Two-way authentication and dynamic packet format transmission method and system based on preset domain

Abstract

The application discloses a kind of two-way authentication and dynamic packet format transmission method and system based on preset domain: data exchange transceiver subsystem initiates to establish data transmission channel request;Data exchange transceiver subsystem obtains noise data from gate guard type gateway device;Data exchange transceiver subsystem calculates the hash value of noise data, obtains data transmission strategy hash value in preset domain with low 8bit as address, and sends gate guard type gateway device;Gate guard type gateway device calculates the hash value of noise data, obtains data transmission strategy hash value in local preset domain with low 8bit as address;Gate guard type gateway device compares two hash values, if consistent, establishes data transmission channel, otherwise, does not establish data transmission channel;System includes data sending PC end and data receiving PC end with built-in data exchange transceiver subsystem and gate guard type gateway device, and data transmission channel is established between the three according to the above method.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data communication security, and more particularly to a two-way authentication and dynamic packet format transmission method and system based on a preset domain. BACKGROUND

[0002] Currently, the communication security requirement for accessing data transmission equipment is higher and higher, and in large and medium-sized equipment, various cryptographic algorithms are applied, such as SM1, SM2, SM3, SM4, AES, etc. The diversity of application algorithms represents the need for more algorithm modules to support, resulting in the power consumption and volume of the equipment also following the increase.

[0003] In some small device application occasions, there are higher requirements for volume and power consumption, and the current mainstream algorithm implementation scheme is difficult to meet the requirements, so a simple, high-speed and low-power cryptographic algorithm implementation scheme is needed to realize data communication transmission. SUMMARY

[0004] In order to overcome the deficiencies in the prior art, based on the consideration of simplicity, high speed and low power consumption, the present application provides a two-way authentication and dynamic packet format transmission method and system based on a preset domain, which can ensure reliable transmission of messages.

[0005] The object of the present application can be achieved by the following technical solutions.

[0006] The two-way authentication and dynamic packet format transmission method based on a preset domain of the present application comprises the following processes:

[0007] S1: The data exchange transceiver subsystem initiates a data transmission channel establishment request to the gatekeeper gateway device;

[0008] S2: The data exchange transceiver subsystem obtains a segment of noise data from the gatekeeper gateway device;

[0009] S3: The data exchange transceiver subsystem calculates the hash value of the noise data obtained in step S2, takes the low 8 bits of the noise data hash value as an address to obtain the corresponding data transmission strategy and its hash value in the preset domain of the data exchange transceiver subsystem, and sends the hash value of the data transmission strategy to the gatekeeper gateway device;

[0010] S4: The gatekeeper gateway device calculates the hash value of the same segment of noise data in step S2, takes the low 8 bits of the noise data hash value as an address to obtain the corresponding data transmission strategy and its hash value in the local preset domain of the gatekeeper gateway device;

[0011] S5: The gatekeeper type gateway device compares the hash value of the data transmission strategy obtained by local calculation in step S4 with the hash value of the data transmission strategy calculated by the data exchange transceiver subsystem in step S3, and if the comparison is consistent, a data transmission channel is established, and step S6 is executed, otherwise, the data transmission channel is not established;

[0012] S6: The original message data to be transmitted is transmitted according to the selected data transmission strategy.

[0013] Further, the gatekeeper type gateway device selects FPGA as the main control and communication chip, and embeds a noise source chip.

[0014] Further, the gatekeeper type gateway device and the data exchange transceiver subsystem each have data transmission strategies of different self-defined communication protocols and hash values of each data transmission strategy stored in the preset domain according to the address.

[0015] Further, each of the data transmission strategies includes a fixed verification header and a dynamic data body; the fixed verification header includes a non-selectable part and a selectable part, the non-selectable part includes a fixed header, a length, a packet sequence number, a session number, and CRC check, and the selectable part includes format check and noise filling; and the dynamic data body is any one or several operations of offset, cyclic shift and encoding on the original message data to be transmitted.

[0016] Further, the offset operation fills noise data in the middle part of the original message data to be transmitted according to an offset amount to obtain result message data; the cyclic shift operation is to move the result data of the above-mentioned offset operation according to bit to obtain new message content; and the encoding operation is to map the result data of the cyclic shift operation according to an encoding table.

[0017] Further, the specific process of transmitting the original message data to be transmitted according to the selected data transmission strategy in step S6 is as follows: according to the selected data transmission strategy, first, the original message data to be transmitted is increased with a fixed verification header, then any one or several operations of offset, cyclic shift and encoding are performed on the message data with the increased fixed verification header in sequence to obtain ciphertext data message, and finally, the ciphertext data message is transmitted.

[0018] The object of the application can also be achieved by the following technical solutions.

[0019] The application is based on the preset field-based two-way authentication and dynamic packet format transmission system, comprising a data sending PC end, a data receiving PC end and a gatekeeper gateway device, the data sending PC end and the data receiving PC end are both internally provided with a data exchange transceiving subsystem, a data transmission channel is established between the data sending PC end and the gatekeeper gateway device and between the data receiving PC end and the gatekeeper gateway device according to the preset field-based two-way authentication and dynamic packet format transmission method in any one of claims 1 to 6, and then a data transmission channel is established between the data sending PC end and the data receiving PC end, after that, the data sending PC end adds a fixed verification packet header to the original message data to be transmitted according to the selected data transmission strategy, and the message data after the fixed verification packet header is added is subjected to any one or several operations of offset, cyclic shift and encoding in sequence, and the obtained cipher text message data is transmitted to the data receiving PC end, and the data receiving PC end is subjected to the reverse data operation: decoding, reverse cyclic shift, reverse offset and deletion of the fixed verification packet header, and finally the original message data to be transmitted is obtained

[0020] Compared with the prior art, the technical scheme of the application has the beneficial effects that:

[0021] The preset field-based two-way authentication and dynamic packet format transmission method and system are adopted in the application, and the legality of the data exchange transceiving subsystem of the access device is ensured. In the case that the data sending PC end does not contain the preset field, the data cannot pass through the gatekeeper gateway device; in the case that the data receiving PC end does not contain the preset field, the original data cannot be correctly parsed, and it is also ensured that only the packet format specified by the preset field can pass through the gatekeeper gateway device. The data can only be sent and received through the data exchange transceiving subsystem. In the case that the data transceiving PC contains the preset field, a random number (i.e. randomly selected noise data) is used to select the data transmission strategy in the preset field before the channel is established, and the data packet format dynamically changes according to the selected data transmission strategy. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 is the flowchart of the preset field-based two-way authentication and dynamic packet format transmission method of the application.

[0023] Figure 2 is the offset operation schematic diagram in the application.

[0024] Figure 3 is the cyclic shift operation schematic diagram in the application.

[0025] Figure 4 is the encoding operation schematic diagram in the application.

[0026] Figure 5 is the preset field-based two-way authentication and dynamic packet format transmission system schematic diagram in the application.

[0027] Figure 6 is the original message data according to the selected data transmission strategy for data encryption schematic diagram.

[0028] Figure 7 is the ciphertext data message according to the selected data transmission strategy for data decryption schematic diagram. DETAILED DESCRIPTION

[0029] The application will be further described below with reference to the drawings.

[0030] Embodiment 1

[0031] As shown in the figure, the two-way authentication and dynamic packet format transmission method based on the preset domain of the application comprises the following processes: Figure 1

[0032] S1: The data exchange transceiver subsystem initiates a data transmission channel establishment request to the gatekeeper gateway device.

[0033] The application selects FPGA as the main control and communication chip, and embeds a noise source chip to realize the gatekeeper gateway device.

[0034] S2: The data exchange transceiver subsystem obtains a segment of noise data from the gatekeeper gateway device.

[0035] S3: The data exchange transceiver subsystem calculates the hash value of the noise data obtained in step S2, takes the low 8 bits of the hash value of the noise data as an address to obtain the corresponding data transmission strategy and its hash value in the preset domain of the data exchange transceiver subsystem, and sends the hash value of the data transmission strategy to the gatekeeper gateway device.

[0036] S4: The gatekeeper gateway device calculates the hash value of the same segment of noise data in step S2, takes the low 8 bits of the hash value of the noise data as an address to obtain the corresponding data transmission strategy and its hash value in the local preset domain of the gatekeeper gateway device.

[0037] S5: The gatekeeper gateway device compares the hash value of the data transmission strategy calculated and obtained in step S4 with the hash value of the data transmission strategy calculated and obtained in step S3, and if the comparison is consistent, a data transmission channel is established, and step S6 is executed, otherwise, no data transmission channel is established.

[0038] S6: The original message data to be transmitted is transmitted according to the selected data transmission strategy, and the specific process is as follows: according to the selected data transmission strategy, first, the original message data to be transmitted is increased with a fixed verification header, then the message data after the fixed verification header is added is sequentially subjected to any one or several operations of offset, cyclic shift and encoding, and the obtained ciphertext data message is transmitted.​

[0039] In the data transmission process, in order to prevent illegal users from connecting the gatekeeper gateway device for data communication and ensure the safety of data transmission, the application introduces an authentication method of data transmission strategy hash value based on random number selection of preset domain. The data transmission channel establishment adopts noise data to select the data transmission strategy, and the data packet format dynamically changes according to the selected data transmission strategy. The preset domain of the gatekeeper gateway device and the data exchange transceiver subsystem stores multiple data transmission strategies and the hash value of each data transmission strategy. The preset domain authentication process is to establish a data transmission channel before sending the data / file sending instruction after the gatekeeper gateway device and the data exchange transceiver subsystem are started. Specifically, the preset domain data transmission strategy hash value is obtained based on the noise data hash value, and the data transmission channel is established based on the comparison of the preset domain data transmission strategy hash value. The data transmission process after the channel is established is based on the data transmission strategy.

[0040] For example: the data exchange transceiver subsystem obtains a segment of noise data R from the gatekeeper gateway device, calculates the hash value HR of the noise data, and takes the low 8 bits of the hash value HR as the address AHRS to obtain the corresponding data transmission strategy and the hash value HB of the data transmission strategy in the preset domain of the data exchange transceiver subsystem. The data exchange transceiver subsystem sends the hash value HB to the gatekeeper gateway device. The gatekeeper gateway device uses the same method as the data exchange transceiver subsystem to obtain the data transmission strategy hash value HDR in the local preset domain by using the previously sent noise data R. The gatekeeper gateway device compares the locally calculated hash value HDR with the hash value HB calculated by the data exchange transceiver subsystem. After the comparison is consistent, the data transmission channel is established, otherwise the transmission channel is not established. It should be noted that if the hash value HDR and the hash value HB are consistent, it means that the corresponding data transmission strategies are also consistent.

[0041] In the above step process, the preset domain of the gatekeeper gateway device and the data exchange transceiver subsystem stores data transmission strategies of different self-defined communication protocols and the hash value of each data transmission strategy. The storage format of the preset domain is shown in Table 1, and the data transmission strategy and the hash value are stored according to the address when storing.

[0042] Table 1: Preset domain storage format

[0043] Sequence number Address Message format policy Result 1 0 Data transfer policy 1 Hash value 2 1 Data transfer policy 2 Hash value 3 2 Data transfer policy 3 Hash value …… …… …… …… 256 255 Data transfer policy 256 Hash value

[0044] The above method can ensure that the data transmission strategy used in each transmission is inconsistent. The data transmission strategy is obtained based on the hash value of the noise data, and has no special rule, random number, and is difficult to track. The access authentication method based on the hash value of the preset domain data transmission strategy can prevent the data transceiver subsystem not containing the preset domain from establishing a data transmission channel with the gatekeeper gateway device. After the data exchange transceiver subsystem and the gatekeeper gateway device establish a data transmission channel, the gatekeeper gateway device communicates according to the data transmission strategy selected in the preset domain based on the hash value of the noise data. The data message that does not conform to the specified format cannot pass through the gatekeeper gateway device.

[0045] Each of the data transmission strategies includes a fixed verification header and a dynamic data body. For example, the data transmission strategy is shown in Table 2, but the specific content is not limited thereto.

[0046] Table 2: Data transmission strategy example

[0047]

[0048]

[0049]

[0050] (1) Fixed verification header

[0051] The fixed verification header includes a non-selectable part and a selectable part, as shown in Table 3. The non-selectable part mainly includes a fixed header, a length, a packet sequence number, a session number, and a CRC check. The selectable part includes a format check and noise padding. The format check is performed on the message. The specified part can only appear in a fixed format of letters, numbers, or letter-number combinations.

[0052] Table 3: Fixed verification header

[0053]

[0054] (2) Dynamic data body

[0055] According to the offset and displacement of the data transmission strategy configuration effective message, any one or several operations of offset, circular shift, and encoding are performed on the original message data to be transmitted.

[0056] ①Offset operation: noise data is filled in the middle part of the original message data to be transmitted according to the offset, and the result message data is obtained. The effective data message (i.e., the original message data to be transmitted after adding the fixed verification header) is subjected to block offset operation, which can be divided into M blocks. Noise data is filled in the head and tail of each block of data block body part according to the head filling length and the tail filling length, respectively, as shown in Figure 2The data format after the Nth (N≤M) data block is filled is shown.

[0057] ②Cyclic shift operation: according to the result of the above offset operation, a bit shift operation is performed according to the obtained data transmission strategy, and the low nbit of each data block offset result of the offset operation result is extracted and placed at the head of the corresponding data block offset result, to obtain a new message content. Figure 3 The low nbit of the Nth (N≤M) data block offset result of the offset operation result is extracted and placed at the head of the Nth data block offset result, to obtain new data.

[0058] ③Encoding operation: the result data of the cyclic shift operation is mapped based on the stored data transmission strategy in byte units, and the encoding operation is performed according to the set encoding table, for example, the format of the encoding table is shown in Figure 4 According to the encoding table, if we input 0x00, the encoded result may be 0xfd, and if we input 0xfe, the result is 0x01. Through the encoding table, a connection is established between the data after the cyclic shift and the ciphertext data message. If the ciphertext data message is obtained, the data before encoding can only be obtained through the encoding table.

[0059] Embodiment 2

[0060] On the basis of the principle of the above-mentioned two-way authentication and dynamic packet format transmission method based on a preset field, the application further provides a two-way authentication and dynamic packet format transmission system based on a preset field, as shown in Figure 5 The system mainly comprises a data sending PC end, a data receiving PC end and a gatekeeper gateway device, and the data sending PC end and the data receiving PC end are both internally provided with a data exchange transceiver subsystem.

[0061] When the data sending PC end sends data, the data sending PC end establishes a data transmission channel with the gatekeeper gateway device through the data exchange transceiver subsystem according to the above-mentioned two-way authentication and dynamic packet format transmission method based on a preset field, and the data receiving PC end establishes a data transmission channel with the gatekeeper gateway device through the data exchange transceiver subsystem according to the above-mentioned two-way authentication and dynamic packet format transmission method based on a preset field, so as to realize the establishment of the data transmission channel between the data sending PC end and the data receiving PC end.

[0062] After the data transmission channel is established, the data exchange transceiver subsystem of the data sending PC end increases a fixed verification packet header to the original message data to be transmitted according to the selected data transmission strategy, and sequentially performs any one or several operations of offset, cyclic shift and encoding on the message data after the fixed verification packet header is added, for example, Figure 6As shown, the obtained cipher data packet is transmitted to the data exchange transceiver subsystem of the data receiving PC, and the data exchange transceiver subsystem of the data receiving PC performs the following operations on the obtained cipher data packet in the reverse order: decoding, inverse cyclic shift, inverse offset, and deleting the fixed verification header, and finally obtains the original data packet to be transmitted, as shown. Figure 7 It should be noted that the data exchange transceiver subsystem of the data sending PC performs the following operations on the data: adding a fixed verification header, offset, cyclic shift, and encoding, and the fixed verification header must be added, and the other operations are performed according to the selected data transmission strategy. The data exchange transceiver subsystem of the data receiving PC performs operations in the reverse order.

[0063] The decoding operation is the reverse operation of the above-mentioned encoding operation: the reverse operation is performed according to the above-mentioned encoding table. If we input 0xfd, the obtained result after decoding is 0x00, and if we input 0x01, the obtained result is 0xfe. The inverse cyclic shift is the reverse operation of the above-mentioned cyclic shift operation: if the cyclic shift operation is cyclic right shift Nbit, then the inverse cyclic shift is cyclic left shift Nbit. The inverse offset is the reverse operation of the above-mentioned offset operation: according to the selected data transmission strategy, the invalid data (i.e., noise data) filled in the header of each data block valid data (i.e., text part) and the invalid data (i.e., noise data) filled in the tail of each data block valid data (i.e., text part) are deleted from the obtained data block. The deleting fixed verification header is to delete the fixed verification header added above.

[0064] The data transmission strategy obtained by the access authentication based on the preset domain can ensure that only the data exchange transceiver subsystem can complete data sending, and illegal data packets cannot pass the data transmission strategy check of the gatekeeper gateway device and are discarded. In the data transceiver subsystem at the receiving end, an illegal user cannot correctly parse the data packet and cannot obtain the original text data.

[0065] Although the functions and working processes of the present application are described above in combination with the drawings, the present application is not limited to the above-mentioned specific functions and working processes. The above-mentioned specific embodiments are only illustrative and not limiting. Those skilled in the art can make many forms under the inspiration of the present application without departing from the purpose of the present application and the scope protected by the claims, and these are all within the protection of the present application.

Claims

1. A method for two-way authentication and dynamic packet format transmission based on pre-set domain, characterized in that, The method comprises the following steps: S1: the data exchange transceiver subsystem initiates a request for establishing a data transmission channel to the gatekeeper gateway device; S2: the data exchange transceiver subsystem obtains a segment of noise data from the gatekeeper gateway device; S3: the data exchange transceiver subsystem calculates the hash value of the noise data obtained in step S2, and obtains the corresponding data transmission strategy and the hash value thereof in the preset domain of the data exchange transceiver subsystem by taking the low 8 bits of the hash value of the noise data as an address, and sends the hash value of the data transmission strategy to the gatekeeper gateway device; S4: the gatekeeper gateway device calculates the hash value of the same segment of noise data in step S2, and obtains the corresponding data transmission strategy and the hash value thereof in the local preset domain of the gatekeeper gateway device by taking the low 8 bits of the hash value of the noise data as an address; S5: the gatekeeper gateway device compares the hash value of the data transmission strategy calculated and obtained in step S4 with the hash value of the data transmission strategy calculated and obtained in step S3, and if the comparison is consistent, a data transmission channel is established, and step S6 is performed, otherwise, the data transmission channel is not established; S6: the original message data to be transmitted is transmitted according to the selected data transmission strategy.

2. The pre-configuration domain based bidirectional authentication and dynamic packet format transmission method according to claim 1, wherein, The gatekeeper gateway device selects FPGA as the main control and communication chip, and embeds a noise source chip. 3.The pre-configuration domain based bidirectional authentication and dynamic packet format transmission method of claim 1, wherein, The preset domains of the gatekeeper gateway device and the data exchange transceiver subsystem each store data transmission strategies of different self-defined communication protocols and the hash values of each data transmission strategy according to the address.

4. The pre-configuration domain based bidirectional authentication and dynamic packet format transmission method according to claim 1, wherein, Each data transmission strategy comprises a fixed verification header and a dynamic data body; the fixed verification header comprises a non-selectable part and a selectable part, the non-selectable part comprises a fixed header, a length, a packet sequence number, a session number, and CRC check, and the selectable part comprises format check and noise filling; the dynamic data body is any one or several operations of offset, cyclic shift, and encoding on the original message data to be transmitted.

5. The pre-configuration domain based bidirectional authentication and dynamic packet format transmission method according to claim 4, characterized in that, The offset operation fills noise data in the middle part of the original message data to be transmitted according to an offset amount to obtain result message data; The cyclic shift operation cyclically shifts the result data of the above-mentioned offset operation according to bits to obtain new message content; The encoding operation maps the result data of the cyclic shift operation according to an encoding table.

6. The pre-configuration domain based bidirectional authentication and dynamic packet format transmission method according to claim 1, wherein, The specific process of transmitting the original message data to be transmitted according to the selected data transmission strategy in step S6 is as follows: according to the selected data transmission strategy, first, the original message data to be transmitted is increased with a fixed verification header, then any one or several operations of offset, cyclic shift, and encoding are performed on the message data increased with the fixed verification header in sequence to obtain ciphertext data message, and finally, the ciphertext data message is transmitted.

7. A pre-set domain based two-way authentication and dynamic packet format transmission system based on the pre-set domain based two-way authentication and dynamic packet format transmission method of any one of claims 1 to 6, characterized in that, The application relates to a data transmission system, which comprises a data sending PC terminal, a data receiving PC terminal and a gatekeeper gateway device, wherein the data sending PC terminal and the data receiving PC terminal are both internally provided with a data exchange transceiving subsystem, a data transmission channel is established between the data sending PC terminal and the gatekeeper gateway device and between the data receiving PC terminal and the gatekeeper gateway device according to the preset domain-based bidirectional authentication and dynamic packet format transmission method in any one of claims 1 to 6, and then a data transmission channel is established between the data sending PC terminal and the data receiving PC terminal; after that, the data sending PC terminal adds a fixed verification packet header to original message data to be transmitted according to a selected data transmission strategy, and the message data after the fixed verification packet header is added is subjected to any one or several operations of offsetting, circular shifting and encoding in sequence, and the obtained cipher text data message is transmitted to the data receiving PC terminal; and the data receiving PC terminal is subjected to reverse data operation, i.e. decoding, reverse circular shifting, reverse offsetting and deleting the fixed verification packet header, so that the original message data to be transmitted is finally obtained.

Images