Pre-shared network encryption authentication system and method

Abstract

The invention discloses a pre-shared network encryption authentication system and method, relates to the field of network security related to an IPSec (Internet Protocol Security) tunnel technology, and is particularly suitable for an Internet of Things scene with tense computing resources, limited network resources, relatively high secret communication link delay requirement and small but important network data volume. The specific implementation mode comprises the following steps: initializing a hardware security module by using a hardware security module management system; the hardware security module is used together with a network password system, completes bidirectional identity verification in a starting stage, and immediately enters an IPSec password state after the bidirectional identity verification is passed. According to the invention, a complex key negotiation exchange process is abandoned, and a key database in a hardware security module is used; meanwhile, a lightweight identity authentication protocol is designed to complete bidirectional identity authentication of both communication parties. The innovation not only reduces the duration of the communication link entering the encrypted communication state and the consumption of computing resources, but also improves the utilization efficiency and stability of the network resources of the system.

Description

Technical Field

[0001] The invention relates to the field of network security, and is a pre-shared encryption authentication system and method using IPSec tunnel technology. Background Art

[0002] At present, with the booming development of the digital economy, the importance of network communication security has become increasingly prominent, and has become a key cornerstone for the stable development of various industries. Among them, the network cryptographic system, as the core system for communication security assurance, has become an essential foundation for various organizations to build information security defense lines. In a network cryptographic system that complies with the GM / T 0022 "IPSec VPN Technical Specification" standard, in order to complete the identity authentication of both parties in communication and establish a secret link, it is necessary to go through the key negotiation message interaction of 9 messages in the first phase and 3 messages in the second phase in sequence; when the lifetime of the first phase ISAKMP SA or the second phase IPSec SA expires, it is necessary to re-initiate key negotiation; if packet loss occurs during the negotiation and causes network retransmission, this will lead to further loss of system resources and further delay the establishment time of the secret link. This is unacceptable for IoT scenarios with tight computing resources, limited network resources, high requirements for secret link latency, and small but important network data volumes. Summary of the invention

[0003] The present invention discloses a pre-shared network encryption authentication system and method using IPSec tunnel technology to solve the problems of bidirectional identity authentication of communication entities and confidentiality and integrity protection of network data, and is particularly suitable for Internet of Things scenarios with tight computing resources, limited network resources, high requirements for secret link delay, and small but important network data volume. Compared with the network cryptographic system that complies with the GM / T 0022 "IPSec VPN Technical Specification" standard, the present invention abandons the complex key negotiation and exchange process and instead uses a key database pre-built into a hardware security module (smart password key, TF card, PCIe password card, etc.). At the same time, a lightweight identity authentication protocol with only 2 message interactions is designed to complete the bidirectional identity authentication of both communicating parties. This innovation not only reduces the delay of the communication link entering the encrypted communication state and the consumption of computing resources, but also improves the utilization efficiency and stability of the system's network resources. It solves the problems of tight computing resources, limited network resources, and high requirements for secret link delay in the Internet of Things scenario due to cost, business and other reasons. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Figure 1 A block diagram of the network cryptographic system provided by the present invention;

[0005] Figure 2 A lightweight two-way identity authentication protocol provided by the present invention;

[0006] Figure 3 A flowchart of initializing a hardware security module for the hardware security module management system provided by the present invention;

[0007] Figure 4 A flow chart of verifying user identity when starting the network password system provided by the present invention;

[0008] Figure 5 The network cryptographic system IPSec data outbound flow chart provided by the present invention;

[0009] Figure 6 The network cryptographic system IPSec data inbound flow chart provided by the present invention; DETAILED DESCRIPTION

[0010] In order to make the system and method of the present invention clearer, the specific implementation of the present invention is further described in detail below with reference to the accompanying drawings and examples. Figure 1 As shown, the network cryptographic system consists of a key daemon, an IPSec protocol stack, and computing hardware. The IPSec protocol stack includes a security alliance database SAD and a security policy database SPD. The computing hardware includes a hardware security module, a network interface module, a central processing unit CPU, memory, external storage, etc.

[0011] Two-way authentication protocol Figure 2 As shown, ID is the 16-byte network cryptographic system identity, NC is a 16-byte random number, SEQ is a 4-byte authentication sequence number, HASH is the 32-byte hash value calculated using the SM3 algorithm for ID, NC, SEQ and authentication key, and SIG is the 64-byte signature value of the SM2 signature on HASH. The detailed process of two-way authentication between network cryptographic systems is as follows:

[0012] S11, the initiator calculates HASH=SM3(ID||NC||SEQ||SK) and SIG=SM2_SIG(HASH, PRIKEY), sends the identity authentication message MSGi=ID||NC||SEQ||HASH||SIG to the responder and updates the initiator's identity authentication sequence number to SEQ+1. Among them, ID is the initiator's identity identifier, NC is the initiator's random number, SEQ is the initiator's identity authentication sequence number, SK is the initiator's identity authentication key, and PRIKEY is the initiator's SM2 signature private key;

[0013] S12. After receiving MSGi, the responder queries the corresponding peer information through MSGi.ID and records the queried peer information as PEERr.

[0014] If the query fails, the initiator identity verification fails. Compare MSGi.SEQ and PEERr.SEQ. If MSGi.SEQ is less than PEERr.SEQ, the initiator identity verification fails. Calculate HASH = SM3 (MSGi.ID || MSGi.NC || MSGi.SEQ || PEERr.SK), where PEERr.SK is the identity authentication key in the responder peer information. Compare MSGi.HASH and HASH. If they are inconsistent, the initiator identity verification fails. Calculate SM2_VER (MSGi.HASH, MSGi.SIG, PEERr.PUBKEY) to verify the initiator signature, where PEERr.PUBKEY is the SM2 signature public key corresponding to the initiator. If it fails, the initiator identity verification fails.

[0015] S13, the responder calculates HASH=SM3(ID||NC||SEQ||SK) and SIG=SM2_SIG(HASH, PRIKEY), sends the identity authentication message MSGr=ID||NC||SEQ||HASH||SIG to the initiator and updates PEERr.SEQ to MSGi.SEQ+1. Among them, ID is the responder identity, NC is the responder random number, SEQ=MSGi.SEQ+1, SK=PEERr.SK, and PRIKEY is the responder SM2 signature private key.

[0016] S14. After receiving MSGr, the initiator queries the corresponding peer information through MSGr.ID and records the queried peer information as PEERi.

[0017] If the query fails, the identity verification of the responder fails. The initiator's current identity authentication sequence number is recorded as SEQi. Compare MSGr.SEQ and SEQi. If MSGr.SEQ is not equal to SEQi, the identity verification of the responder fails. Calculate HASH=SM3(MSGr.ID||MSGr.NC||MSGr.SEQ||SK), where SK is the initiator's identity authentication key. If MSGr.HASH and HASH are inconsistent, the identity verification of the responder fails. Calculate SM2_VER(MSGr.HASH, MSGr.SIG, PEERi.PUBKEY) to verify the responder's signature, where PEERi.PUBKEY is the SM2 signature public key corresponding to the responder. If the signature verification passes, the initiator's identity authentication of the responder is successful.

[0018] like Figure 3As shown, the hardware security module management system initializes the hardware security module, and the information that needs to be entered includes identity identification, identity authentication key, hardware security key, certificate validity period, peer database, policy database, and key database. Among them: the identity identification is used to uniquely identify the network cryptographic system; the identity authentication key is used as a pre-shared key to complete two-way identity authentication between network cryptographic systems; the certificate validity period is used to set the validity period of the SM2 signature certificate; the peer database is used to store the peer identity identification, peer network address, peer identity authentication serial number and peer SM2 public key; the policy database is used to store IPSec security policies; the key database is used to store IPSec security alliances. After the entry is completed, execute the following process:

[0019] S21, start the hardware security module management system;

[0020] S22, input identity identification, identity authentication key, hardware security key, certificate validity period, peer database, policy database, and key database;

[0022] S23, initialize the SM2 signature key pair and generate the SM2 signature certificate;

[0023] S24, mark the hardware security key in segments, with bytes 0 to 15 marked as EKEY, bytes 15 to 31 marked as IV, and bytes 32 to 63 marked as

[0024] The byte is recorded as AKEY; the authentication key, peer database, policy database, and key database are encrypted using the SM4 algorithm, the algorithm mode is CBC, the initial vector is IV, and the encryption key is EKEY, and the ciphertext E is obtained, that is, E=SM4_CBC_ENC(authentication key||

[0025] peer database||policy database||key database,EKEY,IV);

[0026] S25, generate an identity authentication serial number, connect the identity identifier, the identity authentication serial number, the SM2 signature certificate, and the ciphertext E, and use SM3_HMAC to perform an authentication operation. The authentication key is AKEY, and a message authentication code A is obtained, that is, A=SM3_HMAC(identity identifier||identity authentication serial number||SM2 signature certificate||ciphertext E, AKEY);

[0027] S26. Finally, the SM2 signature certificate, ciphertext E and message authentication code A are stored in the hardware security module.

[0028] like Figure 4 As shown, the network password system has preset the identity identification, the CA certificate for issuing the certificate when the hardware security module is initialized, and the hardware security key when it leaves the factory. The detailed process of starting the network password system is as follows:

[0029] S31, check whether there is a hardware security module, if so, proceed to the next step, otherwise stop working;

[0030] S32, read the SM2 signature certificate from the hardware security module and verify it using the preset CA certificate. If the verification is successful, proceed to the next step, otherwise

[0031] Stop working;

[0032] S33, segment the hardware security key, with bytes 0 to 15 marked as EKEY, bytes 15 to 31 marked as IV, and bytes 32 to 63 marked as

[0033] The byte is recorded as AKEY; read the ciphertext E and the message authentication code A from the hardware security module, recalculate the message authentication code A1 according to the identity identifier, the identity authentication serial number, the SM2 signature certificate, and the ciphertext E, that is, A1 = SM3_HMAC (identity identifier || identity authentication serial number || SM2 signature certificate || ciphertext E, AKEY), and compare A and A1. If they are the same, proceed to the next step, otherwise stop working;

[0034] S34, decrypt the ciphertext E to obtain the identity authentication key, peer database, policy database, and key database, i.e., SM4_CBC_DEC (ciphertext

[0035] E,EKEY,IV);

[0036] S35: Send the decrypted policy database to the IPSec protocol stack, and for the IoT terminal, it initiates a two-way identity authentication process as the initiator.

[0037] For the IoT data center, it acts as the responder and enters the working mode after passing the two-way ID card authentication.

[0038] After the network cryptographic system is successfully started, it enters the working mode. When the IPSec protocol stack needs to encrypt and decrypt, it requests the security association from the key management daemon process, and the key daemon process sends the security association in the key database to the IPSec protocol stack. Figure 5 As shown, the data outbound process:

[0039] S41, after receiving the user data, according to the source address, destination address, source port, destination port and protocol in the IP message to the security policy database

[0040] If the match succeeds, the packet is discarded.

[0041] S42: Determine whether a security association associated with the successfully matched security policy exists. If so, use the security association for IPSec encapsulation

[0042] Then prepare to send, otherwise request the key daemon security association.

[0043] S43. After receiving the request, the key daemon selects a security association from the key database and sends it to the IPSec protocol stack.

[0044] S44. After receiving the security association, the IPSec protocol stack performs IPSec encapsulation according to the key information therein and prepares to send it.

[0045] like Figure 6 As shown, the data inbound process:

[0046] S51, when receiving an IPSec message, search for a security association based on the destination address, protocol, and security parameter index in the message header, and if found, use

[0047] Decapsulate using the security association. Otherwise request the security association from the key daemon.

[0048] S52: The key daemon searches for the corresponding security association in the key database according to the destination address, protocol and security parameter index in the request.

[0049] If found, the group is sent down to the IPSec protocol stack, otherwise it is discarded.

[0050] S53. After receiving the security association, the IPSec protocol stack decapsulates the message to obtain the original data.

[0051] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A pre-shared network encryption authentication system and method, including a hardware security module management system, a hardware security module, and a network password system; its characteristic is that the hardware The security module is initialized in the hardware security module management system and is used in conjunction with the network cryptographic system after initialization. A lightweight two-way identity authentication protocol is used between network cryptographic systems. The communication link between network cryptographic systems uses an IPSec tunnel for confidentiality and integrity protection, and the key comes from the hardware security module.

2. According to claim 1, the hardware security module needs to be initialized in the hardware security module management system before use. The feature of this process is that the hardware security module management system needs to enter the identity, identity authentication key, hardware security key, certificate validity period, peer database, policy database, and key database when initializing the hardware security module; the hardware security key is segmented and marked, with bytes 0 to 15 marked as EKEY, bytes 15 to 31 marked as IV, and bytes 32 to 63 marked as AKEY; the identity authentication key, peer database, policy database, and key database are encrypted using the SM4 algorithm, the algorithm mode is CBC, and the initial The initial vector is IV, the encryption key is EKEY, and the ciphertext E is obtained, that is, E=SM4_CBC_ENC(identity authentication key||peer database||policy database||key database, EKEY, IV); generate an identity authentication serial number, connect the identity identifier, identity authentication serial number, SM2 signature certificate, and ciphertext E, and use SM3_HMAC to perform authentication operation. The authentication key is AKEY, and the message authentication code A is obtained, that is, A=SM3_HMAC(identity identifier||identity authentication serial number||SM2 signature certificate||ciphertext E, AKEY); store the SM2 signature certificate, ciphertext E and message authentication code A together in the hardware security module.

3. According to claim 1, the network password system needs to be used in conjunction with the hardware security module when it is working. When the network password system is started, it is characterized by Check if the hardware security module exists; read the SM2 signature certificate from the hardware security module and verify it using the preset CA certificate; The hardware security key is segmented and marked, with bytes 0 to 15 marked as EKEY, bytes 15 to 31 marked as IV, and bytes 32 to 63 marked as AKEY; Read the ciphertext E and the message authentication code A from the hardware security module, recalculate the message authentication code A1 according to the identity identifier, the identity authentication serial number, the SM2 signature certificate, and the ciphertext E, that is, A1 = SM3_HMAC (identity identifier || identity authentication serial number || SM2 signature certificate || ciphertext E, AKEY), and compare whether A and A1 are consistent; decrypt the ciphertext E to obtain the identity authentication key, the peer database, the policy database, and the key database, that is, SM4_CBC_DEC (ciphertext E, EKEY, IV); send the decrypted policy database to the IPSec protocol stack, and for the IoT terminal, it acts as the initiator to initiate the two-way identity authentication process, and for the IoT data center, it acts as the responder. After the two-way ID card authentication is passed, it enters the working mode.

4. According to claim 1, the network cryptographic system uses a lightweight two-way identity authentication protocol, characterized in that The initiator calculates HASH=SM3(ID||NC||SEQ||SK) and SIG=SM2_SIG(HASH, PRIKEY), sends an authentication message MSGi=ID||NC||SEQ||HASH||SIG to the responder and updates the initiator's authentication sequence number to SEQ+1, where ID is the initiator's identity identifier, NC is the initiator's random number, SEQ is the initiator's authentication sequence number, SK is the initiator's authentication key, and PRIKEY is the initiator's SM2 signature private key; after receiving MSGi, the responder queries the corresponding peer information through MSGi.ID and records the queried peer information as PEE Rr; compare MSGi.SEQ and PEERr.SEQ. If MSGi.SEQ is less than PEERr.SEQ, the initiator identity verification fails; calculate HASH = SM3 (MSGi.ID || MSGi.NC || MSGi.SEQ || PEERr.SK), where PEERr.SK is the identity authentication key in the responder peer information, and compare MSGi.HASH and HASH for consistency; calculate SM2_VER (MSGi.HASH, MSGi.SIG, PEERr.PUBKEY) to verify the initiator signature, where PEERr.PUBKEY is the SM2 signature corresponding to the initiator The responder calculates HASH=SM3(ID||NC||SEQ||SK) and SIG=SM2_SIG(HASH, PRIKEY), sends an identity authentication message MSGr=ID||NC||SEQ||HASH||SIG to the initiator and updates PEERr.SEQ to MSGi.SEQ+1, where ID is the responder identity, NC is the responder random number, SEQ=MSGi.SEQ+1, SK=PEERr.SK, and PRIKEY is the responder SM2 signature private key; after receiving MSGr, the initiator queries the corresponding peer information through MSGr.ID and sends the queried peer information to the initiator. The information is recorded as PEERi; the initiator's current identity authentication sequence number is recorded as SEQi, and MSGr.SEQ and SEQi are compared to see if they are equal; HASH=SM3(MSGr.ID||MSGr.NC||MSGr.SEQ||SK) is calculated, where SK is the initiator's identity authentication key, and MSGr.HASH and HASH are compared to see if they are consistent; SM2_VER(MSGr.HASH, MSGr.SIG, PEERi.PUBKEY) is calculated to verify the responder's signature, where PEERi.PUBKEY is the SM2 signature public key corresponding to the responder. If the signature verification is successful, the initiator's identity authentication of the responder is successful.

5. According to claim 1, the communication link between the network cryptographic systems is protected by IPSec tunnel, and the network data outbound is characterized by After receiving the security association request, the key daemon process no longer obtains the security association through key exchange negotiation, but obtains it from the key database in the hardware security module and then sends it to the IPSec protocol stack.

6. According to claim 1, the communication link between the network cryptographic systems is protected by IPSec tunnel, and the network data inbound is characterized by When the protocol stack receives an IPSec message, it searches for a security association based on the destination address, protocol, and security parameter index in the message header. If not found, it requests a security association from the key daemon. The key daemon searches for the corresponding security association in the key database based on the destination address, protocol, and security parameter index, and then sends it to the IPSec protocol stack.

Images