Communication encryption device, method and system

Abstract

The invention discloses a communication encryption device, method and system, and belongs to the field of communication transmission security. A black box is added between a terminal and a channel, and encryption processing is performed on communication data, so that the security is enhanced. In specific operation of the black box, two working modes are set: a transparent transmission mode, namely, the black box directly forwards data without any processing; and in the encryption mode, the black box encrypts the received data and forwards the encrypted data. And the two modes can be switched at any time. In the encryption process, an RSA public key encryption algorithm, an AES algorithm, a sha256 algorithm and an MD5 algorithm are adopted to encrypt and process communication data, the data are compared again in the decryption process, the legality of the data is finally determined, and encryption protection of the communication data is completed.

Description

Technical Field

[0001] The present invention relates to the field of communication transmission security, and particularly to a communication encryption device, method, and system. Background Art

[0002] In the current era of rapid development of digital information, communication security has increasingly attracted people's high attention, and communication encryption is one of the key means to ensure communication security. Generally speaking, communication encryption methods can be mainly divided into two types: channel encryption and source encryption. In actual application scenarios, the channel encryption method is usually widely adopted. However, channel encryption is not perfect, and it has some obvious problems. First, in terms of controllability, there are uncontrollable factors. Take the extremely frequently used telephone communication in our daily life as an example. When we transmit information through the phone, the entire communication process often depends on the communication network and related facilities built by the telephone service provider. For ordinary users, it is simply impossible to control the encryption method adopted by the telephone provider, and even the basic situation of whether they encrypt our call content is unknown. Second, in terms of security, channel encryption also faces many risks. During the transmission of communication data, communication information needs to be transferred and transmitted through various switching devices, and these switching devices may become potential risk points for information leakage. Some lawbreakers or hackers may take advantage of certain security vulnerabilities in the switching devices to eavesdrop on the communication data being transmitted, thereby stealing important information. Moreover, hackers may also launch targeted attacks, attempting to break through the defense line of channel encryption and obtain communication content, which undoubtedly poses a great threat to communication security. Summary of the Invention

[0003] The purpose of the present invention is to overcome one or more deficiencies of the prior art and provide a communication encryption device, method, and system.

[0004] The purpose of the present invention is achieved through the following technical solutions: A communication encryption device, the device includes: a terminal, a black box, and a channel; The black box is arranged between the terminal and the channel, connecting the terminal and the channel. Each device includes at least two terminals, a black box, and a terminal. The black box is provided with a key for encrypting data.

[0005] A communication encryption method, the method includes: Set a pair of RSA keys in communication. When distributing the secret key, form a group of at least two or more black boxes. The public keys in all black boxes in each group are saved in all black boxes in the group in sequence. The working modes during the encryption process include: pass-through mode and encryption mode, and the two working modes can be switched at any time. Communicate data by encrypting and decrypting the key. Pass-through mode: Forward data directly. Encryption mode: Encrypt the received data and then forward it.

[0006] Further, in the encryption mode, the specific steps are as follows: Generate a random work_key; that is, a 16-byte work_key. Calculate the hash value of the sender's public key through the MD5 algorithm. Use this group of public keys as the key, and then encrypt the work_key through the ECB mode of the AES128 algorithm to obtain the ciphered_work_key. Encrypt the received data through the CTR mode of the AES128 algorithm with the work_key to obtain the payload; that is, the effective payload, which is the data after encrypting the original data packet. Encrypt the current time data through the AES128 algorithm with the work_key to obtain the time_stamp. Calculate the sha_digest through the sha256 algorithm for the ciphered_work_key, payload, and time_stamp. Pack all the data obtained above into a data packet according to the message structure and send it to the receiver.

[0007] Further, in the point-to-point message sending mode, after encrypting the work_key through the ECB mode of the AES128 algorithm, encrypt it with the receiver's public key to obtain the encrypted work_key.

[0008] Further, after the receiver receives the data packet, check the first four bytes of the data. If they are "AABB", decrypt it through the following steps: Calculate the sha_digest through the sha256 algorithm for the ciphered_work_key, payload, and time_stamp, and compare it with the last 32 bytes of the received data packet. If they match, the data packet is complete; otherwise, the integrity is incorrect, and discard the data packet. Find the sender's public key and decrypt the ciphered_work_key through the MD5 algorithm and the AES128 algorithm to obtain the work_key. Using work_key as the key, decrypt the time_stamp to obtain the sending time. Compare it with the current time. If the error is within 1 second, it is legal data; otherwise, it is illegal data and will be discarded. This is used to prevent hackers from recording previous legal data and resending it for attacks.

[0009] Furthermore, during the decryption process in the point-to-point message sending mode, decrypt the ciphered_work_key with the private key of the receiving party to obtain the work_key.

[0010] A communication encryption system uses the above-mentioned communication encryption method to encrypt communication data and improve security.

[0011] The beneficial effects of the present invention are: (1) The black box is small in volume and weight, and has low power consumption, and can be embedded in devices such as telephones and the Internet of Things; (2) It has a wide range of applications and can be used in digital telephones, walkie-talkies, the Internet of Things, drones, etc. that require digital communication, whether it is voice, video, text, or other digital information; (3) Through a reliable encryption strategy, it can effectively resist eavesdropping; the public key of the sending end is carried in the sent message, and the public key is pre-stored in each black box and is not truly public, so identity impersonation can be effectively avoided; the message carries a time stamp, which can effectively resist replay attacks. Brief Description of the Drawings

[0012] Figure 1 It is a simple communication channel composition diagram; Figure 2 It is a schematic diagram of the communication channel structure with a black box added. Detailed Embodiments

[0013] Next, the technical solutions of the present invention will be clearly and completely described in conjunction with the embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts fall within the protection scope of the present invention.

[0014] Refer to Figure 1 , a simple communication includes a communication channel and terminals at both ends of the channel, namely the sending party and the receiving party, and the channel transmits data.

[0015] Refer to Figure 2 , a communication encryption device is provided. A black box is added between the terminal and the channel, and the black box encrypts the data in the channel to improve the security of communication.

[0016] In the black box, a communication encryption method is provided. A pair of RSA keys is set up during communication. When distributing the secret keys, at least two or more black boxes are grouped together. The public keys in all the black boxes in each group are stored in all the black boxes in the group in sequence. The working modes during the encryption process include: pass-through mode and encryption mode. Pass-through mode: directly forward the data; Encryption mode: encrypt the received data and then forward it. The two working modes can be switched at any time; data communication is carried out by encrypting and decrypting the keys. Embodiment

[0017] A communication encryption device includes a terminal device and a channel. A black box module is added between the terminal and the channel for encryption processing, improving the security of communication.

[0018] The black box module internally uses an RSA key pair for encryption and decryption. In terms of key distribution and management, the black boxes are organized into multiple groups, and all the black boxes in each group save the public keys of other black boxes. This group key management method increases flexibility and scalability.

[0019] The black box module has two working modes: Pass-through mode: directly forward the received data without any encryption processing.

[0020] Encryption mode: encrypt the received data using the RSA algorithm and then forward it.

[0021] The two working modes can be switched at any time and dynamically selected according to actual needs.

[0022] The internal hardware of the black box module includes a single-chip microcomputer, memory, and Flash. The single-chip microcomputer is responsible for controlling the entire encryption process, the memory is used for temporarily storing data, and the Flash is used for storing key information such as RSA keys.

[0023] The specific working process is as follows: The terminal device sends the plaintext data to the black box module.

[0024] The black box module checks the current working mode. If it is the encryption mode, it uses the saved public key to perform RSA encryption on the data.

[0025] The data after encryption or pass-through processing is sent to the channel for transmission.

[0026] After the black box module at the receiving end receives the data, if it is the encryption mode, it uses its own private key to perform RSA decryption on the data.

[0027] The decrypted plaintext data is forwarded to the terminal device.

[0028] With this design, the encryption function can be added to the communication link without modifying the terminal device, improving the security of the entire system. The group key management method also increases flexibility and scalability. Embodiment

[0029] During the communication sending process: If it is a transparent transmission message, it is directly forwarded through the transparent transmission mode; otherwise: 1. Generate a random encryption key, that is, a 16-byte work_key; 2. Encrypt work_key: 1) For group messages, calculate the hash value of the sender's public key using the MD5 algorithm, and then use this set of hash values as the key to encrypt work_key using the AES128 algorithm in ECB mode to obtain ciphered_work_key; 2) For point-to-point messages, follow the steps below: I. Calculate the hash value of the sender's public key using the MD5 algorithm; II. Use the hash value obtained in the previous step as the key to encrypt work_key using the AES128 algorithm in ECB mode; III. Encrypt the result of the previous step using the receiver's public key to obtain ciphered_work_key; 3. Use work_key as the key to encrypt the received data using the AES128 algorithm in CTR mode to obtain payload; 4. Obtain the current time, and use work_key as the key to encrypt the current time data using the AES128 algorithm to obtain the time stamp time_stamp; 5. Use the sha256 algorithm to calculate sha_digest for ciphered_work_key, payload, and time_stamp; 6. Use the data obtained previously to pack according to the message structure to obtain the final data packet and send it to the receiver.

[0030] During the communication receiving process: After receiving the data packet, first check whether the first four bytes are "AABB". If not, it is plaintext; If the first four bytes are "AABB", then this data packet is an encrypted data packet and is processed according to the following steps: 1. Verify data integrity: Use the sha256 algorithm to calculate sha_digest for ciphered_work_key, payload, and time_stamp, and then compare it with the last 32 bytes of the received data packet. If they match, the data packet is complete; if the data integrity is incorrect, discard this set of data; 2. Decrypt the work_key: For group messages, find the public key of the sender, calculate the hash value using the MD5 algorithm, and then use this hash value as the key to decrypt the ciphered_work_key with AES128 in ECB mode to obtain the work_key; For point-to-point messages: First, decrypt the ciphered_work_key with the recipient's private key; Second, calculate the hash value of the sender's public key using the MD5 algorithm; Third, use the hash value obtained in the second step as the key to decrypt the result of the first step with the AES128 algorithm in ECB mode to obtain the work_key; 3. Use the work_key as the key to decrypt the time_stamp with the AES128 algorithm to obtain the sending time. Compare it with the current time. If the error is within 1 second, it is legal data; otherwise, discard it to prevent hackers from recording previous legal data and resending for attacks; 4. Use the work_key as the key to decrypt the payload with the AES128 algorithm in CTR mode to obtain the correct plaintext, completing a full communication. Embodiment

[0031] Perform the next step of data decryption by matching bytes; The following is the code for the decryption process: Typedef struct Message { unsigned char StartSign[4]; / / ”AABB” unsigned char type; unsigned int length; unsigned int id; unsigned int ciphered_work_key_length; unsigned char ciphered_work_key[ciphered_work_key_length]; unsigned int payload_length; unsigned char payload[payload_length]; unsigned int time_stamp_length; unsigned char time_stamp[time_stamp_length]; unsigned char sha_digest

[32] ; } Among them, StartSign is the start flag of the data packet. If the first 4 bytes of the data packet are not "AABB", it is not an encrypted data packet and is directly forwarded; if it is "AABB", it is parsed according to the data structure. If the parsing is successful, the payload (the original data) is forwarded, otherwise it is directly forwarded; type is the message type and mainly has two types. When the value is 0, it is a point-to-point message, that is, a message sent from one terminal to a specific terminal in the group; when the value is 1, it is a group message, that is, a message sent to all members of the group; Length is the length of the data packet, that is, the number of bytes of the message; id is the serial number of the terminal sending the message, and the receiving party can find the public key of the sending party according to id; ciphered_work_key is the encrypted encryption key data; ciphered_work_key_length is the length of the encrypted payload encryption key data; payload is the payload, that is, the data after the original data packet is encrypted, using the encryption key randomly generated by the sending party, and the encryption algorithm is AES128, CTR mode; payload_length is the payload length; time_stamp is the encrypted timestamp data, and time_stamp_length is the length of the encrypted timestamp data; sha_digest is the hash value calculated by the sha256 algorithm for all the previous data, which is used to ensure data integrity.

[0032] It has a small volume and weight, low power consumption, and can be embedded in devices such as telephones and the Internet of Things; Moreover, it has a wide range of applications. In digital telephones, walkie-talkies, the Internet of Things, drones, etc. that require digital communication, whether it is voice, video, text, or other digital information, it can be used; Using a reliable encryption strategy can effectively resist eavesdropping; the public key of the sending end is carried in the sent message, and the public key is pre-stored in each black box and is not really public, so identity impersonation can be effectively avoided; the message carries a timestamp, which can effectively resist replay attacks and provide protection for the encrypted communication of information.

[0033] The above are only the preferred embodiments of the present invention. It should be understood that the present invention is not limited to the form disclosed herein, should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and can be changed within the scope of the concept described herein through the above teachings or the technology or knowledge in related fields. And the changes and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should all be within the protection scope of the appended claims of the present invention.

Claims

1. A communication encryption device, characterized in that: The device comprises: a terminal, a black box and a channel; The black box is arranged between the terminal and the channel to connect the terminal and the channel. Each device includes at least two terminals, a black box and a terminal. The black box is provided with a key for encrypting data.

2. A communication encryption method, characterized in that: The method comprises: A pair of RSA keys is set in the communication. When distributing secret keys, all public keys in each group are saved in the group in order. The working modes in the encryption process include: transparent transmission mode and encryption mode, and the two working modes can be switched at any time. Data communication is carried out by encrypting and decrypting the keys. Transparent transmission mode: forward data directly; Encryption mode: The received data is encrypted before forwarding.

3. A communication encryption method according to claim 2, characterized in that: In the encryption mode, the specific steps are: Generate a random work_key; Calculate the hash value of the sender's public key through the MD5 algorithm, use this set of public keys as the key, and then encrypt work_key through the ECB mode of the AES128 algorithm to obtain ciphered_work_key; Encrypt the received data with work_key in CTR mode of AES128 algorithm to get payload; encrypt the current time data with work_key in CTR mode of AES128 algorithm to get time_stamp; Calculate ciphered_work_key, payload and time_stamp using the sha256 algorithm to get sha_digest; All the data obtained above are packaged into data packets according to the message structure and sent to the receiver.

4. A communication encryption method according to claim 3, characterized in that: In the point-to-point message sending mode, after encrypting work_key in the ECB mode of the AES128 algorithm, it is encrypted with the recipient's public key to obtain the encrypted work_key.

5. A communication encryption method according to claim 2, characterized in that: After the receiver receives the data packet, it checks the first four bytes of the data. If they are "AABB", it decrypts them through the following steps: The sha_digest is calculated by the sha256 algorithm for the ciphered_work_key, payload, and time_stamp, and compared with the bytes of the received data packet. If they match, the data packet is complete. Otherwise, the integrity is wrong and the data packet is discarded. Find the sender's public key, decrypt ciphered_work_key using MD5 and AES128 algorithms, and obtain work_key; Use work_key as the key to decrypt time_stamp and get the sending time. Compare it with the current time. If the error is within 1 second, it is legal data. Otherwise, it is illegal data and will be discarded.

6. A communication encryption method according to claim 5, characterized in that: In the decryption process of point-to-point message sending mode, the ciphered_work_key is decrypted by the recipient's private key to obtain the work_key.

7. A communication encryption system, characterized in that: The system is used to execute a communication encryption method described in claims 2 to 6, and is used to encrypt communication data.

Images