An underwater communication system

Abstract

The application provides an underwater communication system, comprising a management end and a communication end, wherein the communication key of the communication end is updated in the following manner: the management end determines the update key information corresponding to the management identification key in the key distribution instruction in response to the key distribution instruction; the management end generates a management initialization vector based on the management identification key, the management timestamp and the management random value to encrypt the update key information and generates a data packet; the management end broadcasts the data packet at a preset frequency; the communication end checks the received data packet and decrypts the data packet that passes the check to obtain the update key information; and the communication end takes the update key parsed from the update key information as the current communication key, which is used to encrypt the communication data between the current communication end and other communication ends or the management end.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically, to an underwater communication system. Background Technology

[0002] With the increasing demand for marine resource development and underwater monitoring, underwater communication technology has made significant progress, leading to the construction of various underwater communication systems. These systems are widely used in marine environmental monitoring, underwater resource exploration, and military reconnaissance. Due to the unique characteristics of the underwater environment, underwater communication is characterized by low transmission rates, high error rates, high latency, and narrow channels, which pose numerous challenges to data transmission.

[0003] Because underwater communication systems are mostly isolated, operate autonomously, and do not actively communicate with other information systems, this closed nature poses significant challenges to key management. While pre-configured keys are simple and easy to implement, they suffer from fixed usage periods and difficulty in changing keys in the underwater environment. Given the high latency and low bandwidth characteristics of underwater communication, traditional key distribution and confirmation mechanisms are not directly applicable, leading to numerous technical difficulties in key distribution, updating, and management for underwater terminals. Summary of the Invention

[0004] The purpose of this application is to provide an underwater communication system to solve the technical problem of difficult key distribution in existing underwater communication systems.

[0005] In a first aspect, the present invention provides an underwater communication system, including a management terminal and a communication terminal, wherein the communication key of the communication terminal is updated in the following manner:

[0006] The management terminal responds to the key distribution command and determines the update key information corresponding to the management identifier key in the key distribution command;

[0007] The management terminal generates a management initialization vector based on the management identifier key, management timestamp, and management random value to encrypt the update key information and generate a data packet;

[0008] The management terminal broadcasts data packets at a preset frequency;

[0009] The communication end verifies the received data packets and decrypts the data packets that pass the verification to obtain the updated key information;

[0010] The communication terminal will use the updated key parsed from the updated key information as the current communication key. The communication key is used to encrypt the communication data between the current communication terminal and other communication terminals or management terminals.

[0011] In an optional implementation, the management terminal constructs a management preset vector based on the management identifier key, management timestamp, and management random value;

[0012] Calculate the product of the management preset vector and the preset encoding vector to calculate the management encoding vector;

[0013] The management key information is encrypted based on the management initialization vector and the management identification key to obtain an encrypted data block;

[0014] Data packets are generated based on encrypted data blocks and management preset vectors.

[0015] In an optional implementation, the management terminal generates encrypted data blocks in the following manner:

[0016] The management key information is broken down into multiple key information data blocks;

[0017] The first key information data block is XORed with the management initialization vector, and the XOR result is encrypted using the management identification key to generate an encrypted data block.

[0018] For each remaining key information data block, an XOR operation is performed between the encrypted data block obtained in the previous step and the key information data block. The XOR result is then encrypted using a management identifier key to generate multiple encrypted data blocks.

[0019] In an optional implementation, the management terminal determines the first key block and the second key block based on the current communication key;

[0020] The management system calculates the first hash value based on the first key block and the managed random value.

[0021] The management system calculates the second hash value based on the second key block and the first hash value.

[0022] In an optional implementation, the management terminal generates data packets based on encrypted data blocks, a second hash value, and a management preset vector.

[0023] In an optional implementation, the communication end extracts a preset collection vector from the received data packet to parse out the collection identification key, collection timestamp, and collection random value.

[0024] The communication terminal will match the collected identification key with the local identification key;

[0025] If a match is found, the communicating end calculates the third hash value based on the current communication key and the collected random value.

[0026] The communicating end determines whether the third hash value matches the received second hash value;

[0027] If they match, the communication end determines the acquisition initialization vector and decrypts the received encrypted data block to obtain the update key and key sequence number.

[0028] In an optional implementation, the communication terminal compares the collection timestamp with the anti-duplicate timestamp;

[0029] If the collected timestamp is later than the anti-duplicate timestamp, then the steps of obtaining the update key and key sequence number are executed.

[0030] In an optional implementation, the communication terminal obtains three consecutively extracted update keys. If two of the update keys match, the step of updating the communication key is executed.

[0031] In an optional implementation, the communication terminal determines whether the extracted key sequence number is greater than the previous key sequence number;

[0032] If not, the communication end discards the extracted update key.

[0033] In an optional implementation, the communication terminal encrypts the collected data to be uploaded based on the communication key and the collection identification key.

[0034] This application provides an underwater communication system, including a management terminal and a communication terminal. The communication key of the communication terminal is updated in the following manner: The management terminal, responding to a key distribution command, determines the update key information corresponding to the management identifier key in the key distribution command; the management terminal generates a management initialization vector based on the management identifier key, a management timestamp, and a management random value to encrypt the update key information and generate a data packet; the management terminal broadcasts the data packet at a preset frequency; the communication terminal verifies the received data packet and decrypts the verified data packet to obtain the update key information; the communication terminal uses the key parsed from the update key information as the current communication key, which is used to encrypt communication data between the current communication terminal and other communication terminals or the management terminal. The underwater communication system provided in this application distributes keys through non-interactive authentication, reducing the bandwidth consumption of key distribution and improving the efficiency of key distribution. Attached Figure Description

[0035] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This application provides a schematic diagram of the structure of an underwater communication system according to an embodiment of the present application.

[0037] Figure 2 A communication flowchart of an underwater communication system provided in an embodiment of this application. Detailed Implementation

[0038] First, the application scenario of this application is described. This application can be applied to key distribution and updating in underwater communication systems. This application provides a key distribution method and system for underwater one-way communication, which adopts a non-interactive identity-based key distribution and management mechanism. This reduces the frequent consumption of communication bandwidth by key distribution, reduces the distribution data field to control the distribution transmission time, and increases verification and error correction to ensure reliable transmission with high error rate, thereby realizing underwater one-way key distribution and management and improving the security protection capability of underwater communication systems.

[0039] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0040] Example 1

[0041] like Figure 1 As shown, in one embodiment of this application, the underwater communication system may include a management center and multiple terminal devices. The management center can be used to acquire data uploaded by the terminal devices. The management center may be equipped with a management terminal to manage the underwater terminal devices, including but not limited to key distribution. The terminal devices include underwater sensors that transmit collected data to the management center via underwater short-range communication. The terminal devices also have communication terminals.

[0042] To ensure data security, the collected data needs to be encrypted before being sent. Therefore, the management terminal can preset multiple keys before shipment. Each key corresponds to unique pre-stored key information, which can be a key serial number. The management terminal also presets identification keys for each terminal device before shipment; these identification keys can be in the form of IDs.

[0043] The communication or management end can use locally stored keys to symmetrically encrypt the collected data, or encrypt other communication content between the management center and terminal devices.

[0044] In situations such as the loss of underwater terminal equipment or the prolonged use of resource transmission protection keys, it is necessary to replace the resource transmission protection keys promptly or periodically. Figure 2 As shown, the communication key at the communication end can be updated in the following ways:

[0045] S1. The management terminal responds to the key distribution instruction and determines the update key information corresponding to the management identifier key in the key distribution instruction.

[0046] Key distribution instructions can be generated at a fixed frequency or in response to requests from the communication endpoint. For example, if the communication endpoint loses or runs out of keys, it can request them from the management endpoint. Identification keys are used to identify terminal devices and can also be used as keys.

[0047] The update key information here can include both the update key and the key identifier. The key identifier can be a key serial number. The update key can be derived from a pre-stored key by the management end, etc., and there are no restrictions here.

[0048] Furthermore, the update key information here may also include an encryption range instruction. The encryption range instruction is used to indicate the encryption range corresponding to the update key, for example, indicating the specific encryption range that the update key is used for between the current communication end and the target communication end, or the encryption range for the current communication end to send data of a certain service type.

[0049] S2. The management terminal generates a management initialization vector based on the management identifier key, management timestamp, and management random value to encrypt the update key information and generate a data packet.

[0050] In step S2, the management terminal can use block encryption to encrypt the update key information, decomposing the management key information into multiple key information data blocks. The first key information data block is XORed with the management initialization vector, and the XOR result is encrypted using the management identification key to generate an encrypted data block. For each remaining key information data block, the encrypted data block obtained in the previous step is XORed with the current key information data block, and the XOR result is encrypted using the management identification key to generate multiple encrypted data blocks.

[0051] Other symmetric encryption methods can also be used to encrypt data on the management side; no restrictions are imposed here.

[0052] The data packet also includes an administrative identification key, an administrative timestamp, and an administrative random value. The timestamp indicates when the data packet was sent. The random value can be two randomly generated bytes.

[0053] S3. The management terminal broadcasts data packets at a preset frequency.

[0054] The management end can repeatedly broadcast data packets, ensuring the accuracy and stability of data packet transmission.

[0055] S4. The communication end verifies the received data packets and decrypts the data packets that pass the verification to obtain the updated key information.

[0056] The communication terminal can verify the received data packets and decrypt those that pass verification to obtain the updated key information. Verification may include checking if the parsed acquisition identifier key matches the local identifier key; if they match, the verification passes; otherwise, the data packet is discarded. This acquisition identifier key may match the management identifier key sent by the management terminal, or the inconsistency may be due to a transmission anomaly.

[0057] For data packets that pass verification, the communication end can construct a preset data collection vector using the data collection identification key, data collection timestamp, and random data collection value parsed from the data packet, in the same way as the management end. There are no restrictions on the method for constructing the preset vector.

[0058] The communication terminal can decrypt the encryption algorithm corresponding to the encryption algorithm of the management terminal based on the collected preset vector and the current communication key to obtain the updated key information.

[0059] S5. The communication terminal uses the update key parsed from the update key information as the current communication key. The communication key is used to encrypt the collected data to be uploaded by the communication terminal.

[0060] The communication terminal uses the updated key in the updated key information as the current communication key. The communication key is used to encrypt communication data between the communication terminal and other communication terminals or management terminals, such as data collected by underwater sensors.

[0061] This application provides an underwater communication system that distributes keys through non-interactive authentication, eliminating the need for responses from the communicating end. This reduces the bandwidth consumption of key distribution, improves its efficiency, and makes it more suitable for underwater communication environments characterized by low transmission rates, high latency, and narrow channels.

[0062] Example 2

[0063] Due to the high bit error rate of underwater communication, in order to further improve the reliability of key distribution, an underwater communication system is provided in one embodiment of this application.

[0064] The management system can construct a preset management vector based on the management identifier key, management timestamp, and management random value. The product of the preset management vector and the preset encoding vector is calculated to obtain the management encoding vector. The management key information is encrypted based on the management initialization vector and the management identifier key to obtain an encrypted data block. A data packet is generated based on the encrypted data block and the preset management vector.

[0065] Specifically, RS encoding is used here to encode the management identifier key, management timestamp, and management random value to construct a management preset vector, thereby obtaining the management encoding vector.

[0066] In this way, even if the received encoding vector is incomplete, the communication end can reconstruct the complete encoding vector based on the received encoding vector and the preset encoding vector, and then obtain the error-corrected and decoded identification key, timestamp, and random value. This can avoid bit errors caused by abnormal data transmission, which could affect key distribution.

[0067] Furthermore, the communication terminal can compare the data acquisition timestamp with the anti-duplicate timestamp. If the data acquisition timestamp is later than the anti-duplicate timestamp, the step of obtaining the update key and key sequence number is executed. If the data acquisition timestamp and the anti-duplicate timestamp are far apart, it indicates that the data packet is a replay data packet, which is not decrypted and is discarded.

[0068] The communication terminal can obtain three consecutively extracted update keys. If two of the update keys match, the step of updating the communication key is executed. This improves the probability of code error correction even under high error rates, further ensuring the accuracy of the key being updated. The communication terminal can also determine if the extracted key sequence number is greater than the previous key sequence number. If not, the extracted update key is discarded. The key sequence numbers are consecutive and unique. When a key with a certain key sequence number is successfully received, subsequent received key sequence numbers should be greater than the current sequence number; otherwise, they are discarded, ensuring the accuracy of key distribution.

[0069] Example 3

[0070] In one embodiment of this application, to further enhance the security of key distribution, this application also provides an underwater communication system that uses HMAC for authentication.

[0071] The management terminal can determine the first key block and the second key block based on the current communication key. Based on the first key block and a managed random value, it calculates the first hash value. Based on the second key block and the first hash value, it calculates the second hash value. A data packet is generated based on the encrypted data block, the second hash value, and a managed preset vector. The hash value here is used for authentication.

[0072] Correspondingly, the communication end can extract the preset collection vector from the received data packets to parse out the collection identification key, collection timestamp, and collection random value. The communication end matches the collection identification key with the local identification key. If they match, the communication end calculates a third hash value based on the current communication key and the collection random value. The communication end determines whether the third hash value is consistent with the received second hash value. If they are consistent, the communication end determines the collection initialization vector and decrypts the received encrypted data block to obtain the update key and key sequence number.

[0073] Here, the communication end can determine the third key block and the fourth key block based on the current communication key, calculate the fourth hash value based on the third key block and the management random value, and calculate the third hash value based on the fourth key block and the fourth hash value.

[0074] If the hash value calculated by the communication terminal matches the hash value sent by the management terminal, authentication is successful, and the key can be changed. Otherwise, the key is not changed to prevent key tampering.

[0075] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings, direct couplings, or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0076] Furthermore, the units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0077] Furthermore, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0078] It should be noted that if the function is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0079] In this paper, relational terms such as management and acquisition are used only to distinguish one entity or operation from another, without necessarily requiring or implying any such actual relationship or order between these entities or operations.

[0080] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An underwater communication system, characterized in that, This includes both a management terminal and a communication terminal. The communication key on the communication terminal is updated using the following methods: In response to the key distribution command, the management terminal determines the update key information corresponding to the management identifier key in the key distribution command. The update key information includes the update key and the key sequence number corresponding to the update key. The management system constructs a preset management vector based on the management identifier key, management timestamp, and management random value. The management terminal calculates the product of the management preset vector and the preset encoding vector to calculate the management encoding vector; The management end encrypts the update key information based on the management encoding vector and the management identification key to obtain the encrypted data block; The management terminal generates data packets based on encrypted data blocks and preset management vectors; The management terminal broadcasts data packets at a preset frequency; The communication end verifies the received data packets and decrypts the data packets that pass the verification to obtain the updated key information; The communication terminal will use the updated key parsed from the updated key information as the current communication key. The communication key is used to encrypt the communication data between the current communication terminal and other communication terminals or management terminals.

2. The system according to claim 1, characterized in that, The management system generates encrypted data blocks in the following ways: The management key information is broken down into multiple key information data blocks; The first key information data block is XORed with the management initialization vector, and the XOR result is encrypted using the management identification key to generate an encrypted data block. For each remaining key information data block, an XOR operation is performed between the encrypted data block obtained in the previous step and the key information data block. The XOR result is then encrypted using a management identifier key to generate multiple encrypted data blocks.

3. The system according to claim 2, characterized in that, The management terminal determines the first key block and the second key block based on the current communication key; The management system calculates the first hash value based on the first key block and the managed random value. The management system calculates the second hash value based on the second key block and the first hash value.

4. The system according to claim 3, characterized in that, The management system generates data packets based on encrypted data blocks, a second hash value, and a management preset vector.

5. The system according to claim 4, characterized in that, The communication end extracts the preset collection vector based on the received data packet to parse out the collection identification key, collection timestamp, and collection random value; The communication terminal will match the collected identification key with the local identification key; If a match is found, the communicating end calculates the third hash value based on the current communication key and the collected random value. The communicating end determines whether the third hash value matches the received second hash value; If they match, the communication end determines the acquisition initialization vector and decrypts the received encrypted data block to obtain the update key and key sequence number; Specifically, the communication end determines the third key block and the fourth key block based on the current communication key, calculates the fourth hash value based on the third key block and the management random value, and calculates the third hash value based on the fourth key block and the fourth hash value.

6. The system according to claim 5, characterized in that, The communication terminal compares the collected timestamp with the anti-duplicate timestamp; If the collected timestamp is later than the anti-duplicate timestamp, then the steps of obtaining the update key and key sequence number are executed.

7. The system according to claim 6, characterized in that, The communication terminal obtains three consecutively extracted update keys. If two of the update keys match, the step of updating the communication key is executed.

8. The system according to claim 7, characterized in that, The communication end determines whether the extracted key sequence number is greater than the previous key sequence number; If not, the communication end discards the extracted update key.

9. The system according to claim 1, characterized in that, The communication terminal encrypts the collected data to be uploaded based on the communication key and the collection identification key.

Images