Data encryption method and system for flight control communication system

Abstract

The invention relates to a data encryption method and system for a flight control communication system, and the method comprises the steps: carrying out the combined encryption of BC end data through a first encryption algorithm and a second encryption algorithm, and obtaining encrypted message data; registering registration information of an RT end to a key center of the second encryption algorithm; and decrypting the encrypted message data received by the registered RT end through the second encryption algorithm to obtain decrypted message data. According to the method, the integrity and the attack resistance of the data are ensured, and the encryption speed is also improved.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to a data encryption method and system for a flight control communication system. Background Art

[0002] The MIL-STD-1553B bus is a command / response serial data bus widely used in the fields of aviation and aerospace, which can realize the functions of distributed processing, real-time response and centralized control. The 1553B bus adopts Manchester II encoding and transmits data in half-duplex mode. At the same time, as a standard data bus, the 1553B bus has regulations on the format of data transmission, time requirements of bus communication and security.

[0003] Regarding data transmission on the 1553B bus, the traditional symmetric algorithm SM4.0 has a weak key type, resulting in weak anti-attack capabilities. This makes it impossible to provide the necessary information encryption processing for customized aircraft and special aircraft, and security cannot be effectively guaranteed. Summary of the invention

[0004] The present invention provides a data encryption method and system for a flight control communication system, so as to solve the defects of the prior art.

[0005] The present invention provides a data encryption method for a flight control communication system, comprising:

[0006] S1: Combine and encrypt the BC end data using the first encryption algorithm and the second encryption algorithm to obtain encrypted message data;

[0007] S2: registering the registration information of the RT end with the key center of the second encryption algorithm;

[0008] S3: Decrypt the encrypted message data received by the registered RT end through the second encryption algorithm to obtain decrypted message data.

[0009] According to a data encryption method for a flight control communication system provided by the present invention, the first encryption algorithm is the SM4 algorithm, and the second encryption algorithm is the SM9 encryption algorithm.

[0010] According to a data encryption method for a flight control communication system provided by the present invention, step S1 further comprises:

[0011] S11: According to the first public key ID of the BC end, the key center of the second encryption algorithm of the BC end registers to obtain a first master public key;

[0012] S12: Encrypt the data to be sent by using an encryption key corresponding to the first encryption algorithm to obtain first encrypted data;

[0013] S13: Encrypt the encryption key by using the first public key ID and the first master public key to obtain second encrypted data;

[0014] S14: Concatenate the first encrypted data and the second encrypted data through timestamps to obtain encrypted message data.

[0015] According to a data encryption method for a flight control communication system provided by the present invention, step S11 further includes:

[0016] Save the message ID and time stamp information of the data to be sent.

[0017] According to a data encryption method for a flight control communication system provided by the present invention, the expression of the encrypted message data in step S14 is:

[0018] data e =data1||T||enk;

[0019] Among them, data e The encrypted message data obtained by splicing is as follows: data1 is the first encrypted data, T is the timestamp, and enk is the second encrypted data.

[0020] According to a data encryption method for a flight control communication system provided by the present invention, the registration message in step S2 includes a sender source identifier, a second master public key, and a user private key.

[0021] According to a data encryption method for a flight control communication system provided by the present invention, step S3 further comprises:

[0022] S31: The key center verifies the identity of the terminal user of the RT end through the message ID and the second master public key. When the identity of the terminal user passes the verification, step S32 is executed. When the identity of the terminal user fails the verification, the terminal user is determined to be an illegal user.

[0023] S32: Parsing the received encrypted message data to obtain encrypted ciphertext, timestamp, and encryption key;

[0024] S33: The key center obtains the user private key through the sender source identifier;

[0025] S34: Decrypting the encryption key through the user to obtain a decryption key;

[0026] S35: Decrypt the encrypted ciphertext using the decryption key to obtain decrypted message data.

[0027] A second aspect of the present invention provides a data encryption system for a flight control communication system, comprising:

[0028] The encryption module is used to encrypt the BC end data by combining the first encryption algorithm and the second encryption algorithm to obtain the encrypted message data;

[0029] A registration module, used to register the registration information of the RT end with the key center of the second encryption algorithm;

[0030] The decryption module is used to decrypt the encrypted message data received by the registered RT terminal through the second encryption algorithm to obtain decrypted message data.

[0031] A third aspect of the present invention provides a data encryption device for a flight control communication system, comprising:

[0032] A memory and at least one processor, wherein instructions are stored in the memory;

[0033] The processor calls the instruction in the memory so that the data encryption device for the flight control communication system executes the data encryption method for the flight control communication system as described in any one of the above items.

[0034] A fourth aspect of the present invention provides a computer-readable storage medium having instructions stored thereon, and when the instructions are executed by a processor, a data encryption method for a flight control communication system as described in any one of the above items is implemented.

[0035] The system provided by the present invention provides double security protection by adopting the two encryption algorithms SM4 and SM9 to perform combined encryption on the data of the flight control communication system. It not only has a high encryption and decryption speed and is suitable for encryption processing of large amounts of data, but also can ensure the safe transmission of encryption keys and effectively prevent the keys from being intercepted and cracked. In addition, when the encrypted data is generated, replay attacks are also effectively prevented. Since the method of the present invention adopts a standard encryption algorithm and a key management mechanism, the system has better flexibility and scalability in practical applications.

[0036] The present invention provides a data encryption method and system for a flight control communication system. Without changing the original 1553B protocol control state, the text message content sent by the flight control and navigation systems of the aircraft is encrypted by means of the national secret algorithm SM4.0. The root key index is used in the algorithm. Since the root key index and the diffusion factor are used to generate the key, the decryption and encryption speeds are very fast. In addition, the present invention applies the digital signature of the national secret asymmetric algorithm SM9.0 to the symmetric algorithm SM4.0, that is, the message is encrypted by the symmetric encryption algorithm, and the symmetric encryption key is encrypted by the asymmetric encryption algorithm. The present invention can encrypt quickly and avoid the problem of low efficiency of asymmetric encryption, and solve the delay problem of symmetric encryption key transmission. To a certain extent, it solves the problem of the delay of key distribution on the efficiency of real-time processing of messages in the 1553B bus. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A schematic diagram of a data encryption method for a flight control communication system provided by an embodiment of the present invention;

[0039] Figure 2 A schematic diagram of the structure of a data encryption system for a flight control communication system provided by an embodiment of the present invention;

[0040] Figure 3 A schematic diagram showing a comparison of the time consumption for encryption and decryption of a data encryption method for a flight control communication system provided in an embodiment of the present invention.

[0041] Reference numerals: 100, encryption module; 200, registration module; 300, decryption module. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings in the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments, and they should not be understood as limitations on the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. In the description of the present invention, it should be understood that the terms used are only for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0043] In order to better understand the present invention, the research background of the present invention is first explained below.

[0044] With the development of industrial technology, various electronic equipment and information equipment are widely used in mechanical automation platforms such as aircraft, and their functions are becoming more and more complex. How to reliably and efficiently combine various electronic information equipment in a network platform is of great significance. MIL-STD-1553B is an electronic system information transmission standard proposed to meet the communication safety during aircraft flight. Its advantages such as superior real-time performance, high data reliability and the ability to mount multiple terminals at the same time are widely used in aircraft electronic systems.

[0045] The MIL-STD-1553B bus is a command-response serial data bus widely used in the fields of aviation and aerospace, which can realize the functions of distributed processing, real-time response and centralized control. The 1553B bus adopts Manchester II encoding, with a communication rate of 1Mbit / s and half-duplex data transmission. The 1553B bus includes three types of terminals: Bus Monitor Terminal (MT), Bus Controller (BC), and Remote Terminal (RT).

[0046] The 1553B bus system uses a redundant structure to ensure the high reliability of the system. During normal communication, only one bus is in working condition, and the other buses exist as backup buses. When one bus fails, the system can switch to other buses to continue information transmission. Since the introduction of 1553B bus technology into the avionics system, many problems of electronic equipment communication inside the aircraft have been completely solved, making the originally complex cables inside the aircraft no longer exist, reducing the weight of the entire aircraft, and its multi-device collaborative working ability has greatly improved the performance of the fighter.

[0047] Nowadays, the 1553B bus is widely used in aircraft control systems. Most of the design ideas adopt the solution of MCU+dedicated protocol control chip. However, due to the chip, the shortcomings of this solution are mainly reflected in the following three aspects: unstable performance and high price; complex configuration interface and other shortcomings make it impossible to make major changes to the hardware and improve hardware performance; it is impossible to provide necessary information encryption processing for customized aircraft and special aircraft, and security cannot be effectively guaranteed; the above three points have become bottlenecks in the development of the 1553B bus.

[0048] The development of FPGA technology has provided a new platform for implementing the 1553B bus protocol. The MCU+FPGA architecture is adopted, and the Manchester encoding and decoding as well as the protocol processing functions of the three terminals BC, RT, and MT are implemented on the FPGA through the Verilog language. The MCU is used to implement functions such as message initiation, error correction, and processing of continuous messages. This solution uses FPGA instead of the dedicated 1553B bus protocol chip, which can greatly reduce the hardware development cost. At the same time, the programmable characteristics of the gate array are used to improve the flexibility of the application.

[0049] The present invention introduces a high-efficiency hybrid encryption algorithm in the data link layer unit of the 1553B bus based on FPGA. Aiming at the characteristics of the traditional symmetric algorithm SM4.0 algorithm, such as weak key type and weak anti-attack type, an improved SM4.0 encryption algorithm is proposed, named Intelligent encryption SM4.0 (IE SM4) algorithm. The specific implementation scheme is to combine the characteristics of the national encryption SM9.0 and the national encryption SM4.0 algorithms, and use the national encryption SM9 algorithm to encrypt the key transmission of SM4, thereby ensuring the confidentiality, anti-attack and non-repudiation of the key.

[0050] Combine the following Figures 1 to 3 Embodiments of the present invention are described.

[0051] like Figure 1 As shown, the present invention provides a data encryption method for a flight control communication system, comprising:

[0052] S1: Combine and encrypt the BC end data using the first encryption algorithm and the second encryption algorithm to obtain encrypted message data.

[0053] The first encryption algorithm is the SM4 algorithm, and the second encryption algorithm is the SM9 encryption algorithm.

[0054] Wherein, step S1 further comprises:

[0055] S11: According to the first public key ID of the BC end, the key center of the second encryption algorithm of the BC end registers to obtain the first master public key.

[0056] Wherein, step S11 further includes:

[0057] Save the message ID and time stamp information of the data to be sent.

[0058] S12: Encrypt the data to be sent using an encryption key corresponding to the first encryption algorithm to obtain first encrypted data.

[0059] S13: Encrypt the encryption key using the first public key ID and the first master public key to obtain second encrypted data.

[0060] In step S13, the encryption key of the SM4 encryption algorithm is encrypted using the first public key ID and the first master public key obtained from the key center, which can ensure the secure transmission of the encryption key. Even if the encrypted data is intercepted, it cannot be decrypted without the encryption key.

[0061] S14: Concatenate the first encrypted data and the second encrypted data through timestamps to obtain encrypted message data.

[0062] The expression of the encrypted message data in step S14 is:

[0063] data e =data1||T||enk;

[0064] Among them, data e The encrypted message data obtained by splicing is as follows: data1 is the first encrypted data, T is the timestamp, and enk is the second encrypted data.

[0065] In steps S11 to S14, first register with the key center, specifically register with the receiving end SM9 key center according to the receiving end public key ID. After success, the SM9 master public key K is obtained. At the same time, the receiving end saves the registered user's 1553B message ID address and timestamp information, and records the applied private key.

[0066] Subsequently, the SM4 key generator is used to generate the SM4 encryption key d, and the message data data to be sent is encrypted using SM4; then the SM4 encryption key d is encrypted using the SM9 master public key K and the public key ID; finally, data splicing is performed, and the timestamp T is introduced to prevent replay attacks. The final message data to be sent is as shown in the above expression.

[0067] S2: Register the registration information of the RT end to the key center of the second encryption algorithm.

[0068] Step S2 mainly performs asymmetric SM9 processing of the key center. First, the RT needs to provide the sender source identification, master public key and private key to the SM9 key center and grant usage rights. At the same time, it needs to respond to the security parameters of the asymmetric system SM9. Then the center receives the decryption request from the server and responds with the private key s.

[0069] The registration message in step S2 includes a sender source identifier, a second master public key, and a user private key.

[0070] Furthermore, the identifier is unique and is used to distinguish different senders. The identifier is the sender's device ID, IP address or other information that can uniquely identify the RT user; the second master public key is the public key generated or assigned when the RT is registered at the key center, and is used for encryption operations in the SM9 encryption algorithm; and the user private key is the private key generated or assigned when the RT is registered at the key center, and is used for decryption operations in the SM9 encryption algorithm. The private key is confidential and is crucial to the security of the entire encryption system.

[0071] S3: Decrypt the encrypted message data received by the registered RT end through the second encryption algorithm to obtain decrypted message data.

[0072] Wherein, step S3 further comprises:

[0073] S31: The key center verifies the identity of the terminal user at the RT end through the message ID and the second master public key. When the identity of the terminal user passes the verification, step S32 is executed. When the identity of the terminal user fails to pass the verification, it is determined to be an illegal user.

[0074] S32: Parse the received encrypted message data to obtain encrypted ciphertext, timestamp, and encryption key.

[0075] S33: The key center obtains the user private key through the sender source identifier.

[0076] S34: The encryption key is decrypted by the user to obtain a decryption key.

[0077] S35: Decrypt the encrypted ciphertext using the decryption key to obtain decrypted message data.

[0078] In steps S31 to S35, the rationality of the user identity is first verified, and it is determined whether the message ID and user public key id of 1553B are stored in the SM9 key center record table. If so, proceed to the next step. If not, it is determined to be an illegal user; subsequently, the received encrypted data is parsed into three parts, namely ciphertext, timestamp and encryption key.

[0079] After parsing the data, a source identifier is generated according to the given message ID, and the private key s is obtained from the SM9 key center. The encrypted key obtained by parsing is decrypted, and finally the ciphertext is decrypted using the key obtained by successful decryption to obtain the decrypted data.

[0080] like Figure 2 As shown, the second aspect of the present invention provides a data encryption system for a flight control communication system, comprising:

[0081] The encryption module 100 is used to perform combined encryption on the BC end data by using the first encryption algorithm and the second encryption algorithm to obtain encrypted message data;

[0082] A registration module 200, used to register the registration information of the RT end with the key center of the second encryption algorithm;

[0083] The decryption module 300 is used to decrypt the encrypted message data received by the registered RT terminal through the second encryption algorithm to obtain decrypted message data.

[0084] A third aspect of the present invention provides a data encryption device for a flight control communication system, comprising:

[0085] A memory and at least one processor, wherein instructions are stored in the memory;

[0086] The processor calls the instruction in the memory so that the data encryption device for the flight control communication system executes the data encryption method for the flight control communication system as described in any one of the above items.

[0087] A fourth aspect of the present invention provides a computer-readable storage medium having instructions stored thereon, and when the instructions are executed by a processor, a data encryption method for a flight control communication system as described in any one of the above items is implemented.

[0088] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0089] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0090] like Figure 3As shown, a data encryption method and system for a flight control communication system provided by the present invention, namely, a time consumption analysis of the IE-SM4 algorithm in actual application, it can be seen that the algorithm of the present invention is significantly better than the SM4 and SM9 algorithms in encrypting the transmitted data on multiple flight control systems.

[0091] Based on a data encryption method and system for a flight control communication system provided by the present invention, the present invention also provides an FPGA module for a 1553B bus IP, which is mainly composed of a bus receiving unit, a sending unit, a bus protocol processing unit, an IE SM4.0 encryption algorithm unit in MT monitoring, and an MCU processor interface unit.

[0092] Among them, the bus protocol processing unit includes basic 1553B cooperative control functions, such as 1553B bus arbitration, message format processing, RT status return and other functions. The present invention is a special customized aircraft and specially introduces an efficient hybrid encryption algorithm: Intelligent encryption SM4.0 (IE SM4) algorithm, which is implemented in the bus monitoring unit MT.

[0093] The bus protocol processing unit in the data link layer, when working in the MT state, the traditional data processing method is as follows: all data messages on the bus are received through the bus receiving unit, parsed according to the command word, data word and status word format, and the correctness of the message is judged according to the message format specified by the 1553B protocol. When a correct or abnormal message is received, the corresponding time information is read from the time mark unit in the RAM and sent back to the MCU together with the 1553B message. However, the data transmission method of the 1553B bus in the traditional flight control system is that the data with parity check is directly sent to the MCU, which is beneficial to the information transmission speed, but faces the risk of data tampering and exposure. The present invention takes into account the confidentiality and security of the flight control system. After completing the monitoring of the message by the MT, the message needs to be encrypted accordingly, and the encrypted message is connected to the timestamp and sent back to the MCU. Such an improvement greatly improves the reliability and security of information transmission.

[0094] The present invention applies the digital signature of the national secret asymmetric algorithm SM9.0 to the symmetric algorithm SM4.0 without changing the original 1553B protocol control state. The core idea of ​​the asymmetric algorithm is that different keys are used for encryption and decryption. Therefore, the present invention uses a hybrid encryption algorithm that combines a symmetric algorithm with an asymmetric algorithm, that is, a symmetric encryption algorithm is used to encrypt messages, and an asymmetric encryption algorithm is used to encrypt symmetric encryption keys. This solution can encrypt quickly, avoid the problem of low efficiency of asymmetric encryption, and solve the delay problem of symmetric encryption key transmission.

[0095] Generally speaking, the present invention provides a data encryption method, system, device and storage medium for a flight control communication system. In order to ensure the data security of the flight control system and the transmission efficiency of the data after encryption, a new encryption algorithm IE SM4 that integrates the symmetric algorithm SM4 and the asymmetric algorithm SM9 is proposed. SM4 is used to encrypt the message in 1553B, and then the SM9 algorithm is used to encrypt the encryption key, which effectively ensures the integrity and anti-attack ability of the data while improving the encryption speed. It can not only achieve fast encryption, but also solve the key management and maintenance problems of using only SM4 and the low efficiency of SM9.

[0096] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data encryption method for a flight control communication system, characterized in that: include: S1: Combine and encrypt the BC end data using the first encryption algorithm and the second encryption algorithm to obtain encrypted message data; S2: registering the registration information of the RT end with the key center of the second encryption algorithm; S3: Decrypt the encrypted message data received by the registered RT end through the second encryption algorithm to obtain decrypted message data.

2. A data encryption method for a flight control communication system according to claim 1, characterized in that: The first encryption algorithm is the SM4 algorithm, and the second encryption algorithm is the SM9 encryption algorithm.

3. The data encryption method for a flight control communication system according to claim 1, characterized in that: Step S1 further comprises: S11: According to the first public key ID of the BC end, the key center of the second encryption algorithm of the BC end registers to obtain a first master public key; S12: Encrypt the data to be sent by using an encryption key corresponding to the first encryption algorithm to obtain first encrypted data; S13: Encrypt the encryption key by using the first public key ID and the first master public key to obtain second encrypted data; S14: Concatenate the first encrypted data and the second encrypted data through timestamps to obtain encrypted message data.

4. A data encryption method for a flight control communication system according to claim 3, characterized in that: Step S11 also includes: Save the message ID and time stamp information of the data to be sent.

5. The data encryption method for a flight control communication system according to claim 3, characterized in that: The expression of the encrypted message data in step S14 is: data e =data1||T||single; Among them, data e The encrypted message data obtained by splicing is as follows: data1 is the first encrypted data, T is the timestamp, and enk is the second encrypted data.

6. The data encryption method for a flight control communication system according to claim 1, characterized in that: The registration message in step S2 includes a sender source identifier, a second master public key, and a user private key.

7. A data encryption method for a flight control communication system according to claim 6, characterized in that: Step S3 further comprises: S31: The key center verifies the identity of the terminal user of the RT end through the message ID and the second master public key. When the identity of the terminal user passes the verification, step S32 is executed. When the identity of the terminal user fails the verification, the terminal user is determined to be an illegal user. S32: Parsing the received encrypted message data to obtain encrypted ciphertext, timestamp, and encryption key; S33: The key center obtains the user private key through the sender source identifier; S34: Decrypting the encryption key through the user to obtain a decryption key; S35: Decrypt the encrypted ciphertext using the decryption key to obtain decrypted message data.

8. A data encryption system for a flight control communication system, characterized in that: include: The encryption module is used to encrypt the BC end data by combining the first encryption algorithm and the second encryption algorithm to obtain the encrypted message data; A registration module, used to register the registration information of the RT end with the key center of the second encryption algorithm; The decryption module is used to decrypt the encrypted message data received by the registered RT terminal through the second encryption algorithm to obtain decrypted message data.

9. A data encryption device for a flight control communication system, characterized in that: include: A memory and at least one processor, wherein instructions are stored in the memory; The processor calls the instruction in the memory so that the data encryption device for the flight control communication system executes the data encryption method for the flight control communication system according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed by the processor, the data encryption method for the flight control communication system according to any one of claims 1 to 7 is implemented.

Images