A micro-service communication encryption method based on lightweight cipher PRESENT
By using the lightweight cryptographic algorithm PRESENT for encryption in a microservice architecture, the problems of high computational complexity and high resource consumption of traditional encryption schemes are solved, and efficient and secure data transmission is achieved in microservice communication.
Patent Information
- Application Number
- CN202510369692.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-27
- Publication Date
- 2025-12-16
- Estimated Expiration
- 2045-03-27
AI Technical Summary
In existing technologies, traditional encryption schemes have high computational complexity and high resource consumption in microservice architectures, making it difficult to meet the needs of high-frequency, low-latency communication, resulting in problems such as service response delays and resource contention.
The lightweight cryptographic algorithm PRESENT is used to encrypt microservice communication. Through the collaborative work of the client, message queue module, Docker encryption microserver module and Docker decryption microserver module, multi-round iterative encryption and decryption are achieved. The round function and key expansion algorithm of the PRESENT algorithm are used to ensure secure data transmission.
While ensuring data transmission security, it reduces computational overhead and resource consumption, meets the performance and resource requirements of microservice architecture, and is suitable for resource-constrained environments.
Smart Images
Figure CN120238286B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of microservice communication security, and in particular to a microservice communication encryption method based on the lightweight cipher PRESENT. Background Technology
[0002] With the rapid development of cloud computing and containerization technologies, microservice architecture, with its high cohesion, low coupling, and dynamic scalability, has become the mainstream development model for distributed systems. In a microservice architecture, service modules are typically deployed as lightweight Docker containers, using virtualization technology to achieve resource isolation and rapid orchestration. However, communication between microservices relies on network interface calls. In a containerized environment, cross-node and cross-cluster communication links may be exposed to internal or public networks, leading to security risks such as eavesdropping, tampering, and replay attacks on sensitive data.
[0003] While traditional encryption schemes (such as AES and SM4) offer high security, their high computational complexity and resource consumption make them unsuitable for the high-frequency, low-latency communication needs of microservice architectures, potentially leading to issues such as service response delays and container resource contention. Summary of the Invention
[0004] The purpose of this invention is to provide a microservice communication encryption method based on the lightweight password PRESENT, which can ensure data transmission security while meeting the performance and resource consumption requirements of the microservice architecture.
[0005] To achieve the above objectives, this invention provides a microservice communication encryption method based on the lightweight cryptographic PRESENT, comprising the following steps:
[0006] S1. The client module receives plaintext data (including text, file or message content) input by the user, forms encrypted or decrypted data, and sends an encryption or decryption request to the message queue module. The request information contains plaintext or ciphertext data to be processed.
[0007] S2, the message queue module responds to the sent encryption or decryption request information and forwards the encryption or decryption request information to the Docker encryption microserver module or the Docker decryption microserver module;
[0008] S3, after the Docker encryption micro-server module receives the encryption request forwarded by the message queue module, performs the encryption operation, uses the round function of the PRESENT algorithm to perform multiple rounds of iteration to obtain the corresponding ciphertext, and transmits the encrypted ciphertext to the message queue module.
[0009] S4. After the Docker decryption microserver module receives the decryption request forwarded by the message queue module, it performs the decryption operation, recovers the initial plaintext message through the PRESENT algorithm, and transmits the initial plaintext message to the message queue module.
[0010] S5. The result processing module receives the ciphertext or plaintext transmitted by the message queue module and then returns it to the client module to complete the feedback of the result message, forming a communication closed loop.
[0011] Preferably, the message queue module adopts a dual-queue mechanism to implement task scheduling. Encryption requests and decryption requests are respectively entered into the instruction queue list for classification and processing. When an encryption request is detected, the plaintext data is forwarded to the Docker encryption microserver module, and an encrypted data identifier is created and added to the data queue list. When a decryption request is triggered, the corresponding ciphertext data is automatically matched according to the data identifier and transmitted to the Docker decryption microserver module.
[0012] Preferably, the encryption process of the Docker encrypted microserver module specifically includes:
[0013] S31, the Docker encrypted micro-server module obtains the encrypted request forwarded by the message queue module and reads the plaintext data;
[0014] S32. Generate a round key, perform multiple rounds of iteration on each plaintext data, and use the corresponding round key in each round;
[0015] S33. After all rounds are completed, perform a whitening key operation to obtain the final ciphertext;
[0016] S34. Return the encrypted data to the message queue module.
[0017] Preferably, each round function in step S32 includes round key addition, S-box substitution, and P-permutation, and is iterated 31 times in total, specifically as follows:
[0018] Round key addition: At the start of each round of encryption, the plaintext data state... i The wheel key K of the current round i The XOR operation is performed using the following formula:
[0019]
[0020] S-box substitution: Using a 4-bit S-box, let x and y be 4-bit binary numbers, x being the input and y being the output. The S-box operation is represented as:
[0021] y = S(x);
[0022] P-permutation: After S-box substitution, P-permutation is performed to rearrange the bits of the data.
[0023] Preferably, in step S32, a round function corresponding to each round is generated. After the Docker encrypted microserver module starts, it reads an 80-bit master key K from the client module. This master key is generated by a random number generator, and the master key K = [k 79 ,k 78 The keys [, ..., k0] are placed in a shift register, and multiple round keys K are generated using a key expansion algorithm. i In the first round, the first 64 bits of the master key are taken, and the key for each subsequent round is generated based on the key of the previous round.
[0024] Preferably, the key expansion algorithm includes cyclic shift, S-box substitution, and round constant addition.
[0025] Preferably, the decryption process of the Docker decryption microserver module is the reverse of the encryption process of the Docker encryption microserver module, including inverse P-substitution, inverse S-box substitution, and round key addition, first using the round key K. 31 Perform round key addition operation, and then use the corresponding round key to restore the state of the ciphertext in each round. After the iteration is completed, the initial plaintext is obtained, and finally the initial plaintext is transmitted to the message queue module.
[0026] Therefore, the present invention adopts the above-mentioned microservice communication encryption method based on the lightweight cryptography PRESENT, which can ensure data transmission security while meeting the performance and resource consumption requirements of the microservice architecture. The core idea of this method is to use the PRESENT algorithm to encrypt communication between microservices. The PRESENT algorithm has low computational overhead and memory consumption, and is suitable for running in resource-constrained environments.
[0027] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0028] Figure 1 This is a flowchart of a Docker-based microservice communication framework according to an embodiment of the present invention.
[0029] Figure 2 This is a schematic diagram of the encryption process of the PRESENT algorithm in an embodiment of the present invention.
[0030] Figure 3 This is a schematic diagram illustrating the key expansion principle of an embodiment of the present invention;
[0031] Figure 4 This is a schematic diagram illustrating the decryption process of the PRESENT algorithm in an embodiment of the present invention. Detailed Implementation
[0032] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. In the description of the present invention, it should be noted that the terms "upper," "lower," "inner," "outer," etc., indicating orientation or positional relationships are based on the orientation or positional relationships shown in the accompanying drawings, or the orientation or positional relationships commonly used when the product of the invention is in use. They are only for the convenience of describing the present invention and simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the present invention.
[0033] Example
[0034] This invention provides a microservice communication encryption model based on the lightweight password PRESENT, including a client module, a message queue module, a Docker encryption microserver module, a Docker decryption microserver module, and a result processing module. The specific contents of each module include:
[0035] The client module is responsible for communication requests and result reception. Communication requests include encryption and decryption requests, and result reception involves receiving result messages transmitted by the result processing module. After receiving user input, the client module sends encryption or decryption request messages to the message queue module. The message queue module then performs the next step of the operation.
[0036] The message queue module responds to sent encryption or decryption requests, transmits data to the microserver according to the request, and relays intermediate results. Encryption or decryption requests are placed in an instruction queue. Upon receiving an encryption request, the message queue module forwards it to the Docker encryption microserver module and then places the encrypted data into a data queue. Similarly, upon receiving a decryption request, the ciphertext to be decrypted is transmitted to the Docker decryption microserver module via the message queue, and the decrypted plaintext is returned to the result processing module. This part ensures the confidentiality of the sender's messages during transmission, preventing theft or tampering.
[0037] The Docker encryption microserver module is used for key generation and encryption operations to ensure secure data encryption. It encrypts the received initial plaintext using an iterative PRESENT algorithm encryption round function to obtain the corresponding ciphertext.
[0038] The Docker decryption microserver module is used to progressively recover plaintext through a reverse round function, ensuring data integrity. Upon receiving ciphertext, it performs decryption operations, recovering the initial plaintext message using the PRESENT algorithm. The decryption process is the reverse of the encryption process, iterating through multiple rounds of the decryption function to progressively recover the initial plaintext.
[0039] Result Processing Module: As the exit point for communication messages, it is responsible for processing and returning results. After encryption and decryption, the result processing module receives the encrypted ciphertext or the decrypted plaintext, and finally completes the communication loop through the result processing module, that is, it returns the result to the client module, ensuring the security and integrity of end-to-end communication.
[0040] like Figure 1 As shown, this invention provides a microservice communication encryption method based on the lightweight password PRESENT, the steps of which include:
[0041] S1. The client module receives plaintext data (including text, file, or message content) input by the user, forms encrypted or decrypted data, sends encryption or decryption requests to the message queue module through the interface, and simultaneously associates with and listens to the response channel to receive subsequent processing results. The request information contains plaintext or ciphertext data to be processed.
[0042] S2, the message queue module responds to the sent encryption or decryption request information and forwards the encryption or decryption request information to the Docker encryption microserver module or the Docker decryption microserver module.
[0043] In this embodiment, the message queue module employs a dual-queue mechanism for task scheduling. Encryption and decryption requests are categorized and processed separately in instruction queue lists, ensuring efficient task execution and data timing consistency. When an encryption request is detected, the plaintext data is forwarded to the Docker encryption microserver module, and an encrypted data identifier is created and added to the data queue list. When a decryption request is triggered, the corresponding ciphertext data is automatically matched based on the data identifier and then transmitted to the Docker decryption microserver module.
[0044] S3, the Docker encryption micro-server module, after receiving the encryption request forwarded by the message queue module, performs the encryption operation, uses the round function of the PRESENT algorithm to perform multiple rounds of iteration to obtain the corresponding ciphertext, and transmits the encrypted ciphertext to the message queue module.
[0045] In this embodiment, the encryption process of the Docker encrypted microserver module specifically includes:
[0046] S31: The Docker encrypted microserver module obtains encrypted requests forwarded by the message queue module and reads plaintext data.
[0047] S32. Generate round keys, iterating through each plaintext data for 31 rounds, using the corresponding round key in each round. For example, Figure 2 As shown, each round function includes round key addition, S-box substitution, and P-permutation, specifically:
[0048] Round key addition: At the start of each round of encryption, the plaintext data state... i The wheel key K of the current round i Performing an XOR operation combines the plaintext data with the key, increasing the encryption complexity. That is:
[0049]
[0050] S-box substitution: Using a 4-bit S-box, let x and y be 4-bit binary numbers, x being the input and y being the output. The S-box operation is represented as:
[0051] y = S(x);
[0052] The S-box replacement rules are as follows:
[0053] Table 1. S-box substitution table for the PRESENT algorithm
[0054] x 0 1 2 3 4 5 6 7 8 9 A B C D E F S[x] C 5 6 B 9 0 A D 3 E F 8 4 7 1 2
[0055] P-permutation: After S-box substitution, P-permutation is performed to rearrange the bits of the data. The essence of permutation is shifting. P-permutations are shown in the table below.
[0056] Table 2 PRESENT Encryption Algorithm P Permutation Table
[0057] i 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 P(i) 0 16 32 48 1 17 33 49 2 18 34 50 3 19 35 51 i 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 P(i) 4 20 36 52 5 21 37 53 6 22 38 54 7 23 39 55 i 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 P(i) 8 24 40 56 9 25 41 57 10 26 42 58 11 27 43 59 i 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 P(i) 12 28 44 60 13 29 45 61 13 29 45 61 14 30 46 62
[0058] Since a corresponding round key is used in each round, a total of 31 round keys need to be generated.
[0059] Specifically:
[0060] After the Docker encrypted microserver module starts, it reads an 80-bit master key K from the client module. This master key is generated using a random number generator, and the master key K = [k 79 ,k 78 The keys [, ..., k0] are placed in a shift register, and multiple round keys K are generated through 31-round key expansion. i A total of 31 round keys were generated. The first round used the first 64 bits of the master key, and each subsequent round key was generated based on the previous round key. For example... Figure 3 As shown, the key expansion algorithm includes cyclic shifting, S-box substitution, and round constant addition, specifically including:
[0061] Circular shift: Shift the round key K from the previous round...i Circular left shift by 61 bits:
[0062] [k 79 ,k 78 [k, ..., k0] = [k 18 ,k 17 ,…,k 19 ].
[0063] S-box substitution: Every 4 bits are processed using Table 1 in step S32. That is:
[0064] K[k 79 ,k 78 ,k 77 ,k 76 ]=S([k 79 ,k 78 ,k 77 ,k 76 ]).
[0065] Round constant addition: The round key K after cyclic shifting i Chinese K 19 k 18 k 17 k 16 k 15 Perform a bitwise XOR operation with the 5-bit round constant, round_constant, where the value of round_constant is a five-bit binary number of round number i.
[0066]
[0067] Retrieve the round key K from the current shift register i The high 64 bits are used as the round key for the i-th round. That is:
[0068] K i =[k 63 ,k 62 [k, ..., k0] = [k 79 ,k 78 ,…,k 16 (i = 0, 1, ..., 31).
[0069] After rounds 33 and 31 of iterations, a whitening key operation is performed to obtain the final ciphertext.
[0070] S34. Return the encrypted data to the message queue module.
[0071] S4. After the Docker decryption microserver module receives the decryption request forwarded by the message queue module, it performs the decryption operation, recovers the initial plaintext message using the PRESENT algorithm, and transmits the initial plaintext message to the message queue module.
[0072] In this embodiment, the decryption process of the Docker decryption microserver module is the reverse of the encryption process of the Docker encryption microserver module, such as... Figure 4 As shown, this includes inverse P-permutation, inverse S-box substitution, and round key addition. First, the round key K is used. 31 Perform round key addition operation, and then use the corresponding round key to restore the state of the ciphertext in each round. After 31 rounds of iteration, XOR the round key K0 with the output state of the 31st round to obtain the initial plaintext. Finally, transmit the initial plaintext to the message queue module.
[0073] Decrypting the round function includes inverse P-permutation, inverse S-box substitution, and round key addition, specifically:
[0074] Inverse P-permutation: In the inverse permutation layer, the intermediate state is bit shifted. The inverse P-permutation is shown in the table below.
[0075] Table 3. Inverse P-permutation table for the PRESENT encryption algorithm.
[0076] i 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 P(i) 0 4 8 12 16 20 24 28 32 36 40 44 48 52 56 60 i 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 P(i) 1 5 9 13 17 21 25 29 33 37 41 45 49 53 57 61 i 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 P(i) 2 6 10 14 18 22 26 30 34 38 42 46 50 54 58 62 i 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 P(i) 3 7 11 15 19 23 27 31 35 39 43 47 51 55 59 63
[0077] Inverse S-box substitution: The operation is performed using the inverse mapping of the S-box, similar to the S-box substitution in step S32. The inverse S-box operation can be represented as:
[0078] y = Inv_S(x);
[0079] The rules for replacing the reverse S-box are shown in the table below.
[0080] Table 4. Inverse S-box substitution table for the PRESENT encryption algorithm.
[0081] x 0 1 2 3 4 5 6 7 8 9 A B C D E F S[x] 5 E F 8 C 1 2 D B 4 6 3 0 7 9 A
[0082] Round key addition: Add the ciphertext to the key. 31-i The round key of the round is XORed.
[0083] S5. The result processing module receives the ciphertext or plaintext transmitted by the message queue module and then returns it to the client module to complete the feedback of the result message, forming a communication closed loop.
[0084] Therefore, the present invention adopts the above-mentioned microservice communication encryption method based on the lightweight cryptographic PRESENT. Based on the simplified round function design (31 rounds of encryption), low memory consumption (64-bit block length), and hardware friendliness of the lightweight cryptographic algorithm PRESENT, it can meet the performance and resource consumption requirements of the microservice architecture while ensuring data transmission security.
[0085] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.
Claims
1. A microservice communication encryption method based on lightweight cryptography PRESENT, characterized in that the steps include... include: S1. The client module receives plaintext data input by the user, forms encrypted or decrypted data, and sends encryption or decryption request information to the message queue module. The request information contains plaintext or ciphertext data to be processed. S2, the message queue module responds to the sent encryption or decryption request information and forwards the encryption or decryption request information to the Docker encryption microserver module or the Docker decryption microserver module; The message queue module uses a dual-queue mechanism to implement task scheduling. Encryption requests and decryption requests are respectively entered into the instruction queue list for classification and processing. When an encryption request is detected, the plaintext data is forwarded to the Docker encryption microserver module, and an encrypted data identifier is created and added to the data queue list. When a decryption request is triggered, the corresponding ciphertext data is automatically matched according to the data identifier and transmitted to the Docker decryption microserver module. S3, after the Docker encryption micro-server module receives the encryption request forwarded by the message queue module, performs the encryption operation, uses the round function of the PRESENT algorithm to perform multiple rounds of iteration to obtain the corresponding ciphertext, and transmits the encrypted ciphertext to the message queue module. S4. After the Docker decryption microserver module receives the decryption request forwarded by the message queue module, it performs the decryption operation, recovers the initial plaintext message through the PRESENT algorithm, and transmits the initial plaintext message to the message queue module. S5. The result processing module receives the ciphertext or plaintext transmitted by the message queue module and then returns it to the client module, forming a communication loop.
2. The microservice communication encryption method based on lightweight cryptography PRESENT according to claim 1, characterized in that: The encryption process of the Docker encrypted microserver module specifically includes: S31, the Docker encrypted micro-server module obtains the encrypted request forwarded by the message queue module and reads the plaintext data; S32. Generate a round key, perform multiple rounds of iteration on each plaintext data, and use the corresponding round key in each round; S33. After all rounds are completed, perform a whitening key operation to obtain the final ciphertext; S34. Return the encrypted data to the message queue module.
3. A microservice communication encryption method based on lightweight cryptography PRESENT according to claim 2, characterized in that, Step S32: Each round function includes round key addition, S-box substitution, and P-permutation, with a total of 31 iterations, specifically: Round key addition: At the start of each round of encryption, the plaintext data state... i The wheel key K of the current round i The XOR operation is performed using the following formula: S-box substitution: Using a 4-bit S-box, let x and y be 4-bit binary numbers, x being the input and y being the output. The S-box operation is represented as: y = S(x); P-permutation: After S-box substitution, P-permutation is performed to rearrange the bits of the data.
4. A microservice communication encryption method based on lightweight cryptography PRESENT according to claim 3, characterized in that: In step S32, a round key corresponding to each round is generated. After the Docker encrypted microserver module starts, it reads an 80-bit master key K from the client module. This master key is generated by a random number generator, placed in a shift register, and multiple round keys K are generated through a key expansion algorithm. i In the first round, the first 64 bits of the master key are taken, and the key for each subsequent round is generated based on the key of the previous round.
5. A microservice communication encryption method based on lightweight cryptography PRESENT according to claim 4, characterized in that: The key expansion algorithm includes cyclic shift, S-box substitution, and round constant addition.
6. A microservice communication encryption method based on lightweight cryptography PRESENT according to claim 5, characterized in that: The decryption process of the Docker decryption microserver module is the reverse of the encryption process of the Docker encryption microserver module, including inverse P-substitution, inverse S-box substitution, and round key addition. First, the round key K is used. 31 Perform round key addition operation, and then use the corresponding round key to restore the state of the ciphertext in each round. After the iteration is completed, the initial plaintext is obtained, and finally the initial plaintext is transmitted to the message queue module.
Citation Information
Patent Citations
Method and device for sending and consuming MQ message, and storage medium
CN112235205A