Bidirectional authentication and dynamic packet format transmission method and system based on preset domain

Abstract

The invention discloses a bidirectional authentication and dynamic packet format transmission method and system based on a preset domain. A data exchange transceiving subsystem initiates a request for establishing a data transmission channel; the data exchange transceiving subsystem obtains noise data from the entrance guard type gateway equipment; the data exchange transceiving subsystem calculates a noise data hash value, acquires a data transmission strategy hash value in a preset domain by taking a low 8bit as an address, and sends the data transmission strategy hash value to the entrance guard type gateway equipment; the doorkeeper type gateway device calculates a noise data hash value, and obtains a data transmission strategy hash value in a local preset domain with a low 8bit as an address; comparing the two hash values by the entrance guard type gateway equipment, if the two hash values are consistent, establishing a data transmission channel, and performing data transmission on the to-be-transmitted original message data according to a selected data transmission strategy, otherwise, not establishing the data transmission channel; the system comprises a data sending PC end and a data receiving PC end with a built-in data exchange transceiving subsystem, and a doorkeeper type gateway device, wherein a data transmission channel is established among the data sending PC end, the data receiving PC end and the doorkeeper type gateway device according to the method.

Description

Technical Field

[0001] The present invention relates to the technical field of data communication security, and more particularly to a method and system for bidirectional authentication and dynamic packet format transmission based on a preset domain. Background Art

[0002] At present, the communication security requirements for access to data transmission equipment are getting higher and higher. In large and medium-sized equipment, a variety of cryptographic algorithms are applied, such as SM1, SM2, SM3, SM4, AES, etc. The diversity of application algorithms means that more algorithm modules are needed to support it, resulting in an increase in the power consumption and size of the equipment.

[0003] In some small device applications, there are high requirements for volume and power consumption. The current mainstream algorithm implementation solutions are difficult to meet the requirements. This requires a simple, high-speed, low-power cryptographic algorithm implementation solution to achieve data communication transmission. Summary of the invention

[0004] In order to overcome the deficiencies in the prior art, based on the considerations of simplicity, high speed and low power consumption, the present invention provides a method and system for bidirectional authentication and dynamic packet format transmission based on a preset domain, which can ensure reliable transmission of messages.

[0005] The purpose of the present invention can be achieved through the following technical solutions.

[0006] The bidirectional authentication and dynamic packet format transmission method based on a preset domain of the present invention comprises the following processes:

[0007] S1: The data exchange transceiver subsystem initiates a request to the gatekeeper gateway device to establish a data transmission channel;

[0008] S2: The data exchange transceiver subsystem obtains a piece of noise data from the gatekeeper gateway device;

[0009] S3: The data exchange transceiver subsystem calculates the hash value of the noise data obtained in step S2, uses the lower 8 bits of the hash value of the noise data as the address to obtain the corresponding data transmission strategy and its hash value in the preset domain of the data exchange transceiver subsystem, and sends the hash value of the data transmission strategy to the gatekeeper gateway device;

[0010] S4: The gatekeeper gateway device calculates the hash value of the same noise data segment in step S2, and uses the lower 8 bits of the hash value of the noise data as the address to obtain the corresponding data transmission strategy and its hash value in the local preset domain of the gatekeeper gateway device;

[0011] S5: The gatekeeper gateway device compares the hash value of the data transmission strategy obtained by the local calculation in step S4 with the hash value of the data transmission strategy obtained by the data exchange transceiver subsystem in step S3. If the comparison is consistent, a data transmission channel is established and step S6 is executed. Otherwise, the data transmission channel is not established.

[0012] S6: The original message data to be transmitted is transmitted according to the selected data transmission strategy.

[0013] Furthermore, the gatekeeper gateway device uses FPGA as the main control and communication chip, and has an embedded noise source chip.

[0014] Furthermore, the preset domains of the gatekeeper gateway device and the data exchange transceiver subsystem both store data transmission strategies of different custom communication protocols and hash values ​​of each data transmission strategy according to addresses.

[0015] Furthermore, each of the data transmission strategies includes a fixed verification header and a dynamic data body; the fixed verification header includes a non-optional part and an optional part, the non-optional part includes a fixed header, length, packet sequence number, session number, CRC check, and the optional part includes format check and noise filling; the dynamic data body is any one or more operations of offset, cyclic shift, and encoding performed on the original message data to be transmitted.

[0016] Furthermore, the offset operation fills noise data in the middle part of the original message data to be transmitted according to the offset amount to obtain the result message data; the cyclic shift operation is to perform cyclic shift according to the bit based on the result of the above-mentioned offset operation to obtain new message content; the encoding operation is to map the result data of the cyclic shift operation according to the encoding table.

[0017] Furthermore, the specific process of transmitting the original message data to be transmitted in step S6 according to the selected data transmission strategy is as follows: according to the selected data transmission strategy, firstly, a fixed verification header is added to the original message data to be transmitted, and then the message data after adding the fixed verification header is offset, cyclically shifted, and encoded in sequence, to obtain a ciphertext data message, and finally the ciphertext data message is transmitted.

[0018] The purpose of the present invention can also be achieved through the following technical solutions.

[0019] The present invention discloses a bidirectional authentication and dynamic packet format transmission system based on a preset domain, comprising a data sending PC end, a data receiving PC end, and a gatekeeper-type gateway device, wherein the data sending PC end and the data receiving PC end are both equipped with a data exchange transceiver subsystem, and a data transmission channel is established between the data sending PC end and the gatekeeper-type gateway device, and between the data receiving PC end and the gatekeeper-type gateway device according to the bidirectional authentication and dynamic packet format transmission method based on a preset domain described in any one of claims 1 to 6, and then a data transmission channel is established between the data sending PC end and the data receiving PC end, and then the data transmission channel is established between the data sending PC end and the data receiving PC end, and then the data sending PC end adds a fixed verification packet header to the original message data to be transmitted according to the selected data transmission strategy, and performs any one or more operations of offset, cyclic shift, and encoding on the message data after the fixed verification packet header is added, and the obtained ciphertext data message is transmitted to the data receiving PC end, and for the obtained ciphertext data message, the data receiving PC end performs operations according to the opposite data operations: decoding, reverse cyclic shift, reverse offset, and deletion of the fixed verification packet header, and finally the original message data to be transmitted is obtained.

[0020] Compared with the prior art, the technical solution of the present invention has the following beneficial effects:

[0021] The present invention adopts a two-way authentication and dynamic packet format transmission method and system based on a preset domain, which ensures the legitimacy of the data exchange transceiver subsystem of the access device. When the data sending PC does not contain a preset domain, the data cannot pass through the gatekeeper gateway device; when the data receiving PC does not contain a preset domain, the original data cannot be correctly parsed, and it is also ensured that only the packet format specified by the preset domain can pass through the gatekeeper gateway device. Data can only be sent and received through the data exchange transceiver subsystem. When the data transceiver PC contains a preset domain, a random number (i.e., randomly selected noise data) is used to select a data transmission strategy in the preset domain before the channel is established, and the data packet format changes dynamically according to the selected data transmission strategy. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flow chart of the two-way authentication and dynamic packet format transmission method based on preset domains of the present invention.

[0023] Figure 2 It is a schematic diagram of the offset operation in the present invention.

[0024] Figure 3 It is a schematic diagram of the cyclic shift operation in the present invention.

[0025] Figure 4 It is a schematic diagram of the encoding operation in the present invention.

[0026] Figure 5 It is a schematic diagram of a two-way authentication and dynamic packet format transmission system based on a preset domain in the present invention.

[0027] Figure 6 It is a schematic diagram of encrypting original message data according to the selected data transmission strategy.

[0028] Figure 7 It is a schematic diagram of data decryption of ciphertext data messages according to the selected data transmission strategy. DETAILED DESCRIPTION

[0029] The present invention will be further described below in conjunction with the accompanying drawings.

[0030] Example 1

[0031] like Figure 1 As shown, the bidirectional authentication and dynamic packet format transmission method based on a preset domain of the present invention includes the following processes:

[0032] S1: The data exchange transceiver subsystem initiates a request to the gatekeeper gateway device to establish a data transmission channel.

[0033] The present invention selects FPGA as the main control and communication chip, embeds a noise source chip, and realizes a gatekeeper-type gateway device.

[0034] S2: The data exchange transceiver subsystem obtains a piece of noise data from the gatekeeper gateway device.

[0035] S3: The data exchange transceiver subsystem calculates the hash value of the noise data obtained in step S2, uses the lower 8 bits of the noise data hash value as the address to obtain the corresponding data transmission strategy and its hash value in the preset domain of the data exchange transceiver subsystem, and sends the hash value of the data transmission strategy to the gatekeeper gateway device.

[0036] S4: The gatekeeper gateway device calculates the hash value of the same noise data segment in step S2, and uses the lower 8 bits of the hash value of the noise data as the address to obtain the corresponding data transmission strategy and its hash value in the local preset domain of the gatekeeper gateway device;

[0037] S5: The gatekeeper gateway device compares the hash value of the data transmission strategy obtained by the local calculation in step S4 with the hash value of the data transmission strategy obtained by the data exchange transceiver subsystem in step S3. If the comparison is consistent, a data transmission channel is established and step S6 is executed. Otherwise, the data transmission channel is not established.

[0038] S6: The original message data to be transmitted is transmitted according to the selected data transmission strategy. The specific process is as follows: according to the selected data transmission strategy, a fixed verification header is first added to the original message data to be transmitted, and then the message data after adding the fixed verification header is offset, cyclically shifted, and encoded in sequence, and the obtained ciphertext data message is transmitted.

[0039] During the data transmission process, in order to prevent illegal users from connecting to the gatekeeper gateway device for data communication and ensure the security of data transmission, the present invention introduces an authentication method based on the random number selection of the data transmission strategy hash value of the preset domain. The data transmission channel is established by using noise data to select the data transmission strategy, and the data packet format changes dynamically according to the selected data transmission strategy. Multiple data transmission strategies and the hash value of each data transmission strategy are stored in the preset domain of the gatekeeper gateway device and the data exchange transceiver subsystem. The preset domain authentication process is to establish a data transmission channel before preparing for the data / file sending instruction after the gatekeeper gateway device and the data exchange transceiver subsystem are started. Specifically, the preset domain data transmission strategy hash value is obtained based on the noise data hash value, and the data transmission channel is established based on the comparison of the preset domain data transmission strategy hash value. The data transmission process after the channel is established is transmission based on the data transmission strategy.

[0040] For example: the data exchange transceiver subsystem obtains a piece of noise data R from the gatekeeper gateway device, calculates the hash value HR of the noise data, and uses the lower 8 bits of the hash value HR as the address AHRS to obtain the corresponding data transmission strategy and the hash value HB of the data transmission strategy in the preset domain of the data exchange transceiver subsystem. The data exchange transceiver subsystem sends the hash value HB to the gatekeeper gateway device. The gatekeeper gateway device uses the previously sent noise data R to obtain the data transmission strategy hash value HDR in the local preset domain in the same way as the data exchange transceiver subsystem. The gatekeeper gateway device compares the locally calculated hash value HDR with the hash value HB calculated by the data exchange transceiver subsystem. If the comparison is consistent, a data transmission channel is established, otherwise no transmission channel is established. It should be noted here that if the hash value HDR is consistent with the hash value HB, it means that the corresponding data transmission strategies of the two are also consistent.

[0041] In the above steps, the preset domains of the gatekeeper gateway device and the data exchange transceiver subsystem store data transmission strategies of different custom communication protocols and hash values ​​of each data transmission strategy. The storage format of the preset domain is shown in Table 1. When storing, the data transmission strategies and hash values ​​are stored according to the address.

[0042] Table 1 Preset domain storage format

[0043] Serial number address Message format strategy result 1 0 Data Transfer Strategy 1 Hash value 2 1 Data Transfer Strategy 2 Hash value 3 2 Data Transfer Strategy 3 Hash value …… …… …… …… 256 255 Data transfer policy 256 Hash value

[0044] The above method can ensure that the data transmission strategy used for each transmission is inconsistent. The data transmission strategy is obtained based on the hash value of the noise data, which has no special rules and is a random number that is difficult to track. The access authentication method based on the hash value of the preset domain data transmission strategy can prevent the data transceiver subsystem that does not contain the preset domain from establishing a data transmission channel with the gatekeeper gateway device. After the data exchange transceiver subsystem and the gatekeeper gateway device establish a data transmission channel, the gatekeeper gateway device communicates according to the data transmission strategy selected in the preset domain by the hash value of the noise data. Data messages that do not conform to the specified format cannot pass through the gatekeeper gateway device.

[0045] Each of the data transmission strategies includes a fixed verification header and a dynamic data body. Examples of data transmission strategies are shown in Table 2, but are not limited to this specific content.

[0046] Table 2 Data transmission strategy examples

[0047]

[0048]

[0049]

[0050] (1) Fixed verification header

[0051] The fixed verification header includes a non-optional part and an optional part, as shown in Table 3. The non-optional part mainly includes a fixed header, length, packet sequence number, session number, and CRC check, and the optional part includes format check and noise filling. These parts of the message are format checked, and only fixed format data of letters, numbers, or a combination of letters and numbers can appear in the specified part.

[0052] Table 3 Fixed verification header

[0053]

[0054] (2) Dynamic data text

[0055] The offset and displacement of the valid message are configured according to the data transmission strategy, and any one or more operations of offset, cyclic shift and encoding are performed on the original message data to be transmitted.

[0056] ① Offset operation: fill the middle part of the original message data to be transmitted with noise data according to the offset to obtain the result message data. Perform block offset operation on the valid data message (i.e. the original message data to be transmitted after adding the fixed verification header) and divide it into M blocks. The head and tail of the body of each data block are filled with noise data according to the head filling length and tail filling length respectively. Figure 2The data format after the Nth (N≤M) data block is filled is shown.

[0057] ② Circular shift operation: According to the result of the above offset operation, perform bit shift operation according to the acquired data transmission strategy, take out the lower n bits of each data block offset result of the offset operation result, and place them at the head of the corresponding data block offset result to obtain the new message content. Figure 3 As shown, the lower n bits of the Nth (N≤M) data block offset result of the offset operation result are taken out and placed at the head of the Nth data block offset result to obtain new data.

[0058] ③ Coding operation: In bytes, the result data of the circular shift operation is mapped based on the stored data transmission strategy. The coding operation is performed according to the set coding table. The format of the coding table is as follows: Figure 4 As shown. According to this encoding table, if we input 0x00, the result after encoding may be 0xfd, and if we input 0xfe, the result is 0x01. Through the encoding table, a connection is established between the cyclically shifted data and the ciphertext data message. If the ciphertext data message is obtained, the data before encoding can only be obtained through the encoding table.

[0059] Example 2

[0060] Based on the principle of the above-mentioned two-way authentication and dynamic packet format transmission method based on preset domain, the present invention also proposes a two-way authentication and dynamic packet format transmission system based on preset domain, such as Figure 5 As shown, it mainly includes a data sending PC end, a data receiving PC end, and a gatekeeper gateway device. Both the data sending PC end and the data receiving PC end are equipped with a data exchange transceiver subsystem.

[0061] When the data sending PC sends data, the data sending PC establishes a data transmission channel with the gatekeeper gateway device through the data exchange transceiver subsystem in accordance with the above-mentioned two-way authentication based on the preset domain and dynamic packet format transmission method. Similarly, the data receiving PC establishes a data transmission channel with the gatekeeper gateway device through the data exchange transceiver subsystem in accordance with the above-mentioned two-way authentication based on the preset domain and dynamic packet format transmission method, thereby realizing the establishment of a data transmission channel between the data sending PC and the data receiving PC.

[0062] After the data transmission channel is established, the data exchange transceiver subsystem at the data sending PC adds a fixed verification header to the original message data to be transmitted according to the selected data transmission strategy, and performs any one or more operations of offset, cyclic shift, and encoding on the message data after adding the fixed verification header, such as Figure 6As shown, the obtained ciphertext data message is transmitted to the data exchange transceiver subsystem at the data receiving PC end. For the obtained ciphertext data message, the data exchange transceiver subsystem at the data receiving PC end performs the opposite data operation: decoding, reverse cyclic shift, reverse offset, and deletion of the fixed verification packet header, and finally obtains the original message data to be transmitted, as shown in Figure 7 It should be noted here that the data exchange transceiver subsystem at the data sending PC performs data operations in the order of adding a fixed verification header, offset, cyclic shift, and encoding operations. The fixed verification header is a required part, and the remaining operations are performed according to the selected data transmission strategy. The corresponding data exchange transceiver subsystem at the data receiving PC can perform the opposite operations.

[0063] The decoding operation is the reverse operation of the above encoding operation: perform the reverse operation according to the above set coding table. If we input 0xfd, the result after decoding may be 0x00. If the input is 0x01, the result is 0xfe. The reverse cyclic shift is the reverse operation of the above cyclic shift operation: if the cyclic shift operation is a circular right shift of N bits, then the reverse cyclic shift is a circular left shift of N bits. The reverse shift is the reverse operation of the shift operation: from the obtained data block, according to the selected data transmission strategy, delete the invalid data (i.e., noise data) filled in the header of each data block's valid data (i.e., the text part) and the invalid data (i.e., noise data) filled in the tail of each data block's valid data (i.e., the text part). Deleting the fixed verification header is to delete the fixed verification header added above.

[0064] The data transmission strategy derived from the access authentication based on the preset domain can ensure that data transmission can only be completed through the data exchange transceiver subsystem. Illegal data messages cannot pass the data transmission strategy check of the gatekeeper gateway device and are discarded. In the data transceiver subsystem at the receiving end, illegal users cannot correctly parse the data message and cannot obtain the original data.

[0065] Although the functions and working processes of the present invention have been described above in conjunction with the accompanying drawings, the present invention is not limited to the above-mentioned specific functions and working processes. The above-mentioned specific implementation methods are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the purpose of the present invention and the claims, which are all within the protection of the present invention.

Claims

1. A method for two-way authentication and dynamic packet format transmission based on a preset domain, characterized in that: The process includes: S1: The data exchange transceiver subsystem initiates a request to the gatekeeper gateway device to establish a data transmission channel; S2: The data exchange transceiver subsystem obtains a piece of noise data from the gatekeeper gateway device; S3: The data exchange transceiver subsystem calculates the hash value of the noise data obtained in step S2, uses the lower 8 bits of the hash value of the noise data as the address to obtain the corresponding data transmission strategy and its hash value in the preset domain of the data exchange transceiver subsystem, and sends the hash value of the data transmission strategy to the gatekeeper gateway device; S4: The gatekeeper gateway device calculates the hash value of the same noise data segment in step S2, and uses the lower 8 bits of the hash value of the noise data as the address to obtain the corresponding data transmission strategy and its hash value in the local preset domain of the gatekeeper gateway device; S5: The gatekeeper gateway device compares the hash value of the data transmission strategy obtained by the local calculation in step S4 with the hash value of the data transmission strategy obtained by the data exchange transceiver subsystem in step S3. If the comparison is consistent, a data transmission channel is established and step S6 is executed. Otherwise, the data transmission channel is not established. S6: The original message data to be transmitted is transmitted according to the selected data transmission strategy.

2. The method for bidirectional authentication and dynamic packet format transmission based on a preset domain according to claim 1, characterized in that: The gatekeeper gateway device uses FPGA as the main control and communication chip, and has an embedded noise source chip.

3. The method for bidirectional authentication and dynamic packet format transmission based on a preset domain according to claim 1, characterized in that: The preset domains of the gatekeeper gateway device and the data exchange transceiver subsystem both store data transmission strategies of different custom communication protocols and the hash value of each data transmission strategy according to the address.

4. The method for bidirectional authentication and dynamic packet format transmission based on a preset domain according to claim 1, characterized in that: Each of the data transmission strategies includes a fixed verification header and a dynamic data body; the fixed verification header includes a non-optional part and an optional part, the non-optional part includes a fixed header, length, packet sequence number, session number, CRC check, and the optional part includes format check and noise filling; the dynamic data body is any one or more operations of offset, cyclic shift, and encoding performed on the original message data to be transmitted.

5. The method for bidirectional authentication and dynamic packet format transmission based on a preset domain according to claim 4, characterized in that: The offset operation fills the middle part of the original message data to be transmitted with noise data according to the offset to obtain result message data; The cyclic shift operation is to perform cyclic shift according to the result of the above-mentioned offset operation to obtain new message content; The encoding operation is to map the result data of the cyclic shift operation according to the encoding table.

6. The method for bidirectional authentication and dynamic packet format transmission based on a preset domain according to claim 1, characterized in that: The specific process of transmitting the original message data to be transmitted in step S6 according to the selected data transmission strategy is as follows: according to the selected data transmission strategy, first, a fixed verification header is added to the original message data to be transmitted, and then the message data after adding the fixed verification header is offset, cyclically shifted, and encoded in sequence, to obtain a ciphertext data message, and finally the ciphertext data message is transmitted.

7. A system for bidirectional authentication and dynamic packet format transmission based on a preset domain based on the bidirectional authentication and dynamic packet format transmission method based on a preset domain according to any one of claims 1 to 6, characterized in that: It includes a data sending PC end, a data receiving PC end, and a gatekeeper gateway device, wherein the data sending PC end and the data receiving PC end are both equipped with a data exchange transceiver subsystem, and a data transmission channel is established between the data sending PC end and the gatekeeper gateway device, and between the data receiving PC end and the gatekeeper gateway device according to the two-way authentication and dynamic packet format transmission method based on a preset domain as described in any one of claims 1 to 6 above, and then a data transmission channel is established between the data sending PC end and the data receiving PC end, and then the data transmission channel is established between the data sending PC end and the data receiving PC end, and then the data sending PC end adds a fixed verification packet header to the original message data to be transmitted according to the selected data transmission strategy, and performs any one or more operations of offset, cyclic shift, and encoding on the message data after the fixed verification packet header is added, and the obtained ciphertext data message is transmitted to the data receiving PC end, and for the obtained ciphertext data message, the data receiving PC end performs operations according to the opposite data operations: decoding, reverse cyclic shift, reverse offset, and deletion of the fixed verification packet header, and finally obtains the original message data to be transmitted.

Images