1394B high-speed interface data encryption and obfuscation method for airborne avionics system

Abstract

The 1394B high-speed interface data encryption and obfuscation method for airborne avionics system belongs to the field of data encryption technology of avionics communication, and includes the following steps: step S01, decoding block STOF_2 through the avionics system 1394B interface data file, parsing the attributes in the block, and using the parsed milliseconds as the primary key; step S02, dynamically generating session keys using the key exchange protocol; step S03, setting the block byte replacement and encryption method. The present invention can protect the data security of 1394B communication in the airborne avionics system environment, and reduce the data transmission load caused by data encryption.

Description

Technical Field

[0001] The present invention belongs to the technical field of data encryption of avionics communication, and in particular relates to a 1394B high-speed interface data encryption and obfuscation method for an airborne avionics system. Background Art

[0002] The 1394B communication protocol, also known as IEEE1394 or FireWire, is a high-speed, real-time serial communication protocol.

[0003] At present, the standard 1394B communication protocol is widely used in the avionics systems of active aircraft for data exchange. 1394B has high-speed data exchange capabilities and is widely used in various fields. Therefore, the data security of aircraft communications is subject to a high risk of leakage.

[0004] The implementation of existing encryption methods in the avionics field generally relies on derivative protection measures of intermediate keys. For example, the Chinese patent with publication number CN117938984A, a network data transmission method and device based on a high-speed encryption algorithm, requires the response of an intermediate unit to provide encryption calculations, which increases the data transmission load. Due to the high resource usage of the 1394B communication protocol and the huge amount of on-board communication data, the additional increase in data transmission load may affect the overall performance. Summary of the invention

[0005] In view of the above-mentioned shortcomings and deficiencies of the prior art, the present invention provides a 1394B high-speed interface data encryption and obfuscation method for an airborne avionics system, the purpose of which is to protect the data security of 1394B communication in the airborne avionics system environment and reduce the data transmission load caused by data encryption.

[0006] In order to achieve the above object, the main technical solutions adopted by the present invention include:

[0007] The 1394B high-speed interface data encryption and obfuscation method for an airborne avionics system comprises the following steps:

[0008] Step S01, decode block STOF_2 through the avionics system 1394B interface data file, parse out the block attribute: milliseconds, and use the milliseconds obtained by parsing as the primary key;

[0009] Step S02: dynamically generate a session key using a key exchange protocol;

[0010] Step S03, setting block byte replacement and encryption method;

[0011] The block byte replacement and encryption method includes a data block division and filling method, a block replacement method, a byte-level encryption method, and a reversibility guarantee method.

[0012] The data block division and padding includes dividing the input data into blocks of fixed size, and if the data length is not an integer multiple of the block size, padding it to an integer multiple of the block size;

[0013] The block replacement method includes replacement of the block data, and the replacement rule is replaced according to the replacement table generated based on the random number algorithm;

[0014] The byte-level encryption method involves encrypting the bytes within each block using a derivative of the symmetric encryption algorithm (AES), where the key and initialization vector IV are generated by a random number algorithm and change with each block;

[0015] The reversibility guarantee method includes recording the permutation rule and the encryption key and initialization vector IV of each block.

[0016] Furthermore, the key exchange protocol in step S02 is the Diffie-Hellman key exchange protocol.

[0017] Furthermore, the symmetric encryption algorithm includes AES, DES, SM4, Blowfish, ChaCha20, Salsa20, RC4, RC6, and IDEA algorithms.

[0018] Furthermore, the step S03 includes the following steps:

[0019] Step S301, initialization, selecting a secure random number algorithm and providing it with a random seed, including a timestamp or environmental noise, and determining the size of the data block;

[0020] Step S302, data block division and padding, the input data is divided into blocks according to the block size. If the data length is not an integer multiple of the block size, it is filled using the padding mode PKCS#7;

[0021] Step S303: block replacement, using a random number algorithm to generate a replacement table, and rearranging the data blocks according to the replacement table;

[0022] Step S304: byte-level encryption: for each replaced block, a unique key and initial vector IV are generated using a random number algorithm, and the key and initial vector IV are encrypted with the bytes in each block using the AES-128 symmetric encryption algorithm;

[0023] Step S305, record the replacement rule and the encryption key and initial vector IV of each block;

[0024] Step S306: Send the encrypted data block and the recorded information to the receiver.

[0025] Furthermore, the data encryption and obfuscation method also includes a method for restoring data by a receiver, and the method for restoring data by a receiver includes the following steps:

[0026] Step S401, receiving data, receiving encrypted data blocks and recorded information;

[0027] Step S402: byte-level decryption, using the recorded key and initialization vector IV to decrypt each encrypted data block;

[0028] Step S403: block inverse replacement, restoring the data block to the original data according to the recorded replacement rule;

[0029] Step S404: Remove padding. If the data has been padded, remove the padding data to restore the original data.

[0030] Furthermore, the derivative algorithm of the symmetric encryption algorithm comprises the following steps:

[0031] Step S501, importing a database, wherein the database includes a library for AES encryption and decryption, a library for filling and defilling data, and a library for generating random keys;

[0032] Step S502, define the AES block size: the block size of the AES algorithm is fixed to 16 bytes;

[0033] Step S503, generate a key: generate a 16-byte random key by calling the random key library generation interface;

[0034] Step S503, encryption function: input the key and the data to be encrypted, create an AES encryptor object, convert the data to be encrypted into a UTF-8 encoded byte string, and use the padding function of the data padding library to fill it to the AES block size, use the AES encryptor object to encrypt the filled data, obtain the encrypted data, and output the encrypted data;

[0035] Step S504, decryption function: input the key and the encrypted data, create an AES decryptor object, use the AES decryptor object to decrypt the encrypted data, and obtain the decrypted padding data; use the de-padding function in the de-padding library to remove the padding, restore the length of the original data, and convert the result into a UTF-8 decoded string, and output the decrypted original data;

[0036] Step S504, print the generated key, print the original data to be encrypted, call the encryption function to encrypt the original data, and print the encrypted data, call the decryption function to decrypt the encrypted data, and print the decrypted data.

[0037] The beneficial effects of the present invention are:

[0038] 1. The 1394B high-speed interface data encryption and obfuscation method for airborne avionics systems of the present invention can improve the processing speed and efficiency of the algorithm while reducing resource consumption and safety hazards;

[0039] 2. The present invention does not need to modify the original 1394B communication protocol and has high reusability;

[0040] 3. The present invention increases the processing steps and complexity of data by combining block replacement and byte-level encryption, making it difficult for attackers to predict or restore the original data through simple analysis methods;

[0041] 4. The present invention uses the replacement rules and encryption keys generated by the random number algorithm to ensure the randomness and unpredictability of the algorithm, further enhancing the security of the data;

[0042] 5. The method of the present invention supports data blocks of different sizes and multiple encryption methods, and can be adjusted and optimized according to actual needs to adapt to different application scenarios;

[0043] 6. The method of the present invention can be combined with other security mechanisms (such as digital signatures and hash verification) to further enhance the security and integrity protection of data. DETAILED DESCRIPTION

[0044] In order to better explain the present invention and facilitate understanding, the present invention is described in detail below through specific implementation methods.

[0045] The present invention provides a 1394B high-speed interface data encryption and obfuscation method for an airborne avionics system, comprising the following steps:

[0046] Step S01, decode block STOF_2 through the avionics system 1394B interface data file, parse out the block attribute: milliseconds, and use the parsed milliseconds as the primary key.

[0047] Step S02: Dynamically generate session keys using a key exchange protocol. The present invention uses the Diffie-Hellman key exchange protocol to improve security. Even if an attacker intercepts encrypted data, he cannot directly obtain the primary key because the key for each communication is different.

[0048] Step S03, setting block byte replacement and encryption method;

[0049] The block byte replacement and encryption method includes a data block division and filling method, a block replacement method, a byte-level encryption method, and a reversibility guarantee method.

[0050] The data chunking and padding includes dividing the input data into blocks of fixed size. If the data length is not an integer multiple of the block size, the data length is supplemented to an integer multiple of the block size. Specifically, the padding mode PKCS#7 can be used for padding. Reasonable data chunking size and padding strategy are crucial to the performance and security of encryption and obfuscation methods. Chunking that is too large leads to low processing efficiency, while chunking that is too small increases the complexity and overhead of the algorithm. At the same time, the padding strategy also needs to ensure the integrity and reproducibility of the data.

[0051] The block permutation method includes permuting the data after block division, and the permutation rule is permuted according to the permutation table generated based on the random number algorithm, and the data blocks are rearranged according to the permutation table to increase the randomness and complexity of the data. The setting of the permutation rule needs to be sufficiently complex and random to resist various attack methods. This requires the random number algorithm to have high-quality randomness and unpredictability, and the permutation rule also needs to be updated regularly to prevent being cracked.

[0052] The byte-level encryption method includes encrypting the bytes in each block using a derivative algorithm of a symmetric encryption algorithm, where the key and initial vector IV are generated by a random number algorithm and change with each block. Specifically, the key and initial vector IV can be encrypted with the bytes in each block using a derivative algorithm of the AES symmetric encryption algorithm. The selection of an encryption algorithm requires comprehensive consideration of the algorithm's security, efficiency, and compatibility. The AES symmetric encryption algorithm is a common choice, but it also needs to be adjusted and optimized according to specific application scenarios. At the same time, key management and distribution are also key issues in encryption technology.

[0053] Derivative algorithms of symmetric encryption algorithms include AES, DES, SM4, Blowfish, ChaCha20, Salsa20, RC4, RC6, and IDEA algorithms. The present invention uses the derivative algorithm developed by AES for encryption. The following steps are included:

[0054] Step S501, importing a database, wherein the database includes a library for AES encryption and decryption, a library for filling and defilling data, and a library for generating random keys;

[0055] Step S502, define the AES block size: the block size of the AES algorithm is fixed at 16 bytes (128 bits).

[0056] Step S503, generate a key: Generate a 16-byte random key by calling the random key library generation interface. This key will be used in the encryption and decryption process.

[0057] Step S503, encryption function: input the key and the data to be encrypted, create an AES encryptor object using CBC mode, convert the data to be encrypted into a UTF-8 encoded byte string, and use the padding function of the data padding library to pad it to the AES block size (16 bytes). This is because AES encryption requires that the length of the input data must be an integer multiple of the block size. Use the AES encryptor object to encrypt the padded data to obtain the encrypted data, and output the encrypted data.

[0058] Step S504, decryption function: input the key and the encrypted data, create an AES decryptor object: also use CBC mode. Use the AES decryptor object to decrypt the encrypted data to obtain the decrypted padding data. Use the de-padding function in the de-padding library to remove the padding, restore the length of the original data, and convert the result into a UTF-8 decoded string. Output the decrypted original data.

[0059] Step S504: Print the generated key (in hexadecimal form) and print the original data to be encrypted. Call the encryption function to encrypt the original data and print the encrypted data (in hexadecimal form). Call the decryption function to decrypt the encrypted data and print the decrypted data.

[0060] The AES derivative algorithm of the present invention adjusts and optimizes AES, and key management and distribution are also guaranteed in the algorithm.

[0061] For the target data, other security verification methods can be used in parallel or nested to further enhance the security and integrity protection of the data. For example: using digital signature and hash verification to jointly encrypt data, the specific algorithm flow is as follows:

[0062] 1. Define the function:

[0063] •Generate RSA key pair function: including private key and public key.

[0064] • Signature function: Signs data using a private key.

[0065] • Public key verification function: Use the public key to verify the validity of the signature.

[0066] • Hash calculation function: Calculates the SHA-256 hash value of the data.

[0067] 2. Prepare sample data:

[0068] •Define a string data to represent important data that needs to be protected.

[0069] 3. Generate a key pair:

[0070] •Call the Generate RSA Key Pair function to generate RSA private and public keys.

[0071] 4. Save the public key:

[0072] •Convert the public key to PEM format and print it out. In practice, the public key is securely stored via AES-128 and transmitted to the verifier when decrypted.

[0073] 5. Signature data:

[0074] •Sign the data using the private key and signature function to generate a signature value.

[0075] • Print the hexadecimal representation of the signature value.

[0076] 6. Verify the signature:

[0077] • Use the public key and public key verification function to verify the validity of the signature.

[0078] • Print the signature verification result (True or False).

[0079] 7. Calculate the hash value of the data:

[0080] • Use a hashing function to calculate the SHA-256 hash value of the data.

[0081] • Print a hexadecimal representation of the hash value.

[0082] 8. Verify data integrity:

[0083] •Assume that we have an original hash value for comparison (in the AES-128 algorithm mentioned earlier, this hash value is calculated before data transmission and is transmitted along with the data).

[0084] • Use the data to calculate a hash value and compare it to the previously calculated hash value.

[0085] • Print the data integrity verification result (True or False).

[0086] The entire process covers the generation of RSA key pairs, data signing and verification, hash value calculation, and data integrity verification. These steps are crucial in ensuring the confidentiality, integrity, and authenticity of data in practical applications.

[0087] The reversibility guarantee method includes recording the permutation rules and the encryption key and initial vector IV of each block so that the receiver can correctly restore the data. Recording information such as permutation rules and encryption keys is crucial to the reversibility of encryption and obfuscation methods, so appropriate security measures need to be taken to protect this information. For example, secure storage and transmission mechanisms can be used to prevent information leakage or tampering.

[0088] Specifically, step S03 includes the following steps:

[0089] Step S301, initialization, selecting a secure random number algorithm and providing it with a random seed, including a timestamp, environmental noise, etc., and determining the size of the data block, for example, 128 bytes.

[0090] Step S302, data segmentation and padding, divide the input data into blocks according to the block size. If the data length is not an integer multiple of the block size, use the padding mode PKCS#7 to pad it to an integer multiple of the block size.

[0091] Step S303: block replacement, using a random number algorithm to generate a replacement table, which defines the position of each block in the output, and rearranges the data blocks according to the replacement table.

[0092] Step S304: byte-level encryption. For each replaced block, a unique key and initial vector IV are generated using a random number algorithm. The key and initial vector IV are encrypted with the bytes in each block using the AES-128 symmetric encryption algorithm.

[0093] Step S305: record the permutation rule and the encryption key and initial vector IV of each block. This information is necessary for the receiver to correctly restore the data.

[0094] Step S306: Send the encrypted data block and the recorded information to the receiver.

[0095] The 1394B high-speed interface data encryption and obfuscation method for an airborne avionics system of the present invention further includes a receiving party data restoration method, and the receiving party data restoration method includes the following steps:

[0096] Step S401, receiving data, receiving encrypted data blocks and recorded information; the recorded information includes a substitution rule, a key for each block and an initial vector IV.

[0097] Step S402: byte-level decryption, using the recorded key and initialization vector IV to decrypt each encrypted data block;

[0098] Step S403: block inverse replacement, restoring the data block to the original data according to the recorded replacement rule;

[0099] Step S404: Remove padding. If the data has been padded, remove the padding data to restore the original data.

[0100] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. Alterations, modifications, substitutions and variations of the above embodiments by a person skilled in the art are all within the scope of the present invention.

Claims

1. A 1394B high-speed interface data encryption and obfuscation method for airborne avionics systems, characterized in that: The steps include: Step S01, decode block STOF_2 through the avionics system 1394B interface data file, parse out the block attribute: milliseconds, and use the parsed milliseconds as the primary key; Step S02: dynamically generate a session key using a key exchange protocol; Step S03, setting block byte replacement and encryption method; The block byte replacement and encryption method includes a data block division and filling method, a block replacement method, a byte-level encryption method, and a reversibility guarantee method. The data block division and padding includes dividing the input data into blocks of fixed size, and if the data length is not an integer multiple of the block size, padding it to an integer multiple of the block size; The block replacement method includes replacement of the block data, and the replacement rule is replaced according to the replacement table generated based on the random number algorithm; The byte-level encryption method involves encrypting the bytes within each block, using a derivative of the symmetric encryption algorithm, where the key and initial vector IV are generated by a random number algorithm and change with each block; The reversibility guarantee method includes recording the permutation rule and the encryption key and initial vector IV of each block; The step S03 comprises the following steps: Step S301, initialization, selecting a secure random number algorithm and providing it with a random seed, including a timestamp or environmental noise, and determining the size of the data block; Step S302, data block division and padding, the input data is divided into blocks according to the block size. If the data length is not an integer multiple of the block size, it is filled using the padding mode PKCS#7; Step S303: block replacement, using a random number algorithm to generate a replacement table, and rearranging the data blocks according to the replacement table; Step S304: byte-level encryption: for each replaced block, a unique key and initial vector IV are generated using a random number algorithm, and the key and initial vector IV are encrypted with the bytes in each block using the AES symmetric encryption algorithm; Step S305, record the replacement rule and the encryption key and initial vector IV of each block; Step S306, sending the encrypted data block and the recorded information to the receiver; The data encryption and obfuscation method further includes a method for restoring data by a receiver, and the method for restoring data by a receiver includes the following steps: Step S401, receiving data, receiving encrypted data blocks and recorded information; Step S402: byte-level decryption, using the recorded key and initialization vector IV to decrypt each encrypted data block; Step S403: block inverse replacement, restoring the data block to the original data according to the recorded replacement rule; Step S404: Remove padding. If the data has been padded, remove the padding data to restore the original data. The derivative algorithm of the symmetric encryption algorithm comprises the following steps: Step S501, importing a database, wherein the database includes a library for AES encryption and decryption, a library for filling and defilling data, and a library for generating random keys; Step S502, define the AES block size: the block size of the AES algorithm is fixed to 16 bytes; Step S503, generate a key: generate a 16-byte random key by calling the random key library generation interface; Step S503, encryption function: input the key and the data to be encrypted, create an AES encryptor object, convert the data to be encrypted into a UTF-8 encoded byte string, and use the padding function of the data padding library to fill it to the AES block size, use the AES encryptor object to encrypt the filled data, obtain the encrypted data, and output the encrypted data; Step S504, decryption function: input the key and the encrypted data, create an AES decryptor object, use the AES decryptor object to decrypt the encrypted data, and obtain the decrypted padding data; use the de-padding function in the de-padding library to remove the padding, restore the length of the original data, and convert the result into a UTF-8 decoded string, and output the decrypted original data; Step S504, print the generated key, print the original data to be encrypted, call the encryption function to encrypt the original data, and print the encrypted data, call the decryption function to decrypt the encrypted data, and print the decrypted data.

2. The 1394B high-speed interface data encryption and obfuscation method for an airborne avionics system according to claim 1, characterized in that: The key exchange protocol in step S02 is the Diffie-Hellman key exchange protocol.

3. The 1394B high-speed interface data encryption and obfuscation method for an airborne avionics system according to claim 1, characterized in that: The symmetric encryption algorithms include AES, DES, SM4, Blowfish, ChaCha20, Salsa20, RC4, RC6, and IDEA algorithms.