Door guard type password application method and device

Abstract

The invention discloses an entrance guard type password application method and device, a first entrance guard type application cipher machine obtains original service data of a first service, the original service data comprise original application loads, to-be-protected data are determined according to each sub-content protection strategy, and the sub-content safety protection strategy comprises to-be-protected data limitation, a protection mode and a key index; generating a security control parameter, encrypting the security control parameter to obtain a ciphertext load and an extended load, and further generating security service data and sending the security service data to a second entrance guard type application cipher machine; and the second entrance guard type application cipher machine obtains the security control parameter through the sub-extended load, decrypts the ciphertext load by using a preset decryption algorithm according to the protection mode, the security control parameter and the key index to obtain to-be-protected data, and finally determines original service data in combination with the ciphertext load and sends the original service data to the second service. According to the method, the protection strategy comprises a plurality of sub-content protection strategies, fine distinguishing protection can be achieved for data of different parts in the original application load, and complex and diverse data protection requirements can be better met.

Description

Technical Field

[0001] The present application belongs to the field of information security, and specifically relates to a gatekeeper password application method and device. Background Art

[0002] With the rapid development of information technology, the risk of data leakage and illegal interception is increasing. In order to strengthen the safe and reliable operation of important systems such as government affairs, electricity, and banks, it is necessary to use cryptographic technology to encrypt information and achieve information concealment, thereby effectively protecting the security of data during transmission, storage, and use, ensuring that data is not illegally intercepted or tampered with, and protecting the integrity and authenticity of data.

[0003] Currently, there is a data protection solution that deploys VPN gateway devices at the boundary of the business system. Through the key negotiation mechanism, the same business protection key is maintained between VPN gateways. When the plain text data between businesses is transmitted on the network, it will be encrypted and signed for protection through the VPN gateway. Sensitive data is securely transmitted in the network between two VPN gateways and cannot be stolen or tampered with, achieving network-level security protection for business data.

[0004] However, this type of VPN gateway is a device for protecting business data and cannot provide fine-grained protection for data. It can only protect data at specified addresses, protocols, and ports, but cannot protect a certain field of business data. Summary of the invention

[0005] The technical purpose of this application is to provide a gatekeeper password application method and system for the current data protection methods that cannot achieve fine-grained data protection. A fine-grained application data protection method that is not sensitive to the business system prevents business data from being stolen and tampered with during transmission.

[0006] In order to achieve the above technical objectives, this application adopts the following technical solutions.

[0007] In a first aspect, an embodiment of the present application provides a gatekeeper-style password application method, which is applied to a first gatekeeper-style application password machine, and the method includes:

[0008] Acquire original service data of the first service, where the original service data includes an original application payload;

[0009] Acquire each sub-content protection strategy according to a preset data protection strategy, each of the sub-content protection strategies includes a limiting parameter of the data to be protected, a protection mode and a protection key index, and the data protection strategy includes at least one sub-content protection strategy;

[0010] Determine the data to be protected corresponding to each sub-content protection strategy in the original application payload according to each of the data to be protected limiting parameters; determine the corresponding security control parameters according to each of the protection methods; encrypt each of the data to be protected using a preset encryption algorithm according to the corresponding protection method, security control parameter and protection key index to obtain a ciphertext payload;

[0011] Generate a corresponding sub-extension payload according to each of the sub-content protection strategies and the corresponding security control parameters, and generate an extension payload according to each of the sub-extension payloads;

[0012] Generate a new application payload according to the ciphertext payload and the extended payload, and generate security service data according to the new application payload;

[0013] The security service data is sent to the second guard-type application cryptographic machine, so that the second guard-type application cryptographic machine obtains the original application payload according to the security service data, generates original service data according to the original application payload, and sends the original service data to the second service.

[0014] As an improvement of the above solution, the method further includes:

[0015] Each of the sub-content protection strategies includes protection conditions, and the data-limited parameters to be protected include a protection starting point and a protection length;

[0016] Determining the data to be protected corresponding to each of the sub-content protection strategies in the original application payload according to each of the limiting parameters of the data to be protected, includes:

[0017] Determine whether the data corresponding to the sub-content protection policy in the original application payload needs to be protected according to each of the protection conditions; if protection is required, use the data of the protection length starting from the protection starting point as the data to be protected corresponding to the sub-content protection policy.

[0018] As an improvement of the above solution, the protection condition includes an operation mode, an operation value and a preset result; determining whether the data corresponding to the sub-content protection policy in the original application payload needs to be protected according to each of the protection conditions includes:

[0019] The operation value is operated using the operation method, and the obtained operation result is compared with the preset result. If they are consistent, the data corresponding to the sub-content protection policy in the original application payload needs to be protected.

[0020] As an improvement of the above solution, the original service data also includes a protocol header;

[0021] Before obtaining each sub-content protection policy according to the preset data protection policy, the following steps are included:

[0022] The network protocol, source port and destination port are obtained from the protocol header; if the network protocol, source port and destination port meet the requirements of the data protection policy on the protocol and port, the protection policies of each sub-content are obtained according to the data protection policy.

[0023] As an improvement of the above solution, the protection method includes any one of a confidentiality protection method, an integrity protection method or an integrity confidentiality protection method;

[0024] If the protection mode includes a confidentiality protection mode, the corresponding security control parameter includes an encryption protection vector;

[0025] If the protection mode includes an integrity protection mode, the corresponding security control parameter includes an integrity check value.

[0026] In a second aspect, the embodiment of the present application further provides a gatekeeper-style password application method, which is applied to a second gatekeeper-style application password machine, and the method includes:

[0027] Acquire security service data, wherein the security service message includes a new application payload, wherein the new application payload includes a ciphertext payload and an extended payload corresponding to all sub-content protection policies in a preset data protection policy, wherein the data protection policy includes at least one sub-content protection policy;

[0028] Obtain each sub-extension payload according to the extension payload, each of the sub-extension payloads is determined according to the security control parameters corresponding to the sub-content protection strategy and the protection mode, and each of the sub-content protection strategies includes a to-be-protected data limiting parameter, the protection mode and a protection key index;

[0029] Decrypting the ciphertext payload using a preset decryption algorithm according to each of the protection modes, security control parameters and protection key indexes to obtain the data to be protected corresponding to each sub-content protection strategy;

[0030] Determine the original application payload according to each of the to-be-protected data and the ciphertext payload; generate original service data according to the original application payload, and send the original service data to the second service.

[0031] As an improvement of the above solution, the protection method includes any one of a confidentiality protection method, an integrity protection method or an integrity confidentiality protection method;

[0032] If the protection mode includes a confidentiality protection mode, the corresponding security control parameter includes an encryption protection vector;

[0033] If the protection method includes an integrity protection method, the corresponding security control parameter includes an integrity check value. After decrypting the ciphertext payload, the calculated integrity check result is compared with the received integrity check value; if the two are consistent, it means that the data maintains integrity during transmission and has not been tampered with; if the two are inconsistent, the decrypted data to be protected is not adopted.

[0034] In a third aspect, an embodiment of the present application further provides a gatekeeper-style password application method, which is applied to a gatekeeper-style password application system, wherein the gatekeeper-style password application system includes a first gatekeeper-style application password machine and a second gatekeeper-style application password machine;

[0035] The method comprises:

[0036] After the first guard-type application cryptographic machine and the second guard-type application cryptographic machine establish a communication connection, the first guard-type application cryptographic machine obtains original service data of the first service, where the original service data includes an original application payload;

[0037] The first security application cryptographic machine obtains each sub-content protection strategy according to a preset data protection strategy, each of the sub-content protection strategies includes a limited parameter of the data to be protected, a protection mode and a protection key index, and the data protection strategy includes at least one sub-content protection strategy;

[0038] The first guard-type application cryptographic machine determines the data to be protected corresponding to each sub-content protection strategy in the original application payload according to each of the data to be protected limiting parameters; determines the corresponding security control parameters according to each of the protection modes, encrypts each of the data to be protected using a preset encryption algorithm according to the corresponding protection mode, security control parameters and protection key index, and obtains a ciphertext payload; generates a corresponding sub-extension payload according to each of the sub-content protection strategies and the corresponding security control parameters, and generates an extension payload according to each of the sub-extension payloads; generates a new application payload according to the ciphertext payload and the extension payload, and generates security service data according to the new application payload;

[0039] The first guard-type application cryptographic machine sends the security service data to the second guard-type application cryptographic machine;

[0040] The second guard-type application cryptographic machine obtains the security service data, the security service data includes a new application payload, the new application payload includes a ciphertext payload and an extended payload corresponding to all sub-content protection policies in a preset data protection policy, and the data protection policy includes at least one sub-content protection policy;

[0041] The second guard-type application cryptographic machine obtains each sub-extension payload according to the extension payload, each of the sub-extension payloads is determined according to the security control parameters corresponding to the sub-content protection strategy and the protection mode, and each of the sub-content protection strategies includes a to-be-protected data limiting parameter, the protection mode and a protection key index;

[0042] The second guard-type application cryptographic machine decrypts the ciphertext payload using a preset decryption algorithm according to each of the protection modes, security control parameters and protection key indexes to obtain the data to be protected corresponding to each sub-content protection strategy; determines the original application payload based on each of the data to be protected and the ciphertext payload; generates original business data based on the original application payload, and sends the original business data to the second business.

[0043] In a fourth aspect, the embodiment of the present application further provides a gatekeeper-type password application device, which is applied to the first gatekeeper-type application password machine, and the device includes:

[0044] A first data receiving module, used to obtain original service data of a first service, wherein the original service data includes an original application payload;

[0045] A first protection policy acquisition module, configured to acquire each sub-content protection policy according to a preset data protection policy, each of the sub-content protection policies including a limit parameter of the data to be protected, a protection mode and a protection key index, and the data protection policy includes at least one sub-content protection policy;

[0046] A data encryption module, used to determine the data to be protected corresponding to each sub-content protection strategy in the original application payload according to each of the data to be protected limiting parameters; determine the corresponding security control parameters according to each of the protection modes, encrypt each of the data to be protected using a preset encryption algorithm according to the corresponding protection mode, security control parameters and protection key index, and obtain a ciphertext payload; generate a corresponding sub-extension payload according to each of the sub-content protection strategies and the corresponding security control parameters, and generate an extension payload according to each of the sub-extension payloads; generate a new application payload according to the ciphertext payload and the extension payload, and generate security service data according to the new application payload;

[0047] The first data sending module is used to send the security business data to the second guard-type application cryptographic machine, so that the second guard-type application cryptographic machine obtains the original application payload according to the security business data, generates original business data according to the original application payload, and sends the original business data to the second business.

[0048] In a fifth aspect, the present application also provides a gatekeeper-style password application device, which is applied to a second gatekeeper-style application password machine, and the device includes:

[0049] A second data receiving module, configured to obtain security service data, wherein the security service data includes a new application payload, wherein the new application payload includes a ciphertext payload and an extended payload corresponding to all sub-content protection policies in a preset data protection policy, wherein the data protection policy includes at least one sub-content protection policy;

[0050] A second protection strategy acquisition module, configured to obtain each sub-extension payload according to the extension payload, each of the sub-extension payloads being determined according to the sub-content protection strategy and the security control parameter corresponding to the protection mode, each of the sub-content protection strategies including a to-be-protected data limiting parameter, the protection mode and a protection key index;

[0051] A data decryption module is used to decrypt the ciphertext payload using a preset decryption algorithm according to each of the protection modes, security control parameters and protection key indexes, to obtain the data to be protected corresponding to each sub-content protection strategy; determine the original application payload according to each of the data to be protected and the ciphertext payload; and generate the original business data according to the original application payload;

[0052] The second data sending module is used to send the original service data to the second service.

[0053] Compared with the prior art, the embodiment of the present application provides a gatekeeper-style password application method and device, which can achieve fine-grained application data protection without the business system being aware of it, prevent business data from being stolen and tampered with during transmission, and enable the business system to achieve application-level data transmission protection without the need for modification. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The drawings described herein are for explanation purposes only and are not intended to limit the scope of the present application in any way. In addition, the shapes and proportional dimensions of the components in the drawings are only for illustration purposes and are used to help understand the present application. They do not specifically limit the shapes and proportional dimensions of the components of the present application. Under the guidance of the present application, those skilled in the art can select various possible shapes and proportional dimensions to implement the present application according to specific circumstances. In the drawings:

[0055] Figure 1 This is a schematic diagram of the principle of the current solution 1 for realizing data protection;

[0056] Figure 2 This is a schematic diagram of the principle of the second solution for currently implementing data protection;

[0057] Figure 3 This is a schematic diagram of the principle of the third solution for currently implementing data protection;

[0058] Figure 4 A schematic diagram of a flow chart of a gatekeeper password application method provided in an embodiment of the present application;

[0059] Figure 5 A schematic diagram showing the comparison of data before and after protection by the gatekeeper password application method provided in one embodiment of the present application;

[0060] Figure 6 A schematic diagram of a flow chart of a gatekeeper password application method provided by another embodiment of the present application;

[0061] Figure 7 A schematic diagram of the structure of the gatekeeper password application system provided in the embodiment of the present application;

[0062] Figure 8 A schematic diagram of the structure of a gatekeeper password application device provided in one embodiment of the present application;

[0063] Fig. 9 A schematic diagram of the structure of a gatekeeper-style password application device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to enable those skilled in the art to better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0065] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more features.

[0066] There are currently three common approaches to achieve data protection at different scopes and levels.

[0067] Solution 1: deploy a server cryptographic machine in the business system to provide cryptographic service capabilities such as key management, symmetric encryption machine, asymmetric encryption and decryption, and signature verification. After the business system generates data (such as power 104 protocol data), the cryptographic operation interface of the server cryptographic machine is called through socket communication to encrypt and sign the data for protection.

[0068] If sensitive data needs to be exchanged between multiple systems, the initiator sends the protected data to the receiver through the network. The receiver also calls the cryptographic operation interface of the server cryptographic machine through socket communication to restore and verify the authenticity of the protected data. Figure 1 The first server cipher machine and the second server cipher machine) have the same key, so the sensitive data of the initiator and the receiver can be circulated to each other.

[0069] In this way, sensitive data is securely transmitted over the network and cannot be stolen or tampered with. Only the first and second businesses can see the sensitive data in plain text, thus achieving application-level security protection for business data.

[0070] Solution 2: Deploy VPN gateway devices at the border of the business system and maintain the same business protection key between VPN gateways through the key negotiation mechanism. Figure 2 As shown, when the plain text data of the first service and the second service are transmitted on the network, they will be encrypted and signed for protection by the VPN gateway. Sensitive data is securely transmitted in the network between the two VPN gateways and cannot be stolen or tampered with, thus achieving network-level security protection for service data.

[0071] Option 3: Sometimes, for safety reasons, such as Figure 3 As shown in the figure, the server cryptographic machine and VPN gateway will be deployed at the same time to protect business data transmission at multiple levels. The business system first calls the cryptographic operation interface of the server cryptographic machine to implement application-level data protection. Then, the VPN gateway is used to implement network-level data protection.

[0072] Now more and more existing systems need to be reviewed and modified. The method of deploying a server cryptographic machine is not as simple as purchasing a server cryptographic machine for the business system. What is more complicated is that the business system needs to be modified. Although the server cryptographic machine provides multiple API interfaces for cryptographic operations, the interfaces cover symmetric cryptographic operations, asymmetric cryptographic operations, etc. However, due to the high degree of professionalism of cryptographic technology, the R&D personnel of the business system need to understand cryptographic technology, the meaning of cryptographic operation API interfaces, and need to know how to protect a certain data with a certain cryptographic algorithm and how the length of the protected data changes, so as to specify the protection of the data of the business system.

[0073] Especially in industrial control systems such as power generation systems, foreign business systems account for the majority, and any foreign business systems involved cannot be modified. Domestic business systems require high learning costs and modification costs to call the cryptographic operation interface of the server cryptographic machine. Therefore, in actual applications, it can be seen that in the cryptographic evaluation tests of business systems in many fields, the "application and data security" project scores are low.

[0074] In order to ensure the secure transmission of business system data and avoid the difficulty of business system transformation, Solution 2 can be used to protect the entire network security at the border. However, the VPN gateway in Solution 2 is a device that protects the original business data and cannot provide fine-grained protection for the data. It can only protect the data of the specified address, protocol, and port, but cannot protect a certain field of the business data. For example, it can only protect the IEC 104 protocol data of the power system, but cannot provide fine-grained protection control for the protection of remote control and remote adjustment instructions, or the plain text transmission of telemetry and telesignaling instructions.

[0075] In order to solve the above technical problems, the embodiment of the present application provides a gatekeeper-type password application method, which is applied to a first gatekeeper-type application password machine, and the method includes:

[0076] Step S101: Acquire original service data of a first service, where the original service data includes an original application payload;

[0077] Step S102: acquiring each sub-content protection policy according to a preset data protection policy, each sub-content protection policy including a limit parameter of the data to be protected, a protection mode and a protection key index, and the data protection policy includes at least one sub-content protection policy;

[0078] Step S103: determine the to-be-protected data corresponding to each sub-content protection strategy in the original application payload according to the limiting parameters of each to-be-protected data; determine the corresponding security control parameters according to each protection mode, encrypt each to-be-protected data using a preset encryption algorithm according to the corresponding protection mode, security control parameters and protection key index, and obtain a ciphertext payload; generate a corresponding sub-extension payload according to each sub-content protection strategy and the corresponding security control parameter, and generate an extension payload according to each sub-extension payload; generate a new application payload according to the ciphertext payload and the extension payload, and generate security service data according to the new application payload;

[0079] Step S104: Send the security service data to the second guard-type application cryptographic machine, so that the second guard-type application cryptographic machine obtains the original application payload according to the security service data, generates original service data according to the original application payload, and sends the original service data to the second service.

[0080] It should be noted that the embodiment of the present application is applicable to the data security transmission process between the first guard-type application cryptographic machine and the second guard-type application cryptographic machine, and the first guard-type application cryptographic machine and the second guard-type application cryptographic machine are the main bodies of data security communication.

[0081] In network communications, application payload refers to the part of the content that actually carries application layer related data. It is the data part that is encapsulated in the protocol headers (protocol headers) of each layer of the network protocol stack and is actually passed to the application for processing.

[0082] In some embodiments, the method also includes: each sub-content protection strategy includes a protection condition, and the parameters for limiting the data to be protected include a protection starting point and a protection length; determining the data to be protected corresponding to each sub-content protection strategy in the original application payload according to each parameter for limiting the data to be protected, including: determining whether the data corresponding to the sub-content protection strategy in the original application payload needs to be protected according to each protection condition; if protection is required, then the data with a protection length starting from the protection starting point is used as the data to be protected corresponding to the sub-content protection strategy.

[0083] In some embodiments, the format of each sub-content protection policy may be as shown in Table 1.

[0084] Table 1 Example of the format of a sub-content protection policy

[0085]

[0086] In some embodiments, the protection condition includes an operation mode, an operation value, and a preset result; determining whether the data corresponding to the sub-content protection policy in the original application payload needs to be protected according to each protection condition includes:

[0087] The operation value is operated using the operation method, and the obtained operation result is compared with the preset result. If they are consistent, the data corresponding to the sub-content protection policy in the original application payload needs to be protected.

[0088] As an example, the protection condition also includes a protection start point and a protection length, which are the same as the limiting parameters of the data to be protected and are used to determine the data corresponding to the sub-content protection policy.

[0089] As an example, the protection condition field supports multiple sub-condition fields, and the format of each sub-condition field may be as shown in Table 2.

[0090] Table 2 Example of the format of the sub-condition field

[0091]

[0092]

[0093] In some embodiments, the original service data also includes a protocol header; see Figure 4Before obtaining the protection strategies of each sub-content according to the preset data protection strategy, it includes: obtaining the network protocol, source port and destination port from the protocol header; if the network protocol, source port and destination port meet the requirements of the protection strategy on the protocol and port, then obtaining the protection strategies of each sub-content according to the preset protection strategy.

[0094] As an example, the format of the data protection policy may be as shown in Table 3, which shows that data of a specified protocol and port are protected according to protection content requirements.

[0095] Table 3 Example of the format of a data protection policy

[0096]

[0097] In the embodiment, the comparison diagram of the data before protection and after protection is as follows: Figure 5 The protected new application payload includes the ciphertext payload and sub-extension payload corresponding to each sub-content protection strategy.

[0098] The gatekeeper password application method provided in the present application protects the application payload (application data) part in the business data (network data message), and the ciphertext payload includes several small encrypted ciphertext fields within the original application payload.

[0099] As can be seen from Table 1 above, the protection mode includes any one of a confidentiality protection mode, an integrity protection mode, or an integrity confidentiality protection mode. If the protection mode includes a confidentiality protection mode, the corresponding security control parameter includes an encryption protection vector; if the protection mode includes an integrity protection mode, the corresponding security control parameter includes an integrity check value.

[0100] As an example, the SM4-GCM encryption algorithm can be used to encrypt data. SM4-GCM is an encryption algorithm that combines the SM4 symmetric encryption algorithm and the GCM (Galois / Counter Mode) encryption mode. In the embodiment, when the SM4-GCM algorithm is used for confidentiality protection, no padding is required, and the encrypted data covers the original application payload to be encrypted (i.e., the plaintext data area).

[0101] As an example, an example of an extended load structure is shown in Table 4.

[0102] Table 4 Extended payload format example

[0103] As shown in Table 4, in an embodiment, the extended payload may include an extended header, multiple sub-extended payloads, and an extended tail.

[0104] As an example, the structure of each sub-extension payload may be as shown in Table 5.

[0105] Table 5 Example of sub-extension payload format

[0106]

[0107]

[0108] As shown in Table 5, in some embodiments, the sub-extended payload stores a first security control parameter (confidentiality protection vector IV), a confidentiality protection key index, an integrity protection key index and a second security control parameter (integrity check value).

[0109] The first security application cipher machine as the sender can modify the extended payload when protecting the confidentiality and integrity of the application data. The second security application cipher machine as the receiver can use the key and IV information in each sub-extended payload to decrypt and verify the ciphertext payload.

[0110] In some embodiments, the content of the extended header field may be as shown in Table 6.

[0111] Table 6 Example of extended header field format

[0112]

[0113] In an embodiment, the key identifier of the extended payload, such as the header identifier, and metadata information can be included through the setting of the extended header pair, which helps the recipient to quickly identify and understand the basic attributes and purpose of the extended payload. The design of multiple sub-extension payloads has strong flexibility and scalability. Different sub-content protection strategies can correspond to different sub-extension payloads, which can more finely manage and distinguish various protection-related information. This can adapt to complex business needs and diversified protection strategies, so that the system can handle different types of data protection situations more targeted.

[0114] In some embodiments, the content of the extended tail may be as shown in Table 7.

[0115] Table 7 Example of the content format of the extension end

[0116]

[0117]

[0118] The existence of the extended tail can be used for integrity verification or to add some end markers, etc., which helps to ensure the integrity of the extended payload during transmission and processing and prevent data loss or tampering.

[0119] In a specific embodiment, before the gatekeeper-type application cryptographic machine protects data, key presetting and data protection policy configuration can be completed in advance.

[0120] The key management of the gatekeeper application cryptographic machine (including the first gatekeeper application cryptographic machine and the second gatekeeper application cryptographic machine) is consistent with that of the conventional server cryptographic machine. The key information includes the key index and the key, and the key information is distributed and maintained by the key management system. The first gatekeeper application cryptographic machine and the second gatekeeper application cryptographic machine for encryption and decryption of the same service use the same key information.

[0121] The data protection strategy is the basis for protecting business data and needs to be configured in advance in the gatekeeper application cryptographic machine. For example, in one embodiment, it is necessary to implement corresponding protection for the IEC 104 protocol data of the power system. For the data involving the IEC 104 protocol in the power system, it is obtained as the original business data of the first business, and the original application load is separated therefrom. Among them, the original business data covers various types of relevant data content transmitted in accordance with the IEC 104 protocol during the communication process of the power system, such as data related to telemetry, telesignaling, remote control, remote adjustment and other instructions. The data protection strategy is preset according to the safety requirements of the power system and the characteristics of the IEC 104 protocol data, and multiple sub-content protection strategies are set in this strategy. For example: the sub-content protection strategy related to the remote control and remote adjustment instructions and the sub-content protection strategy related to the telemetry and telesignaling instructions, each sub-content protection strategy sets the corresponding data limit parameters, protection mode and protection key index to be protected. After obtaining the security business data according to the above embodiment, the security business data is sent to the second guard-type application cryptographic machine, and the second guard-type application cryptographic machine restores the original business data, and accurately sends the original business data to the second business, such as to the corresponding control center, monitoring terminal, etc. in the power system, to achieve fine-grained protection and correct transmission and use of different instructions of IEC 104 protocol data.

[0122] A flow chart of another gatekeeper password application method provided in an embodiment of the present application is provided. The gatekeeper password application method is applied to a second gatekeeper application password machine. The gatekeeper password application method includes:

[0123] Step S201: Acquire security service data, where the security service data includes a new application payload, where the new application payload includes ciphertext payloads and extended payloads corresponding to all sub-content protection policies in a preset data protection policy, where the data protection policy includes at least one sub-content protection policy;

[0124] Step S202: Obtain each sub-extension payload according to the extension payload, each sub-extension payload is determined according to the security control parameters corresponding to the sub-content protection strategy and the protection mode, and each sub-content protection strategy includes the data limitation parameters to be protected, the protection mode and the protection key index;

[0125] Step S203: Decrypt the ciphertext payload using a preset decryption algorithm according to each protection mode, security control parameter and protection key index, and obtain the data to be protected corresponding to each sub-content protection strategy; determine the original application payload according to each data to be protected and the ciphertext payload; and generate the original business data according to the original application payload;

[0126] Step S204: Send the original service data to the second service.

[0127] In some embodiments, the protection mode (the format of which can be set is shown in Table 1 above) includes any one of a confidentiality protection mode, an integrity protection mode, or an integrity confidentiality protection mode; if the protection mode includes a confidentiality protection mode, the corresponding security control parameter includes an encryption protection vector; if the protection mode includes an integrity protection mode, such as Figure 6 As shown, the corresponding security control parameters include an integrity check value. After decrypting the ciphertext payload, the calculated integrity check result is compared with the received integrity check value. If the two are consistent, it means that the data has maintained integrity during transmission and has not been tampered with. If the two are inconsistent, the decrypted data to be protected will not be used.

[0128] In an embodiment, the extended payload includes an extended header, at least one sub-extension field and an extended tail. After the second guard-type application cryptographic machine obtains the security business data in step S201, it also includes: determining the range of the extended field based on the header identifier in the extended payload, the tail representation of the extended tail field, and the length of the extended tail field; calculating the CRC32 value of the extended field and comparing it with the check value in the extended tail field; if the check value is consistent, it is considered that this security business data needs to undergo an inbound data verification processing flow.

[0129] It should be noted that the gatekeeper-type password application method applied to the second gatekeeper-type application password machine provided in the embodiment of the present invention corresponds to each other in all process steps with the gatekeeper-type password application method applied to the first gatekeeper-type application password machine in the above embodiment, and the working principles and beneficial effects of the two are the same, so they will not be repeated here.

[0130] The present application embodiment also provides another gatekeeper password application method, which is applied to a gatekeeper password application system, such as Figure 7 As shown, the system includes a first guard-type application cipher machine and a second guard-type application cipher machine; the method includes:

[0131] Step 301: After the first guard-type application cryptographic machine establishes a communication connection with the second guard-type application cryptographic machine, the first guard-type application cryptographic machine obtains original service data of a first service, where the original service data includes an original application payload;

[0132] Step 302: The first security application cryptographic machine obtains each sub-content protection strategy according to the preset data protection strategy. Each sub-content protection strategy includes a limited parameter of the data to be protected, a protection method and a protection key index. The data protection strategy includes at least one sub-content protection strategy.

[0133] Step 303: The first guard-type application cryptographic machine determines the to-be-protected data corresponding to each sub-content protection strategy in the original application payload according to the limiting parameters of each to-be-protected data; determines the corresponding security control parameters according to each protection mode, encrypts each to-be-protected data using a preset encryption algorithm according to the corresponding protection mode, security control parameters and protection key index, and obtains a ciphertext payload; generates a corresponding sub-extension payload according to each sub-content protection strategy and the corresponding security control parameter, and generates an extension payload according to each sub-extension payload; generates a new application payload according to the ciphertext payload and the extension payload, and generates security service data according to the new application payload;

[0134] Step 304: the first guard-type application cryptographic machine sends the security service data to the second guard-type application cryptographic machine;

[0135] Step 305: The second security guard application cryptographic machine obtains security service data, where the security service data includes a new application payload, and the new application payload includes ciphertext payloads and extended payloads corresponding to all sub-content protection policies in the preset data protection policy, where the protection policy includes at least one sub-content protection policy.

[0136] Step 306: The second security application cryptographic machine obtains each sub-extension payload according to the extension payload, each sub-extension payload is determined according to the security control parameters corresponding to the sub-content protection strategy and the protection mode, and each sub-content protection strategy includes the data limitation parameters to be protected, the protection mode and the protection key index;

[0137] Step 307: The second guard-type application cryptographic machine decrypts the ciphertext payload using a preset decryption algorithm according to each protection mode, security control parameter and protection key index, and obtains the data to be protected corresponding to each sub-content protection strategy; determines the original application payload according to each data to be protected and the ciphertext payload; and generates the original business data according to the original application payload;

[0138] Step 308: Send the original service data to the second service.

[0139] In an embodiment, a first guard-type application cryptographic machine intercepts network message data (i.e., original business data) sent from a first business to a second business, and performs confidentiality protection and / or integrity protection on certain fields of the original application payload of the network message data, obtains a secure network message containing a new application payload, and then forwards the network message to the second business. A second guard-type application cryptographic machine intercepts network messages sent to the second business, and verifies and decrypts the new application payload therein, or verifies the integrity in some embodiments. The second guard-type application cryptographic machine forwards the restored and verified original data message to the second business. The application payloads between the guard-type application cryptographic machines use cryptographic algorithm messages, which cannot be stolen, intercepted, or tampered with during transmission on the network. All the business systems see are plaintext business application payloads, and the application payloads can be stored, reprocessed, etc.

[0140] In the embodiment of the present application, the gatekeeper application cryptographic machine is connected in series between the business system and the border router. When the data of the business system passes through the gatekeeper application cryptographic machine, the gatekeeper application cryptographic machine protects the confidentiality and integrity of the application payload that complies with the security policy by identifying the application payload part in the business network data.

[0141] See also Figure 7 In some embodiments, the specific process of data protection in the outbound direction of the first guard-type application cipher machine includes:

[0142] The first guard-type application cryptographic machine checks the passing service data packets according to the data protection policy, and the first guard-type application cryptographic machine only processes the service data packets whose protocols and ports conform to the data protection policy.

[0143] The first gatekeeper application cryptographic machine compares each sub-content protection policy in the protection policy one by one, and compares all protection conditions in each sub-content protection policy. The first gatekeeper application cryptographic machine only processes service data messages whose all protection conditions match.

[0144] The first guard-type application cipher determines the protection range of the application payload according to the protection starting point and protection length in the sub-content protection policy. If the protection mode is integrity protection or integrity confidentiality protection (corresponding to protection mode 2 and protection mode 3 in Table 1 above), the first guard-type application cipher uses the key of the integrity protection key index to calculate the payload data within the protection range according to the protection mode using the SM4-GCM algorithm to obtain its integrity check value. The integrity check value will be stored in the sub-extension field.

[0145] If the protection mode is confidentiality protection or integrity confidentiality protection (corresponding to protection mode 1 and protection mode 3 in Table 1), the first gatekeeper application cipher generates an encryption protection vector IV, uses the key of the confidentiality protection key index, and uses the SM4-GCM algorithm to protect the payload data within the protection range according to the protection mode. The encrypted data is stored in the "payload data starting from the protection starting point and the protection length" position.

[0146] According to the protection mode, the sub-extension payload is constructed using the encryption protection vector IV, protection starting point, protection length and protection mode, protection key index or integrity check value. Multiple sub-extension payloads form an extended payload, and the extended payload check value is calculated and filled at the end of the original data message to obtain a secure message.

[0147] In some embodiments, the specific process of data verification in the inbound direction of the second guard-type application cryptographic machine includes: the second guard-type application cryptographic machine determines the type of the passing service data packet, and the determination is based on:

[0148] The header identifier in the extended header field, the tail representation of the extended tail field, and the length of the extended tail field determine the range of the extended payload field. The CRC32 value of the extended field is calculated and compared with the check value in the extended tail field. If the check value is consistent, it is considered that this data message needs to be processed by the inbound data verification process.

[0149] like Figure 6 In the illustrated embodiment, the second guard-type application cryptographic machine processes each sub-extension payload one by one, and parses and obtains the protection starting point and protection length in each sub-extension payload, thereby determining the protection range.

[0150] If the protection mode is confidentiality protection or integrity confidentiality protection, the second security application cipher uses the vector IV in the sub-extension payload and the key of the confidentiality protection key index to protect it using the SM4-GCM algorithm. The decrypted data is stored in the "payload data of protection starting point and protection length" position.

[0151] If the protection mode is integrity protection or integrity confidentiality protection, the second security application cipher uses the key of the integrity protection key index and the SM4-GCM algorithm to calculate the integrity check value of the protection range. The integrity check value is compared with the integrity check value in the sub-extension payload to see if they are consistent. If they are inconsistent, the application payload is considered to have been tampered with.

[0152] The second guard-type application cryptographic machine constructs the sub-extension payload according to the protection mode using the vector IV, protection starting point, protection length and protection mode, protection key index, and integrity check value. After the second guard-type application cryptographic machine processes all sub-extension payloads, it strips off the extension payload and restores the service data application payload to obtain the original service data message. The second guard-type application cryptographic machine forwards the restored original service data message to the second service.

[0153] This application provides a fine-grained gatekeeper-style password application method that can support refined protection of a field in the application payload. For the business system, it does not participate in the process of protecting the application data. This application reduces the difficulty for business system developers to learn cryptographic algorithms and server cryptographic machine interfaces, which can reduce the cost of applying passwords in business systems, and is more helpful for existing old business systems and industrial control systems to quickly apply passwords.

[0154] An embodiment of the present application also provides a gatekeeper-type password application device, which is applied to a first gatekeeper-type application password machine, such as Figure 8 As shown, the device comprises:

[0155] A first data receiving module, used to obtain original service data of a first service, where the original service data includes an original application payload;

[0156] A first protection policy acquisition module, used to acquire each sub-content protection policy according to a preset data protection policy, each sub-content protection policy includes a limited parameter of the data to be protected, a protection mode and a protection key index, and the data protection policy includes at least one sub-content protection policy;

[0157] A data encryption module is used to determine the data to be protected corresponding to each sub-content protection strategy in the original application payload according to the limiting parameters of each data to be protected; determine the corresponding security control parameters according to each protection mode, encrypt each data to be protected using a preset encryption algorithm according to the corresponding protection mode, security control parameters and protection key index to obtain a ciphertext payload; generate a corresponding sub-extension payload according to each sub-content protection strategy and the corresponding security control parameter, and generate an extension payload according to each sub-extension payload; generate a new application payload according to the ciphertext payload and the extension payload, and generate security service data according to the new application payload;

[0158] The first data sending module is used to send the security business data to the second guard-type application cryptographic machine, so that the second guard-type application cryptographic machine obtains the original application payload according to the security business data, generates the original business data according to the original application payload, and sends the original business data to the second business.

[0159] Another embodiment of the present application also provides a gatekeeper-type password application device, which is applied to a second gatekeeper-type application password machine, such as Fig. 9 As shown, the device comprises:

[0160] A second data receiving module is used to obtain security business data, the security business data includes a new application payload, the new application payload includes a ciphertext payload and an extended payload corresponding to all sub-content protection policies in a preset data protection policy, and the data protection policy includes at least one sub-content protection policy;

[0161] A second protection strategy acquisition module is used to obtain each sub-extension payload according to the extension payload, each sub-extension payload is determined according to the security control parameters corresponding to the sub-content protection strategy and the protection mode, and each sub-content protection strategy includes the data limitation parameters to be protected, the protection mode and the protection key index;

[0162] The data decryption module is used to decrypt the ciphertext payload using a preset decryption algorithm according to each protection mode, security control parameter and protection key index, and obtain the data to be protected corresponding to each sub-content protection strategy; determine the original application payload according to each data to be protected and the ciphertext payload; and generate the original business data according to the original application payload;

[0163] The second data sending module is used to send the original service data to the second service.

[0164] The embodiment of the present application provides a gatekeeper-style password application device, which provides imperceptible fine-grained application data protection for the business system, can effectively increase the difficulty and cost of applying passwords in the business system, and ensure the security of application-level transmission of business data.

[0165] The above is a detailed introduction to the guard-type password application device and apparatus provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the concept of the present application and should not be understood as limiting the scope of protection of the present application.

Claims

1. A gatekeeper password application method, characterized in that: Applied to the first gatekeeper application cipher machine, the method comprises: Acquire original service data of the first service, where the original service data includes an original application payload; Acquire each sub-content protection strategy according to a preset data protection strategy, each of the sub-content protection strategies includes a limiting parameter of the data to be protected, a protection mode and a protection key index, and the data protection strategy includes at least one sub-content protection strategy; Determine the data to be protected corresponding to each sub-content protection strategy in the original application payload according to each of the data to be protected limiting parameters; determine the corresponding security control parameters according to each of the protection modes, encrypt each of the data to be protected using a preset encryption algorithm according to the corresponding protection mode, security control parameters and protection key index, and obtain a ciphertext payload; generate a corresponding sub-extension payload according to each of the sub-content protection strategies and the corresponding security control parameters, and generate an extension payload according to each of the sub-extension payloads; generate a new application payload according to the ciphertext payload and the extension payload, and generate security service data according to the new application payload; The security service data is sent to the second guard-type application cryptographic machine, so that the second guard-type application cryptographic machine obtains the original application payload according to the security service data, generates original service data according to the original application payload, and sends the original service data to the second service.

2. The gatekeeper password application method according to claim 1, characterized in that: The method further comprises: Each of the sub-content protection strategies includes protection conditions, and the data-limited parameters to be protected include a protection starting point and a protection length; Determining the data to be protected corresponding to each of the sub-content protection strategies in the original application payload according to each of the limiting parameters of the data to be protected, includes: Determine whether the data corresponding to the sub-content protection policy in the original application payload needs to be protected according to each of the protection conditions; if protection is required, use the data of the protection length starting from the protection starting point as the data to be protected corresponding to the sub-content protection policy.

3. The gatekeeper password application method according to claim 2, characterized in that: The protection conditions include operation mode, operation value and preset result; Determining whether the data corresponding to the sub-content protection policy in the original application payload needs to be protected according to each of the protection conditions, includes: The operation value is operated using the operation method, and the obtained operation result is compared with the preset result. If they are consistent, the data corresponding to the sub-content protection policy in the original application payload needs to be protected.

4. The gatekeeper password application method according to claim 1, characterized in that: The original business data also includes a protocol header; Before obtaining each sub-content protection policy according to the preset data protection policy, the following steps are included: The network protocol, source port and destination port are obtained from the protocol header; if the network protocol, source port and destination port meet the requirements of the data protection policy on the protocol and port, the protection policies of each sub-content are obtained according to the data protection policy.

5. The gatekeeper password application method according to claim 1, characterized in that: The protection mode includes any one of a confidentiality protection mode, an integrity protection mode or an integrity confidentiality protection mode; If the protection mode includes a confidentiality protection mode, the corresponding security control parameter includes an encryption protection vector; If the protection mode includes an integrity protection mode, the corresponding security control parameter includes an integrity check value.

6. A gatekeeper password application method, characterized in that: Applied to the second guard-type application cipher machine, the method comprises: Acquire security service data, wherein the security service message includes a new application payload, wherein the new application payload includes a ciphertext payload and an extended payload corresponding to all sub-content protection policies in a preset data protection policy, wherein the data protection policy includes at least one sub-content protection policy; Obtain each sub-extension payload according to the extension payload, each of the sub-extension payloads is determined according to the security control parameters corresponding to the sub-content protection strategy and the protection mode, and each of the sub-content protection strategies includes a to-be-protected data limiting parameter, the protection mode and a protection key index; According to each of the protection modes, security control parameters and protection key indexes, the ciphertext payload is decrypted using a preset decryption algorithm to obtain the data to be protected corresponding to each sub-content protection strategy; the original application payload is determined based on each of the data to be protected and the ciphertext payload; the original business data is generated based on the original application payload, and the original business data is sent to the second business.

7. The gatekeeper password application method according to claim 6, characterized in that: The protection mode includes any one of a confidentiality protection mode, an integrity protection mode or an integrity confidentiality protection mode; If the protection mode includes a confidentiality protection mode, the corresponding security control parameter includes an encryption protection vector; If the protection method includes an integrity protection method, the corresponding security control parameter includes an integrity check value. After decrypting the ciphertext payload, the calculated integrity check result is compared with the received integrity check value; if the two are consistent, it means that the data maintains integrity during transmission and has not been tampered with; if the two are inconsistent, the decrypted data to be protected is not adopted.

8. A gatekeeper password application method, characterized in that: Applied to a gatekeeper-type password application system, the gatekeeper-type password application system comprises a first gatekeeper-type application password machine and a second gatekeeper-type application password machine; The method comprises: After the first guard-type application cryptographic machine and the second guard-type application cryptographic machine establish a communication connection, the first guard-type application cryptographic machine obtains original service data of the first service, where the original service data includes an original application payload; The first security application cryptographic machine obtains each sub-content protection strategy according to a preset data protection strategy, each of the sub-content protection strategies includes a limited parameter of the data to be protected, a protection mode and a protection key index, and the data protection strategy includes at least one sub-content protection strategy; The first guard-type application cryptographic machine determines the data to be protected corresponding to each sub-content protection strategy in the original application payload according to each of the data to be protected limiting parameters; determines the corresponding security control parameters according to each of the protection modes, encrypts each of the data to be protected using a preset encryption algorithm according to the corresponding protection mode, security control parameters and protection key index, and obtains a ciphertext payload; generates a corresponding sub-extension payload according to each of the sub-content protection strategies and the corresponding security control parameters, and generates an extension payload according to each of the sub-extension payloads; generates a new application payload according to the ciphertext payload and the extension payload, and generates security service data according to the new application payload; The first guard-type application cryptographic machine sends the security service data to the second guard-type application cryptographic machine; The second guard-type application cryptographic machine obtains the security service data, the security service data includes a new application payload, the new application payload includes a ciphertext payload and an extended payload corresponding to all sub-content protection policies in a preset data protection policy, and the data protection policy includes at least one sub-content protection policy; The second guard-type application cryptographic machine obtains each sub-extension payload according to the extension payload, each of the sub-extension payloads is determined according to the security control parameters corresponding to the sub-content protection strategy and the protection mode, and each of the sub-content protection strategies includes a to-be-protected data limiting parameter, the protection mode and a protection key index; The second guard-type application cryptographic machine decrypts the ciphertext payload using a preset decryption algorithm according to each of the protection modes, security control parameters and protection key indexes to obtain the data to be protected corresponding to each sub-content protection strategy; determines the original application payload based on each of the data to be protected and the ciphertext payload; generates original business data based on the original application payload, and sends the original business data to the second business.

9. A gatekeeper password application device, characterized in that: Applied to the first guard-type application cipher machine, the device comprises: A first data receiving module, used to obtain original service data of a first service, wherein the original service data includes an original application payload; A first protection policy acquisition module, configured to acquire each sub-content protection policy according to a preset data protection policy, each of the sub-content protection policies including a limit parameter of the data to be protected, a protection mode and a protection key index, and the data protection policy includes at least one sub-content protection policy; A data encryption module, used to determine the data to be protected corresponding to each sub-content protection strategy in the original application payload according to each of the data to be protected limiting parameters; determine the corresponding security control parameters according to each of the protection modes, encrypt each of the data to be protected using a preset encryption algorithm according to the corresponding protection mode, security control parameters and protection key index, and obtain a ciphertext payload; generate a corresponding sub-extension payload according to each of the sub-content protection strategies and the corresponding security control parameters, and generate an extension payload according to each of the sub-extension payloads; generate a new application payload according to the ciphertext payload and the extension payload, and generate security service data according to the new application payload; The first data sending module is used to send the security business data to the second guard-type application cryptographic machine, so that the second guard-type application cryptographic machine obtains the original application payload according to the security business data, generates original business data according to the original application payload, and sends the original business data to the second business.

10. A gatekeeper password application device, characterized in that: Applied to the second guard-type application cipher machine, the device comprises: A second data receiving module, configured to obtain security service data, wherein the security service data includes a new application payload, wherein the new application payload includes a ciphertext payload and an extended payload corresponding to all sub-content protection policies in a preset data protection policy, wherein the data protection policy includes at least one sub-content protection policy; A second protection strategy acquisition module, configured to obtain each sub-extension payload according to the extension payload, each of the sub-extension payloads being determined according to the sub-content protection strategy and the security control parameter corresponding to the protection mode, each of the sub-content protection strategies including a to-be-protected data limiting parameter, the protection mode and a protection key index; A data decryption module is used to decrypt the ciphertext payload using a preset decryption algorithm according to each of the protection modes, security control parameters and protection key indexes, to obtain the data to be protected corresponding to each sub-content protection strategy; determine the original application payload according to each of the data to be protected and the ciphertext payload; and generate the original business data according to the original application payload; The second data sending module is used to send the original service data to the second service.

Images