain second signature data;

[0027] The party encrypts its own identity authentication message and the second signature data based on the first shared key to obtain a first encrypted authentication ciphertext, and sends it to the other party;

[0028] The other party decrypts the received first encrypted authentication ciphertext based on the first shared key to obtain A's identity authentication message and second signature data;

[0029] The other party verifies the second signature data based on the party's public key to confirm the party's identity authentication message.

[0030] Furthermore, the identity authentication message includes a device identifier, a timestamp, a protocol version, and a random number; the random number is 16 bytes long.

[0031] Furthermore, the device A and the device B respectively calculate the second shared key based on the random numbers generated by both parties, including:

[0032] ;

[0033] Among them, RandA represents the random number generated by A, and RandB represents the random number generated by B. Indicates that a hash algorithm is used.

[0034] On the other hand, the present invention also provides a multi-point secure transmission system with hidden services, including an identification key distribution management system and various gateway devices.

[0035] The identification key distribution management system is used to deploy an independent software shield for each gateway device as the identification key for system communication;

[0036] The gateway devices perform the following point-to-point communication between each other to perform encrypted data transmission: Device B, as the receiver of the communication request, verifies the single-packet authentication message of Device A, as the initiator of the communication request, based on the identification key information of Device A; after the single-packet authentication is passed, Device A and Device B negotiate the identity authentication key based on the identification key information of both parties to obtain a shared key for data transmission; Device A and Device B build an encrypted UDP channel based on the shared key to achieve encrypted data transmission.

[0037] Further, the device initiating the communication request is the client, and the device receiving the communication request is the server;

[0038] For dial-up network devices without fixed IP and port, they can only act as clients;

[0039] For network devices with fixed external IP and port, they can act as both clients and servers.

[0040] The present invention can achieve at least one of the following beneficial effects:

[0041] Based on the idea of ​​zero-trust network stealth and relying on the existing communication infrastructure network, a proprietary encrypted communication protocol is designed. An independent software shield is deployed for each gateway device through the identification key distribution management system as the identification key for system communication. Point-to-point communication is performed between gateway devices, and a hidden, secure and reliable encrypted transmission mechanism is built in the untrusted network to protect the business system from APT network attacks and ensure the security of transmission. At the same time, since encrypted data transmission is realized between gateway devices based on the software shield distributed by the identification key distribution management system, the identity of each network node is clearly known during the network transmission process, which solves the anonymity and uncertainty problems existing in Tor network technology.

[0042] By building a communication strategy based on a non-secure network with hidden device addresses, variable ports, and default rejection, we can prevent communication devices from being scanned and detected, thereby preventing communication nodes from being attacked by vulnerabilities. By adopting identification cryptography technology, single-packet authentication is achieved to ensure the legitimacy of network access identities. Through the ECDH-based key distribution and sharing algorithm, secure negotiation of encrypted communication keys is achieved. By adopting the UDP encrypted communication protocol, data encryption protection is achieved. The overall identification cryptography technology is used to achieve point-to-point communication security.

[0043] The system of the present invention is based on a dual mode of server and client, conforms to the complex network environment with the Internet as the infrastructure, can be widely used in scenarios such as fixed IP and dial-up networks, has stronger equipment flexibility, can provide on-demand network services, and build a more stable network communication.

[0044] Other features and advantages of the present invention will be described in the following description, and some advantages may become apparent from the description, or may be understood by practicing the present invention. The purpose and other advantages of the present invention may be realized and obtained through the contents particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. In the entire drawings, the same reference symbols represent the same components;

[0046] Figure 1 This is a schematic diagram of the multi-point secure transmission method of the present invention;

[0047] Figure 2 This is a flow chart of data encryption transmission for point-to-point communication of the present invention;

[0048] Figure 3 This is a diagram of the architecture of the multi-point secure transmission system of the present invention;

[0049] Figure 4 This is a basic principle diagram of the network communication connection of the present invention. DETAILED DESCRIPTION

[0050] The preferred embodiments of the present invention are described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, but are not used to limit the scope of the present invention.

[0051] Method Embodiment

[0052] A specific embodiment of the present invention discloses a multi-point secure transmission method for service concealment, in which an independent software shield is deployed for each gateway device as an identification key for system communication through an identification key distribution management system, and the gateway devices communicate point-to-point to perform data encryption transmission (such as Figure 1 is a communication principle diagram, wherein device A is the communication request initiator and device B is the communication request receiver). The point-to-point communication specifically includes steps S00-S03 (such as Figure 2 ).

[0053] Step S00: Device A generates a single-packet authentication message and sends it to device B, which specifically includes S001-S002.

[0054] S001. Device A uses its private key to digitally sign a single-package authentication message to obtain first signature data;

[0055] The single-packet authentication message includes the device identification, timestamp, protocol version and random packet sequence number of the communication request initiator;

[0056] The step of using its private key to digitally sign the single-package authentication message to obtain first signature data includes:

[0057] ;

[0058] Among them, SignA represents the first signature data, Signature represents the digital signature algorithm based on public key encryption technology, Apriv represents A's private key, Hash represents the hash algorithm, IDA represents A's device identification, Timestamp represents the timestamp, Version represents the protocol version, RandId represents the random package number, and "||" represents the data connection symbol.

[0059] S002. Device A constructs a single-package authentication message based on the single-package authentication message and the first signature data and sends it to device B.

[0060] It should be noted that when device A constructs a single-package authentication message based on the single-package authentication message and the first signature data, the single-package authentication message is encrypted based on an encryption algorithm. Exemplarily, a pre-shared key can be allocated to both communicating parties through a secure channel, and device A encrypts based on the pre-shared key.

[0061] Step S01: Device B verifies a single-package authentication message of device A based on identification key information of device A.

[0062] It should be noted that, by default, device B enables the firewall rule that prohibits all external access, and at the same time opens an external UDP port to wait for external authentication requests, and discards all non-authentication request packets by default.

[0063] In step S01, device B obtains first signature data based on the single-package authentication message, and verifies the single-package authentication message of device A based on the first signature data.

[0064] Specifically, device B decrypts the single-packet authentication message, illustratively using a pre-shared key for decryption. Device B obtains A's device identification based on the decrypted single-packet authentication message, calculates A's public key based on A's device identification using an identification cryptographic system, verifies the first signature data based on A's public key, and discards the corresponding data packet if the verification fails. If the verification succeeds, a firewall rule for temporarily opening the authentication service port is set for step S02.

[0065] Furthermore, the default time length for which device B temporarily opens the authentication service port is 2 minutes.

[0066] Step S02: After the single packet authentication is passed, device A and device B negotiate the identity authentication key based on the identification key information of both parties to obtain the data transmission shared key. Step S02 includes S021-S023.

[0067] S021. Device A and device B respectively calculate a first shared key based on their own private keys and the other party's public key; the calculation method is:

[0068] ;

[0069] Among them, Skey1 represents the first shared key, Apriv and Bpriv represent the private key of the receiver A and the private key of B respectively, Apub and Bpub represent the public key of A and the public key of B respectively; Ecdh represents the ECDH algorithm.

[0070] S022. Device A and device B exchange their respective identity authentication messages based on the first shared key, including the random numbers generated by each.

[0071] When exchanging their respective identity authentication messages, A and B both act as initiators and receivers. The initiator sends its own identity authentication message to the receiver, and the receiver receives and verifies the other party's identity authentication message.

[0072] Specifically, they include:

[0073] One of the devices A and B signs its own identity authentication message data using its private key to obtain second signature data;

[0074] The party encrypts its own identity authentication message and the second signature data based on the first shared key to obtain a first encrypted authentication ciphertext, and sends it to the other party;

[0075] The other party decrypts the received first encrypted authentication ciphertext based on the first shared key to obtain A's identity authentication message and second signature data;

[0076] The other party verifies the second signature data based on the party's public key to confirm the party's identity authentication message.

[0077] The exchange process when A is the sender of the identity authentication message is as follows:

[0078] Device A uses its private key to sign the identity authentication message data of A to obtain the second signature data; the identity authentication message includes the device identifier, timestamp, protocol version, and random number, expressed as ; MsgA represents the identity authentication message, and the random number RandA is 16 bytes long; the data signature process is expressed as: ; SignA' represents the second signature data;

[0079] Device A encrypts A's identity authentication message and the second signature data based on the first shared key to obtain a first encrypted authentication ciphertext, and sends it to device B. The encryption process is expressed as:

[0080] ; AuthA represents the encrypted authentication data, Encrypt represents the symmetric encryption algorithm, which can be AES or SM4, etc.;

[0081] Device B decrypts the received first encrypted authentication ciphertext based on the first shared key to obtain A's identity authentication message and second signature data; the decryption process is described as follows: ; Wherein, Decrypt represents the decryption process of the symmetric encryption algorithm;

[0082] Device B verifies the second signature data based on the public key of device A to confirm A's identity authentication message; the verification process is described as follows: ; Among them, VerifySign is a signature verification function, which is used to verify whether A's signature value is reliable based on the received message.

[0083] It should be noted that, unlike when device B acts as the sender of the authentication message, when device A acts as the sender of the authentication message, if device B, as the receiver of the authentication message, does not receive any message within the length of time (such as 2 minutes) when the authentication service port is temporarily opened, device B closes the port.

[0084] S023. Device A and device B respectively calculate a second shared key based on the random numbers generated by both parties, that is, a data transmission shared key, and the calculation method is:

[0085] ;

[0086] Among them, Skey2 represents the second shared key; RandB represents the random number generated by B, with a length of 16 bytes. Indicates that a hash algorithm is used to determine the number of hash calculations based on the required key length and the hash value (the n value is determined based on the number of calculations) to ensure that the key length requirement is met.

[0087] Step S03: Device A and device B construct an encrypted UDP channel based on the data transmission shared key to achieve encrypted data transmission.

[0088] Specifically, virtual network cards (ie, virtual network interfaces) are created on device A and device B respectively, and an encrypted UDP channel is constructed based on the data transmission shared key, ie, the second shared key, to realize data encrypted transmission.

[0089] The present embodiment discloses a multi-point secure transmission method with hidden services, which adopts the stealth technology of network communication equipment, and builds a communication strategy based on a non-secure network with hidden device addresses, variable ports, and default rejection, so as to prevent communication equipment from being scanned and detected, and further prevent communication nodes from being attacked by vulnerabilities; by adopting identification cryptographic technology, single-packet authentication is realized, the legitimacy of network access identity is guaranteed, and the anonymity and uncertainty problems of transmission nodes are avoided; by using a key distribution and sharing algorithm based on ECDH, encrypted communication key security negotiation is realized; by adopting a UDP encrypted communication protocol, data encryption protection is realized; and the overall identification cryptographic technology is adopted to realize point-to-point communication security;

[0090] System Example

[0091] A specific embodiment of the present invention discloses a multi-point secure transmission system with hidden services, including an identification key distribution management system and various gateway devices.

[0092] Specifically, the identification key distribution management system is used to deploy an independent software shield for each gateway device as an identification key for system communication;

[0093] The gateway devices perform the following point-to-point communication between each other to perform encrypted data transmission: Device B verifies the single-packet authentication message of Device A as the initiator of the communication request based on the identification key information of Device A; after the single-packet authentication is passed, Device A and Device B negotiate the identity authentication key based on the identification key information of both parties to obtain a shared key for data transmission; Device A and Device B build an encrypted UDP channel based on the shared key to achieve encrypted data transmission.

[0094] Further, such as Figure 3 As shown, the identification key distribution management system is used to deploy an independent software shield for each gateway device, adopt a default rejection firewall policy to achieve the hiding of each network device, and realize point-to-point communication with encrypted data transmission between gateway devices, thereby realizing the connection between edges and edges, and the connection between edges and centers. The overall deployment forms a mesh interconnection, thereby realizing the access of edge business users to edge business systems, and the access of edge business users to central business systems, and forwarding access between edges through the central gateway.

[0095] Furthermore, in the peer-to-peer communication, the device initiating the communication request is the client, and the device receiving the communication request is the server (e.g. Figure 4 The figure shows the basic principle diagram of network communication connection);

[0096] During implementation, determine the working status of network equipment according to different situations:

[0097] For dial-up network devices without fixed IP and port, they can only act as clients; all network connections are initiated by the client device, and the firewall works in stateful mode, opening three UDP outbound traffic ports for single-packet authorization, authentication request and communication connection, recording the 5-tuple of request data, receiving response data according to the source port of the 5-tuple, and realizing external connection;

[0098] For network devices with fixed external IP and ports, they can act as both clients and servers. When the network device works in server mode, the firewall opens three UDP inbound traffic ports for single-packet authorization, authentication request and communication connection. The device itself uses a zero-trust approach to reject external connections by default. Data is encrypted and transmitted in accordance with the point-to-point communication described in the method implementation example to ensure the security of the server.

[0099] The present embodiment discloses a multi-point secure transmission system with hidden services. The system is based on the Internet communication infrastructure and is designed to adopt a point-to-point communication protocol with a separation of the control plane and the data plane. It adopts phased key negotiation and control and utilizes the one-way communication characteristics of UDP to achieve multi-channel one-way encrypted communication, thereby increasing the difficulty of data hijacking and cracking.

[0100] Users can build a private encrypted network based on the Internet communication infrastructure, implement transparent proxy and automatic tunnel encryption of business data, and hide the ports and services of network communication equipment. This can not only ensure the security of data transmission and avoid attacks and information leakage from hostile parties, but also identify the identity of each node in the communication based on the software shield, solving the uncertainty and anonymity problems in the existing technology.

[0101] The system of this embodiment implements a dual mode based on the server and the client, which conforms to the complex network environment with the Internet as the infrastructure, and can be widely used in scenarios such as fixed IP and dial-up networks. The equipment is more flexible, can provide on-demand network services, and build a more stable network communication.

[0102] It should be noted that the above embodiments are based on the same inventive concept and parts not described repeatedly can be used as reference for each other.

[0103] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by any technician familiar with the technical field within the technical scope disclosed by the present invention should be covered within the protection scope of the present invention.

Claims

1. A multi-point secure transmission method with service concealment, characterized in that: Through the identification key distribution management system, an independent software shield is deployed for each gateway device as the identification key for system communication. The gateway devices perform the following point-to-point communication between each other to encrypt data transmission: Device B, as a communication request receiver, verifies a single-package authentication message of device A, as a communication request initiator, based on the identification key information of device A, including: device A uses its private key to digitally sign the single-package authentication message to obtain first signature data; device A constructs a single-package authentication message based on the single-package authentication message and the first signature data and sends it to device B; device B obtains the first signature data based on the single-package authentication message, and verifies the single-package authentication message of device A based on the first signature data; wherein the single-package authentication message includes a device identification, a timestamp, a protocol version, and a random package sequence number; device A uses its private key to digitally sign the single-package authentication message to obtain signature data, including: , SignA represents the first signature data, Signature represents a digital signature algorithm based on public key encryption technology, Apriv represents A's private key, Hash represents a hash algorithm, IDA represents A's identifier, Timestamp represents a timestamp, Version represents a protocol version, RandId represents a random packet number, and "||" represents a data connection symbol; After the single-packet authentication is passed, device A and device B perform identity authentication key negotiation based on the identification key information of both parties to obtain a data transmission shared key, including: device A and device B respectively calculate a first shared key based on their own private keys and the other party's public key; device A and device B exchange their respective identity authentication messages based on the first shared key, including random numbers generated by each party; device A and device B respectively calculate a second shared key based on the random numbers generated by both parties, that is, a data transmission shared key; the calculation method for device A and device B to calculate the first shared key based on their own private keys and the other party's public key is: , wherein Skey1 represents the first shared key, Apriv and Bpriv represent the private key of A and the private key of B respectively, Apub and Bpub represent the public key of A and the public key of B respectively; Ecdh represents the ECDH algorithm; the device A and the device B exchange their respective authentication messages based on the first shared key, including: one of the devices A and B signs its own authentication message data with its private key to obtain the second signature data; the party encrypts its own authentication message and the second signature data based on the first shared key to obtain the first encrypted authentication ciphertext, and sends it to the other party; the other party decrypts the received first encrypted authentication ciphertext based on the first shared key to obtain the identity authentication message and the second signature data of A; the other party verifies the second signature data based on the public key of the party to confirm the identity authentication message of the party; Device A and device B construct an encrypted UDP channel based on the shared key to achieve encrypted data transmission.

2. The transmission method according to claim 1, characterized in that: The identity authentication message includes a device identifier, a timestamp, a protocol version, and a random number; the random number is 16 bytes long.

3. The transmission method according to claim 2, characterized in that: The device A and the device B respectively calculate the second shared key based on the random numbers generated by both parties, including: ； Among them, RandA represents the random number generated by A, and RandB represents the random number generated by B. Indicates that a hash algorithm is used.

4. A multi-point secure transmission system with hidden services, characterized in that: Including identification key distribution management system and various gateway devices, The identification key distribution management system is used to deploy an independent software shield for each gateway device as the identification key for system communication; The gateway devices perform the following point-to-point communication between each other to perform data encryption transmission: Device B, as the communication request receiver, verifies the single-package authentication message of Device A, as the communication request initiator, based on the identification key information of Device A, including: Device A uses its private key to digitally sign the single-package authentication message to obtain the first signature data; Device A constructs a single-package authentication message based on the single-package authentication message and the first signature data and sends it to Device B; Device B obtains the first signature data based on the single-package authentication message, and verifies the single-package authentication message of Device A based on the first signature data; wherein the single-package authentication message includes a device identification, a timestamp, a protocol version, and a random package sequence number; Device A uses its private key to digitally sign the single-package authentication message to obtain the signature data including: , SignA represents the first signature data, Signature represents a digital signature algorithm based on public key encryption technology, Apriv represents A's private key, Hash represents a hash algorithm, IDA represents A's identification, Timestamp represents a timestamp, Version represents a protocol version, RandId represents a random package number, and "||" represents a data connection symbol; after the single package authentication is passed, device A and device B perform identity authentication key negotiation based on the identification key information of both parties to obtain a data transmission shared key, including: device A and device B respectively calculate the first shared key based on their own private keys and the other party's public key; device A and device B exchange their respective identity authentication messages based on the first shared key, including the random numbers generated by each party; device A and device B respectively calculate the second shared key based on the random numbers generated by both parties, that is, the data transmission shared key; the calculation method for the first shared key calculated by device A and device B respectively based on their own private keys and the other party's public key is: , wherein Skey1 represents the first shared key, Apriv and Bpriv represent the private key of A and the private key of B respectively, Apub and Bpub represent the public key of A and the public key of B respectively; Ecdh represents the ECDH algorithm; the device A and the device B exchange their respective authentication messages based on the first shared key, including: one of the devices A and B signs its own authentication message data with its private key to obtain the second signature data; the party encrypts its own authentication message and the second signature data based on the first shared key to obtain the first encrypted authentication ciphertext, and sends it to the other party; the other party decrypts the received first encrypted authentication ciphertext based on the first shared key to obtain A's authentication message and the second signature data; the other party verifies the second signature data based on the public key of the party to confirm the party's authentication message; the device A and the device B construct an encrypted UDP channel based on the shared key to realize data encryption transmission.

5. The transmission system according to claim 4, characterized in that: The device initiating the communication request is the client, and the device receiving the communication request is the server; For dial-up network devices without fixed IP and port, they can only act as clients; For network devices with fixed external IP and port, they can act as both clients and servers.

Images