Regional encryption communication support system based on communication tower group

Abstract

The invention discloses a regional encryption communication safeguard system based on a communication tower group. The regional encryption communication safeguard system comprises an encryption module, a regional control center, a user terminal and an intelligent routing module, the encryption module is integrated on each communication tower signal output end and each communication tower signal receiving end in the encrypted communication support system area, and is used for encrypting communication tower output signals and decrypting received signals; the area control center is used for distributing a dynamic secret key to the communication tower and monitoring the operation state of the whole system; the user terminal is used for providing a human-computer interaction interface for a management user, transmitting a key with the communication tower in the area through a key distribution protocol, and performing data communication; and the intelligent routing module is used for determining an optimal routing path for communication between the communication towers.

Description

Technical Field

[0001] The present invention relates to the field of communication security technology, and in particular to a regional encrypted communication security system based on a communication tower group. Background Art

[0002] With the rapid development of information technology, communication security issues have become increasingly prominent. Traditional encrypted communication methods often rely on the encryption capabilities of terminal devices, and during signal transmission, especially in wireless environments, information is vulnerable to monitoring and attacks. Therefore, it is particularly important to build a communication security system that encrypts the entire link from the signal source to the receiving end. However, the methods for link encryption in the prior art include symmetric encryption, asymmetric encryption, and hybrid encryption, but there are still security issues such as key leakage and key cracking, as well as compatibility issues where encryption algorithms do not support each other; at the same time, the existing communication link encryption methods usually use methods with high computational overhead, especially when processing high-frequency and large-scale data, which may lead to performance degradation, high encryption costs, and difficulty in achieving secure communication coverage in a large area. Summary of the invention

[0003] The purpose of the present invention is to provide a regional encrypted communication security system based on a communication tower group, which aims to improve the security of communication data, prevent illegal interception and tampering, and utilize the existing communication tower infrastructure to provide regional encrypted communication coverage, reduce deployment costs, and improve service efficiency.

[0004] To achieve the above-mentioned purpose, the present invention provides a regional encrypted communication guarantee system based on a communication tower group, comprising an encryption module, a regional control center, a user terminal and an intelligent routing module; An encryption module, integrated in each communication tower signal output terminal and communication tower signal receiving terminal in the encrypted communication security system area, for encrypting the communication tower output signal and decrypting the received signal; The regional control center is used to distribute dynamic keys to communication towers and monitor the operating status of the entire system; User terminals are used to provide a human-computer interaction interface for management users and to transmit keys to communication towers in the area through a key distribution protocol for data communication; Intelligent routing module, used to determine the optimal routing path for communications between various communication towers.

[0005] Furthermore, the encryption module includes: An encryption processor, used to generate a corresponding key using a preset encryption algorithm to encrypt or decrypt the output signal of the communication tower; A key storage unit, used to store the key generated by the encryption and decryption processor; A key control unit, used to update or revoke the key in the key storage unit; The signal modulation and demodulation unit is used to modulate and demodulate the output and input signals of the communication tower, convert the input analog signal into a digital signal, and convert the output digital signal processed by the encryption processor into an analog signal.

[0006] Furthermore, the workflow of the encryption module is: S1: Get the input signal of the current communication tower; S2: demodulate the input signal using the signal modulation and demodulation unit, convert it into a digital signal, and send it to the encryption processor; S3: The encryption processor calls the encryption algorithm currently stored in the key storage unit to encrypt or decrypt the input signal, and sends the processed signal back to the signal modulation and demodulation unit; S4: The signal modulation and demodulation unit modulates the signal output by the encryption processor into an analog signal and sends it to the next communication tower or user terminal of the communication link.

[0007] Furthermore, the regional control center includes: A server cluster includes multiple server groups and is used to provide applications, system resources, and data services to users; The database management subsystem is deployed on the server group and is used to store infrastructure information, equipment information, maintenance operation log records, environmental information, traffic data, and manage data integrity and backup; A real-time monitoring subsystem to monitor the status, key activity, and network performance parameters of all communication towers in the area; The security policy execution subsystem is used to execute the set security policy according to the preset network security policy when the trigger conditions are met; The key management server is used to generate keys and update and revoke the keys, and transmit the generated keys to the key storage units of all communication towers, and update the keys in the key storage units for the encryption and decryption processors to call.

[0008] Furthermore, the key management server includes: A key generation unit, for generating dynamic keys using CSPRNG; A key transmission unit, used to send the generated dynamic key to the encryption modules on all communication towers through a security protocol, store the dynamic key in a key storage unit, and verify the identity using a digital certificate; The key update and revocation unit is used to regularly update the key according to the preset update cycle and distribute the new key to each communication tower according to actual needs.

[0009] Furthermore, the key distribution protocol comprises the following steps: Step 1: Establish a connection Step 1.1: The user terminal initiates a connection request to a communication tower in the area; Step 1.2: The communication tower responds to the connection request and establishes a physical connection with the user terminal; Step 2: Identity Verification Step S2.1: The user terminal sends an identity certificate to the communication tower; Step 2.2: The communication tower verifies the identity of the user terminal to ensure that it is an authorized user; Step 3: Key negotiation Step 3.1: The user terminal and the communication tower each select a random number generated by the CSPRNG and send the value processed by the public parameters to the other party; Step 3.2: Determine whether the user terminal and the communication tower are set with a pre-shared key. If yes, proceed to step 3.4; otherwise, proceed to step 3.3; Step 3.3: Both parties use their own random numbers and the public value sent by the other party to calculate the same shared key; Step 3.4: Get the pre-shared key; Step 4: Use digital signature or hash function to confirm the key; Step 5: After the key is successfully negotiated, the user terminal and the communication tower use the negotiated key to encrypt and decrypt the communication data.

[0010] Furthermore, the real-time monitoring subsystem includes: A real-time monitoring unit that monitors the status of all communication towers and records key activity; An anomaly detection unit, used to analyze the signal data obtained by the communication tower using a signal analysis algorithm, identify abnormal patterns in the signal, and issue an alarm; The performance and compliance monitoring unit is used to monitor the system's performance indicators and compliance assessment indicators and generate audit reports.

[0011] Furthermore, the status of the communication tower includes security around the communication tower, firewall and intrusion detection, environmental status, and firmware software status; key activities include key update and revocation behaviors.

[0012] Furthermore, the performance indicators include latency, packet loss rate and throughput; the compliance assessment indicators include system normal working time, security and ISO.

[0013] Furthermore, the intelligent routing module includes: A data analysis unit, used to obtain network load and signal strength from the real-time monitoring subsystem, and analyze the obtained data to determine the evaluation index of each possible path; The routing selection unit is used to evaluate the security risk of each path using the Dijkstra algorithm and take the low-risk path as the optimal path.

[0014] Therefore, the present invention adopts the above-mentioned regional encrypted communication guarantee system based on a communication tower group, which has the following beneficial effects: First, the present invention sets up an encryption module, uses advanced encryption algorithms (such as AES, RSA, etc.) to encrypt data, stores private keys in a secure hardware module, and regularly changes keys while implementing a key rotation strategy to prevent leakage and ensure that even if the data is intercepted, it cannot be easily decrypted.

[0015] Second, the present invention accelerates the encryption process and reduces the impact of encryption operations on communication delays by setting up and using a dedicated hardware encryption chip, such as NXP LPC55S69, STM32L476, Intel Arria 10 and other chips.

[0016] Third, the present invention improves existing communication towers, fully utilizes existing communication tower resources, reduces additional infrastructure construction, and reduces implementation costs and complexity.

[0017] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is the module architecture diagram of this system. DETAILED DESCRIPTION

[0019] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, these embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention. In addition, it should be understood that after reading the content taught by the present invention, those skilled in the art make various changes or modifications to the present invention, and these equivalent forms also fall within the scope limited by the claims attached to the application.

[0020] The present invention discloses a regional encrypted communication guarantee system based on a communication tower group, which is deployed on the existing communication tower infrastructure. The system integrates advanced encryption technology and network protocols to build a communication guarantee system with full-link encryption from the user end to the communication tower where communication is to be established.

[0021] The regional encrypted communication security system includes the following modules: 1. Encryption module This module is integrated on each communication tower signal output terminal and communication tower signal receiving terminal in the encrypted communication security system area, and is used to encrypt the communication tower output signal and decrypt the received signal.

[0022] The encryption module further comprises: An encryption and decryption processor, used to generate a corresponding key using a preset encryption algorithm (such as AES and RSA) to encrypt or decrypt the output signal of the communication tower; A key storage unit, used to store the key generated by the encryption and decryption processor; A key control unit, used to update or revoke the key in the key storage unit; A signal modulation and demodulation unit, used for modulating and demodulating the output and input signals of the communication tower, converting the input analog signal into a digital signal, and converting the output digital signal processed by the encryption processor into an analog signal; The workflow of this module is: S1: Get the input signal of the current communication tower; S2: demodulate the input signal using the signal modulation and demodulation unit, convert it into a digital signal, and send it to the encryption processor; S3: The encryption processor calls the encryption algorithm currently stored in the key storage unit to encrypt or decrypt the input signal, and sends the processed signal back to the signal modulation and demodulation unit; S4: The signal modulation and demodulation unit modulates the signal output by the encryption processor into an analog signal and sends it to the next communication tower or user terminal of the communication link.

[0023] 2. Regional Control Center It is deployed in a control room within a certain area, including server clusters, database management subsystems, real-time monitoring subsystems, security policy execution subsystems, and key management servers; A server cluster includes multiple server groups and is used to provide applications, system resources, and data services to users; The database management subsystem is deployed on the server group and is used to store infrastructure information, equipment information, maintenance operation log records, environmental information, traffic data, and manage data integrity and backup; The real-time monitoring subsystem is mainly deployed in the regional control room and is used to monitor the status, key activities, and network performance parameters of all communication towers in the region; Security policy execution subsystem, which includes firewalls and intrusion detection systems, emergency plans and regular security audits to prevent unauthorized access, prevent and respond to equipment failures and network attacks; The key management server is used to generate keys and update and revoke the keys, and transmit the generated keys to the key storage units of all communication towers, and update the keys in the key storage units for the encryption and decryption processors to call.

[0024] To achieve secure distribution of dynamic keys and monitor the operating status of the entire system, the following steps and technical solutions can be followed: The key management server includes: 1) Key generation unit: used to generate dynamic keys, which are one-time or regularly updated.

[0025] 2) Key transmission unit: The generated dynamic key is sent to all communication towers through a security protocol (such as TLS / SSL), and the identity is verified using a digital certificate. The communication tower uses its own hardware security module (HSM) to securely store the dynamic key. The HSM module includes the key storage unit and an encryption and decryption processor. The key storage unit receives and stores the dynamic key for the encryption and decryption processor to call. 3) Key update and revocation unit: The control center regularly updates the key according to the preset update cycle, and distributes the new key to each communication tower according to actual needs. Communication towers that are not directly connected to the control center can transfer the updated key between communication towers according to the protocol; The key management server adopts a dynamic key management mechanism, which specifically includes: (1) Dynamic key generation algorithm A more advanced physical noise source quantum random number generator is used to enhance randomness, improve the unpredictability of the key, and make it more difficult for attackers to predict future keys by analyzing historical data.

[0026] Dynamically adjust key strength to adapt to evolving computing power, ensuring that keys are strong enough to resist current cracking techniques.

[0027] (2) Key lifecycle management ①Key generation: Use CSPRNG to generate session keys.

[0028] ②Key distribution: The session key is sent to the communication towers of both parties through a security protocol (such as TLS / SSL).

[0029] ③Key usage: Use the key only during the specified session.

[0030] ④Key update: Regularly change session keys to prevent the same key from being used for a long time.

[0031] ⑤Key destruction: After the session ends, the key is completely destroyed to ensure that it cannot be recovered.

[0032] (3) Key security and unpredictability security measures ① Use a quantum random number generator: Make sure the CSPRNG has enough entropy input, usually from physical noise or other unpredictable sources.

[0033] ②Key isolation: Different sessions use independent keys to prevent one session key from being used for another session.

[0034] ③Key storage security: Use HSM for key generation, storage and management to protect the keys of the key storage unit of the encryption module.

[0035] ④ Regular audit: Monitor the key management and usage process by regularly analyzing and checking the operation log records maintained in the database management subsystem.

[0036] (4) Key Distribution Protocol The present invention transmits a key between a communication tower and a user terminal through a key distribution protocol, which specifically includes the following steps: S1: Establishing a connection S1.1: The user terminal initiates a connection request to a communication tower in the area; S1.2: The communication tower responds to the connection request and establishes a physical connection with the user terminal; S2: Authentication S2.1: The user terminal sends an identity certificate to the communication tower; S2.2: The communication tower verifies the identity of the user terminal to ensure that it is an authorized user; S3: Key negotiation Using Diffie-Hellman key exchange, the specific steps are: S3.1: The user terminal and the communication tower each select a random number generated by a CSPRNG and send the value processed by public parameters (i.e., parameters that all participants can access and use) to the other party; S3.2: Determine whether the user terminal and the communication tower are set with a pre-shared key. If yes, proceed to S3.4; otherwise, proceed to S3.3; S3.3: Both parties use their own random numbers and the public value sent by the other party to calculate the same shared key; In the above process, even if it is monitored, since the key is calculated based on the private information of both parties, it is impossible to derive the key directly from the public information, thus ensuring the security of the key. In addition, the key used for each communication is temporary, so even if the future key is leaked, the previous communication is still safe; S3.4: Pre-shared key. If there is a shared key in advance, this key can be used directly; S4: Key confirmation Use digital signatures or hash functions to confirm the authenticity and integrity of the key source.

[0037] S5: Key usage After the key is successfully negotiated, the user terminal and the communication tower use the key to encrypt and decrypt the communication data.

[0038] In step S2, the present invention uses digital certificates and signatures to verify the identities of both parties. The communication tower and the user terminal use digital certificates to verify each other's identities. The real-time monitoring subsystem further comprises: 1) Real-time monitoring unit Used to monitor the status of all communication towers and record key activities; the status of communication towers includes security around the communication towers, firewalls and intrusion detection, environmental status, and firmware software status; key activities include key updates and revocations; 2) Anomaly Detection Unit It is used to identify abnormal behaviors by using signal analysis algorithms, such as FFT, STFT, and ICA, to analyze the signal data obtained from the communication tower, identify abnormal patterns in the signal, and take measures such as blocking addresses and isolating attacked devices for terminals with abnormal behaviors according to the policies set in the security policy execution subsystem, and issue alarms.

[0039] 3) Performance and compliance monitoring unit ① Performance monitoring: Continuously monitor network performance, including latency, packet loss rate, and throughput.

[0040] ② Compliance Check: Automatically perform compliance checks, including system normal operating hours, security, and ISO, and generate audit reports.

[0041] 3. User Terminal Used to provide a human-computer interaction interface for management users. The encryption chip used in this user terminal is NXPLPC55S69, and the communication protocol stack uses TLS / SSL and IPSec combined with AES and RSA.

[0042] (1) Communication protocol stack The encryption protocol stack adopted by the present invention is TLS / SSL, IPSec combined with AES and RSA.

[0043] The establishment of a secure connection between a user terminal and a communication tower is divided into the following stages:

[0044] Phase 1: Handshake Phase ① The user terminal and the communication tower conduct handshake negotiation through TLS / SSL and use AES for data encryption; ②The communication tower sends a digital certificate to the user terminal, and the user terminal verifies the validity of the certificate; ③Use RSA to encrypt the session key and send it to the communication tower through the TLS / SSL secure channel;

[0045] Phase 2: Data transmission phase ① The user terminal uses AES to encrypt the data to be transmitted and sends the encrypted ciphertext to the communication tower; ②The communication tower uses the same AES key to decrypt the ciphertext and obtain the original data.

[0046] Phase 2: Key Update Phase The session key is updated periodically and revoked when the session ends, thus ensuring that old session data cannot be re-decrypted.

[0047] (2) Combination of symmetric and asymmetric encryption From the above handshake phase, it can be seen that the present invention uses asymmetric encryption to establish a secure channel in the early stage of data transmission, and then converts to symmetric encryption for efficient data transmission. It specifically includes the following two stages:

[0048] Phase 1: Asymmetric encryption phase ①The key management server generates a pair of asymmetric keys (public key and private key); ②The user terminal uses the server's public key to encrypt a randomly generated symmetric key and sends it to the server; ③The key management server uses its private key to decrypt and obtain the symmetric key;

[0049] Phase 2: Symmetric encryption phase ①The client encrypts the data using a symmetric key and sends it to the server; ②The key management server uses the same symmetric key to decrypt the data; As can be seen from the above, the present invention uses asymmetric encryption to securely exchange symmetric keys, and then uses symmetric encryption to efficiently encrypt and decrypt data, thereby ensuring the security of data transmission and improving data transmission efficiency.

[0050] 4. Intelligent routing module This module dynamically selects the best routing path based on network load, signal strength, and security risk factors. It includes: (1) Data Analysis Unit This unit is used to obtain network load and signal strength from the real-time monitoring subsystem and analyze the obtained data to determine the evaluation index of each possible path; specifically, when performing data analysis, by creating a graph model of the network topology, the collected network load, signal strength, and security risk information are analyzed to evaluate the current status and performance of each node and link; (2) Routing unit This unit uses the Dijkstra algorithm to evaluate the safety risk of each path and selects the low-risk path as the optimal path.

[0051] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. Regional encrypted communication security system based on communication tower group, characterized by: Includes encryption module, regional control center, user terminal and intelligent routing module; An encryption module, integrated in each communication tower signal output terminal and communication tower signal receiving terminal in the encrypted communication security system area, for encrypting the communication tower output signal and decrypting the received signal; The regional control center is used to distribute dynamic keys to communication towers and monitor the operating status of the entire system; User terminals are used to provide a human-computer interaction interface for management users and to transmit keys to communication towers in the area through a key distribution protocol for data communication; Intelligent routing module, used to determine the optimal routing path for communications between various communication towers.

2. The regional encrypted communication security system based on a communication tower group as claimed in claim 1, characterized in that: The encryption module comprises: An encryption processor, used to generate a corresponding key using a preset encryption algorithm to encrypt or decrypt the output signal of the communication tower; A key storage unit, used to store the key generated by the encryption and decryption processor; A key control unit, used to update or revoke the key in the key storage unit; The signal modulation and demodulation unit is used to modulate and demodulate the output and input signals of the communication tower, convert the input analog signal into a digital signal, and convert the output digital signal processed by the encryption processor into an analog signal.

3. The regional encrypted communication security system based on a communication tower group as claimed in claim 2, characterized in that: The workflow of the encryption module is: S1: Get the input signal of the current communication tower; S2: demodulate the input signal using the signal modulation and demodulation unit, convert it into a digital signal, and send it to the encryption processor; S3: The encryption processor calls the encryption algorithm currently stored in the key storage unit to encrypt or decrypt the input signal, and sends the processed signal back to the signal modulation and demodulation unit; S4: The signal modulation and demodulation unit modulates the signal output by the encryption processor into an analog signal and sends it to the next communication tower or user terminal of the communication link.

4. The regional encrypted communication security system based on a communication tower group as claimed in claim 1, characterized in that: The regional control center includes: A server cluster includes multiple server groups and is used to provide applications, system resources, and data services to users; The database management subsystem is deployed on the server group and is used to store infrastructure information, equipment information, maintenance operation log records, environmental information, traffic data, and manage data integrity and backup; A real-time monitoring subsystem to monitor the status, key activity, and network performance parameters of all communication towers in the area; The security policy execution subsystem is used to execute the set security policy according to the preset network security policy when the trigger conditions are met; The key management server is used to generate keys and update and revoke the keys, and transmit the generated keys to the key storage units of all communication towers, and update the keys in the key storage units for the encryption and decryption processors to call.

5. The regional encrypted communication security system based on a communication tower group as claimed in claim 4, characterized in that: The key management server comprises: A key generation unit, for generating dynamic keys using CSPRNG; A key transmission unit, used to send the generated dynamic key to the encryption modules on all communication towers through a security protocol, store the dynamic key in a key storage unit, and verify the identity using a digital certificate; The key update and revocation unit is used to regularly update the key according to the preset update cycle and distribute the new key to each communication tower according to actual needs.

6. The regional encrypted communication security system based on a communication tower group as claimed in claim 5, characterized in that: The key distribution protocol comprises the following steps: Step 1: Establish a connection Step 1.1: The user terminal initiates a connection request to a communication tower in the area; Step 1.2: The communication tower responds to the connection request and establishes a physical connection with the user terminal; Step 2: Identity Verification Step S2.1: The user terminal sends an identity certificate to the communication tower; Step 2.2: The communication tower verifies the identity of the user terminal to ensure that it is an authorized user; Step 3: Key negotiation Step 3.1: The user terminal and the communication tower each select a random number generated by the CSPRNG and send the value processed by the public parameters to the other party; Step 3.2: Determine whether the user terminal and the communication tower are set with a pre-shared key. If yes, proceed to step 3.4; otherwise, proceed to step 3.3; Step 3.3: Both parties use their own random numbers and the public value sent by the other party to calculate the same shared key; Step 3.4: Get the pre-shared key; Step 4: Use digital signature or hash function to confirm the key; Step 5: After the key is successfully negotiated, the user terminal and the communication tower use the negotiated key to encrypt and decrypt the communication data.

7. The regional encrypted communication security system based on a communication tower group as claimed in claim 3, characterized in that: The real-time monitoring subsystem includes: A real-time monitoring unit that monitors the status of all communication towers and records key activity; An anomaly detection unit, used to analyze the signal data obtained by the communication tower using a signal analysis algorithm, identify abnormal patterns in the signal, and issue an alarm; The performance and compliance monitoring unit is used to monitor the system's performance indicators and compliance assessment indicators and generate audit reports.

8. The regional encrypted communication security system based on a communication tower group as claimed in claim 7, characterized in that: The status of the communication tower includes security around the communication tower, firewall and intrusion detection, environmental status, and firmware software status; key activities include key update and revocation behavior.

9. The regional encrypted communication security system based on a communication tower group as claimed in claim 7, characterized in that: The performance indicators include latency, packet loss rate and throughput; the compliance assessment indicators include system normal operation time, security and ISO.

10. The regional encrypted communication security system based on a communication tower group as claimed in claim 7, characterized in that: The intelligent routing module includes: A data analysis unit, used to obtain network load and signal strength from the real-time monitoring subsystem, and analyze the obtained data to determine the evaluation index of each possible path; The routing selection unit is used to evaluate the security risk of each path using the Dijkstra algorithm and take the low-risk path as the optimal path.

Images