Security encryption wireless communication device and method based on commercial cryptographic algorithm

Abstract

The invention relates to the technical field of communication security, in particular to a security encryption wireless communication device and method based on a commercial password algorithm, and the device is installed on terminal equipment facing a commercial password transformation demand, and is used as a client to access an external commercial password service or as a server to agency a local service into a commercial password service; the device comprises a management module, a data capture module and a commercial password encryption and decryption module, the management module supports two management modes, namely a Web management mode and an AT instruction management mode, the Web management mode is suitable for terminal equipment with a browser, and the AT instruction management mode is suitable for embedded terminal equipment; the management module issues a strategy to the data capture module and the commercial password encryption and decryption module according to the configuration of the terminal equipment; and the data capture module and the commercial password encryption and decryption module work according to the issued strategy. According to the invention, comprehensive support for various network protocols can be realized, the compatibility of different systems is improved, and the commercial password transformation difficulty is reduced.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and more specifically to a secure encrypted wireless communication device and method based on a commercial cryptographic algorithm. Background Art

[0002] With the rapid development of the Internet and the increasing rampant cyber attacks, the security of data transmission has become extremely important. The SSL / TLS protocol is the main means of secure data transmission on the Internet. The TLCP protocol uses cryptographic algorithms independently developed by China (such as SM2, SM3, and SM4) to reduce the risk of data leakage and enhance the controllability of information security. With the promulgation of national policies, various information systems inevitably face the problem of commercial secret transformation. However, most existing software does not support the TLCP protocol, which means that in order to make these systems meet the commercial secret standards, large-scale transformation is required, which is not only a large workload, but also has a significant impact on the transformation of the original business system. How to reduce the cost of transformation is an important issue we face.

[0003] At present, the market generally adopts the method of deploying commercial secret SSL gateway hardware equipment on the server side and installing commercial secret proxy software on the client side for commercial secret transformation. This deployment method can well solve the problem of commercial secret transformation on the server side, but the existing client solutions have great limitations. There are basically two solutions for client implementation: one is HTTP proxy mode (such as CN106101056A), and the other is virtual network card mode (such as CN 112887444A). However, these methods all have some defects:

[0004] HTTP proxy mode only supports HTTP / HTTPS protocols and cannot proxy other common network protocols, such as TCP and UDP. This is a significant limitation for applications that require full network protocol support and cannot meet diverse network communication needs.

[0005] Virtual NIC mode requires the operating system to support the virtual NIC function. However, some embedded systems or customized systems do not have this capability, which makes it impossible for these systems to use virtual NIC mode. The installation and configuration of virtual NICs may involve complex operations, and compatibility issues may occur in different operating systems and environments, increasing the difficulty of deployment and maintenance.

[0006] Therefore, how to achieve comprehensive support for multiple network protocols, improve the compatibility of different systems, and reduce the difficulty of commercial encryption transformation has become a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0007] In view of this, the present invention provides a secure encrypted wireless communication device and method based on a commercial cryptographic algorithm, which can achieve comprehensive support for multiple network protocols, improve the compatibility of different systems, and reduce the difficulty of commercial cryptographic transformation.

[0008] In order to achieve the above object, the present invention adopts the following technical solution:

[0009] In a first aspect, the present invention provides a secure encrypted wireless communication device based on a commercial cryptographic algorithm, which is installed on a terminal device facing the need for commercial cryptographic transformation, and is used as a client to access external commercial cryptographic services, or as a server to proxy local services into commercial cryptographic services;

[0010] The device comprises: a management module, a data capture module and a commercial key encryption and decryption module;

[0011] The management module supports two management modes, namely, Web management mode and AT command management mode. The Web management mode is applicable to terminal devices with browsers, and the AT command management mode is applicable to embedded terminal devices. The management module issues policies to the data capture module and the commercial key encryption and decryption module according to the configuration of the terminal device.

[0012] The data capture module and the commercial key encryption and decryption module work according to the issued strategy.

[0013] Furthermore, the device also includes a plurality of different types of physical interfaces for pluggable connection with different types of terminals.

[0014] Furthermore, after the device establishes a connection with the terminal device, it is identified as a network adapter and a serial port device. The network adapter obtains an intranet IP through DHCP, and the intranet IP is the address of the default gateway; the terminal device performs Web management through the address of the default gateway, or performs AT command management through the serial port device.

[0015] Furthermore, the device also integrates a 4G module, a 5G module and a WiFi module.

[0016] In a second aspect, the present invention provides a secure encrypted wireless communication method based on a commercial cryptographic algorithm, comprising:

[0017] Install the above device on the terminal device that needs to be modified for commercial encryption, and use it as a client to access external commercial encryption services;

[0018] Or use the device as a server to proxy local services into commercial encryption services.

[0019] Furthermore, when the device accesses an external commercial secret service as a client, its workflow includes:

[0020] S11, the terminal device sends configuration information through the Web or AT command program, and the management module sends the configuration information to the data capture module and the commercial key encryption and decryption module;

[0021] S12, when the terminal device initiates a service request, the handshake message first reaches the data capture module, and the data capture module matches the capture rule, which includes the destination address, the destination port and the protocol; if the match is successful and the protocol is the TCP protocol, the data capture module establishes a TCP connection with the client program of the terminal device as a server; if the match is successful and the protocol is the UDP protocol, S13 is directly executed;

[0022] S13, the terminal device sends the service request data to the data capture module through a TCP connection or directly through a UDP protocol, and the data capture module then forwards the service request data to the commercial key encryption and decryption module for encryption; the data capture module also informs the commercial key encryption and decryption module of the configuration policy corresponding to the service request data;

[0023] S14, the commercial key encryption and decryption module first establishes a commercial key TLCP connection with the external commercial key server according to the information in the configuration policy, and after the connection is successfully established, sends the encrypted business data to the external commercial key server through the commercial key TLCP;

[0024] S15. The business response data returned by the external commercial secret service end is first decrypted by the commercial secret encryption module and then forwarded to the data capture module. The data capture module uses the TCP connection established in S12 or directly sends the decrypted business response data to the terminal device through the UDP protocol.

[0025] Furthermore, the configuration information sent by the terminal device includes at least: a destination address, a port, a protocol version, an algorithm suite, and a certificate.

[0026] Furthermore, when the device acts as a server to proxy the local service into a commercial secret service, its workflow includes:

[0027] S21, the terminal device sends configuration information through the Web or AT command program, and the management module sends the configuration information to the data capture module and the commercial key encryption and decryption module;

[0028] S22, the commercial secret request sent by the external commercial secret client arrives at the commercial secret encryption and decryption module, and the commercial secret encryption and decryption module establishes a commercial secret TLCP connection with the external commercial secret client;

[0029] S23. After completing the commercial secret TLCP connection, the external commercial secret client sends the service request data to the commercial secret encryption and decryption module. The commercial secret encryption and decryption module decrypts the service request data and forwards it to the data capture module. At the same time, the configuration policy corresponding to the service request data is also informed to the data capture module. If the communication protocol in the configuration policy is the TCP protocol, the data capture module acts as a client and establishes a TCP connection with the terminal device. If it is the UDP protocol, S24 is directly executed.

[0030] S24, the data capture module sends the decrypted service request data to the terminal device via a TCP connection or directly via a UDP protocol;

[0031] S25. The response data of the terminal device is returned to the data capture module through a TCP connection or directly through a UDP protocol. The data capture module forwards the returned response data to the commercial key encryption and decryption module for encryption. The commercial key encryption and decryption module uses the commercial key TLCP connection established in S22 to send the encrypted response data to the external commercial key client.

[0032] Furthermore, when two terminal devices A and terminal device B that face the need for commercial secret transformation need to perform the commercial secret TLCP protocol, the device is installed on terminal device A and terminal device B respectively, and the device on terminal device A is configured as client mode, and the device on terminal device B is configured as server mode; or, the device on terminal device A is configured as server mode, and the device on terminal device B is configured as client mode.

[0033] It can be seen from the above technical solutions that, compared with the prior art, the present invention has the following beneficial effects:

[0034] 1. The present invention supports multiple network protocols, including HTTP / HTTPS, TCP, UDP, etc., so as to meet diverse network communication needs and improve the flexibility and applicability of the system.

[0035] 2. The present invention supports Web management and AT command management, thereby having stronger compatibility with different operating systems and embedded devices, making deployment and use on different devices more convenient and efficient.

[0036] 3. The present invention integrates the national encryption SSL proxy service into the wireless network card, which has plug-and-play characteristics, reduces the modification and installation burden on the user terminal, reduces the cost and difficulty of transformation, simplifies the system configuration and deployment process, and enables more systems to quickly and economically implement national encryption protocol support.

[0037] 4. The present invention is more friendly to embedded devices by reducing the performance consumption and resource occupation of embedded devices, and helps to improve the performance and stability of the devices.

[0038] 5. The present invention improves the communication security and data privacy protection level by introducing the national secret SSL proxy service in the terminal, while enhancing the controllability of information security and reducing the risk of data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1 A hardware structure diagram of a secure encryption wireless communication device based on a commercial encryption algorithm provided by the present invention;

[0041] Figure 2 A schematic diagram of the software structure of a secure encrypted wireless communication device based on a commercial cryptographic algorithm provided by the present invention;

[0042] Figure 3 The working flow diagram of the wireless communication device provided by the present invention when it accesses an external commercial secret service as a client;

[0043] Figure 4 The present invention provides a workflow diagram when the wireless communication device acts as a server to proxy the local service into a commercial encryption service;

[0044] Figure 5 A schematic diagram of the structure of the terminal device A and the terminal device B provided by the present invention when performing a commercial secret TLCP connection. DETAILED DESCRIPTION

[0045] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] The embodiment of the present invention discloses a secure encryption wireless communication device based on a commercial cryptographic algorithm, which is installed on a terminal device that faces the need for commercial cryptographic transformation, and is used as a client to access external commercial cryptographic services, or as a server to proxy local services into commercial cryptographic services;

[0047] The hardware part of the device is as follows Figure 1As shown, it mainly includes a wireless communication module, multiple different types of physical interfaces and multiple different categories of wireless card slots, among which the physical interfaces include USB and Mini PCIe, which are used for pluggable connection with different types of terminals; the wireless card slot is used to install a 4G network card, a 5G network card or a WiFi network card to realize 4G, 5G and WiFi communications.

[0048] Software part such as Figure 2 As shown, the wireless communication module is burned with commercial secret firmware, which includes: a management module, a data capture module and a commercial secret encryption and decryption module;

[0049] The management module supports two management modes, namely Web management mode and AT command management mode. The Web management mode is applicable to terminal devices with browsers, while the AT command management mode is applicable to embedded terminal devices. The management module issues policies to the data capture module and the commercial key encryption and decryption module according to the configuration of the terminal device.

[0050] The data capture module and the commercial key encryption and decryption module work according to the issued policies.

[0051] All commercial TLCP-related functions are implemented in the commercial firmware. There is no need to consider the compatibility of terminal devices, and the network card is plug-and-play.

[0052] After the device establishes a connection with the terminal device, it is identified as a network adapter and a serial port device. The network adapter obtains an intranet IP through DHCP, and the intranet IP is the address of the default gateway; the terminal device performs Web management through the address of the default gateway, or performs AT command management through the serial port device.

[0053] In another embodiment, the present invention discloses a secure encrypted wireless communication method based on a commercial cryptographic algorithm, comprising:

[0054] The above device is installed on the terminal equipment that needs to be converted to commercial secrets, and used as a client to access external commercial secrets services; or the device is used as a server to proxy local services into commercial secrets services.

[0055] like Figure 3 As shown, when the device accesses an external commercial secret service as a client, its workflow includes:

[0056] S11, the terminal device sends configuration information through the Web or AT command program, and the configuration information at least includes: destination address, port, protocol version, algorithm suite and certificate information; the management module sends the configuration information to the data capture module and the commercial key encryption and decryption module;

[0057] S12. When the terminal device initiates a service request, the handshake message first reaches the data capture module. The data capture module matches the capture rules, which include destination address, destination port, protocol and other information. If the match is successful and the protocol is TCP, the data capture module establishes a TCP connection with the client program of the terminal device in the role of the server. The service request data initiated by the terminal device is then sent to the data capture module via the TCP connection. If the protocol is UDP, S13 is directly executed. If no match is found, it means that the service request traffic does not require special processing (i.e., commercial secret connection), and the data packet can be forwarded normally.

[0058] S13. The terminal device sends the service request data to the data capture module through a TCP connection or directly through the UDP protocol. The data capture module forwards the service request data to the commercial encryption and decryption module for encryption. The data capture module also informs the commercial encryption and decryption module of the configuration policy corresponding to the service request data. When the data capture module receives the handshake message, it automatically obtains the configuration policy such as the destination address, destination port, and protocol corresponding to the current data. After informing the commercial encryption and decryption module of the configuration policy, the commercial encryption and decryption module will know how to send the data.

[0059] S14, the commercial key encryption and decryption module first establishes a commercial key TLCP connection with the external commercial key server according to the information in the configuration policy. After the connection is successfully established, the encrypted business data is sent to the external commercial key server through the commercial key TLCP;

[0060] S15. The business response data returned by the external commercial secret server is first decrypted by the commercial secret encryption module and then forwarded to the data capture module. The data capture module uses the TCP connection established by S12 or directly sends the decrypted business response data to the terminal device through the UDP protocol.

[0061] like Figure 4 As shown, when the device acts as a server to proxy the local service into a commercial secret service, its workflow includes:

[0062] S21. The terminal device sends configuration information through the Web or AT command program. The configuration information includes local source port, protocol version, algorithm suite, certificate and other information. The management module sends the configuration information to the data capture module and the commercial key encryption and decryption module; if the management module sends the configuration of the server mode, the commercial key encryption and decryption module will open the listening port of the commercial key SSL protocol according to the configuration. The listening port is bound to the configuration, and all subsequent data received by this port will be processed through the configuration.

[0063] S22, the commercial secret request sent by the external commercial secret client arrives at the commercial secret encryption and decryption module, and the commercial secret encryption and decryption module establishes a commercial secret TLCP connection with the external commercial secret client;

[0064] S23. After completing the commercial secret TLCP connection, the external commercial secret client sends the business request data to the commercial secret encryption and decryption module. The commercial secret encryption and decryption module decrypts the business request data and forwards it to the data capture module. At the same time, it also tells the data capture module the configuration policy corresponding to the business request data; if the communication protocol in the configuration policy is the TCP protocol, the data capture module acts as a client and establishes a TCP connection with the terminal device; if it is the UDP protocol, S24 is directly executed.

[0065] In server mode, the external commercial key client will directly access the listening port opened in advance by the commercial key encryption and decryption module. After receiving the client's request, the commercial key encryption and decryption module can know the configuration policy corresponding to the data according to the data message header without decrypting it. The commercial key encryption and decryption module will then tell the data capture module the configuration policy.

[0066] S24, the data capture module sends the decrypted service request data to the terminal device via a TCP connection or directly via a UDP protocol;

[0067] S26. The response data of the terminal device is returned to the data capture module through the TCP connection or UDP protocol. The data capture module forwards the returned response data to the commercial key encryption and decryption module for encryption. The commercial key encryption and decryption module uses the commercial key TLCP connection established in S22 to send the encrypted response data to the external commercial key client.

[0068] In general, in server mode, if the commercial key encryption and decryption module receives the correct commercial key request, it will send the decrypted data to the data capture module after decryption is completed, and will also inform the data capture module which port to forward the data to. If it is TCP protocol, after receiving the data sent by the commercial key encryption and decryption module, the data capture module will directly establish a TCP connection with the destination port to be forwarded, and then forward the data to the terminal device. If it is UDP protocol, the data capture module directly forwards the data to the terminal device through UDP protocol.

[0069] In one embodiment, Figure 5 As shown, assuming that both terminal device A and terminal device B face the need for commercial encryption transformation, when both need to perform the commercial encryption TLCP protocol, the above-mentioned wireless communication devices are installed on terminal device A and terminal device B respectively, the device on terminal device A is configured as client mode, and the device on terminal device B is configured as server mode; the request sent by terminal device A will be converted into commercial encryption TLCP by the secure encrypted wireless communication device based on the commercial encryption algorithm and then sent to terminal device B, and the commercial encryption TLCP request received by terminal device B will also be decrypted by the secure encrypted wireless communication device based on the commercial encryption algorithm.

[0070] Alternatively, the device on terminal device A is configured as server mode, and the device on terminal device B is configured as client mode; the request sent by terminal device B will be converted into a commercial secret TLCP by a secure encrypted wireless communication device based on a commercial cryptographic algorithm and sent to terminal device A, and the commercial secret TLCP request received by terminal device A will also be decrypted by a secure encrypted wireless communication device based on a commercial cryptographic algorithm.

[0071] In this way, the system achieves commercial secret transformation without changing the original business logic.

[0072] Below, the relevant terms involved in the present invention are further explained:

[0073] Commercial secret: It is the national secret algorithm standard, including SM1, SM2, SM3, SM4, SM7, SM9 and Zu Chongzhi algorithm.

[0074] SM2: Commercial asymmetric encryption algorithm.

[0075] SM3: Commercial cryptographic hash algorithm.

[0076] SM4: Commercial symmetric encryption algorithm.

[0077] Wireless communication: A communication method that uses radio electromagnetic waves to transmit information in space.

[0078] SSL (Secure Socket Layer): Secure Socket Layer protocol.

[0079] TLS (Transport Layer Security): Transport layer security protocol.

[0080] TLCP (Transport Layer Cryptography Protocol): Transport layer cryptography protocol.

[0081] HTTP (Hypertext Transfer Protocol): Hypertext Transfer Protocol.

[0082] TCP / UDP: Transmission Control Protocol / User Datagram Protocol.

[0083] VPN (Virtual Private Network): Virtual private network.

[0084] Proxy: A server or software that acts as an intermediary in the communication process.

[0085] Virtual NIC: software that simulates the functions of a physical NIC.

[0086] Embedded system: A dedicated computer system that can operate independently.

[0087] USB (Universal Serial Bus): Universal Serial Bus.

[0088] Mini PCIe: A small, high-speed serial computer expansion bus standard interface.

[0089] SIM (Subscriber Identity Module) card: An integrated circuit card held by users of the Global System for Mobile Communications.

[0090] AT commands: commands used for connection and communication between terminal devices and PC applications.

[0091] DHCP (Dynamic Host Configuration Protocol): Dynamic Host Configuration Protocol.

[0092] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0093] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A secure encrypted wireless communication device based on a commercial cryptographic algorithm, characterized in that: It is installed on terminal devices that need to be converted to commercial secrets, and is used as a client to access external commercial secrets services, or as a server to proxy local services into commercial secrets services; The device comprises: a management module, a data capture module and a commercial key encryption and decryption module; The management module supports two management modes, namely, Web management mode and AT command management mode. The Web management mode is applicable to terminal devices with browsers, and the AT command management mode is applicable to embedded terminal devices. The management module issues policies to the data capture module and the commercial key encryption and decryption module according to the configuration of the terminal device. The data capture module and the commercial key encryption and decryption module work according to the issued strategy.

2. The device according to claim 1, characterized in that The device also includes a plurality of different types of physical interfaces for pluggable connection with different types of terminals.

3. The device according to claim 1, characterized in that After the device establishes a connection with the terminal device, it is identified as a network adapter and a serial port device. The network adapter obtains an intranet IP through DHCP, and the intranet IP is the address of the default gateway; the terminal device performs Web management through the address of the default gateway, or performs AT command management through the serial port device.

4. The device according to claim 1, characterized in that The device also includes multiple wireless card slots of different categories for installing 4G network cards, 5G network cards or WiFi network cards.

5. A secure encrypted wireless communication method based on a commercial cryptographic algorithm, characterized in that: include: Installing the device according to any one of claims 1 to 4 on a terminal device that needs to be modified for commercial encryption, and accessing external commercial encryption services as a client; Or use the device as a server to proxy local services into commercial encryption services.

6. The method according to claim 5, characterized in that When the device accesses an external commercial secret service as a client, its workflow includes: S11, the terminal device sends configuration information through the Web or AT command program, and the management module sends the configuration information to the data capture module and the commercial key encryption and decryption module; S12, when the terminal device initiates a service request, the handshake message first reaches the data capture module, and the data capture module matches the capture rule, which includes the destination address, the destination port and the protocol; if the match is successful and the protocol is the TCP protocol, the data capture module establishes a TCP connection with the client program of the terminal device as a server; if the match is successful and the protocol is the UDP protocol, S13 is directly executed; S13, the terminal device sends the service request data to the data capture module through a TCP connection or directly through a UDP protocol, and the data capture module then forwards the service request data to the commercial key encryption and decryption module for encryption; the data capture module also informs the commercial key encryption and decryption module of the configuration policy corresponding to the service request data; S14, the commercial key encryption and decryption module first establishes a commercial key TLCP connection with the external commercial key server according to the information in the configuration policy, and after the connection is successfully established, sends the encrypted business data to the external commercial key server through the commercial key TLCP; S15. The business response data returned by the external commercial secret service end is first decrypted by the commercial secret encryption module and then forwarded to the data capture module. The data capture module uses the TCP connection established in S12 or directly sends the decrypted business response data to the terminal device through the UDP protocol.

7. The method according to claim 6, characterized in that The configuration information sent by the terminal device includes at least: destination address, port, protocol version, algorithm suite and certificate.

8. The method according to claim 6, characterized in that When the device acts as a server to proxy the local service into a commercial secret service, its workflow includes: S21, the terminal device sends configuration information through the Web or AT command program, and the management module sends the configuration information to the data capture module and the commercial key encryption and decryption module; S22, the commercial secret request sent by the external commercial secret client arrives at the commercial secret encryption and decryption module, and the commercial secret encryption and decryption module establishes a commercial secret TLCP connection with the external commercial secret client; S23. After completing the commercial secret TLCP connection, the external commercial secret client sends the service request data to the commercial secret encryption and decryption module. The commercial secret encryption and decryption module decrypts the service request data and forwards it to the data capture module. At the same time, the configuration policy corresponding to the service request data is also informed to the data capture module. If the communication protocol in the configuration policy is the TCP protocol, the data capture module acts as a client and establishes a TCP connection with the terminal device. If it is the UDP protocol, S24 is directly executed. S24, the data capture module sends the decrypted service request data to the terminal device via a TCP connection or directly via a UDP protocol; S25. The response data of the terminal device is returned to the data capture module through a TCP connection or directly through a UDP protocol. The data capture module forwards the returned response data to the commercial key encryption and decryption module for encryption. The commercial key encryption and decryption module uses the commercial key TLCP connection established in S22 to send the encrypted response data to the external commercial key client.

9. The method according to claim 5, characterized in that When two terminal devices A and B that need to be transformed into commercial encryption need to perform the commercial encryption TLCP protocol, the device is installed on the terminal device A and the terminal device B respectively, the device on the terminal device A is configured as a client mode, and the device on the terminal device B is configured as a server mode; Alternatively, the device on terminal device A is configured as a server mode, and the device on terminal device B is configured as a client mode.

Images