Communication data decryption method and device, electronic equipment and storage medium

Abstract

The invention provides a communication data decryption method and device, electronic equipment and a storage medium, relates to the technical field of wireless communication networks, and aims to perform authentication attempt on a received authentication request message through a plurality of stored user decryption parameters, avoid communication interaction with a communication sender, obtain a communication user identity and improve the user experience. And according to the matched user decryption parameter, the authentication request message and the key generation function, obtaining a key set of the communication of the two communication parties. The NAS message and the RRC message are subjected to multiple attempts to decrypt according to the preset integrity protection algorithm, the initial count value and the bearerid, so that the decryption parameter set used for communication of the two parties is obtained under the condition that communication interaction with the communication sender is not carried out, and the efficiency of obtaining the decryption parameter set is improved. In the authentication process and the decryption process, the number of times of communication interaction with the communication sender is greatly reduced, and the decryption efficiency of the communication data is improved.

Description

Technical Field

[0001] The present invention relates to the field of wireless communication network technology, and in particular to a communication data decryption method, device, electronic equipment and storage medium. Background Art

[0002] Currently, the number of users of the Long Term Evolution (LTE) mobile communication system is the largest and its application is the most extensive. LTE mobile communication air interface transmission requires two-way authentication between the network and the terminal user. In the LTE non-cooperative reception scenario, as a third party in communication, it is difficult to determine the identity of the communication terminal and receive the full context of the communication between the two parties, resulting in low efficiency of the existing communication data decryption method. Summary of the invention

[0003] The present invention provides a communication data decryption method, device, electronic device and storage medium, which are used to solve the defect of low efficiency of the communication data decryption method in the prior art and improve the efficiency of the existing communication data decryption method.

[0004] The present invention provides a communication data decryption method, comprising: authenticating an authentication request message of a communication sender based on a user decryption parameter of at least one user that has been stored; when the authentication request message passes the authentication, acquiring a key set of the communication sender based on the matching user decryption parameter of the authentication request message, the authentication request message and a key generation function, the key set including a key of a non-access layer NAS message, a key of a radio resource control RRC message and a key of a user plane message; when the NAS message of the communication data of the communication sender and the RRC message of the communication data are decrypted for the first time, decrypting the key set based on multiple preset protection algorithms, multiple initial count values, multiple history values ​​and the like. The bearer identifier bearerid and the key set are used to attempt to decrypt the NAS message and the RRC message at least once. When the decryption of the NAS message and the RRC message is successful, the decryption parameter set of the communication data is saved, and the user plane message of the communication data is decrypted based on the decryption parameter set and the key set; the decryption parameter set includes at least a protection algorithm, a count value and bearerid, and the count value represents the round of the communication data; when the NAS message and the RRC message are not decrypted for the first time, the decryption parameter set is obtained according to the saved result of the decryption parameter set, and the NAS message, the RRC message and the user plane message are decrypted based on the decryption parameter set and the key set.

[0005] According to the communication data decryption method provided by the present invention, the user decryption parameters at least include the key identifier KI and the operator configuration parameter OPC, and the authentication request message of the communication sender is authenticated based on the user decryption parameters of at least one user that have been stored, including: obtaining the authentication token AUTN and the random value of the authentication request message; obtaining the authentication parameter set based on AUTN, the random value, the KI of the target user and the OPC of the target user, the target user being any user; generating the message authentication code MAC of the authentication request message based on the authentication parameter set; when the MAC of the authentication request message is equal to the extended message authentication code MAC of the authentication request message, the authentication parameter set is generated; and .... When the MAC of the authentication request message is equal to the XMAC of the authentication request message, it is determined that the authentication request message has passed the authentication; when the MAC of the authentication request message is not equal to the XMAC of the authentication request message, traverse the users in sequence to update the target user, update the authentication parameter set based on the updated target user, and update the MAC of the authentication request message based on the updated authentication parameter set. When the MAC of the updated authentication request message is equal to the XMAC of the authentication request message, it is determined that the authentication request message has passed the authentication; when all users have been traversed and the MAC of the updated authentication request message is still not equal to the XMAC of the authentication request message, it is determined that the authentication request message has not passed the authentication.

[0006] According to the communication data decryption method provided by the present invention, based on multiple preset protection algorithms, multiple initial count values, multiple historical bearer identifiers bearerid and key sets, before attempting to decrypt a NAS message and an RRC message at least once, the method also includes: if a security mode message from the communication sender is received, then based on the security mode message, obtaining a protection algorithm; if no security mode message is received, then determining a preset protection algorithm based on a non-encryption algorithm, an advanced encryption standard AES algorithm, a serial number stream cipher SNOW3G algorithm and a Zu Chongzhi ZUC algorithm.

[0007] According to the decryption method of communication data provided by the present invention, the initial count value is obtained based on the following steps: when an authentication request message is received, the current count value is determined to be 0, and during the communication process, the current sequence number of the current air interface packet data convergence protocol PDCP message of the communication sender is obtained; if the current sequence number is less than the previous sequence number, the current count value is increased by one to obtain the initial count value; the previous sequence number is the sequence number of the previous air interface PDCP message of the communication sender.

[0008] According to the communication data decryption method provided by the present invention, the key of the NAS message includes the encryption key of the NAS message and the integrity key of the NAS message. Based on multiple preset protection algorithms, multiple initial count values, multiple historical bearerids and key sets, the NAS message is attempted to be decrypted at least once, including: based on at least one combination result of multiple preset protection algorithms, multiple initial count values ​​and multiple historical bearerids, at least one initial decryption parameter set is obtained; based on the encryption key of the NAS message, the integrity key of the NAS message and at least one initial decryption parameter set, the NAS message is decrypted at least once to obtain the MAC of the NAS message, until the MAC of the NAS message is equal to the XMAC of the NAS message, and it is determined that the NAS message is decrypted successfully.

[0009] According to the communication data decryption method provided by the present invention, the key of the RRC message includes the encryption key of the RRC message and the integrity key of the RRC message. Based on multiple preset protection algorithms, multiple initial count values, multiple historical bearerids and key sets, the RRC message is attempted to be decrypted at least once, including: based on at least one combination result of multiple preset protection algorithms, multiple initial count values ​​and multiple historical bearerids, at least one initial decryption parameter set is obtained; based on the encryption key of the RRC message, the integrity key of the RRC message and at least one initial decryption parameter set, the RRC message is decrypted at least once to obtain the MAC of the RRC message, until the MAC of the RRC message is equal to the XMAC of the RRC message, and it is determined that the RRC message is successfully decrypted.

[0010] According to the communication data decryption method provided by the present invention, the user plane message of the communication data is decrypted based on the decryption parameter set and the key set, including: decrypting the user plane message based on the key and decryption parameter set of the user plane message to obtain the decryption result of the user plane message; when the decryption result of the user plane message meets the IP packet characteristics or the robust header compression packet ROHC characteristics, it is determined that the user plane message decryption is successful.

[0011] The present invention also provides a communication data decryption device, comprising: an authentication module, used to authenticate the authentication request message of the communication sender based on the user decryption parameters of at least one user that have been stored; a key set determination module, used to obtain the key set of the communication sender based on the matching user decryption parameters of the authentication request message, the authentication request message and the key generation function when the authentication request message passes the authentication, the key set including the key of the non-access layer NAS message, the key of the radio resource control RRC message and the key of the user plane message; a first decryption module, used to, when the NAS message of the communication data of the communication sender and the RRC message of the communication data are decrypted for the first time, based on multiple preset protection algorithms, multiple An initial count value, multiple historical bearer identifiers bearerid and a key set, attempt to decrypt a NAS message and an RRC message at least once, when the NAS message and the RRC message are decrypted successfully, save the decryption parameter set of the communication data, and decrypt the user plane message of the communication data based on the decryption parameter set and the key set; the decryption parameter set at least includes a protection algorithm, a count value and bearerid, and the count value represents the round of the communication data; a second decryption module is used to obtain the decryption parameter set according to the saved result of the decryption parameter set when the NAS message and the RRC message are not decrypted for the first time, and decrypt the NAS message, the RRC message and the user plane message based on the decryption parameter set and the key set.

[0012] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, any of the above-mentioned communication data decryption methods is implemented.

[0013] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the method for decrypting communication data as described above is implemented.

[0014] The communication data decryption method, device, electronic device and storage medium provided by the present invention perform authentication attempts on the received authentication request message through multiple stored user decryption parameters, avoid communication interaction with the communication sender, obtain the communication user identity, and obtain the key set of the communication between the two parties according to the matching user decryption parameters, authentication request message and key generation function. According to the preset integrity protection algorithm, initial count value and bearerid, multiple attempts are made to decrypt NAS messages and RRC messages, so that the decryption parameter set used by the two parties in communication is obtained without communication interaction with the communication sender, thereby improving the efficiency of obtaining the decryption parameter set. In both the authentication process and the decryption process, the present invention greatly reduces the number of communication interactions with the communication sender and improves the decryption efficiency of communication data. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 This is one of the flow charts of the communication data decryption method provided by the present invention.

[0017] Figure 2 This is the second flow chart of the communication data decryption method provided by the present invention.

[0018] Figure 3 This is the third flow chart of the communication data decryption method provided by the present invention.

[0019] Figure 4 It is a schematic diagram of the structure of the communication data decryption device provided by the present invention.

[0020] Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] Combine the following Figure 1-Figure 5 The present invention describes a method, device and electronic device for decrypting communication data.

[0023] Figure 1 FIG. 1 is one of the flow charts of the communication data decryption method provided by the present invention, such as Figure 1 As shown, the method for decrypting communication data includes S100 to S400, and each step is specifically as follows.

[0024] S100: authenticating an authentication request message of a communication sender based on a stored user decryption parameter of at least one user.

[0025] The executor of this application can be a third party in communication or a recipient of communication.

[0026] like Figure 2As shown, the user decryption parameters of at least one user are stored in advance. When an authentication request message sent by a communication sender is received, the user decryption parameters of each saved user are traversed to authenticate the authentication request message until the authentication request message passes the authentication. If the authentication request message fails to be authenticated after traversing the user decryption parameters of all users, it means that the communication sender does not match all pre-stored users and the authentication fails.

[0027] S200: When the authentication request message passes the authentication, the key set of the communication sender is obtained based on the matching user decryption parameters of the authentication request message, the authentication request message and the key generation function.

[0028] The key set includes the keys of non-access stratum NAS messages, the keys of radio resource control RRC messages and the keys of user plane messages.

[0029] Matching user decryption parameters includes matching key identifier (KI), matching operator configuration parameter (OPC) and other user decryption parameters. Obtain the authentication token (AUTN) and random value in the authentication request message. Input the matching KI, matching OPC, AUTN and random value into the key generation function to obtain the key set of the communication sender.

[0030] S300: When the NAS message of the communication data and the RRC message of the communication data of the communication sender are decrypted for the first time, based on multiple preset protection algorithms, multiple initial count values, multiple historical bearer identifiers bearerid and key sets, at least one attempt is made to decrypt the NAS message and the RRC message. When the NAS message and the RRC message are decrypted successfully, the decryption parameter set of the communication data is saved, and the user plane message of the communication data is decrypted based on the decryption parameter set and the key set.

[0031] The decryption parameter set includes at least a protection algorithm, a count value and bearerid, and the count value represents the round of communication data.

[0032] Based on multiple preset protection algorithms, multiple initial count values, multiple historical bearer identifiers bearerid and key sets, before attempting to decrypt the NAS message and the RRC message at least once, it also includes: if a security mode message from the communication sender is received, then obtaining the protection algorithm based on the security mode message; if no security mode message is received, then determining the preset protection algorithm based on the no encryption algorithm, the Advanced Encryption Standard AES algorithm, the serial number stream cipher SNOW3G algorithm and the Zu Chongzhi ZUC algorithm.

[0033] The protection algorithm includes encryption and decryption and integrity protection algorithms, which are used to decrypt and verify the integrity of communication data (including NAS messages, RRC messages and user plane messages). The count value represents the round of communication data sent by the communication sender, for example, sending the first round of communication data, sending the second round of communication data, etc. Each round of communication data includes multiple communication data, for example, one round includes 1024 communication data. The historical bearer identifier (bearerid) is a typical bearer identifier, for example, 0-7.

[0034] When receiving communication data from a communication sender, if a Non-Access Stratum (NAS) message of the communication data or a Radio Resource Control (RRC) message of the communication data is decrypted for the first time, it is necessary to attempt to decrypt the NAS message and the RRC message.

[0035] like Figure 3 As shown in the figure, if a security mode message is received from the communication sender, the algorithm configured in the security mode message is directly used as the security protection algorithm. If no security mode message is received, the no encryption algorithm, the Advanced Encryption Standard (AES) algorithm, the SNOW3G algorithm, and the ZUC algorithm are traversed to attempt to decrypt the NAS message and the RRC message until the decryption attempt is successful.

[0036] The present application obtains the protection algorithm according to the security mode message, thereby improving the accuracy of determining the protection algorithm. The protection algorithm is obtained by traversing multiple preset protection algorithms, thereby avoiding obtaining the protection algorithm from the communication sender and reducing the number of interactions with the communication sender.

[0037] When the NAS message and RRC message attempt to decrypt is successful, the preset protection algorithm corresponding to the successful decryption attempt is used as the protection algorithm of the communication data, the initial count value corresponding to the successful decryption attempt is used as the count value of the communication data, and the historical bearer identifier (bearerid) corresponding to the successful decryption attempt is used as the bearerid of the communication data. Figure 3 As shown, further, the uplink and downlink directions of the communication data and the length of the communication data are obtained. The decryption parameter set is determined according to the protection algorithm, the count value, the bearerid, the uplink and downlink directions of the message and the length of the communication data. The decryption parameter set is saved, and the user plane message of the communication data is decrypted according to the decryption parameter set.

[0038] S400: When the NAS message and the RRC message are not decrypted for the first time, the decryption parameter set is obtained according to the saved result of the decryption parameter set, and the NAS message, the RRC message and the user plane message are decrypted based on the decryption parameter set and the key set.

[0039] like Figure 2 As shown, if the NAS message and the RRC message are not decrypted for the first time, the decryption parameter set is directly obtained according to the saved result of the decryption parameter set. The NAS message, the RRC message and the user plane message are decrypted in sequence based on the decryption parameter set.

[0040] (1) Decrypt the NAS message according to the key of the NAS message (encryption key of the NAS message). If the NAS message decryption is successful, the subsequent RRC message is decrypted. If the NAS message decryption is unsuccessful, it means that the decryption parameter set has changed, then the decryption parameter set is updated according to S300, and the NAS message is decrypted according to the updated decryption parameter set.

[0041] (2) Decrypt the RRC message according to the key of the RRC message (the encryption key of the RRC message). If the RRC message decryption is successful, the subsequent user plane message is decrypted. If the RRC message decryption is unsuccessful, it means that the decryption parameter set has changed. The decryption parameter set is updated according to S300, and the RRC message is decrypted according to the updated decryption parameter set.

[0042] (3) Decrypt the user plane message according to the user plane message key.

[0043] The communication data decryption method provided by the present invention performs an authentication attempt on the received authentication request message through multiple stored user decryption parameters, avoids communication interaction with the communication sender, obtains the communication user identity, and obtains the key set of the communication between the two parties according to the matching user decryption parameters, the authentication request message and the key generation function. According to the preset integrity protection algorithm (preset protection algorithm), the initial count value and the bearerid, the NAS message and the RRC message are decrypted multiple times, so that the decryption parameter set used for the communication between the two parties is obtained without communication interaction with the communication sender, and the efficiency of obtaining the decryption parameter set is improved. In the authentication process and the decryption process, the present invention greatly reduces the number of communication interactions with the communication sender and improves the decryption efficiency of the communication data.

[0044] Based on the above embodiment, the user decryption parameters include at least the key identifier KI and the operator configuration parameter OPC. Based on the stored user decryption parameters of at least one user, the authentication request message of the communication sender is authenticated, including S110 to S160. The specific steps are as follows.

[0045] S110: Acquire the authentication token AUTN and the random value of the authentication request message.

[0046] S120: Based on AUTN, the random value, the target user's KI and the target user's OPC, an authentication parameter set is obtained, where the target user is any user.

[0047] S130: Generate a message authentication code MAC for the authentication request message based on the authentication parameter set.

[0048] S140: When the MAC of the authentication request message is equal to the extended message authentication code XMAC of the authentication request message, it is determined that the authentication request message passes the authentication.

[0049] S150: When the MAC of the authentication request message is not equal to the XMAC of the authentication request message, traverse the users in turn to update the target user, update the authentication parameter set based on the updated target user, and update the MAC of the authentication request message based on the updated authentication parameter set. When the updated MAC of the authentication request message is equal to the XMAC of the authentication request message, determine that the authentication request message has passed the authentication.

[0050] S160: When the user has traversed all the authentication requests and the MAC of the updated authentication request message is still not equal to the XMAC of the authentication request message, it is determined that the authentication request message fails the authentication.

[0051] Attempt to authenticate the authentication request message based on the target user's user decryption parameters. Obtain the authentication parameter set. Generate a message authentication code (MAC) for the authentication request message based on each authentication parameter set.

[0052] The Extended Message Authentication Code (XMAC) of the authentication request message can be directly obtained from the authentication request message. The XMAC of the authentication request message is used to verify the integrity of the authentication request message to ensure that the authentication request message has not been tampered with during transmission.

[0053] When the MAC of the authentication request message is equal to the XMAC of the authentication request message, it is determined that the authentication request message is successfully authenticated (passed authentication), otherwise it is determined that the authentication request message fails to be authenticated (failed authentication). If the authentication request message fails to be authenticated, other users are used as target users and the authentication parameter set is updated. The MAC of the updated authentication request message is calculated based on the updated authentication parameter set. If the MAC of the updated authentication request message is equal to the XMAC of the authentication request message, it is determined that the authentication request message is successfully authenticated. If the authentication request message still fails to be authenticated after traversing the user decryption parameters of all users, it means that the communication sender does not match all pre-stored users and the authentication is stopped.

[0054] The present invention automatically authenticates the authentication request message according to the user decryption parameter, reduces the number of communication interactions with the communication inventor, and improves the efficiency of authenticating the authentication request message.

[0055] The initial count value is obtained based on the following steps.

[0056] S310: When receiving the authentication request message, determine that the current count value is 0. During the communication process, obtain the current sequence number of the current air interface packet data convergence protocol PDCP message of the communication sender; if the current sequence number is less than the previous sequence number, increase the current count value by one to obtain the initial count value; the previous sequence number is the sequence number of the previous air interface PDCP message of the communication sender.

[0057] After receiving the current air interface packet data convergence protocol (PDCP) message from the communication sender, the current sequence number of the current air interface PDCP is obtained. If the current sequence number is less than the previous sequence number, it means that the current sequence number of the air interface PDCP has been rolled over, and the current count value needs to be updated.

[0058] In a round of communication data, the sequence number of the air interface PDCP increases sequentially, for example, from 0 to a maximum value. When the sequence number increases to the maximum value, the count value is increased by 1, and the next round of communication data is sent. The sequence number of the air interface PDCP increases sequentially from 0 until it increases to the maximum value, and the count value is increased by 1 again, and the above operation is repeated.

[0059] If the current sequence number is less than the previous sequence number, it means that a cross-round reception of communication data has occurred, and the current count value needs to be increased by 1 to update the current count value.

[0060] Furthermore, the communication data received across rounds is usually received across one round, and at most across two rounds. Therefore, the setting error of the current count value is ±1 and ±2. The current count value is added with the setting error to obtain the initial count value. For example, the current count value is 3, the setting error includes ±1 and ±2, and the initial count value includes 1, 2, 4 and 5.

[0061] The present invention automatically corrects the current count value according to the set error, thereby improving the accuracy of determining the initial count value and being beneficial to improving the accuracy of determining the count value.

[0062] Based on the above embodiment, the key of the NAS message includes the encryption key of the NAS message and the integrity key of the NAS message. Based on multiple preset protection algorithms, multiple initial count values, multiple historical bearerids and key sets, at least one attempt to decrypt the NAS message is performed, including S320 to S330, and each step is specifically as follows.

[0063] S320: Obtain at least one initial decryption parameter set based on at least one combination result of multiple preset protection algorithms, multiple initial count values, and multiple historical bearerids.

[0064] S330: Based on the encryption key of the NAS message, the integrity key of the NAS message and at least one initial decryption parameter set, decrypt the NAS message at least once to obtain the MAC of the NAS message until the MAC of the NAS message is equal to the XMAC of the NAS message, and determine that the NAS message decryption is successful.

[0065] If a NAS message is received from a communication sender, and the NAS message is decrypted for the first time, multiple initial decryption parameter sets are obtained according to multiple combination results of multiple preset protection algorithms, multiple initial count values, and multiple historical bearerids. Among them, one initial decryption parameter set is obtained according to one preset protection algorithm, one initial count value, and one historical bearerid.

[0066] Furthermore, the initial decryption parameter set also includes the message uplink and downlink directions of the communication data and the length of the communication data.

[0067] Determine whether the integrity key and the encryption key of the NAS message exist. If not, exit directly and determine that the NAS message cannot be decrypted. If the integrity key and the encryption key of the NAS message exist, decrypt the NAS message according to the encryption key of the NAS message and an initial decryption parameter set. Obtain the MAC of the NAS message according to the decryption result, the initial decryption parameter set and the integrity key of the NAS message. Obtain the XMAC of the NAS message directly according to the NAS message. Traverse each initial decryption parameter set and decrypt the NAS message until the MAC of the NAS message is equal to the XMAC of the NAS message, and determine that the NAS message is successfully decrypted. Otherwise, determine that the NAS decryption fails. When the NAS message is decrypted successfully, the corresponding initial decryption parameter set is used as the decryption parameter set of the NAS message and saved. At the same time, the encryption key of the NAS message and the integrity key of the NAS message corresponding to the successful decryption of the NAS message are saved. For example, the encryption key of the NAS message is the non-access layer encryption key (Knasenc), and the integrity key of the NAS message is the non-access layer integrity key (Knasinc).

[0068] If the NAS message cannot be decrypted successfully after traversing all the initial decryption parameter sets, the decryption of the NAS message is stopped, and it is determined that the NAS message cannot be decrypted.

[0069] like Figure 2As shown, further, if a NAS message is received and the NAS message is not decrypted for the first time, the decryption parameter set corresponding to the NAS message is directly obtained. The NAS message is decrypted according to the decryption parameter set and the encryption key of the NAS message. If the NAS message is decrypted successfully, the subsequent RRC message is decrypted. If the NAS message is decrypted unsuccessfully, it means that the decryption parameter set may have changed, and the NAS message is decrypted again according to the initial decryption parameter set to update the decryption parameter set.

[0070] The present invention attempts to decrypt a NAS message according to at least one initial decryption parameter set, an encryption key of the NAS message and an integrity key of the NAS message, thereby realizing automatic decryption of the NAS message in the absence of a context of communication data and improving the efficiency of decrypting the NAS message.

[0071] Based on the above embodiment, the key of the RRC message includes the encryption key of the RRC message and the integrity key of the RRC message. Based on multiple preset protection algorithms, multiple initial count values, multiple historical bearerids and key sets, the RRC message is attempted to be decrypted at least once, including S350 to S360, and each step is specifically as follows.

[0072] S350: Obtain at least one initial decryption parameter set based on at least one combination result of multiple preset protection algorithms, multiple initial count values, and multiple historical bearerids.

[0073] S360: Based on the encryption key of the RRC message, the integrity key of the RRC message and at least one initial decryption parameter set, decrypt the RRC message at least once, obtain the MAC of the RRC message, until the MAC of the RRC message is equal to the XMAC of the RRC message, and determine that the RRC message decryption is successful.

[0074] If an RRC message is received from a communication sender and the RRC message is decrypted for the first time, multiple initial decryption parameter sets are obtained based on multiple combinations of multiple preset protection algorithms, multiple initial count values, and multiple historical bearerids. Furthermore, the initial decryption parameter set also includes the message uplink and downlink directions of the communication data and the length of the communication data.

[0075] Determine whether there is an integrity key and an encryption key of the RRC message. If not, exit directly and determine that the RRC message cannot be decrypted; if it exists, decrypt the RRC message according to the encryption key of the RRC message and an initial decryption parameter set. Obtain the MAC of the RRC message according to the decryption result, the initial decryption parameter set and the integrity key of the RRC message. Obtain the XMAC of the RRC message directly according to the RRC message. Traverse each initial decryption parameter set and decrypt the RRC message until the MAC of the RRC message is equal to the XMAC of the RRC message, and determine that the RRC message decryption is successful, otherwise determine that the RRC decryption fails. When the RRC message is decrypted successfully, the corresponding initial decryption parameter set is used as the decryption parameter set of the RRC message and saved. In the same round of communication data transmission, the RRC message and the NAS message correspond to the same decryption parameter set. Save the encryption key of the RRC message and the integrity key of the RRC message corresponding to the successful decryption of the RRC message. For example, the encryption key of the RRC message is the radio resource control encryption key (Krrcenc), and the integrity key of the RRC message is the radio resource control integrity key (Krrcinc).

[0076] If the RRC message cannot be decrypted successfully after traversing all the initial decryption parameter sets, the decryption of the RRC message is stopped, and it is determined that the RRC message cannot be decrypted.

[0077] like Figure 2 As shown, further, if an RRC message is received and the RRC message is not decrypted for the first time, the decryption parameter set corresponding to the RRC message is directly obtained. The RRC message is decrypted according to the decryption parameter set and the encryption key of the RRC message. If the RRC message is decrypted successfully, the subsequent user plane message is decrypted. If the RRC message decryption is unsuccessful, it means that the decryption parameter set may have changed, and the RRC message is re-tried to decrypt according to the initial decryption parameter set to update the decryption parameter set.

[0078] The present invention attempts to decrypt the RRC message according to at least one initial decryption parameter set, the encryption key of the RRC message and the integrity key of the RRC message, thereby realizing automatic decryption of the RRC message in the absence of the context of communication data and improving the efficiency of decrypting the RRC message.

[0079] Based on the above embodiment, the user plane message of the communication data is decrypted based on the decryption parameter set and the key set, including S370 to S380, and each step is specifically as follows.

[0080] S370: Decrypt the user plane message based on the key and the decryption parameter set of the user plane message to obtain a decryption result of the user plane message.

[0081] S380: When the decryption result of the user plane message meets the IP packet characteristics or the robust header compression packet ROHC characteristics, it is determined that the user plane message decryption is successful.

[0082] If a user plane message is received from the communication sender, determine whether there is a key for the user plane message. If not, exit decryption directly and determine that the user plane message cannot be decrypted. If there is a key for the user plane message, decrypt the user plane message according to the key and decryption parameter set of the user plane message to obtain the decryption result of the user plane message. The key of the user plane message includes the user plane encryption key (Kupenc).

[0083] When the decryption result of the user plane message meets the IP packet feature or the robust header (ROHC) compression packet feature, it is determined that the user plane message is decrypted successfully.

[0084] The present invention directly decrypts the user plane message according to the key of the user plane message, thereby improving the efficiency of decrypting the user plane message.

[0085] The communication data decryption device provided by the present invention is described below. The communication data decryption device described below and the communication data decryption method described above can be referenced to each other.

[0086] like Figure 4 As shown, a communication data decryption device includes: an authentication module 401, which is used to authenticate the authentication request message of the communication sender based on the stored user decryption parameters of at least one user.

[0087] The key set determination module 402 is used to obtain the key set of the communication sender based on the matching user decryption parameters of the authentication request message, the authentication request message and the key generation function when the authentication request message passes the authentication. The key set includes the key of the non-access layer NAS message, the key of the radio resource control RRC message and the key of the user plane message.

[0088] The first decryption module 403 is used to attempt to decrypt the NAS message and the RRC message of the communication data of the communication sender at least once based on multiple preset protection algorithms, multiple initial count values, multiple historical bearer identifiers bearerid and key sets when the NAS message and the RRC message are decrypted for the first time. When the NAS message and the RRC message are decrypted successfully, the decryption parameter set of the communication data is saved, and the user plane message of the communication data is decrypted based on the decryption parameter set and the key set; the decryption parameter set includes at least a protection algorithm, a count value and bearerid, and the count value represents the round of the communication data.

[0089] The second decryption module 404 is used to obtain a decryption parameter set according to the saved result of the decryption parameter set when the NAS message and the RRC message are not decrypted for the first time, and decrypt the NAS message, the RRC message and the user plane message based on the decryption parameter set and the key set.

[0090] The communication data decryption device provided by the present invention performs an authentication attempt on the received authentication request message through multiple stored user decryption parameters, avoids communication interaction with the communication sender, obtains the communication user identity, and obtains the key set of the communication between the two parties according to the matching user decryption parameters, the authentication request message and the key generation function. According to the preset integrity protection algorithm, the initial count value and the bearerid, the NAS message and the RRC message are decrypted multiple times, so that the decryption parameter set used by the two parties in the communication is obtained without communication interaction with the communication sender, and the efficiency of obtaining the decryption parameter set is improved. In the authentication process and the decryption process, the present invention greatly reduces the number of communication interactions with the communication sender and improves the decryption efficiency of the communication data.

[0091] In one embodiment, the user decryption parameters at least include a key identifier KI and an operator configuration parameter OPC, and the authentication module 401 is used to: obtain an authentication token AUTN and a random value of the authentication request message; obtain an authentication parameter set based on AUTN, the random value, the target user's KI and the target user's OPC, where the target user is any user; generate a message authentication code MAC of the authentication request message based on the authentication parameter set; when the MAC of the authentication request message is equal to the extended message authentication code XMAC of the authentication request message, it is determined that the authentication request message passes the authentication; when the MAC of the authentication request message is not equal to the XMAC of the authentication request message, traverse the users in sequence to update the target user, update the authentication parameter set based on the updated target user, and update the MAC of the authentication request message based on the updated authentication parameter set; when the MAC of the updated authentication request message is equal to the XMAC of the authentication request message, it is determined that the authentication request message passes the authentication; when all users are traversed and the MAC of the updated authentication request message is still not equal to the XMAC of the authentication request message, it is determined that the authentication request message fails the authentication.

[0092] In one embodiment, the first decryption module 403 is also used for: if a security mode message is received from the communication sender, obtaining a protection algorithm based on the security mode message; if no security mode message is received, determining a preset protection algorithm based on the no encryption algorithm, the Advanced Encryption Standard AES algorithm, the serial number stream cipher SNOW3G algorithm and the Zu Chongzhi ZUC algorithm.

[0093] In one embodiment, the first decryption module 403 is used to: when receiving an authentication request message, determine that the current count value is 0, and during the communication process, obtain the current sequence number of the current air interface packet data convergence protocol PDCP message of the communication sender; if the current sequence number is less than the previous sequence number, increase the current count value by one to obtain the initial count value; the previous sequence number is the sequence number of the previous air interface PDCP message of the communication sender.

[0094] In one embodiment, the key of the NAS message includes an encryption key of the NAS message and an integrity key of the NAS message. The first decryption module 403 is used to: obtain at least one initial decryption parameter set based on at least one combination result of multiple preset protection algorithms, multiple initial count values, and multiple historical bearerids; decrypt the NAS message at least once based on the encryption key of the NAS message, the integrity key of the NAS message, and the at least one initial decryption parameter set, and obtain the MAC of the NAS message until the MAC of the NAS message is equal to the XMAC of the NAS message, and determine that the NAS message is successfully decrypted.

[0095] In one embodiment, the key of the RRC message includes an encryption key of the RRC message and an integrity key of the RRC message. The first decryption module 403 is used to: obtain at least one initial decryption parameter set based on at least one combination result of multiple preset protection algorithms, multiple initial count values ​​and multiple historical bearerids; decrypt the RRC message at least once based on the encryption key of the RRC message, the integrity key of the RRC message and at least one initial decryption parameter set, and obtain the MAC of the RRC message until the MAC of the RRC message is equal to the XMAC of the RRC message, and determine that the RRC message decryption is successful.

[0096] In one embodiment, the first decryption module 403 is used to: decrypt the user plane message based on the key and decryption parameter set of the user plane message to obtain the decryption result of the user plane message; when the decryption result of the user plane message meets the IP packet characteristics or the robust header compression packet ROHC characteristics, it is determined that the user plane message decryption is successful.

[0097] Figure 5 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 5As shown, the electronic device may include: a processor 510, a communications interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communications interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute a method for decrypting communication data, the method comprising: authenticating the authentication request message of the communication sender based on the user decryption parameters of at least one user that have been stored; when the authentication request message passes the authentication, obtaining the key set of the communication sender based on the matching user decryption parameters of the authentication request message, the authentication request message and the key generation function, the key set including the key of the non-access layer NAS message, the key of the radio resource control RRC message and the key of the user plane message; when the NAS message of the communication data of the communication sender and the RRC message of the communication data are decrypted for the first time, based on multiple preset protection algorithms, Multiple initial count values, multiple historical bearer identifiers bearerid and key sets, at least one attempt to decrypt the NAS message and the RRC message, when the NAS message and the RRC message are decrypted successfully, the decryption parameter set of the communication data is saved, and the user plane message of the communication data is decrypted based on the decryption parameter set and the key set; the decryption parameter set includes at least a protection algorithm, a count value and bearerid, and the count value represents the round of the communication data; when the NAS message and the RRC message are not decrypted for the first time, the decryption parameter set is obtained according to the saved result of the decryption parameter set, and the NAS message, the RRC message and the user plane message are decrypted based on the decryption parameter set and the key set.

[0098] In addition, the logic instructions in the above-mentioned memory 530 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0099] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the communication data decryption method provided by the above methods, the method comprising: authenticating an authentication request message of a communication sender based on a user decryption parameter of at least one user that has been stored; when the authentication request message passes the authentication, obtaining a key set of the communication sender based on the matching user decryption parameter of the authentication request message, the authentication request message and a key generation function, the key set including a key of a non-access layer NAS message, a key of a radio resource control RRC message and a key of a user plane message; when the NAS message of the communication data of the communication sender and the RRC message of the communication data are During the first decryption, based on multiple preset protection algorithms, multiple initial count values, multiple historical bearer identifiers bearerid and key sets, at least one attempt is made to decrypt the NAS message and the RRC message. When the NAS message and the RRC message are decrypted successfully, the decryption parameter set of the communication data is saved, and the user plane message of the communication data is decrypted based on the decryption parameter set and the key set; the decryption parameter set includes at least a protection algorithm, a count value and bearerid, and the count value represents the round of the communication data; when the NAS message and the RRC message are not decrypted for the first time, the decryption parameter set is obtained according to the saved result of the decryption parameter set, and the NAS message, the RRC message and the user plane message are decrypted based on the decryption parameter set and the key set.

[0100] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0101] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for decrypting communication data, characterized in that: include: authenticating the authentication request message of the communication sender based on the stored user decryption parameter of at least one user; When the authentication request message passes the authentication, based on the matching user decryption parameter of the authentication request message, the authentication request message and the key generation function, obtaining the key set of the communication sender, wherein the key set includes the key of the non-access layer NAS message, the key of the radio resource control RRC message and the key of the user plane message; When the NAS message of the communication data of the communication sender and the RRC message of the communication data are decrypted for the first time, based on multiple preset protection algorithms, multiple initial count values, multiple historical bearer identifiers bearerid and the key set, at least one attempt is made to decrypt the NAS message and the RRC message, when the NAS message and the RRC message are decrypted successfully, a decryption parameter set of the communication data is saved, and a user plane message of the communication data is decrypted based on the decryption parameter set and the key set; The decryption parameter set includes at least a protection algorithm, a count value and bearerid, wherein the count value represents the round of the communication data; When the NAS message and the RRC message are not decrypted for the first time, the decryption parameter set is obtained according to the saved result of the decryption parameter set, and the NAS message, the RRC message and the user plane message are decrypted based on the decryption parameter set and the key set.

2. The method for decrypting communication data according to claim 1, characterized in that: The user decryption parameters at least include a key identifier KI and an operator configuration parameter OPC, and the authentication request message of the communication sender is authenticated based on the stored user decryption parameters of at least one user, including: Obtaining the authentication token AUTN and the random value of the authentication request message; Based on the AUTN, the random value, the KI of the target user and the OPC of the target user, obtaining an authentication parameter set, the target user being any of the users; Generate a message authentication code MAC of the authentication request message based on the authentication parameter set; When the MAC of the authentication request message is equal to the extended message authentication code XMAC of the authentication request message, determining that the authentication request message passes the authentication; When the MAC of the authentication request message is not equal to the XMAC of the authentication request message, traverse the users in sequence to update the target user, update the authentication parameter set based on the updated target user, and update the MAC of the authentication request message based on the updated authentication parameter set, and when the MAC of the updated authentication request message is equal to the XMAC of the authentication request message, determine that the authentication request message passes the authentication; When all the users have been traversed and the MAC of the updated authentication request message is still not equal to the XMAC of the authentication request message, it is determined that the authentication request message fails the authentication.

3. The method for decrypting communication data according to claim 1, characterized in that: Before attempting to decrypt the NAS message and the RRC message at least once based on the multiple preset protection algorithms, the multiple initial count values, the multiple historical bearer identifiers bearerids and the key set, the method further includes: If a security mode message from the communication sender is received, acquiring the protection algorithm based on the security mode message; If the security mode message is not received, the preset protection algorithm is determined based on the no encryption algorithm, the Advanced Encryption Standard AES algorithm, the serial number stream cipher SNOW3G algorithm and the Zu Chongzhi ZUC algorithm.

4. The method for decrypting communication data according to claim 1, characterized in that: The initial count value is obtained based on the following steps: When the authentication request message is received, the current count value is determined to be 0. During the communication process, the current sequence number of the current air interface packet data convergence protocol PDCP message of the communication sender is obtained; if the current sequence number is less than the previous sequence number, the current count value is increased by one to obtain the initial count value; the previous sequence number is the sequence number of the previous air interface PDCP message of the communication sender.

5. The method for decrypting communication data according to claim 1, characterized in that: The key of the NAS message includes an encryption key of the NAS message and an integrity key of the NAS message, and based on the multiple preset protection algorithms, the multiple initial count values, the multiple historical bearerids and the key set, attempting to decrypt the NAS message at least once, comprising: Obtaining at least one initial decryption parameter set based on at least one combination result of the plurality of preset protection algorithms, the plurality of initial count values, and the plurality of historical bearerids; Based on the encryption key of the NAS message, the integrity key of the NAS message and at least one of the initial decryption parameter sets, the NAS message is decrypted at least once to obtain the MAC of the NAS message until the MAC of the NAS message is equal to the XMAC of the NAS message, and it is determined that the NAS message is decrypted successfully.

6. The method for decrypting communication data according to claim 1, characterized in that: The key of the RRC message includes an encryption key of the RRC message and an integrity key of the RRC message, and based on the multiple preset protection algorithms, the multiple initial count values, the multiple historical bearerids and the key set, attempting to decrypt the RRC message at least once, comprising: Obtaining at least one initial decryption parameter set based on at least one combination result of the plurality of preset protection algorithms, the plurality of initial count values, and the plurality of historical bearerids; Based on the encryption key of the RRC message, the integrity key of the RRC message and at least one of the initial decryption parameter sets, the RRC message is decrypted at least once to obtain the MAC of the RRC message until the MAC of the RRC message is equal to the XMAC of the RRC message, and it is determined that the RRC message is decrypted successfully.

7. The method for decrypting communication data according to claim 1, characterized in that: The decrypting the user plane message of the communication data based on the decryption parameter set and the key set includes: Decrypting the user plane message based on the key of the user plane message and the decryption parameter set to obtain a decryption result of the user plane message; When the decryption result of the user plane message meets the IP packet feature or the robust header compression packet ROHC feature, it is determined that the user plane message is successfully decrypted.

8. A communication data decryption device, characterized in that: include: An authentication module, used to authenticate the authentication request message of the communication sender based on the stored user decryption parameters of at least one user; A key set determination module, configured to, when the authentication request message passes authentication, obtain the key set of the communication sender based on the matching user decryption parameter of the authentication request message, the authentication request message and a key generation function, wherein the key set includes a key of a non-access layer NAS message, a key of a radio resource control RRC message and a key of a user plane message; A first decryption module, configured to, when the NAS message of the communication data of the communication sender and the RRC message of the communication data are decrypted for the first time, attempt to decrypt the NAS message and the RRC message at least once based on multiple preset protection algorithms, multiple initial count values, multiple historical bearer identifiers bearerid and the key set, and when the NAS message and the RRC message are decrypted successfully, save the decryption parameter set of the communication data, and decrypt the user plane message of the communication data based on the decryption parameter set and the key set; The decryption parameter set includes at least a protection algorithm, a count value and bearerid, wherein the count value represents the round of the communication data; The second decryption module is used to obtain the decryption parameter set according to the saved result of the decryption parameter set when the NAS message and the RRC message are not decrypted for the first time, and decrypt the NAS message, the RRC message and the user plane message based on the decryption parameter set and the key set.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the method for decrypting communication data according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the communication data decryption method according to any one of claims 1 to 7 is implemented.

Images