A link layer communication encryption method and system

Abstract

The present invention relates to a link layer communication encryption method and system. The method is designed with a terminal side link encryption gateway and a service side link encryption gateway for a service terminal and a service system. Based on device authentication, identity authentication and session key negotiation are integrated for design and application. While realizing security authentication, a session key applied between the terminal side link encryption gateway and the service side link encryption gateway is obtained, that is, a lightweight security authentication mechanism is realized, a dynamic session key is generated for each service terminal connected, and the security of data communication and transmission is enhanced. The design scheme encrypts the communication data of the service terminal at the link layer, ensures that the intranet network information is hidden, and realizes that the intranet service system and equipment are not attacked; and the gateway itself is not configured with an actual IP and MAC, so that malicious users cannot carry out targeted attacks on it.

Description

Technical Field

[0001] The present invention relates to a link layer communication encryption method and system, belonging to the technical field of data encryption. Background Art

[0002] The network communication encryption method is a mechanism for encrypting data during network transmission. It mainly encrypts and decrypts data between two nodes of communication to ensure the security of data during transmission. The TCP / IP network model describes the hierarchical structure of data transmission in the network. When data is transmitted from the sender to the receiver, it will go through multiple levels of encapsulation and decapsulation processes. Therefore, people have proposed many communication encryption methods for the TCP / IP network model. The mainstream ones include SSL protocol and IPSec protocol. They realize communication encryption and security protection between terminals and business systems and between subnets for the application layer, transport layer and network layer, and have been fully and widely used in various industries. However, with the extension of business scenarios and the improvement of security requirements, it is urgent to break through the traditional communication encryption mechanism on the market and realize a communication encryption method based on the link layer, realize transparent encryption of upper-layer protocols, support multiple network environments, be compatible with existing network equipment and topologies, and further improve the security protection level of business data during network transmission.

[0003] The existing network communication encryption construction process involves three entities: terminals, security gateways, and business systems. The channel construction process is as follows: Figure 2 As shown,

[0004] Taking SSLVPN as an example, the specific communication encryption process is as follows: ① The SSLVPN module of the terminal performs identity authentication, cipher suite and session key negotiation with the SSLVPN gateway. After successful authentication, the SSLVPN gateway sends the virtual address and business system routing configuration; ② The terminal SSLVPN module adds a virtual network card to the terminal and modifies the target IP to the next-hop gateway of the business system as a virtual address, so that the SSLVPN module can read data from the virtual network card for encryption; ③ When data is upstream, the business APP sends the data with the target IP of the business system to the operating system, and the operating system sends the data to the virtual network card according to the route; ④ The SSLVPN module polls the virtual network card to obtain the business plaintext data, encrypts the original network layer data, adds a new IP header and sends it to the operating system, which is sent to the physical network card according to the route. The new destination IP is the SSLVPN gateway address; ⑤ The SSLVPN gateway receives the data, decrypts it to obtain the original IP data, and sends it to the designated business system according to the original destination IP address.

[0005] Existing communication encryption technologies and methods have improved the security of terminal and business communications to a certain extent, but they have the following shortcomings:

[0006] (1) They can only achieve network layer data security protection, that is, the IP packet header in the business communication process is still visible to the outside world, and it is impossible to completely hide the network information of the internal business system, which poses the risk of being sniffed and attacked. In addition, as a network boundary security protection device, the VPN gateway is also very easy to become a target of network attacks after its own network information is exposed;

[0007] (2) Significant changes are made to business systems, business terminals, and network topology. For example, SSLVPN requires the installation of a client on the terminal to achieve network layer security protection, and the terminal's network configuration will be modified during the communication process; IPSecVPN requires the devices in the subnet to re-modify the routing gateway configuration to achieve data forwarding, and has high requirements on user network configuration capabilities. Summary of the invention

[0008] The technical problem to be solved by the present invention is to provide a link layer communication encryption method, which is designed with link layer encryption to ensure the hiding of intranet network information and to protect the intranet business system and equipment from attack.

[0009] In order to solve the above technical problems, the present invention adopts the following technical solutions: The present invention designs a link layer communication encryption method, based on the data link created by the service terminal through the terminal side link encryption gateway, the service side link encryption gateway, and the service system in sequence, for the data frame uploaded by the service terminal to the terminal side link encryption gateway, the following steps are performed:

[0010] Step A. The terminal side link encryption gateway receives the data frame from the service terminal, performs device authentication on the service terminal corresponding to the data frame, and contacts the service side link encryption gateway to perform identity authentication on the service terminal corresponding to the data frame, and enters step B when both the device authentication and identity authentication are currently passed;

[0011] Step B. The terminal-side link encryption gateway calls the session key corresponding to the most recent successful identity authentication state, encrypts and encapsulates the data frame, and sends it to the service-side link encryption gateway. The service-side link encryption gateway calls the session key corresponding to the most recent successful identity authentication state to parse and decrypt it, and forwards it to the corresponding service system for query, obtains the feedback result data frame, and forwards it to the service-side link encryption gateway, and then proceeds to step C;

[0012] Step C. The service side link encryption gateway calls the session key corresponding to the most recent successful identity authentication state, encrypts and encapsulates the received feedback result data frame, and sends it to the terminal side link encryption gateway. The terminal side link encryption gateway calls the session key corresponding to the most recent successful identity authentication state to parse and decrypt, and forward it to the service terminal.

[0013] As a preferred technical solution of the present invention: in the step A, the link encryption gateway on the terminal side performs device authentication based on the preset legal MACs to determine whether the source MAC corresponding to the received data frame is legal. If so, the device authentication is currently passed, and the link encryption gateway on the terminal side is contacted to perform identity authentication of the service terminal corresponding to the data frame; otherwise, the device authentication is currently not passed and the data frame is discarded.

[0014] As a preferred technical solution of the present invention: in the step A, based on the current passing of the device authentication, the terminal side link encryption gateway determines if the service terminal corresponding to the data frame has successfully passed the identity authentication, and further determines whether the current time is within the preset authentication validity period from the time when the service terminal's most recent identity authentication was successful. If so, the identity authentication is currently passed, and the process goes to step B; otherwise, the identity authentication is currently not passed, and the service side link encryption gateway is contacted to perform the identity authentication of the service terminal corresponding to the data frame. If the identity authentication is successful, that is, the identity authentication is currently passed, and the process goes to step B. If the identity authentication fails, the data frame is discarded; the terminal side link encryption gateway determines if the service terminal corresponding to the data frame has not successfully passed the identity authentication, and the identity authentication is currently not passed, and the service side link encryption gateway is contacted to perform the identity authentication of the service terminal corresponding to the data frame. If the identity authentication is successful, that is, the identity authentication is currently passed, and the process goes to step B. If the identity authentication fails, the data frame is discarded.

[0015] As a preferred technical solution of the present invention: in step A, the terminal side link encryption gateway contacts the service side link encryption gateway according to the following steps to perform identity authentication of the service terminal corresponding to the data frame;

[0016] Step A1. The terminal side link encryption gateway , and its The corresponding root key , combined with the current timestamp , and the service terminal in the data frame , , using the ECB key derivation function of the standard national encryption SM1 , according to the following formula:

[0017]

[0018] Obtain the basic session key of the link encryption gateway on the terminal side corresponding to the service terminal , then proceed to step A2;

[0019] Step A2. The terminal side link encryption gateway generates a preset byte random number , combined with the base session key , respectively apply the key derivation function of the standard national encryption SM1 , and the HMAC function of the standard national encryption SM3 , according to the following formula:

[0020]

[0021]

[0022] Obtain the certification material corresponding to the terminal side link encryption gateway , and the session key material authentication code , then proceed to step A3;

[0023] Step A3. The terminal side link encryption gateway , basic session key , random numbers , and the service terminal in the data frame , using the ECB key derivation function of the standard national encryption SM1 , according to the following formula:

[0024]

[0025] Get the session key of the terminal side link encryption gateway , then proceed to step A4;

[0026] Step A4. The terminal side link encryption gateway uses , Authentication materials corresponding to the terminal side link encryption gateway , Session key material authentication code , and the service terminal in the data frame , construct the identity authentication request data, and add the business terminal Source IP, service terminal The source MAC, the virtual IP address provided by the service side link encryption gateway as the destination IP, and the MAC of the service system as the destination MAC, the message header is updated, an identity authentication request message is constructed, and the message is sent to the service side link encryption gateway along the data link between the terminal side link encryption gateway and the service side link encryption gateway, and then step A5 is entered;

[0027] Step A5. The service side link encryption gateway receives the identity authentication request message for parsing and obtains the terminal side link encryption gateway , business terminal , , and combined with the current timestamp , using the ECB key derivation function of the standard national encryption SM1 , according to the following formula:

[0028]

[0029] Obtain the basic session key of the service side link encryption gateway corresponding to the service terminal ,in, Indicates the link encryption gateway on the service side that has learned the link encryption gateway on the terminal side The corresponding root key and apply the basic session key Certification materials Decrypt and get a random number , Terminal side link encryption gateway timestamp , Terminal side link encryption gateway , Business Terminal , Business Terminal , determine the current timestamp Is it located in If the authentication is successful, the data frame is discarded.

[0030] Step A6. The service side link encryption gateway for the basic session key , random numbers , Current timestamp , Terminal side link encryption gateway , Business Terminal , Business Terminal , using the HMAC function of the standard national encryption SM3 , according to the following formula:

[0031]

[0032] Get the session key material authentication code corresponding to the service side link encryption gateway , and judge and Are they consistent? If yes, the business side link encryption gateway applies the ECB key derivation function of the national encryption standard SM1. , according to the following formula:

[0033]

[0034] Get the session key of the service side link encryption gateway , then go to step A7; otherwise, the identity authentication fails;

[0035] Step A7. The service side link encryption gateway applies the session key , encrypt the authentication success message and the authentication success time, construct the authentication success data, and add the service side gateway virtual IP as the source IP, the service system MAC as the source MAC, and the service terminal For the destination IP and service terminal The source is the destination MAC, the message header is updated, an identity authentication success message is constructed, and the message is sent to the terminal side link encryption gateway along the data link between the service side link encryption gateway and the terminal side link encryption gateway, and then step A8 is entered;

[0036] Step A8. The terminal side link encryption gateway applies the session key , decrypt the identity authentication success message to obtain the identity authentication success message and the identity authentication success time, that is, the identity authentication is successful.

[0037] As a preferred technical solution of the present invention: in the step B, the service side link encryption gateway parses the encrypted message from the terminal side link encryption gateway, and performs device authentication based on the preset legal MACs to determine whether the source MAC is legal. If the source MAC is legal, it further determines whether the identity authentication of the corresponding service terminal has been successfully authenticated. If so, the service side link encryption gateway further calls the session key corresponding to the most recent successful authentication state for decryption; otherwise, the encrypted message is discarded; if the source MAC is illegal, the encrypted message is discarded.

[0038] As a preferred technical solution of the present invention: in step B, the terminal side link encryption gateway first calls its session key corresponding to the most recent successful identity authentication state, encrypts the IP header, the target network transmission protocol header, and the application data in the data frame to form encrypted application data; then, based on the Ethernet header, adds the service terminal's Source IP, service terminal The source MAC, the virtual IP address provided by the service side link encryption gateway as the destination IP, and the MAC of the service system as the destination MAC constitute the message header; finally, a check code for the message header and the encrypted application data is generated, and the message header, the encrypted application data, and the check code are encapsulated to constitute an encrypted message, which is sent to the service side link encryption gateway; the service side link encryption gateway parses the received encrypted message to obtain the encrypted application data, and then calls the session key corresponding to the most recent successful identity authentication state to decrypt the encrypted application data, obtain the data frame, and encapsulate and forward it to the corresponding service system for query;

[0039] In step C, the service side link encryption gateway calls the session key corresponding to the most recent successful identity authentication state to encrypt the received feedback result data frame to form encrypted feedback data; then, based on the Ethernet header, add the service side gateway virtual IP as the source IP, the service system MAC as the source MAC, and the service terminal For the destination IP and service terminal The source and destination MAC are used to form a message header; finally, a check code for the message header and the encrypted feedback data is generated, and the message header, encrypted feedback data, and the check code are encapsulated to form an encrypted feedback message, which is sent to the link encryption gateway on the terminal side. The link encryption gateway on the terminal side parses the received encrypted feedback message to obtain the encrypted feedback data, and then calls the session key corresponding to the most recent successful authentication state to decrypt the encrypted feedback data, obtain the feedback result data frame, and encapsulate it to the forwarding service terminal.

[0040] Corresponding to the above, the technical problem that the present invention also needs to solve is to provide a system for a link layer communication encryption method, modularly design a gateway under link layer encryption, efficiently implement the design method, and ensure data security and efficiency.

[0041] In order to solve the above technical problems, the present invention adopts the following technical solutions: the present invention designs a system of a link layer communication encryption method, based on a data link created by a service terminal through a terminal side link encryption gateway, a service side link encryption gateway, and a service system in sequence, the structure of the terminal side link encryption gateway is the same as that of the service side link encryption gateway, and the terminal side link encryption gateway and the service side link encryption gateway respectively include a data capture module, a data parsing module, a device authentication module, an identity authentication module, a data encryption and decryption module, a device authentication library, a hardware password module, and a data sending module;

[0042] In the terminal side link encryption gateway, the data capture module is used to poll the data frames and encrypted feedback messages on the network card receiving buffer queue; the data parsing module is used to parse the data frames and encrypted feedback messages received by the data capture module; the device authentication library is composed of preset legal MACs, and the device authentication module is used to authenticate the source MAC of the data frames from the service terminal according to the preset legal MACs in the device authentication library; the identity authentication module is used to contact the identity authentication module in the service side link encryption gateway through the data sending module and the data capture module according to the hardware password module to realize identity authentication for the service terminal; the data encryption and decryption module is used to encrypt the data frames and decrypt the encrypted feedback messages according to the hardware password module; the data sending module is used to send the encrypted messages and feedback result data frames;

[0043] In the service side link encryption gateway, the data capture module is used to poll the feedback result data frames and encrypted messages on the network card receiving buffer queue; the data parsing module is used to parse the feedback result data frames and encrypted messages received by the data capture module; the device authentication library is composed of preset legal MACs, and the device authentication module is used to authenticate the source MAC of the encrypted message from the terminal side link encryption gateway according to the preset legal MACs in the device authentication library; the identity authentication module is used to determine whether the identity authentication of the service terminal has been successfully authenticated according to the hardware password module; the data encryption and decryption module is used to encrypt the feedback result data frames and decrypt the encrypted messages according to the hardware password module; the data sending module is used to send encrypted feedback messages and data frames.

[0044] The link layer communication encryption method and system described in the present invention, using the above technical solution, has the following technical effects compared with the prior art:

[0045] The present invention designs a link layer communication encryption method and system, which are designed for the link encryption gateway on the terminal side and the link encryption gateway on the service side between the service terminal and the service system. Based on the device authentication, the identity authentication and the session key negotiation are designed and applied in one body. While realizing the security authentication, the session key applied between the link encryption gateway on the terminal side and the link encryption gateway on the service side is obtained, that is, a lightweight security authentication mechanism is realized, and a dynamic session key is generated for each service terminal connected, thereby enhancing the security of data communication and transmission. The design scheme encrypts the communication data of the service terminal at the link layer, ensures the hiding of the intranet network information, and realizes that the intranet service system and equipment are not attacked; and the gateway itself is not configured with the actual IP and MAC, thereby ensuring that malicious users cannot carry out targeted attacks on it. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the system application architecture of the link layer communication encryption method designed by the present invention;

[0047] Figure 2 It is an application schematic diagram of the link layer communication encryption method designed by the present invention;

[0048] Figure 3 It is a schematic diagram of message construction under the link layer communication encryption method designed by the present invention;

[0049] Figure 4 It is a schematic diagram of an encryption gateway module in a system of a link layer communication encryption method designed by the present invention. DETAILED DESCRIPTION

[0050] The specific implementation modes of the present invention will be further described in detail below in conjunction with the accompanying drawings.

[0051] The present invention aims at the deficiencies in the prior art, and the design ideas are as follows:

[0052] (1) Design a link layer identity authentication and key negotiation mechanism to perform security authentication based on terminal communication information, complete key negotiation, and generate session keys;

[0053] (2) Design a link layer encryption communication mechanism to securely encrypt communication data at the link layer, shield the differences between the network layer and the transport layer protocols, and hide the network information of devices within the LAN to prevent malicious sniffing;

[0054] (3) Provide a link layer communication encryption system, including a terminal, a link encryption gateway and a business system; connect the link encryption gateway in series between the terminal and the business system to achieve secure authentication and encryption of communication data between the terminal and the business system, and provide data filtering and access control to resist various forms of network attacks.

[0055] Regarding the above design ideas, the present invention designs a link layer communication encryption method, according to Figure 1 As shown, based on the data link created by the service terminal through the terminal side link encryption gateway, the service side link encryption gateway, and the service system in sequence, for the data frame uploaded by the service terminal to the terminal side link encryption gateway, in actual application, such as Figure 2 As shown, taking TCP connection as an example, in the three-way handshake process under TCP connection, device authentication and identity authentication are added, and the following step A is specifically performed, and then steps B to C are further performed to perform data communication.

[0056] Step A. The terminal side link encryption gateway performs device authentication on the service terminal corresponding to the data frame by polling the data frame from the service terminal in the buffer queue of its network card reception, and contacts the service side link encryption gateway to perform identity authentication on the service terminal corresponding to the data frame. When both the device authentication and the identity authentication are currently passed, it proceeds to step B.

[0057] In step A, it is about verifying whether the device authentication and identity authentication are passed. In actual application, regarding device authentication, the link encryption gateway on the terminal side performs device authentication based on the preset legal MACs to determine whether the source MAC corresponding to the received data frame is legal. If so, the device authentication is currently passed, and the link encryption gateway on the terminal side is contacted to perform identity authentication of the service terminal corresponding to the data frame; otherwise, the device authentication is currently not passed and the data frame is discarded.

[0058] Regarding identity authentication, based on the fact that the device authentication has currently passed, the terminal side link encryption gateway determines if the service terminal corresponding to the data frame has successfully passed the identity authentication, and then further determines whether the current time is within the preset authentication validity period from the time when the service terminal's most recent identity authentication was successful. If so, the identity authentication is currently passed and enters step B; otherwise, the identity authentication is currently not passed, and the service side link encryption gateway is contacted to perform the identity authentication of the service terminal corresponding to the data frame. If the identity authentication is successful, that is, the identity authentication is currently passed, then enter step B. If the identity authentication fails, the data frame is discarded; the terminal side link encryption gateway determines that if the service terminal corresponding to the data frame has not successfully passed the identity authentication, then the identity authentication is currently not passed, and the service side link encryption gateway is contacted to perform the identity authentication of the service terminal corresponding to the data frame. If the identity authentication is successful, that is, the identity authentication is currently passed, then enter step B. If the identity authentication fails, the data frame is discarded.

[0059] During actual implementation, the terminal side link encryption gateway specifically contacts the service side link encryption gateway according to the following steps A1 to A8 to perform identity authentication of the service terminal corresponding to the data frame.

[0060] Step A1. The terminal side link encryption gateway , and its The corresponding root key , combined with the current timestamp , and the service terminal in the data frame , , using the ECB key derivation function of the standard national encryption SM1 , according to the following formula:

[0061]

[0062] Obtain the basic session key of the link encryption gateway on the terminal side corresponding to the service terminal , then go to step A2.

[0063] Step A2. The terminal side link encryption gateway generates a preset byte random number , combined with the base session key , respectively apply the key derivation function of the standard national encryption SM1 , and the HMAC function of the standard national encryption SM3 , according to the following formula:

[0064]

[0065]

[0066] Obtain the certification material corresponding to the terminal side link encryption gateway , and the session key material authentication code , then go to step A3.

[0067] Step A3. The terminal side link encryption gateway , basic session key , random numbers , and the service terminal in the data frame , using the ECB key derivation function of the standard national encryption SM1 , according to the following formula:

[0068]

[0069] Get the session key of the terminal side link encryption gateway , then go to step A4.

[0070] Step A4. The terminal side link encryption gateway uses , Authentication materials corresponding to the terminal side link encryption gateway , Session key material authentication code , and the service terminal in the data frame , construct the identity authentication request data, and add the business terminal Source IP, service terminal The source MAC, the virtual IP address provided by the service side link encryption gateway as the destination IP, and the MAC of the service system as the destination MAC, update the message header, construct an authentication request message, and send it to the service side link encryption gateway along the data link between the terminal side link encryption gateway and the service side link encryption gateway, and then enter step A5.

[0071] Step A5. The service side link encryption gateway receives the identity authentication request message for parsing and obtains the terminal side link encryption gateway , business terminal , , and combined with the current timestamp , using the ECB key derivation function of the standard national encryption SM1 , according to the following formula:

[0072]

[0073] Obtain the basic session key of the service side link encryption gateway corresponding to the service terminal ,in, Indicates the link encryption gateway on the service side that has learned the link encryption gateway on the terminal side The corresponding root key and apply the basic session key Certification materials Decrypt and get a random number , Terminal side link encryption gateway timestamp , Terminal side link encryption gateway , Business Terminal , Business Terminal , determine the current timestamp Is it located in If the authentication is successful within the validity period of the preset authentication process, the process proceeds to step A6; otherwise, the identity authentication fails and the data frame is discarded.

[0074] Step A6. The service side link encryption gateway for the basic session key , random numbers , Current timestamp , Terminal side link encryption gateway , Business Terminal , Business Terminal , using the HMAC function of the standard national encryption SM3 , according to the following formula:

[0075]

[0076] Get the session key material authentication code corresponding to the service side link encryption gateway , and judge and Are they consistent? If yes, the business side link encryption gateway applies the ECB key derivation function of the national encryption standard SM1. , according to the following formula:

[0077]

[0078] Get the session key of the service side link encryption gateway , then go to step A7; otherwise, the identity authentication fails.

[0079] Step A7. The service side link encryption gateway applies the session key , encrypt the authentication success message and the authentication success time, construct the authentication success data, and add the service side gateway virtual IP as the source IP, the service system MAC as the source MAC, and the service terminal For the destination IP and service terminal The source is the destination MAC, the message header is updated, an identity authentication success message is constructed, and it is sent to the terminal side link encryption gateway along the data link between the service side link encryption gateway and the terminal side link encryption gateway, and then step A8 is entered.

[0080] Step A8. The terminal side link encryption gateway applies the session key , decrypt the identity authentication success message to obtain the identity authentication success message and the identity authentication success time, that is, the identity authentication is successful.

[0081] Step B. The terminal-side link encryption gateway first calls the session key corresponding to the most recent successful identity authentication state to encrypt the IP header, target network transmission protocol header, and application data in the data frame to form encrypted application data; then Figure 3 As shown, based on the Ethernet header, add the service terminal Source IP, service terminal The source MAC, the virtual IP address provided by the service side link encryption gateway is the destination IP, and the MAC of the service system is the destination MAC to form the message header; finally, a check code for the message header and encrypted application data is generated, and the message header, encrypted application data, and the check code are encapsulated to form an encrypted message, which is sent to the service side link encryption gateway.

[0082] The service side link encryption gateway parses the encrypted message from the terminal side link encryption gateway, obtains the source MAC and encrypted application data, and performs device authentication based on the preset legal MACs to determine whether the source MAC is legal. If the source MAC is legal, it further determines whether the identity authentication of the corresponding service terminal has been successfully authenticated. If so, the service side link encryption gateway further calls the session key corresponding to the most recent successful authentication state to decrypt the encrypted application data, obtains the data frame, encapsulates and forwards it to the corresponding service system for query, obtains the feedback result data frame, and forwards it to the service side link encryption gateway, and then enters step C; otherwise, the encrypted message is discarded; if the source MAC is illegal, the encrypted message is discarded.

[0083] Step C. The service side link encryption gateway calls the session key corresponding to the most recent successful identity authentication state to encrypt the received feedback result data frame to form encrypted feedback data; then based on the Ethernet header, add the service side gateway virtual IP as the source IP, the service system MAC as the source MAC, and the service terminal For the destination IP and service terminal The source and destination MAC are used to form a message header; finally, a check code for the message header and the encrypted feedback data is generated, and the message header, encrypted feedback data, and the check code are encapsulated to form an encrypted feedback message, which is sent to the link encryption gateway on the terminal side. The link encryption gateway on the terminal side parses the received encrypted feedback message to obtain the encrypted feedback data, and then calls the session key corresponding to the most recent successful authentication state to decrypt the encrypted feedback data, obtain the feedback result data frame, and encapsulate it to the forwarding service terminal.

[0084] In view of the application of the link layer communication encryption method designed above, in actual application, a corresponding system is further designed, based on the data link created by the business terminal through the terminal side link encryption gateway, the business side link encryption gateway, and the business system in sequence. The structure of the terminal side link encryption gateway is the same as that of the business side link encryption gateway, such as Figure 4 As shown, the terminal side link encryption gateway and the service side link encryption gateway respectively include a data capture module, a data parsing module, a device authentication module, an identity authentication module, a data encryption and decryption module, a device authentication library, a hardware password module, and a data sending module.

[0085] In the terminal side link encryption gateway, the data capture module is used to poll the data frames and encrypted feedback messages on the network card receiving buffer queue; the data parsing module is used to parse the data frames and encrypted feedback messages received by the data capture module; the device authentication library is composed of preset legal MACs, and the device authentication module is used to authenticate the source MAC of the data frames from the service terminal according to the preset legal MACs in the device authentication library; the identity authentication module is used to contact the identity authentication module in the service side link encryption gateway through the data sending module and the data capture module according to the hardware password module, and realize identity authentication for the service terminal; the data encryption and decryption module is used to encrypt the data frames and decrypt the encrypted feedback messages according to the hardware password module; the data sending module is used to send encrypted messages and feedback result data frames.

[0086] In the service side link encryption gateway, the data capture module is used to poll the feedback result data frames and encrypted messages on the network card receiving buffer queue; the data parsing module is used to parse the feedback result data frames and encrypted messages received by the data capture module; the device authentication library is composed of preset legal MACs, and the device authentication module is used to authenticate the source MAC of the encrypted message from the terminal side link encryption gateway according to the preset legal MACs in the device authentication library; the identity authentication module is used to determine whether the identity authentication of the service terminal has been successfully authenticated according to the hardware password module; the data encryption and decryption module is used to encrypt the feedback result data frames and decrypt the encrypted messages according to the hardware password module; the data sending module is used to send encrypted feedback messages and data frames.

[0087] In the design application, since the encryption gateway takes the initiative to capture data packets, the network topology on the terminal side and the business side does not need to be changed. The encryption gateway implements security authentication and binding of the terminal and business system server based on the MAC address to ensure the security and reliability of the access device. At the same time, the encryption gateway on the terminal side and the encryption gateway on the business side perform identity authentication to generate dynamic session keys to implement link data security encryption, hide IP and other communication information, and prevent malicious users from sniffing the network and tampering with data.

[0088] The present invention is designed for the service terminal and the service system with a terminal-side link encryption gateway and a service-side link encryption gateway. Based on device authentication, identity authentication and session key negotiation are designed and applied in one. While realizing security authentication, the session key applied between the terminal-side link encryption gateway and the service-side link encryption gateway is obtained, that is, a lightweight security authentication mechanism is realized, and a dynamic session key is generated for each service terminal connected, thereby enhancing the security of data communication and transmission. The design encrypts the service terminal communication data at the link layer to ensure that the intranet network information is hidden, and the intranet service system and equipment are not attacked. In addition, the gateway itself is not configured with an actual IP and MAC, thereby ensuring that malicious users cannot carry out targeted attacks on it.

[0089] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the above embodiments, and various changes can be made within the knowledge scope of ordinary technicians in this field without departing from the purpose of the present invention.

Claims

1. A link layer communication encryption method, characterized in that: Based on the data link created by the service terminal through the terminal side link encryption gateway, the service side link encryption gateway, and the service system in sequence, the following steps are performed for the data frame uploaded by the service terminal to the terminal side link encryption gateway: Step A. The terminal side link encryption gateway receives the data frame from the service terminal, performs device authentication on the service terminal corresponding to the data frame, and contacts the service side link encryption gateway to perform identity authentication on the service terminal corresponding to the data frame, and enters step B when both the device authentication and identity authentication are currently passed; Step B. The terminal side link encryption gateway calls its session key corresponding to the most recent successful identity authentication state, encrypts and encapsulates the data frame, and sends it to the service side link encryption gateway. The service side link encryption gateway calls its session key corresponding to the most recent successful identity authentication state to parse and decrypt, and forwards it to the corresponding service system for query, obtains the feedback result data frame, and forwards it to the service side link encryption gateway, and then enters step C; Step C. The service-side link encryption gateway calls the session key corresponding to the most recent successful identity authentication state, encrypts and encapsulates the received feedback result data frame, and sends it to the terminal-side link encryption gateway. The terminal-side link encryption gateway calls the session key corresponding to the most recent successful identity authentication state to parse and decrypt it, and forwards it to the service terminal; In the above step A, the terminal side link encryption gateway contacts the service side link encryption gateway according to the following steps to perform identity authentication of the service terminal corresponding to the data frame; Step A1. The terminal side link encryption gateway uses its ID A , and its ID A The corresponding root key K Am , combined with the current timestamp T A , and the MAC address of the service terminal in the data frame i 、IP i , using the ECB key derivation function SM1_ECB[] of the standard national encryption SM1, according to the following formula: K i =SM1_ECB(K Am ,T A ||ID A ||MAC i ||IP i ) Obtain the basic session key K of the terminal-side link encryption gateway corresponding to the service terminal i , then proceed to step A2; Step A2. The terminal side link encryption gateway generates a preset byte random number R A , and combined with the basic session key K i , respectively apply the key derivation function SM1_ECB[ ] of the standard national secret SM1 and the HMAC function SM3_HMAC[ ] of the standard national secret SM3, according to the following formula: M A =SM1_ECB(K i ,R A ||T A ||ID A ||MAC i ||IP i ) K_HASH=SM3_HMAC(K i ,R A ||T A ||ID A ||MAC i ||IP i ) Get the authentication material M corresponding to the terminal side link encryption gateway A , and the session key material authentication code K_HASH, and then proceed to step A3; Step A3. The terminal side link encryption gateway uses its ID A , basic session key K i , random number R A , and the MAC address of the service terminal in the data frame i , using the ECB key derivation function SM1_ECB[ ] of the standard national encryption SM1, according to the following formula: K A =SM1_ECB(K i ,R A ||ID A ||MAC i ) Get the session key K of the terminal side link encryption gateway A , then proceed to step A4; Step A4. The terminal side link encryption gateway uses its ID A , the authentication material M corresponding to the terminal side link encryption gateway A , session key material authentication code K_HASH, and the MAC of the service terminal in the data frame i , construct the authentication request data and add the IP of the business terminal i Source IP, MAC of service terminal i The source MAC, the virtual IP address provided by the service side link encryption gateway as the destination IP, and the MAC of the service system as the destination MAC, the message header is updated, an identity authentication request message is constructed, and the message is sent to the service side link encryption gateway along the data link between the terminal side link encryption gateway and the service side link encryption gateway, and then step A5 is entered; Step A5. The service side link encryption gateway receives the identity authentication request message and parses it to obtain the ID of the terminal side link encryption gateway A , MAC address of the service terminal i 、IP i , and combined with the current timestamp T B , using the ECB key derivation function SM1_ECB[ ] of the standard national encryption SM1, according to the following formula: Obtain the basic session key of the service side link encryption gateway corresponding to the service terminal Among them, K' Am Indicates the terminal side link encryption gateway ID learned by the service side link encryption gateway A The corresponding root key and apply the basic session key For certified material M A Decrypt and obtain the random number R A , terminal side link encryption gateway timestamp T A , Terminal side link encryption gateway ID A 、Business terminal MAC i , Business terminal IP i , determine the current timestamp T B Is it located in the self T A If the authentication is successful, the data frame is discarded. Step A6. The service side link encryption gateway uses the basic session key Random number R A , current timestamp T B , Terminal side link encryption gateway ID A 、Business terminal MAC i , Business terminal IP i , apply the HMAC function SM3_HMAC[ of the standard national encryption SM3, according to the following formula: Get the session key material authentication code K_HASH corresponding to the service side link encryption gateway * , and determine K_HASH * Is it consistent with K_HASH? If yes, the service side link encryption gateway applies the ECB key derivation function SM1_ECB[ ] of the standard national encryption SM1, according to the following formula: Get the session key K of the service side link encryption gateway B , then go to step A7; otherwise, the identity authentication fails; Step A7. The service side link encryption gateway applies the session key K B , encrypt the authentication success message and the authentication success moment, construct the authentication success data, and add the business side gateway virtual IP as the source IP, the business system MAC as the source MAC, and the business terminal IP i Destination IP, MAC of service terminal i The source is the destination MAC, the message header is updated, an identity authentication success message is constructed, and the message is sent to the terminal side link encryption gateway along the data link between the service side link encryption gateway and the terminal side link encryption gateway, and then step A8 is entered; Step A8. The terminal side link encryption gateway applies the session key K A , decrypt the identity authentication success message to obtain the identity authentication success message and the identity authentication success time, that is, the identity authentication is successful.

2. A link layer communication encryption method according to claim 1, characterized in that: In step A, the link encryption gateway on the terminal side performs device authentication based on the preset legal MACs to determine whether the source MAC corresponding to the received data frame is legal. If so, the device authentication is currently passed, and the link encryption gateway on the terminal side is contacted to perform identity authentication of the service terminal corresponding to the data frame; otherwise, the device authentication is currently not passed and the data frame is discarded.

3. A link layer communication encryption method according to claim 1 or 2, characterized in that: In step A, based on the device authentication currently passing, the terminal side link encryption gateway determines if the service terminal corresponding to the data frame has successfully passed the identity authentication, and further determines whether the current time is within the preset authentication validity period from the time when the service terminal's most recent identity authentication was successful. If so, the identity authentication is currently passed, and enters step B; otherwise, the identity authentication is currently not passed, and the service side link encryption gateway is contacted to perform the identity authentication of the service terminal corresponding to the data frame. If the identity authentication is successful, that is, the identity authentication is currently passed, then enter step B. If the identity authentication fails, the data frame is discarded; the terminal side link encryption gateway determines that if the service terminal corresponding to the data frame has not successfully passed the identity authentication, the identity authentication is currently not passed, and the service side link encryption gateway is contacted to perform the identity authentication of the service terminal corresponding to the data frame. If the identity authentication is successful, that is, the identity authentication is currently passed, then enter step B. If the identity authentication fails, the data frame is discarded.

4. A link layer communication encryption method according to claim 1, characterized in that: In the step B, the service side link encryption gateway parses the encrypted message from the terminal side link encryption gateway, performs device authentication based on the preset legal MACs to determine whether the source MAC is legal, and if the source MAC is legal, further determines whether the identity authentication of the corresponding service terminal has been successfully authenticated, and if so, the service side link encryption gateway further calls the session key corresponding to the most recent successful authentication state for decryption; otherwise, the encrypted message is discarded; If the source MAC is illegal, the encrypted message is discarded.

5. The link layer communication encryption method according to claim 1, characterized in that: In step B, the terminal-side link encryption gateway first calls the session key corresponding to the most recent successful identity authentication state, encrypts the IP header, the target network transmission protocol header, and the application data in the data frame to form encrypted application data; Then based on the Ethernet header, add the IP address of the service terminal i Source IP, MAC of service terminal i The source MAC, the virtual IP address provided by the service side link encryption gateway as the destination IP, and the MAC of the service system as the destination MAC constitute the message header; finally, a check code for the message header and the encrypted application data is generated, and the message header, the encrypted application data, and the check code are encapsulated to constitute an encrypted message, which is sent to the service side link encryption gateway; the service side link encryption gateway parses the received encrypted message to obtain the encrypted application data, and then calls the session key corresponding to the most recent successful identity authentication state to decrypt the encrypted application data, obtain the data frame, and encapsulate and forward it to the corresponding service system for query; In step C, the service side link encryption gateway calls the session key corresponding to the most recent successful identity authentication state to encrypt the received feedback result data frame to form encrypted feedback data; Then, based on the Ethernet header, add the service side gateway virtual IP as the source IP, the service system MAC as the source MAC, and the service terminal IP i Destination IP, MAC of service terminal i The source and destination MAC are used to form a message header; finally, a check code for the message header and the encrypted feedback data is generated, and the message header, encrypted feedback data, and the check code are encapsulated to form an encrypted feedback message, which is sent to the link encryption gateway on the terminal side. The link encryption gateway on the terminal side parses the received encrypted feedback message to obtain the encrypted feedback data, and then calls the session key corresponding to the most recent successful authentication state to decrypt the encrypted feedback data, obtain the feedback result data frame, and encapsulate it to the forwarding service terminal.

6. A system for implementing the link layer communication encryption method according to claim 5, characterized in that: Based on the data link created by the business terminal through the terminal side link encryption gateway, the business side link encryption gateway, and the business system in sequence, the structure of the terminal side link encryption gateway is the same as that of the business side link encryption gateway. The terminal side link encryption gateway and the business side link encryption gateway respectively include a data capture module, a data parsing module, a device authentication module, an identity authentication module, a data encryption and decryption module, a device authentication library, a hardware password module, and a data sending module; In the terminal-side link encryption gateway, the data capture module is used to poll the data frames and encrypted feedback messages on the network card receiving buffer queue; The data analysis module is used to analyze the data frames and encrypted feedback messages received by the data capture module; The device authentication library is composed of preset legal MACs. The device authentication module is used to authenticate the source MAC of the data frame from the service terminal according to the preset legal MACs in the device authentication library. The identity authentication module is used to contact the identity authentication module in the service side link encryption gateway through the data sending module and the data capture module based on the hardware password module to realize identity authentication for the service terminal; the data encryption and decryption module is used to encrypt the data frame and decrypt the encrypted feedback message based on the hardware password module; The data sending module is used to send encrypted messages and feedback result data frames; In the service side link encryption gateway, the data capture module is used to poll the feedback result data frame and encrypted message on the network card receiving buffer queue; The data analysis module is used to analyze the feedback result data frame and encrypted message received by the data capture module; The device authentication library is composed of preset legal MACs. The device authentication module is used to authenticate the source MAC of the encrypted message from the terminal side link encryption gateway according to the preset legal MACs in the device authentication library; The identity authentication module is used to determine whether the identity authentication of the business terminal has been successfully authenticated based on the hardware password module; The data encryption and decryption module is used to encrypt the feedback result data frame and decrypt the encrypted message according to the hardware password module; the data sending module is used to send the encrypted feedback message and data frame.

Images