Password synchronization method and system based on HDLC

Abstract

The invention relates to the technical field of information security, and discloses an HDLC (High-level Data Link Control)-based password synchronization method and system, and the method realizes password synchronization of a sender and a receiver based on a Gold code and an HDLC frame. The problem that reliable password synchronization is difficult to realize at low overhead in the prior art is solved.

Description

Technical Field

[0001] The invention relates to the technical field of information security, in particular to a password synchronization method and system based on HDLC. Background Art

[0002] The High Level Data Link Control (HDLC) protocol is widely used in various digital communication fields such as SDH systems and E1 trunk lines due to its simple encapsulation and good flow control and error detection capabilities. HDLC frame communication is a bit stream-oriented data link layer protocol with efficient processing, reliable transparent transmission and powerful error detection functions. It is also widely used in the field of satellite communications. The protocol uses 0x7E as the flag bit at the head and tail, and uses synchronous transmission based on the clock. When there is no valid data information to be transmitted, 0x7E is also used for bit filling to maintain synchronous transmission of the data link without the need for protocol reciprocating responses or special flow control between communication devices or functional modules.

[0003] In traditional encryption systems, in order to ensure the randomness of ciphertext during encryption and prevent key reuse, the cryptographic devices of both the sender and receiver usually require the communication system to allocate a certain link bandwidth for inserting cryptographic synchronization information, which usually includes frame synchronization words, random numbers as initial vectors, and other information. This type of information is added to the link protocol by the sender during encryption and sent in-band through the channel. After the receiver retrieves the frame synchronization word, it generates the same cryptographic synchronization data through the initial vector and other information, thereby achieving cryptographic synchronization between the sender and receiver.

[0004] In wireless communication systems with limited channel bandwidth and channel quality, such as satellite communication, the cryptographic synchronization method in traditional encryption systems has great limitations in such systems. The main limitations are: first, the stability of wireless communication channels is poor, and reliable transmission of all data cannot be guaranteed; second, in application scenarios based on HDLC frame communication, there may be full bandwidth operation of communication information. Due to the characteristics of synchronous transmission, there is no redundant length field for direct embedding of cryptographic synchronization overhead, which leads to synchronization difficulties. In particular, when multiple synchronizations are performed, a cumulative effect will occur, which will increase channel delays and handle buffer overflows. Summary of the invention

[0005] In order to overcome the deficiencies of the prior art, the present invention provides a password synchronization method and system based on HDLC, which solves the problems existing in the prior art such as difficulty in realizing reliable password synchronization with low overhead.

[0006] The technical solution adopted by the present invention to solve the above problems is:

[0007] The invention discloses a password synchronization method based on HDLC, which realizes the password synchronization between a sender and a receiver based on Gold code and HDLC frame.

[0008] As a preferred technical solution, the following steps are included:

[0009] S1, synchronization sequence construction: build the synchronization sequence of the communication link;

[0010] S2, synchronization sequence insertion: inserting a synchronization sequence in the communication link;

[0011] S3, synchronization sequence capture: The receiving end captures the synchronization sequence, realizes password synchronization, and completes data decryption;

[0012] S4, 7E flag interpolation and HDLC frame recovery: After the receiving end completes data decryption, it performs 7E flag interpolation and HDLC frame recovery before outputting the service plaintext data.

[0013] As a preferred technical solution, in step S1, two pseudo-random m-sequences are selected and bitwise XORed to obtain a Gold code, which is constructed as a synchronization sequence.

[0014] As a preferred technical solution, in step S2, the synchronization sequence is inserted in the following manner: when the link is initially established, an initial vector and a Gold code are inserted into the link; during the link maintenance phase, the Gold code is periodically and continuously inserted into the link as a synchronization sequence.

[0015] As a preferred technical solution, in step S2, when the link is initially established, the link is established in the following manner according to the moment when the link establishment information is received:

[0016] 1) If the received link establishment information is in the middle of the HDLC, the data is not cached, and the received data is directly replaced. The random number of the required bytes is inserted as the initial vector; the Gold code is inserted as the synchronization sequence, and the synchronization sequence is transmitted on the channel. The subsequent code stream information is encrypted and transmitted on the channel;

[0017] 2) If the link establishment information is received at the idle part between two HDLC frames, a random number of the required byte length is inserted in the frame gap as the initial vector; and the Gold code is inserted as the synchronization sequence. The data after the insertion position is not discarded, and encrypted transmission is performed following the synchronization sequence.

[0018] As a preferred technical solution, in step S2, during the link maintenance phase, the Gold code is periodically inserted as a synchronization sequence, and the m-byte ciphertext data at the end of the previous encryption cycle is intercepted as a new initial vector for the next synchronization; wherein m represents the byte length of the initial vector.

[0019] As a preferred technical solution, in step S2, during the link maintenance phase, the field length required for the synchronization sequence is dynamically adjusted by using a flag bit sliding extraction pool: the flag bit sliding extraction pool discards 7E data based on the synchronization sequence n-byte length; wherein n represents the synchronization sequence Gold code byte length, and 7E represents the HDLC inter-frame flag.

[0020] As a preferred technical solution, the 7E flag is discarded in the following manner according to the number of bytes of the 7E flag:

[0021] 1) If the number of 7E flag bytes is ≥ n+1, after the synchronization sequence is inserted once, n bytes of 7E flags are discarded continuously;

[0022] 2) If the number of 7E flag bytes is less than n+1, after the synchronization sequence is inserted once, the 7E flag is continuously extracted and discarded between subsequent HDLC frames to ensure that at least one byte of 7E flag is left between HDLC frames to indicate the HDLC frame interval.

[0023] As a preferred technical solution, in step S3, the receiving end implements Gold code discrimination and positioning, and intercepts the m-byte length ciphertext before the synchronization sequence as the initial vector of this password synchronization, implements password synchronization, and completes the decryption of the received data; wherein m represents the byte length of the initial vector;

[0024] In step S4, after the receiving end completes data decryption, before outputting the received service plaintext data, the 7E flag bit is interpolated and the HDLC frame is restored. The HDLC frame is restored in the following manner:

[0025] 1) If the data after the Gold code synchronization sequence is still 7E, the synchronization sequence is directly discarded and 7E with a length of n bytes is backfilled at one time; where n represents the synchronization sequence Gold code byte length and 7E represents the HDLC inter-frame flag bit;

[0026] 2) If the data after the Gold code synchronization sequence is not 7E, the synchronization sequence is directly discarded, and a 7E flag bit with a length of 1 byte is first inserted at the original synchronization sequence position; and, the next HDLC frame interval is detected in the subsequent plaintext data. If the number of 7E flag bytes in the next frame interval is greater than 1, the 7E with a length of n-1 bytes is directly backfilled in the next frame interval to end the flag bit insertion; if the number of 7E flag bytes in the next frame interval is 1, a 7E flag bit with a length of 1 byte is inserted in the next frame interval, and the number of 7E flag bytes in the subsequent HDLC frame intervals is determined in turn, until the backfilling and interpolation of the 7E flag bit with a length of n bytes is completed, and the original HDLC frame data is restored.

[0027] A password synchronization system based on HDLC, used to implement the password synchronization method based on HDLC, comprises the following modules connected in sequence:

[0028] Synchronous sequence building module: used to build the synchronous sequence of the communication link;

[0029] Synchronous sequence insertion module: used to insert a synchronous sequence into the communication link;

[0030] Synchronous sequence capture module: used for the receiving end to capture the synchronous sequence, realize password synchronization, and complete data decryption;

[0031] 7E flag interpolation and HDLC frame recovery module: used to interpolate the 7E flag and recover the HDLC frame after the receiving end completes data decryption and before outputting the service plaintext data.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] (1) Improving the probability of password synchronization: The present invention uses the Gold code constructed by bitwise XOR of two M sequences as the synchronization sequence, which has the pseudo-random characteristics of white noise. Combined with the setting of the decision threshold at the receiving end, the probability of password synchronization can be further improved;

[0034] (2) Zero overhead in communication channels: HDLC-side flag bits are extracted and inserted to replace synchronization sequences. The ciphertext at the end of the previous frame is used as the initial vector of the next frame. This allows HDLC frame communication to not increase system channel bandwidth, maintain link synchronization timing integrity, and achieve zero-overhead cryptographic synchronization. This provides confidentiality services to the communication system without affecting the existing communication system, thus improving security efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a principle block diagram of the present invention;

[0036] Figure 2 Insert a schematic diagram of the synchronization sequence for initial synchronization of link establishment;

[0037] Figure 3 Insert diagram for synchronization sequence of multiple synchronizations. DETAILED DESCRIPTION

[0038] The present invention will be further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0039] Example 1

[0040] like Figures 1 to 3As shown, the present invention proposes a zero-overhead cryptographic synchronization method based on HDLC frame communication, which improves the efficiency of secure communication in a channel-constrained system and increases the probability of cryptographic synchronization.

[0041] Traditional encryption systems generally use the communication system to provide additional cryptographic synchronization field overhead to achieve cryptographic synchronization between the communicating parties. The present invention selects Gold codes with good correlation to build frame synchronization and uses the HDLC flag bit sliding extraction and interpolation method to achieve zero-overhead cryptographic synchronization without increasing the channel bandwidth of the communication system during confidential communication. This increases the probability of cryptographic synchronization while reducing the impact of encryption on the communication system and improving the efficiency of confidential communication.

[0042] The scheme of the present invention is applicable to a satellite communication private network based on HDLC frame communication. The communication system usually works in an FDMA technical system. At the beginning of a mission, a communication link between the two parties is established under the dynamic channel control of a network control center. The sending and receiving parties exclusively occupy the channel to carry out business communications. The link layer is a HDLC frame format in which the clock continuously works at the channel code rate.

[0043] like Figure 1 As shown, a more specific scheme includes the following steps:

[0044] (1) Synchronous sequence construction

[0045] Since the link clock works all the time in HDLC frame communication and there is no reserved confidential synchronization field in the frame information, it is impossible to directly determine the starting position of data encryption through the frame boundary, and a dedicated synchronization sequence needs to be constructed. Since the synchronization sequence is transmitted in plain text, for wireless communication links such as satellite communications, the synchronization sequence must have a certain pseudo-randomness, and the signal characteristics are close to the channel white noise, and it must have good autocorrelation. Using a pseudo-random m sequence as a synchronization sequence is one of the options. However, the number of m sequences is limited, and the mutual correlation is relatively weak. In an open wireless channel, there is a possibility of interference, which leads to a decrease in the probability of receiving restoration. Therefore, in this scheme, two pseudo-random m sequences are selected to obtain the Gold code by bitwise XOR, and constructed as a synchronization sequence. On the premise of maintaining the autocorrelation of the m sequence, the Gold code has excellent orthogonal cross-correlation characteristics and relatively strong anti-interference ability.

[0046] (2) Synchronous sequence insertion

[0047] According to the characteristics of satellite communication network link establishment for HDLC frame communication, full-time full-duplex synchronous data communication is maintained as long as the link is not disconnected after the link is established. The information rate is equal to the channel bit rate. When there is no business data input, the 7E flag bit is filled in the link to maintain the integrity of the channel data transmission. There are two main situations for the insertion of synchronization sequences for cryptographic synchronization:

[0048] First, when the link is initially established, an initial vector and a synchronization sequence are inserted into the link.

[0049] When the link is initially established, since the communication system notifies the cryptographic device of the link establishment at a random time, the time when the cryptographic device starts to receive the link plaintext data is also random, which may be in the middle of an HDLC or in the idle part between two consecutive HDLCs.

[0050] 1) If the link establishment information is received at the middle of the HDLC frame, the receiver cannot restore the incomplete HDLC frame, so the data is not cached, and the received data is directly replaced. A random number of the required byte length is inserted as the initial vector, and then the Gold code is inserted as the synchronization sequence. The synchronization sequence is transmitted on the channel, and the subsequent code stream information is encrypted and transmitted on the channel. Figure 2 shown.

[0051] 2) If the link establishment information is received at the idle part between two HDLC frames, a random number of the required byte length is inserted as the initial vector in the interframe gap, and a Gold code is inserted as the synchronization sequence. The data after the insertion position is not discarded, and encrypted transmission is performed immediately after the synchronization sequence. This is followed by processing delays, such as Figure 2 As shown in the figure, taking 128-bit synchronization information as an example, at a 2048kbps channel rate, the processing delay will increase by 62.5us. The number of bytes required to insert the synchronization sequence is extracted by the flag bit sliding extraction pool to extract the 7E flag bit in the HDLC frame, and the size of the service plaintext data input buffer is dynamically adjusted, which can not only maintain the continuity of the output buffer ciphertext data, but also obtain the transmission bandwidth required for the initial synchronization of the link establishment.

[0052] Second, during the link maintenance phase, synchronization sequences are inserted into the link periodically and continuously.

[0053] like Figure 3 As shown, the link maintenance phase uses a continuous synchronization method, uses the inter-frame flag bit to insert the synchronization sequence, and uses timed multiple synchronizations.

[0054] The relevant symbols are defined as follows:

[0055] T0: The time when the communication system notifies the cryptographic device of the start of link establishment;

[0056] t: synchronization time interval, such as 1 second. Since the effective data moment of the HDLC frame may occur after t seconds, the interval t represents an approximate value. In actual processing, the synchronization sequence needs to be inserted when the HDLC frame gap appears for the first time after t seconds.

[0057] m: initial vector byte length, such as 8 bytes or 16 bytes;

[0058] n: synchronization sequence Gold code byte length, such as 8 bytes can represent a 63-bit code sequence;

[0059] c: The cth synchronization during the link maintenance phase.

[0060] The continuous synchronization sequence insertion in the link maintenance phase is similar to the insertion of the synchronization sequence in the frame gap during the initial link establishment. The difference is that in the link maintenance phase, only the Gold code needs to be inserted as the synchronization sequence at a fixed time, and there is no need to insert a random number as the initial vector. Instead, the m-byte ciphertext data at the end of the previous encryption cycle is intercepted as the new initial vector for the next synchronization, reducing the timing adjustment of HDLC frame communication and simplifying internal processing.

[0061] The 7E flag bit sliding extraction pool is used to dynamically adjust the field length required for the synchronization sequence. Since the synchronization sequence is inserted after the HDLC frame positioning detects two 7E flag bits, it is necessary to ensure that there is at least one 7E flag bit in the HDLC frame interval where the synchronization sequence is inserted. The decryption end restores and inserts a 7E flag bit to meet the implementation requirement that the HDLC frame recovery module must have 7E at the beginning and end. The flag bit sliding extraction pool discards the 7E data according to the n-byte length of the synchronization sequence to ensure that the insertion of the synchronization sequence does not introduce new overhead to the communication link. According to the number of 7E flag bit bytes between HDLC frames, the 7E flag bit is discarded in two cases:

[0062] 1) When the number of 7E flag bytes contained in the HDLC frame is greater than or equal to n+1

[0063] When the number of 7E flag bytes between HDLC frames at the synchronization sequence insertion position is greater than or equal to n+1, after the synchronization sequence is inserted once, n bytes of 7E flag bits can be discarded continuously.

[0064] 2) When the number of 7E flag bytes contained in the HDLC frame is less than n+1

[0065] When the number of 7E flag bytes between HDLC frames at the synchronization sequence insertion position is less than n+1, after the synchronization sequence is inserted once, the 7E flags of n bytes cannot be discarded continuously. It is necessary to continue to extract and discard the 7E flags between subsequent HDLC frames to ensure that at least one 7E flag is left between HDLC data to indicate the HDLC frame interval. In extreme cases, when the link is transmitting at full bandwidth, the minimum length of the 7E flag between frames is 2 bytes, so only 1 byte of 7E can be extracted in each frame interval, and n HDLC frames need to be transmitted to complete the 7E flag discard and replacement after the synchronization sequence is inserted.

[0066] (3) Synchronous sequence capture

[0067] At the receiving end, the synchronization sequence capture module realizes the identification and positioning of the specific Gold code through correlation detection and search, and intercepts the m-byte length ciphertext before the synchronization sequence as the initial vector of this password synchronization, realizes password synchronization, and completes the decryption of the received data. When the 63-bit-long Gold code is used, the correlation judgment threshold is set to 60, which can achieve 3-bit error correction. When the channel bit error rate is 1×10 -7 When , the password synchronization probability can reach 99.999%, improving the password synchronization probability.

[0068] (4) 7E flag interpolation and HDLC frame recovery

[0069] After the receiving end completes data decryption, before outputting the received service plaintext data, the HDLC frame recovery module needs to perform 7E flag interpolation and HDLC frame recovery. According to the number of bytes of the 7E flag between HDLC frames and the principle of discarding the 7E flag at the sender, the HDLC frame recovery is completed in the following two cases.

[0070] 1) If the data after the Gold code synchronization sequence is still 7E, it means that the sender has replaced the 7E flag with the synchronization sequence once. The module on the receiving end can directly discard the synchronization sequence and fill in the 7E flag with a length of n bytes at one time.

[0071] 2) When the data after the Gold code synchronization sequence is not 7E, it means that the sender still extracts and discards the 7E flag in the subsequent HDLC frame. The module at the receiving end can directly discard the synchronization sequence and first insert a 1-byte 7E flag at the original synchronization sequence position; and, detect the next HDLC frame interval in the subsequent plaintext data. If the number of 7E flag bytes in the next frame interval is greater than 1, directly backfill n-1 bytes of 7E in the next frame interval to end the flag insertion; if the number of 7E flag bytes in the next frame interval is equal to 1, it is necessary to insert a 1-byte 7E flag in the next frame interval, and so on, and successively determine the number of 7E flag bytes in the subsequent HDLC frame intervals until the 7E flag backfilling and insertion of n bytes is completed, and the original HDLC frame data is restored, the receiving end timing is kept intact, the link is smooth, and there will be no abnormal conditions such as empty or overflow of the input and output buffers, effectively ensuring the smoothness of the communication link.

[0072] According to the characteristic that the original HDLC frame header and frame tail form at least two 7E flag bits when HDLC is at full bandwidth, combined with the principle of frame interval 7E flag bit extraction and discarding and synchronization sequence insertion at the sending end, and the principle of high-reliability synchronization sequence detection and HDLC frame recovery at the receiving end, zero-overhead cryptographic synchronization processing of HDLC frame communication under full bandwidth can be achieved.

[0073] The present invention has the following advantages:

[0074] (1) Improving the probability of password synchronization: The present invention uses the Gold code constructed by bitwise XOR of two M sequences as the synchronization sequence, which has the pseudo-random characteristics of white noise. Combined with the setting of the decision threshold at the receiving end, the probability of password synchronization can be further improved;

[0075] (2) Zero overhead in communication channels: HDLC-side flag bits are extracted and inserted to replace synchronization sequences. The ciphertext at the end of the previous frame is used as the initial vector of the next frame. This allows HDLC frame communication to not increase system channel bandwidth, maintain link synchronization timing integrity, and achieve zero-overhead cryptographic synchronization. This provides confidentiality services to the communication system without affecting the existing communication system, thus improving security efficiency.

[0076] As described above, the present invention can be preferably implemented.

[0077] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0078] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. According to the technical essence of the present invention, within the spirit and principles of the present invention, any simple modification, equivalent replacement and improvement made to the above embodiment still falls within the protection scope of the technical solution of the present invention.

Claims

1. A password synchronization method based on HDLC, characterized in that: Cryptographic synchronization between the sender and the receiver is achieved based on Gold code and HDLC frame.

2. A password synchronization method based on HDLC according to claim 1, characterized in that: The following steps are involved: S1, synchronization sequence construction: build the synchronization sequence of the communication link; S2, synchronization sequence insertion: inserting a synchronization sequence in the communication link; S3, synchronization sequence capture: The receiving end captures the synchronization sequence, realizes password synchronization, and completes data decryption; S4, 7E flag interpolation and HDLC frame recovery: After the receiving end completes data decryption, it performs 7E flag interpolation and HDLC frame recovery before outputting the service plaintext data.

3. A password synchronization method based on HDLC according to claim 1, characterized in that: In step S1, two pseudo-random m sequences are selected and bitwise XORed to obtain a Gold code, which is constructed as a synchronization sequence.

4. A password synchronization method based on HDLC according to claim 3, characterized in that: In step S2, the synchronization sequence is inserted in the following manner: when the link is initially established, an initial vector and a Gold code are inserted into the link; during the link maintenance phase, the Gold code is inserted into the link periodically and continuously as a synchronization sequence.

5. A password synchronization method based on HDLC according to claim 4, characterized in that: In step S2, when the link is initially established, the link is established in the following manner according to the time when the link establishment information is received: 1) If the link establishment information received is in the middle of the HDLC, data caching is not performed, and the received data is directly replaced, and a random number of the required byte length is inserted as the initial vector; the Gold code is inserted as the synchronization sequence, and the synchronization sequence is transmitted on the channel, and the subsequent code stream information is encrypted and transmitted on the channel; 2) If the link establishment information is received at the idle part between two HDLC frames, a random number of the required byte length is inserted in the frame gap as the initial vector; and the Gold code is inserted as the synchronization sequence. The data after the insertion position is not discarded, and encrypted transmission is performed following the synchronization sequence.

6. A password synchronization method based on HDLC according to claim 4, characterized in that: In step S2, during the link maintenance phase, the Gold code is periodically inserted as a synchronization sequence, and the m-byte ciphertext data at the end of the previous encryption cycle is intercepted as a new initial vector for the next synchronization; wherein m represents the byte length of the initial vector.

7. A password synchronization method based on HDLC according to claim 6, characterized in that: In step S2, during the link maintenance phase, the byte length required for the synchronization sequence is dynamically adjusted by using a flag bit sliding extraction pool: the flag bit sliding extraction pool discards 7E data based on the n-byte length of the synchronization sequence; wherein n represents the byte length of the synchronization sequence Gold code, and 7E represents the HDLC inter-frame flag.

8. A password synchronization method based on HDLC according to claim 7, characterized in that: The 7E flag is discarded in the following way according to the number of 7E flag bytes: 1) If the number of 7E flag bytes is ≥ n+1, after the synchronization sequence is inserted once, n bytes of 7E flags are discarded continuously; 2) If the number of 7E flag bytes is less than n+1, after the synchronization sequence is inserted once, the 7E flag is continuously extracted and discarded between subsequent HDLC frames to ensure that at least 1 byte of 7E flag is left between HDLC frames to indicate the HDLC frame interval.

9. A password synchronization method based on HDLC according to any one of claims 2 to 8, characterized in that: In step S3, the receiving end implements Gold code identification and positioning, and intercepts the m-byte length ciphertext before the synchronization sequence as the initial vector of this password synchronization, implements password synchronization, and completes the decryption of the received data; where m represents the byte length of the initial vector; In step S4, after the receiving end completes data decryption, before outputting the received service plaintext data, the 7E flag bit is interpolated and the HDLC frame is restored. The HDLC frame is restored in the following manner: 1) If the data after the Gold code synchronization sequence is still 7E, the synchronization sequence is directly discarded and 7E with a length of n bytes is backfilled at one time; where n represents the byte length of the synchronization sequence Gold code, and 7E represents the HDLC inter-frame flag bit; 2) If the data after the Gold code synchronization sequence is not 7E, the synchronization sequence is directly discarded, and a 7E flag bit with a length of 1 byte is first inserted at the original synchronization sequence position; and, the next HDLC frame interval is detected in the subsequent plaintext data. If the number of 7E flag bytes in the next frame interval is greater than 1, the 7E with a length of n-1 bytes is directly backfilled in the next frame interval to end the flag bit insertion; if the number of 7E flag bytes in the next frame interval is 1, a 7E flag bit with a length of 1 byte is inserted in the next frame interval, and the number of 7E flag bytes in the subsequent HDLC frame intervals is determined in turn, until the backfilling and interpolation of the 7E flag bit with a length of n bytes is completed, and the original HDLC frame data is restored.

10. A cryptographic synchronization system based on HDLC, characterized in that: A HDLC-based password synchronization method for implementing any one of claims 1 to 9, comprising the following modules connected in sequence: Synchronous sequence building module: used to build the synchronous sequence of the communication link; Synchronous sequence insertion module: used to insert a synchronous sequence into the communication link; Synchronous sequence capture module: used for the receiving end to capture the synchronous sequence, realize password synchronization, and complete data decryption; 7E flag interpolation and HDLC frame recovery module: used to interpolate the 7E flag and recover the HDLC frame after the receiving end completes data decryption and before outputting the service plaintext data.

Images