CCSDS network security authentication method, device, equipment, medium and product

Abstract

The invention relates to the technical field of space-air-ground integrated network security, and provides a CCSDS network security authentication method, device, equipment, medium and product, and the method comprises the steps: based on a CCSDS secure transmission frame, carrying out an encryption and authentication process in a sending direction and an authentication and decryption process in a receiving direction; fields of a security head and a security tail are added in the CCSDS security transmission frame, and confidentiality and integrity protection is carried out by adopting a national cryptographic algorithm. According to the method, a CCSDS secure transmission frame is designed, confidentiality and integrity protection is carried out by adopting a cryptographic algorithm, and encryption and authentication processes in the sending direction and authentication and decryption processes in the receiving direction based on the CCSDS secure transmission frame are carried out; the technical bottlenecks of low security, native and uncontrollable algorithm and the like of the current CCSDS network can be solved, the confidentiality, integrity and availability of the CCSDS network are greatly improved, and a technical framework of the high-security, autonomous and controllable CCSDS network is powerfully constructed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of space-air-ground integrated network security, in particular to a CCSDS network security authentication method and device based on a national cryptographic algorithm, equipment, medium and product. BACKGROUND

[0002] Space-air-ground integrated network is to realize seamless coverage and efficient communication in the global range by fusing space-based network (high, medium and low orbit satellite network, etc.), air-based network (unmanned aerial vehicle network, high-altitude aircraft network, aviation Internet, etc.), ground-based network (optical fiber network, ground mobile communication network).

[0003] The Consultative Committee for Space Data Systems (CCSDS) space communication network protocol family defines four kinds of data link layer transmission protocols suitable for different scenarios: USLP (Unified Space data Link Protocol) / AOS (Advanced Orbiting Systems) / TC (TeleCommand) / TM (TeleMetry) / Prox-1 (Proximity-1), which realizes efficient transmission and provides a basic framework for building space-air-ground integrated network.

[0004] Compared with ground-based network, air-based and space-based network has a higher risk of wireless channel and link transmission data being stolen and tampered, and a more serious network security threat; although the CCSDS space communication network protocol family also defines security protocols such as SDLS (Space Data Link Security protocol) at the data link layer, the encryption and authentication algorithms all use international algorithms, which exist non-autonomous controllable original security risks. SUMMARY

[0005] In view of the above problems, the present application aims to provide a CCSDS network security authentication method and device based on a national cryptographic algorithm, equipment, medium and product to greatly improve the confidentiality, integrity and availability of CCSDS network.

[0006] In the first aspect, the present application provides a CCSDS network security authentication method, which comprises: Based on the CCSDS secure transmission frame, the encryption and authentication process in the sending direction is carried out; Based on the CCSDS secure transmission frame, the authentication and decryption process in the receiving direction is carried out; The fields of security header and security tail are added in the CCSDS secure transmission frame, and the national cryptographic algorithm is used for confidentiality and integrity protection.

[0007] In a preferred embodiment, the fields in the CCSDS secure transmission frame in turn include a frame header, an insertion area, a security header, a payload area, an operation control area, a security tail, and an error control area; wherein: The confidentiality protection domain is protected by the SM4 symmetric block cipher algorithm of the national secret; the confidentiality protection domain starts from the first bit of the payload area and ends at the last bit of the operation control area; The integrity protection domain is protected by the SM3 hash algorithm of the national secret; the integrity protection domain starts from the first bit of the frame header and ends at the last bit of the operation control area.

[0008] In a preferred embodiment, the fields in the security header in turn include a security parameter index, an anti-replay sequence number, and a padding length; The security parameter index is used to identify the selected security parameter group of the CCSDS secure transmission frame, and the security parameter group includes information indexes such as cipher algorithm and mode, authentication algorithm, encryption key information, and initial vector; The anti-replay sequence number is used to identify the anti-replay attack; The padding length is used to identify the padding length of the SM4 symmetric block cipher algorithm and the padding length of the SM3 hash algorithm.

[0009] In a preferred embodiment, the field of the security tail includes a message authentication code; The message authentication code is a message authentication code generated by the SM3 hash algorithm for the integrity protection domain.

[0010] In a preferred embodiment, the encryption and authentication process in the sending direction includes: According to the parameter configuration of the CCSDS secure transmission frame, generate the frame header and the insertion area; Generate the security header with the security parameter index, the anti-replay sequence number, and the padding length; Generate the ciphertext by calling the SM4 symmetric block cipher algorithm core for the payload area and the operation control area according to the symmetric block cipher parameter group identified by the security parameter index and the corresponding padding length; Generate the security tail by calling the SM3 hash algorithm core for the frame header to the encrypted payload area and operation control area according to the hash authentication parameter group identified by the security parameter index and the corresponding padding length; Calculate the CRC check value from the frame header to the security tail and fill it into the error control area.

[0011] In a preferred embodiment, the authentication and decryption process in the receiving direction includes: When receiving the CCSDS secure transmission frame, parse and buffer the frame header and the insertion area, and simultaneously start CRC calculation; parsing the security header, extracting the security parameter index, the anti-replay sequence number and the padding length selected by the CCSDS security transmission frame, and checking whether the anti-replay sequence number is a value of one less than the anti-replay sequence number of the previous frame; if not, discarding the CCSDS security transmission frame; decrypting the ciphertext by the SM4 symmetric block cipher algorithm core according to the cipher algorithm and mode identified by the security parameter index, the encryption key information, the initial vector and the padding length, and authenticating the data starting from the frame header by the SM3 hash algorithm core; if the authentication value calculated by the SM3 hash algorithm core is consistent with the security tail, the integrity authentication check is passed; and if the check value calculated by the CRC is consistent with the error control area value, the error control check is passed; if both the integrity check and the error control check are correct, the decrypted payload area and the operation control area are extracted for use by the upper layer application; and if the integrity check and the error control check are not all correct, the CCSDS security transmission frame is discarded, and the upper layer application is notified.

[0012] In a second aspect, the present application provides a CCSDS network security authentication device, comprising: a first processing unit configured to perform encryption and authentication processes in the sending direction based on the CCSDS security transmission frame; a second processing unit configured to perform authentication and decryption processes in the receiving direction based on the CCSDS security transmission frame; The CCSDS security transmission frame is increased with the fields of the security header and the security tail, and the confidentiality and integrity protection is performed by using the national secret algorithm.

[0013] In a third aspect, the present application provides an electronic device, comprising: at least one processor; and a memory connected with the at least one processor in communication; The memory stores instructions executable by the at least one processor, and the at least one processor executes the method by executing the instructions stored in the memory.

[0014] In a fourth aspect, the present application provides a computer readable storage medium for storing instructions, when the instructions are executed, the method is implemented.

[0015] In a fifth aspect, the present application provides a computer program product, when the computer program product is invoked by a computer, the computer executes the method.

[0016] In summary, due to the adoption of the above technical solutions, the present application has the following beneficial effects: This invention designs a CCSDS secure transmission frame and employs national cryptographic algorithms for confidentiality and integrity protection. It also establishes encryption and authentication processes for the sending direction and authentication and decryption processes for the receiving direction based on the CCSDS secure transmission frame. This invention can solve the current technical bottlenecks of low network security and uncontrollable algorithms in CCSDS networks, significantly improve the confidentiality, integrity, and availability of CCSDS networks, and effectively build a technical framework for a highly secure and independently controllable CCSDS network. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of a CCSDS network security authentication method provided in an embodiment of the present invention.

[0018] Figure 2 This is a schematic diagram of a CCSDS secure transmission frame in an embodiment of the present invention.

[0019] Figure 3 This is a schematic diagram of the security header field in an embodiment of the present invention.

[0020] Figure 4 This is a schematic diagram of the security tail field in an embodiment of the present invention.

[0021] Figure 5 This is a flowchart illustrating the encryption and authentication process for the sending direction in an embodiment of the present invention.

[0022] Figure 6 This is a flowchart illustrating the authentication and decryption process in the receiving direction according to an embodiment of the present invention.

[0023] Figure 7 This is a schematic diagram of the structure of a CCSDS network security authentication device provided in an embodiment of the present invention.

[0024] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0026] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0027] Example like Figure 1 As shown, this embodiment of the invention provides a CCSDS network security authentication method, including: Based on CCSDS secure transmission frames, an encryption and authentication process is performed for the transmission direction; Based on CCSDS secure transmission frames, the authentication and decryption process for the receiving direction is performed; The CCSDS secure transmission frame adds secure header and secure trailer fields and uses national cryptographic algorithms for confidentiality and integrity protection.

[0028] The present invention will be described in detail below through specific implementation process.

[0029] 1. Design CCSDS secure transmission frames: Based on the principles of confidentiality, integrity, and availability in network security, security header and security trailer fields are added to obtain the CCSDS secure transmission frame. For example... Figure 2 As shown, the fields in the CCSDS secure transmission frame include, in sequence, a frame header, an insertion area, a security header, a payload area, an operation control area, a security tail, and an error control area. Among them: The confidentiality protection field starts from the first bit of the payload area and ends at the last bit of the operation control area. In this embodiment, the SM4 symmetric block cipher algorithm is used to protect the confidentiality of the payload area and the operation control area. The integrity protection field starts from the first bit of the frame header and ends at the last bit of the operation control area. In this embodiment, the national standard SM3 hash cipher algorithm is used to implement integrity protection from the frame header to the encrypted payload area and operation control area.

[0030] 2. Design security header fields: like Figure 3 As shown, the security header consists of 6 bytes, and the fields in the security header include the security parameter index, the anti-replay sequence number, and the padding length. The specific design is as follows: (1) Security Parameter Index (SPI), 2 bytes, is used to identify the security parameter group selected for this CCSDS secure transmission frame. It can support up to 65534 security parameter groups (0x0000 and 0xFFFF are reserved). The security parameter group contains information indexes such as cryptographic algorithm and mode, authentication algorithm, encryption key information, and initialization vector.

[0031] (2) Anti-Replay Sequency Number (ARSN), 2 bytes, used to identify the anti-replay attack. The serial number decreases and cycles from 0xFFFF to 0x0000.

[0032] (3) Length of Padding (LOP), 2 bytes, used to identify the padding length of the SM4 symmetric block cipher algorithm and the padding length of the SM3 hash cipher algorithm. The first 6 bits represent the padding length of the SM4 symmetric block cipher algorithm (in bytes, maximum 15 bytes); the last 10 bits represent the padding length of the SM3 hash cipher algorithm (in bits, maximum 511 bits).

[0033] 3. Design the safety tail field: like Figure 4 As shown, the security field includes the Message Authentication Code (MAC), which is 32 bytes long. This MAC is a 32-byte message authentication code generated by the SM3 hash cipher algorithm from the first bit of the integrity protection field (starting from the first bit of the frame header and ending at the last bit of the operation control field).

[0034] 4. For example Figure 5 As shown, the encryption and authentication process in the sending direction includes: (1) Generate the frame header and insertion area (if any) according to the parameter configuration of the CCSDS secure transmission frame.

[0035] (2) Generate a security header by combining the security parameter index, the anti-replay sequence number (the anti-replay sequence number of the previous frame is decremented by one, and the sequence is cyclically decremented) and the padding length.

[0036] (3) Based on the information such as the symmetric block cipher parameter group and padding length identified by the security parameter index, the payload area and operation control area (if any) are called to generate ciphertext by calling the SM4 symmetric block cipher algorithm kernel.

[0037] (4) Based on the information such as the hash authentication parameter group and padding length identified by the security parameter index, the SM3 hash cryptography algorithm kernel is called from the frame header to the encrypted payload area and operation control area (if any) to generate a 32-byte security tail.

[0038] (5) Calculate the CRC check value from frame header to security tail and fill it into the error control area.

[0039] 5. For example Figure 6 As shown, the authentication and decryption process on the receiving side includes: (1) When a CCSDS secure transmission frame is received, the frame header and insertion area (if any) are parsed and buffered, and CRC (Cyclic Redundancy Check) calculation is started at the same time; (2) Parse the security header and extract the security parameter index, anti-replay sequence number and padding length information selected for the CCSDS secure transmission frame; and check whether the anti-replay sequence number is the anti-replay sequence number of the previous frame minus one; if it is not minus one, discard the CCSDS secure transmission frame.

[0040] (3) Based on the cryptographic algorithm and mode, encryption key information, initial vector and other information identified by the security parameter index, as well as the padding length, the ciphertext is sent to the SM4 symmetric block cipher kernel for decryption, and the data starting from the frame header is sent to the SM3 hash cipher kernel for authentication calculation.

[0041] (4) If the authentication value calculated by the SM3 hash cryptographic algorithm core is consistent with the security tail, the integrity authentication verification passes; if the check value calculated by CRC is consistent with the error control area value, the error control verification passes.

[0042] (5) If both integrity verification and error control verification are correct, the decrypted payload area and operation control area (if any) are extracted for use by the upper-layer application. If both integrity verification and error control verification are not correct, the CCSDS secure transmission frame is discarded and the upper-layer application is notified.

[0043] Based on the same technological concept, such as Figure 7 As shown, this embodiment of the invention also provides a CCSDS network security authentication device, comprising: The first processing unit is used to perform encryption and authentication processes in the sending direction based on CCSDS secure transmission frames. The second processing unit is used to perform authentication and decryption processes in the receiving direction based on CCSDS secure transmission frames. The CCSDS secure transmission frame adds secure header and secure trailer fields and uses national cryptographic algorithms for confidentiality and integrity protection.

[0044] The working principle of each processing unit in the above-mentioned device can be referred to the description in the foregoing method embodiments, and will not be repeated here.

[0045] Based on the same technical concept, embodiments of the present invention also provide an electronic device that can implement the CCSDS network security authentication method provided in the above embodiments of the present invention. In one embodiment, the electronic device can be a server, a terminal device, or other electronic devices. Figure 8 As shown, the electronic device may include: At least one processor and a memory connected to the at least one processor. In this embodiment of the invention, the specific connection medium between the processor and the memory is not limited. Figure 8 The example used is the connection between the processor and memory via a bus. The bus... Figure 8The connections between other components are indicated by thick lines and are for illustrative purposes only, not as limiting information. Buses can be divided into address buses, data buses, control buses, etc., but for ease of representation, [the specific bus type is not shown here]. Figure 8 The processor is represented by a single thick line, but this does not imply that there is only one bus or one type of bus. Alternatively, a processor can also be called a controller; there are no restrictions on the name.

[0046] In this embodiment of the invention, the memory stores instructions that can be executed by at least one processor. By executing the instructions stored in the memory, at least one processor can execute a CCSDS network security authentication method as described above.

[0047] The processor is the control center of the device. It can connect to various parts of the control equipment through various interfaces and lines. By running or executing instructions stored in memory and calling data stored in memory, it can monitor the various functions and data processing of the device as a whole.

[0048] In an alternative design, the processor may include one or more processing units. The processor may integrate an application processor and a modem processor, wherein the application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may also not be integrated into the processor. In some embodiments, the processor and memory may be implemented on the same chip; in some embodiments, they may also be implemented separately on separate chips.

[0049] The processor can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit, field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the CCSDS network security authentication method disclosed in the embodiments of this invention can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0050] Memory, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory can include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic memory, magnetic disk, optical disk, etc. Memory is any other medium capable of carrying or storing desired program code in the form of instructions or data structures, and accessible by a computer, but is not limited thereto. In embodiments of the present invention, memory can also be a circuit or any other device capable of implementing storage functions, used to store program instructions and / or data.

[0051] By designing and programming the processor, the code corresponding to the CCSDS network security authentication method described in the foregoing embodiments can be embedded into the chip, enabling the chip to execute the steps of the method described in the foregoing embodiments during operation. How to design and program the processor is a technique well-known to those skilled in the art and will not be elaborated upon here.

[0052] Based on the same inventive concept, embodiments of the present invention also provide a storage medium storing computer instructions that, when executed on a computer, cause the computer to perform a CCSDS network security authentication method as described above.

[0053] In some alternative embodiments, the present invention also provides that various aspects of the CCSDS network security authentication method can also be implemented in the form of a program product, which includes program code that, when the program product is run on a device, causes the control device to perform the steps in the CCSDS network security authentication method according to various exemplary embodiments of the present invention described above.

[0054] It should be noted that although several units or sub-units of the apparatus have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of the invention, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided and embodied by multiple units. Furthermore, although the operation of the method of the invention is described in a specific order in the drawings, this does not require or imply that these operations must be performed in that specific order, or that all the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0055] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0056] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a server, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0057] Program code for performing the operations of this invention can be written using any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0058] In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0059] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0060] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0061] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A CCSDS network security authentication method, characterized in that, include: Based on CCSDS secure transmission frames, an encryption and authentication process is performed for the transmission direction; Based on CCSDS secure transmission frames, the authentication and decryption process for the receiving direction is performed; The CCSDS secure transmission frame adds secure header and secure trailer fields and uses national cryptographic algorithms for confidentiality and integrity protection.

2. The CCSDS network security authentication method according to claim 1, characterized in that, The fields in the CCSDS secure transmission frame include, in sequence, a frame header, an insertion area, a security header, a payload area, an operation control area, a security trailer, and an error control area; wherein: The confidentiality protection field is protected by the national standard SM4 symmetric block cipher algorithm; the confidentiality protection field starts from the first bit of the payload area and ends at the last bit of the operation control area. The integrity protection field is implemented using the national standard SM3 hash cipher algorithm; the integrity protection field starts from the first bit of the frame header and ends at the last bit of the operation control area.

3. The CCSDS network security authentication method according to claim 2, characterized in that, The fields in the security header include, in order, a security parameter index, an anti-replay sequence number, and a padding length; The security parameter index is used to identify the security parameter group selected for the CCSDS secure transmission frame. The security parameter group includes information indexes such as cryptographic algorithms and modes, authentication algorithms, encryption key information, and initialization vectors. The anti-replay sequence number is used to identify resistance to anti-replay attacks; The padding length is used to identify the padding length of the SM4 symmetric block cipher algorithm and the padding length of the SM3 hash cipher algorithm.

4. The CCSDS network security authentication method according to claim 2, characterized in that, The fields of the security tail include the message verification code; The message verification code is a message verification code generated by calculating the integrity protection field using the SM3 hash cryptography algorithm.

5. The CCSDS network security authentication method according to claim 2, characterized in that, The encryption and authentication process in the sending direction includes: Generate the frame header and insertion area based on the parameter configuration of the CCSDS secure transmission frame; Generate a security header using the security parameter index, anti-replay sequence number, and padding length; Based on the symmetric block cipher parameter group identified by the security parameter index and the corresponding padding length, the payload area and operation control area call the SM4 symmetric block cipher algorithm kernel to generate ciphertext; Based on the hash authentication parameter group identified by the security parameter index and the corresponding padding length, the SM3 hash cryptographic algorithm kernel is called from the frame header to the encrypted payload area and operation control area to generate a secure tail. Calculate the CRC check value from frame header to security tail and fill it into the error control area.

6. The CCSDS network security authentication method according to claim 5, characterized in that, The authentication and decryption process for the receiving direction includes: Upon receiving a CCSDS secure transmission frame, the frame header and insertion area are parsed and buffered, and CRC calculation begins simultaneously. Parse the security header to extract the security parameter index, anti-replay sequence number, and padding length selected for the CCSDS secure transmission frame; and check whether the anti-replay sequence number is one less than the anti-replay sequence number of the previous frame; if it is not one less, discard the CCSDS secure transmission frame. Based on the cryptographic algorithm and mode identified by the security parameter index, the encryption key information, the initialization vector, and the padding length, the ciphertext is sent to the SM4 symmetric block cipher kernel for decryption, and the data starting from the frame header is sent to the SM3 hash cipher kernel for authentication calculation. If the authentication value calculated by the SM3 hash algorithm core matches the security tail, the integrity authentication verification passes; if the check value calculated by the CRC matches the error control area value, the error control verification passes. If both integrity and error control checks are correct, the decrypted payload and operation control areas are extracted for use by upper-layer applications; if neither integrity nor error control checks are correct, the CCSDS secure transmission frame is discarded and the upper-layer application is notified.

7. A CCSDS network security authentication device, characterized in that, include: The first processing unit is used to perform encryption and authentication processes in the sending direction based on CCSDS secure transmission frames. The second processing unit is used to perform authentication and decryption processes in the receiving direction based on CCSDS secure transmission frames. The CCSDS secure transmission frame adds secure header and secure trailer fields and uses national cryptographic algorithms for confidentiality and integrity protection.

8. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, cause the method as described in any one of claims 1-6 to be implemented.

10. A computer program product, characterized in that, When the computer program product is invoked by a computer, it causes the computer to perform the method as described in any one of claims 1-6.

Images