CTC system based on SM4 algorithm and secure communication method

Abstract

The invention discloses a CTC system based on an SM4 algorithm and a safety communication method, and the safety communication method comprises the steps: S10, building TCP connection between at least one pair of CTC communication equipment, negotiating to build safety communication, and generating a key KeySM4; s20, after the secure communication negotiation is established, encrypting a plaintext message to be sent by using the key KeySM4 according to an SM4 algorithm to form a secure communication message, and sending the secure communication message; and S30, receiving the secure communication message, and performing SM4 algorithm decryption on the secure communication message by using the key KeySM4 to obtain the complete plaintext message. The method has the advantages of being high in safety and good in compatibility.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of railway communication, in particular to a CTC system based on SM4 algorithm and a secure communication method. BACKGROUND

[0002] The centralized traffic control system (CTC system for short) is a kind of key infrastructure of railway system, which is widely used in the field of railway dispatching and command in 18 railway bureaus and thousands of stations in China. The information transmitted in the CTC system contains train operation plan, dispatching command, station signal device state and other key data information related to railway transportation safety. Such key data information should be transmitted in an encrypted manner to ensure information security.

[0003] The SM4 algorithm is a kind of symmetric encryption algorithm based on block encryption, and its block length and key length are both 128 bits. The SM4 algorithm has the advantages of strong security, fast calculation speed and high encryption efficiency, and is suitable for CTC systems with high real-time requirements.

[0004] The security of the message encryption algorithm used in the existing CTC system is not high (for example, simple XOR encryption algorithm, such encryption algorithm is easy to be cracked. Hereinafter referred to as weak encryption algorithm). With the development of science and technology, the computing speed of computer is improved, and the attack means of information security is also increasing. It is an urgent need to use the SM4 algorithm with strong security and self-control in the CTC system to realize the secure communication between system devices.

[0005] The statements herein only provide background technology related to the present application, and do not necessarily constitute prior art. SUMMARY

[0006] The purpose of the present application is to provide a CTC system based on SM4 algorithm and a secure communication method, which overcomes the defects of insufficient encryption protection ability of the existing CTC system, and has the advantages of strong security and good compatibility.

[0007] In order to achieve the above purpose, the present application provides a secure communication method of CTC system based on SM4 algorithm, which comprises: S10, establishing TCP connection between at least one pair of CTC communication devices, negotiating to establish secure communication, and generating key Key_SM4; S20, after the establishment of secure communication negotiation is completed, using the key Key_SM4 to encrypt the plaintext message to be sent according to the SM4 algorithm to form a secure communication message and send it; S30. Receive the secure communication message and use the key Key_SM4 to decrypt the secure communication message using the SM4 algorithm to obtain the complete plaintext message.

[0008] In one embodiment, step S10, which involves establishing a TCP connection between at least one pair of CTC communication devices, negotiating secure communication, and generating a key Key_SM4, specifically includes: Step S11: Establish the TCP connection between CTC communication devices point-to-point; Step S12: The TCP client sends an SM4 encryption request message SM4_REQ to the TCP server, requesting that the communication between the CTC communication devices that have established the TCP connection use the SM4 algorithm to encrypt and decrypt message data; S13. After receiving the SM4 encryption request message SM4_REQ, the TCP server immediately sends an SM4 encryption consent message SM4_REPLY to the TCP client. S14. The TCP server calculates and generates the SM4 algorithm key Key_SM4 based on the parameters in the SM4 encryption request message SM4_REQ and the SM4 encryption agreement message SM4_REPLY, and records the completion of the secure communication negotiation. S15. After receiving the SM4 encryption consent message SM4_REPLY, the TCP client calculates and generates the SM4 algorithm key Key_SM4 based on the parameters in the SM4 encryption request message SM4_REQ and the SM4 encryption consent message SM4_REPLY, and records the completion of the secure communication negotiation.

[0009] In one embodiment, the SM4 encryption request message SM4_REQ mentioned in step S12 is sent immediately by the TCP client to the TCP server after the TCP connection is established; wherein, the SM4 encryption request message SM4_REQ includes an encryption request identifier and a 64-bit first key to calculate a random number Random_A.

[0010] In one embodiment, the SM4 encrypted consent message SM4_REPLY includes an encrypted consent identifier and a 64-bit second key to calculate a random number Random_B.

[0011] In one embodiment, the first key calculates a random number Random_A, which is generated by the TCP client using a general random number function; the second key calculates a random number Random_B, which is generated by the TCP server using a general random number function.

[0012] In one embodiment, the step S14 and step S15, which involves calculating and generating the SM4 algorithm key Key_SM4 based on the parameters in the SM4 encryption request message SM4_REQ and the SM4 encryption consent message SM4_REPLY, specifically includes: The first key-calculated random number Random_A in the SM4 encryption request message SM4_REQ is placed in the high 64 bits, and the second key-calculated random number Random_B in the SM4 encryption agreement message SM4_REPLY is placed in the low 64 bits, so that the first key-calculated random number Random_A and the second key-calculated random number Random_B are combined into a 128-bit number Random_AB; The bit number Random_AB is encrypted once using the universal key built into the CTC system using the SM4 algorithm to generate the 128-bit key Key_SM4.

[0013] In one embodiment, step S20, which involves encrypting the plaintext message to be sent using the key Key_SM4 according to the SM4 algorithm to form a secure communication message, specifically includes: S21. Read the plaintext message to be sent; S22. Determine whether secure communication has been successfully negotiated and established. If it has been established, proceed to S23; otherwise, proceed to S25. S23. Encrypt the plaintext message to be sent using the SM4 algorithm using the key Key_SM4; S24. Add an SM4 ciphertext frame header to the encrypted plaintext message to form a complete message frame to be sent as the secure communication message, and execute S27. S27. The secure communication message is sent to the receiver via a TCP connection according to the TCP protocol.

[0014] In one embodiment, step S20 further includes: S25. Encrypt the plaintext message to be sent using a weak encryption algorithm; S26. Add the original protocol frame header to the encrypted plaintext message to form a complete message frame to be sent as the secure communication message, and execute step S27.

[0015] In one embodiment, the weak encryption algorithm includes a simple XOR encryption algorithm.

[0016] In one embodiment, when step S20 encrypts the plaintext message to be sent using the key Key_SM4 according to the SM4 algorithm to form a secure communication message, it further includes: padding the length of the plaintext message to be sent to an integer multiple of 128 bits by adding 0 to the end of the plaintext message to be sent.

[0017] In one embodiment, the determination conditions for whether secure communication has been successfully negotiated in step S22 include: Condition 1: For the TCP client, the determination condition is that the TCP client has sent the SM4 encryption request message SM4_REQ and received the SM4 encryption consent message SM4_REPLY from the TCP server. Condition 2: For the TCP server, the determination condition is that the TCP server has received the SM4 encryption request message SM4_REQ and replied to the TCP client with the SM4 encryption consent message SM4_REPLY.

[0018] In one embodiment, the SM4 ciphertext frame header added in step S24 includes: an SM ciphertext identifier, the length of the padded frame message, and the length of the valid message before padded; wherein the SM ciphertext identifier is different from the ciphertext identifier in the original protocol frame header.

[0019] In one embodiment, step S30, which involves receiving the secure communication message and decrypting it using the SM4 algorithm with the key Key_SM4, specifically includes: S31. Read the secure communication message to be received from the TCP connection; S32. Determine the frame header format of the received secure communication message. If the frame header format is an SM4 ciphertext frame header, then execute S33; if the frame header format is a standard protocol frame header, then execute S35. S33. The length of the received secure communication message is parsed according to the frame message length in the SM4 ciphertext frame header to obtain the first message to be decrypted; S34. Using the key Key_SM4, the first message to be decrypted is decrypted using the SM4 algorithm. After decryption, according to the effective message length in the SM4 ciphertext frame header, the padding data at the end of the first message to be decrypted is removed to obtain the complete plaintext message. Then, S37 is executed. Step S37: Submit the complete plaintext message to the application layer for processing.

[0020] In one embodiment, step S30 further includes: S35. The length of the received secure communication message is parsed according to the frame message length in the original protocol frame header to obtain the second message to be decrypted; S36. Decrypt the second message to be decrypted using a weak encryption algorithm to obtain the complete plaintext message.

[0021] This invention also provides a CTC system based on the SM4 algorithm, wherein the CTC system is used for the secure communication method of the CTC system based on the SM4 algorithm as described above, and the CTC system includes: at least one pair of CTC communication devices; each of the CTC communication devices is configured with the SM4 algorithm, which includes: The TCP connection module is used to establish TCP connections, negotiate secure communication, and generate the key Key_SM4. The SM4 encryption module uses the key Key_SM4 to encrypt the plaintext message to be sent according to the SM4 algorithm to form a secure communication message; A sending module, used to send the secure communication message; A receiving module is used to receive the secure communication message; The SM4 decryption module uses the key Key_SM4 to decrypt the secure communication message using the SM4 algorithm to obtain the complete plaintext message.

[0022] In one embodiment, each of the CTC communication devices is further configured with a weak encryption algorithm. When the secure communication negotiation is not completed, the plaintext message to be sent is encrypted according to the weak encryption algorithm to form a secure communication message.

[0023] Compared with existing technologies, the CTC system and secure communication method based on the SM4 algorithm provided by this invention have at least the following advantages: 1. After the secure communication negotiation between the two parties in the TCP connection is established, the present invention uses the key Key_SM4 and the SM4 algorithm to encrypt the plaintext message to be sent before sending and decryption after receiving, thus solving the problem of weak information security protection capabilities of the existing CTC system.

[0024] 2. This invention ensures communication compatibility between new and old devices during the gradual upgrade of the CTC system by introducing a secure communication negotiation mechanism into the existing CTC system communication.

[0025] 3. This invention has good adaptability. Taking a pair of communication devices in the CTC system as an example, when one party has been upgraded and the other party has not, they can still communicate encrypted using the original protocol and a weak encryption algorithm; when both parties have been upgraded, they can automatically switch to SM4 algorithm encryption and decryption communication without additional configuration, which facilitates the implementation of CTC system upgrade schemes.

[0026] 4. This invention employs a collaborative mechanism between the communicating parties to manage the generation of SM4 keys, ensuring the security and confidentiality of the keys. Attached Figure Description

[0027] Figure 1 This is a flowchart of the secure communication method for CTC system based on the SM4 algorithm of the present invention; Figure 2 This is a schematic diagram illustrating the working process of the secure communication negotiation establishment mechanism in the CTC system secure communication method based on the SM4 algorithm of the present invention. Figure 3 A schematic diagram illustrating the encryption and transmission process of plaintext messages in the CTC system secure communication method based on the SM4 algorithm of this invention; Figure 4 A schematic diagram illustrating the process of receiving and decrypting secure communication messages in the CTC system secure communication method based on the SM4 algorithm of this invention. Detailed Implementation

[0028] The following detailed description, in conjunction with the accompanying drawings and specific embodiments, further illustrates the CTC system and secure communication method based on the SM4 algorithm proposed in this invention. The advantages and features of this invention will become clearer from the following description. It should be noted that the drawings are in a very simplified form and use non-precise proportions, used only to facilitate and clearly illustrate the embodiments of this invention. Please refer to the drawings to make the objectives, features, and advantages of this invention more apparent and understandable. It should be understood that the structures, proportions, sizes, etc., depicted in the accompanying drawings are only for illustrative purposes to aid those skilled in the art and are not intended to limit the implementation conditions of this invention. Therefore, they have no substantial technical significance. Any modifications to the structure, changes in proportions, or adjustments to the size, without affecting the effects and objectives achieved by this invention, should still fall within the scope of the technical content disclosed in this invention.

[0029] Because the message encryption algorithms used in existing CTC systems are not very secure, and given the wide application and extensive coverage of CTC systems, embodiments of this invention provide a secure communication method for CTC systems based on the SM4 algorithm. This method introduces a secure communication negotiation mechanism into the communication process between existing CTC communication devices. CTC communication devices that have completed the negotiation use the SM4 algorithm for encrypted communication, while CTC communication devices that have not completed the negotiation still use the original weak encryption algorithm for communication. This satisfies the secure communication requirements of CTC communication devices after upgrades to use the SM4 algorithm, while maintaining good compatibility during CTC system upgrades.

[0030] Based on the above inventive concept, such as Figure 1 As shown, the secure communication method for CTC systems based on the SM4 algorithm of the present invention specifically includes: S10. Establish a TCP connection between at least one pair of CTC communication devices, negotiate to establish secure communication, and generate a key Key_SM4; S20. After the secure communication negotiation is established, the plaintext message to be sent is encrypted using the key Key_SM4 according to the SM4 algorithm to form a secure communication message and then sent. S30. Receive the secure communication message and use the key Key_SM4 to decrypt the secure communication message using the SM4 algorithm to obtain the complete plaintext message.

[0031] Among them, such as Figure 2 The diagram illustrates the working process of the secure communication negotiation and establishment mechanism in the CTC system secure communication method based on the SM4 algorithm of the present invention. Step S10, which involves establishing a TCP connection between at least one pair of CTC communication devices, negotiating secure communication, and generating the key Key_SM4, specifically includes: Step S11: Establish the TCP connection between CTC communication devices point-to-point.

[0032] In this embodiment, the pair of CTC communication devices includes a first CTC communication device (e.g., a dispatch center server) located in the dispatch center and a second CTC communication device (e.g., a station self-regulating machine) located in the station. The first CTC communication device acts as a TCP server, and the second CTC communication device acts as a client. Establishing a TCP connection specifically involves: S111. The TCP client initiates a connection request by sending a SYN packet; the SYN packet contains the TCP client's initial sequence number and preset CTC communication port information (such as client IP, port, etc.) to indicate "request to establish a TCP connection"; S112. After receiving the SYN packet, the TCP server verifies whether the client IP and port are in the whitelist of allowed communication. If the verification is successful, it replies with a SYN+ACK packet. S113. After receiving the SYN+ACK packet, the TCP client sends an ACK packet. The ACK packet contains an acknowledgment number (Ack=y+1) for the server's Seq, indicating that "acceptance has been received and the connection is formally established." The above is a specific implementation method provided in this embodiment. This invention does not limit the scope of the invention; any method that can establish a TCP connection for a CTC communication device is acceptable.

[0033] Step S12: The TCP client sends an SM4 encryption request message SM4_REQ to the TCP server, requesting that the communication between the CTC communication devices establishing the TCP connection use the SM4 algorithm for encryption and decryption of message data. After the TCP connection is established, the TCP client immediately sends an SM4 encryption request message SM4_REQ to the TCP server to request that subsequent communication use the SM4 algorithm for encryption and decryption. The SM4 encryption request message SM4_REQ includes an encryption request identifier and a 64-bit first key calculation random number Random_A. In some embodiments, the first key calculation random number Random_A is generated by the TCP client using a general random number function. In this embodiment, the SM4 encryption request message SM4_REQ consists of an encryption request identifier (1 byte) and a random number Random_A calculated with the first key (8 bytes). The random number Random_A is obtained by calling a general random number generation function twice (each call yields a 4-byte random number) using the current time as the random number seed. The SM4 encryption request message SM4_REQ is packaged and sent in the original CTC protocol frame format.

[0034] S13. After receiving the SM4 encryption request message SM4_REQ, the TCP server immediately sends an SM4 encryption consent message SM4_REPLY to the TCP client; wherein, the SM4 encryption consent message SM4_REPLY includes an encryption consent identifier and a 64-bit second key to calculate a random number Random_B.

[0035] In this embodiment, the SM4 encrypted consent message SM4_REPLY consists of an encrypted consent message identifier (1 byte) and a second key random number Random_B (8 bytes); the generation method of the second key random number Random_B is the same as that of the first key random number Random_A, and will not be described in detail here; the SM4 encrypted consent message SM4_REPLY is packaged and sent in the original CTC protocol frame format.

[0036] S14. The TCP server calculates and generates the SM4 algorithm key Key_SM4 based on the parameters in the SM4 encryption request message SM4_REQ and the SM4 encryption agreement message SM4_REPLY, and records the completion of the secure communication negotiation. S15. After receiving the SM4 encryption consent message SM4_REPLY, the TCP client calculates and generates the SM4 algorithm key Key_SM4 based on the parameters in the SM4 encryption request message SM4_REQ and the SM4 encryption consent message SM4_REPLY, and records the completion of the secure communication negotiation.

[0037] Specifically, step S14, which involves calculating and generating the SM4 algorithm key Key_SM4 based on the parameters in the SM4 encryption request message SM4_REQ and the SM4 encryption consent message SM4_REPLY, includes: S141. Place the first key-calculated random number Random_A in the SM4 encryption request message SM4_REQ into the high 64 bits, and at the same time place the second key-calculated random number Random_B in the SM4 encryption agreement message SM4_REPLY into the low 64 bits, so that the first key-calculated random number Random_A and the second key-calculated random number Random_B are combined into a 128-bit number Random_AB; S142. Encrypt the bit number Random_AB once using the universal key built into the CTC system using the SM4 algorithm to generate the 128-bit key Key_SM4.

[0038] When the TCP client receives the SM4 encrypted consent message SM4_REPLY, it uses the algorithm in steps S141~S142 to calculate and generate a 128-bit key Key_SM4. Since the calculation parameters and methods are the same, it can be guaranteed that the two communicating parties (i.e., the first CTC communication device and the second CTC communication device) use the same key.

[0039] like Figure 3 The diagram illustrates the encryption and transmission process of plaintext messages in the CTC system secure communication method based on the SM4 algorithm of the present invention. Step S20, which involves encrypting the plaintext message to be sent using the key Key_SM4 according to the SM4 algorithm to form a secure communication message, specifically includes: S21. Read the plaintext message to be sent. In this embodiment, the message sender (e.g., the second CTC communication device) reads a plaintext message to be sent from the message sending queue.

[0040] S22. Determine whether secure communication has been successfully negotiated and established. If established, proceed to S23; otherwise, proceed to S25. Here, determining whether secure communication has been successfully negotiated and established refers to the negotiation process in steps S12 to S15. In some embodiments, it is also necessary to pad the plaintext message to be sent with zeros at the end to ensure the length of the plaintext message is a multiple of 128 bits, thus meeting the message length requirements of the SM4 algorithm for block encryption.

[0041] The determination conditions for whether secure communication has been successfully established in step S22 include: Condition 1: For the TCP client, the determination condition is that the TCP client has sent the SM4 encryption request message SM4_REQ and received the SM4 encryption consent message SM4_REPLY from the TCP server; Condition 2: For the TCP server, the determination condition is that the TCP server has received the SM4 encryption request message SM4_REQ and replied to the TCP client with the SM4 encryption consent message SM4_REPLY.

[0042] S23. Use the key Key_SM4 to encrypt the plaintext message to be sent using the SM4 algorithm to obtain the encrypted plaintext message to be sent; this process can be completed using general technology, and the present invention does not limit it.

[0043] S24. Add an SM4 ciphertext frame header to the encrypted plaintext message to form a complete message frame to be sent as the first secure communication message, and then execute S27; wherein, the SM4 ciphertext frame header added in step S24 includes: SM ciphertext identifier, the length of the padded frame message, and the length of the valid message before padded; wherein, the SM ciphertext identifier is different from the ciphertext identifier in the original protocol frame header.

[0044] S25. Encrypt the plaintext message to be sent using a weak encryption algorithm; S26. Add the original protocol frame header to the encrypted plaintext message to form a complete message frame to be sent, which serves as the second secure communication message, and then execute step S27. S27. The first secure communication message and / or the second secure communication message are sent to the receiver via a TCP connection according to the TCP protocol. In some embodiments, the secure communication message is sent to the receiver (i.e., the first CTC communication device) by calling a TCP send function.

[0045] For each plaintext message to be sent in the message queue, steps S21-S27 are repeated to complete the message sending process between CTC communication devices. Steps S25 and S26 ensure communication compatibility. When one of a pair of communication devices has been upgraded (i.e., can use the SM4 algorithm for encryption) and the other has not been upgraded (i.e., cannot use the SM4 algorithm for encryption), message communication can proceed using the original weak encryption algorithm and original protocol frames, ensuring communication compatibility between new and old devices during the gradual upgrade of the CTC system. Once both communication devices have been upgraded, communication can automatically switch to SM4 algorithm encryption / decryption without additional configuration, facilitating the implementation of the CTC system upgrade plan.

[0046] like Figure 4 The diagram illustrates the process of receiving and decrypting secure communication messages in the CTC system secure communication method based on the SM4 algorithm of the present invention. Step S30, which involves receiving the secure communication message and decrypting it using the key Key_SM4 with the SM4 algorithm, specifically includes: S31. Read the secure communication message to be received from the TCP connection; specifically: the message receiver (i.e., the first CTC communication device) calls the TCP receive function to read a secure communication message to be received from the TCP connection.

[0047] S32. Parse the frame header in the received secure communication message, determine the frame header format of the received secure communication message, and if the frame header format is an SM4 ciphertext frame header, then execute S33; if the frame header format is a native protocol frame header, then execute S35. S33. The length of the received secure communication message is parsed according to the frame message length in the SM4 ciphertext frame header to obtain the first message to be decrypted; S34. Using the key Key_SM4, the first message to be decrypted is decrypted using the SM4 algorithm. After decryption, the padding data at the end of the first message to be decrypted is removed according to the effective message length in the SM4 ciphertext frame header to obtain the complete plaintext message. Then, S37 is executed. This process can be completed using general techniques, and the present invention does not limit it.

[0048] S35. The length of the received secure communication message is parsed according to the frame message length in the original protocol frame header to obtain the second message to be decrypted; S36. Decrypt the second message to be decrypted using a weak encryption algorithm to obtain the complete plaintext message; Step S37: Submit the complete plaintext message to the application layer for processing.

[0049] For established TCP connections, repeat steps S31-S37 to complete the message reception process between CTC devices. Steps S35 and S36 ensure communication compatibility, enabling upgraded devices to normally receive original protocol messages sent by non-upgraded devices.

[0050] Embodiments of the present invention also provide a CTC system based on the SM4 algorithm. The CTC system is used for the secure communication method of the CTC system based on the SM4 algorithm as described in the above embodiments. The CTC system includes: at least one pair of CTC communication devices; each CTC communication device is configured with the SM4 algorithm and includes: a TCP connection module for establishing a TCP connection, negotiating secure communication, and generating a key Key_SM4; an SM4 encryption module for encrypting a plaintext message to be sent using the key Key_SM4 according to the SM4 algorithm to form a secure communication message; a sending module for sending the secure communication message; a receiving module for receiving the secure communication message; and an SM4 decryption module for decrypting the secure communication message using the key Key_SM4 using the SM4 algorithm to obtain the complete plaintext message.

[0051] Each of the CTC communication devices is also equipped with a weak encryption algorithm. When one of the CTC communication devices in a pair has been upgraded (i.e., can use the SM4 algorithm for encryption) and the other has not been upgraded (i.e. cannot use the SM4 algorithm for encryption), that is, when the two CTC communication devices have not completed the establishment of the secure communication negotiation, the plaintext message to be sent is encrypted according to the weak encryption algorithm to form a secure communication message.

[0052] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0053] In the description of this invention, it should be understood that the terms "center," "height," "thickness," "upper," "lower," "vertical," "horizontal," "top," "bottom," "inner," "outer," "axial," "radial," and "circumferential," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0054] In the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," "linking," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0055] In this invention, unless otherwise explicitly specified and limited, "above" or "below" the second feature can include direct contact between the first and second features, or contact between the first and second features through another feature between them. Furthermore, "above," "over," and "on top" of the second feature includes the first feature directly above or diagonally above the second feature, or simply indicates that the first feature is at a higher horizontal level than the second feature. "Below," "below," and "under" the second feature includes the first feature directly below or diagonally below the second feature, or simply indicates that the first feature is at a lower horizontal level than the second feature.

[0056] Although the present invention has been described in detail through the preferred embodiments above, it should be understood that the above description should not be considered as a limitation of the present invention. Various modifications and substitutions to the present invention will be apparent to those skilled in the art after reading the above description. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A secure communication method for a CTC system based on the SM4 algorithm, characterized in that, include: S10. Establish a TCP connection between at least one pair of CTC communication devices, negotiate to establish secure communication, and generate a key Key_SM4; S20. After the secure communication negotiation is established, the plaintext message to be sent is encrypted using the key Key_SM4 according to the SM4 algorithm to form a secure communication message and then sent. S30. Receive the secure communication message and use the key Key_SM4 to decrypt the secure communication message using the SM4 algorithm to obtain the complete plaintext message.

2. The secure communication method for CTC systems based on the SM4 algorithm as described in claim 1, characterized in that, Step S10, which involves establishing a TCP connection between at least one pair of CTC communication devices, negotiating secure communication, and generating a key Key_SM4, specifically includes: Step S11: Establish the TCP connection between CTC communication devices point-to-point; Step S12: The TCP client sends an SM4 encryption request message SM4_REQ to the TCP server, requesting that the communication between the CTC communication devices that have established the TCP connection use the SM4 algorithm to encrypt and decrypt message data; S13. After receiving the SM4 encryption request message SM4_REQ, the TCP server immediately sends an SM4 encryption consent message SM4_REPLY to the TCP client. S14. The TCP server calculates and generates the SM4 algorithm key Key_SM4 based on the parameters in the SM4 encryption request message SM4_REQ and the SM4 encryption agreement message SM4_REPLY, and records the completion of the secure communication negotiation. S15. After receiving the SM4 encryption consent message SM4_REPLY, the TCP client calculates and generates the SM4 algorithm key Key_SM4 based on the parameters in the SM4 encryption request message SM4_REQ and the SM4 encryption consent message SM4_REPLY, and records the completion of the secure communication negotiation.

3. The secure communication method for CTC systems based on the SM4 algorithm as described in claim 2, characterized in that, The SM4 encryption request message SM4_REQ mentioned in step S12 is sent immediately by the TCP client to the TCP server after the TCP connection is established; wherein, the SM4 encryption request message SM4_REQ includes an encryption request identifier and a 64-bit first key to calculate a random number Random_A.

4. The secure communication method for CTC systems based on the SM4 algorithm as described in claim 3, characterized in that, The SM4 encrypted consent message SM4_REPLY includes an encrypted consent identifier and a 64-bit second key to calculate a random number Random_B.

5. The secure communication method for CTC system based on the SM4 algorithm as described in claim 4, characterized in that, The first key calculates a random number Random_A, which is generated by the TCP client using a general random number function; the second key calculates a random number Random_B, which is generated by the TCP server using a general random number function.

6. The secure communication method for CTC system based on SM4 algorithm as described in claim 4, characterized in that, Steps S14 and S15, which involve calculating and generating the SM4 algorithm key Key_SM4 based on the parameters in the SM4 encryption request message SM4_REQ and the SM4 encryption consent message SM4_REPLY, specifically include: The first key-calculated random number Random_A in the SM4 encryption request message SM4_REQ is placed in the high 64 bits, and the second key-calculated random number Random_B in the SM4 encryption agreement message SM4_REPLY is placed in the low 64 bits, so that the first key-calculated random number Random_A and the second key-calculated random number Random_B are combined into a 128-bit number Random_AB; The bit number Random_AB is encrypted once using the universal key built into the CTC system using the SM4 algorithm to generate the 128-bit key Key_SM4.

7. The secure communication method for CTC system based on SM4 algorithm as described in claim 1, characterized in that, Step S20, which involves using the key Key_SM4 to encrypt the plaintext message to be sent according to the SM4 algorithm to form a secure communication message, specifically includes: S21. Read the plaintext message to be sent; S22. Determine whether secure communication has been successfully negotiated and established. If it has been established, proceed to S23; otherwise, proceed to S25. S23. Encrypt the plaintext message to be sent using the SM4 algorithm using the key Key_SM4; S24. Add an SM4 ciphertext frame header to the encrypted plaintext message to form a complete message frame to be sent as the secure communication message, and execute S27. S27. The secure communication message is sent to the receiver via a TCP connection according to the TCP protocol.

8. The secure communication method for a CTC system based on the SM4 algorithm as described in claim 7, characterized in that, Step S20 also includes: S25. Encrypt the plaintext message to be sent using a weak encryption algorithm; S26. Add the original protocol frame header to the encrypted plaintext message to form a complete message frame to be sent as the secure communication message, and execute step S27.

9. The secure communication method for a CTC system based on the SM4 algorithm as described in claim 8, characterized in that, The weak encryption algorithm includes the simple XOR encryption algorithm.

10. The secure communication method for a CTC system based on the SM4 algorithm as described in claim 1, characterized in that, When using the key Key_SM4 to encrypt the plaintext message to be sent according to the SM4 algorithm to form a secure communication message in step S20, it further includes: padding the length of the plaintext message to be sent to an integer multiple of 128 bits by adding 0 to the end of the plaintext message to be sent.

11. The secure communication method for a CTC system based on the SM4 algorithm as described in claim 7, characterized in that, The conditions for determining whether secure communication has been successfully negotiated and established in step S22 include: Condition 1: For the TCP client, the determination condition is that the TCP client has sent the SM4 encryption request message SM4_REQ and received the SM4 encryption consent message SM4_REPLY from the TCP server. Condition 2: For the TCP server, the determination condition is that the TCP server has received the SM4 encryption request message SM4_REQ and replied to the TCP client with the SM4 encryption consent message SM4_REPLY.

12. The secure communication method for a CTC system based on the SM4 algorithm as described in claim 8, characterized in that, The SM4 ciphertext frame header added in step S24 includes: SM ciphertext identifier, the length of the padded frame message, and the length of the valid message before padded; wherein, the SM ciphertext identifier is different from the ciphertext identifier in the original protocol frame header.

13. The secure communication method for a CTC system based on the SM4 algorithm as described in claim 1, characterized in that, Step S30, which involves receiving the secure communication message and decrypting it using the SM4 algorithm with the key Key_SM4, specifically includes: S31. Read the secure communication message to be received from the TCP connection; S32. Determine the frame header format of the received secure communication message. If the frame header format is an SM4 ciphertext frame header, then execute S33; if the frame header format is a standard protocol frame header, then execute S35. S33. The length of the received secure communication message is parsed according to the frame message length in the SM4 ciphertext frame header to obtain the first message to be decrypted; S34. Using the key Key_SM4, the first message to be decrypted is decrypted using the SM4 algorithm. After decryption, according to the effective message length in the SM4 ciphertext frame header, the padding data at the end of the first message to be decrypted is removed to obtain the complete plaintext message. Then, S37 is executed. Step S37: Submit the complete plaintext message to the application layer for processing.

14. The secure communication method for a CTC system based on the SM4 algorithm as described in claim 13, characterized in that, Step S30 also includes: S35. The length of the received secure communication message is parsed according to the frame message length in the original protocol frame header to obtain the second message to be decrypted; S36. Decrypt the second message to be decrypted using a weak encryption algorithm to obtain the complete plaintext message.

15. A CTC system based on the SM4 algorithm, characterized in that, The CTC system is used in the secure communication method for a CTC system based on the SM4 algorithm as described in any one of claims 1 to 14, wherein the CTC system comprises: at least one pair of CTC communication devices; each of the CTC communication devices is configured with the SM4 algorithm, which includes: The TCP connection module is used to establish TCP connections, negotiate secure communication, and generate the key Key_SM4. The SM4 encryption module uses the key Key_SM4 to encrypt the plaintext message to be sent according to the SM4 algorithm to form a secure communication message; A sending module, used to send the secure communication message; A receiving module is used to receive the secure communication message; The SM4 decryption module uses the key Key_SM4 to decrypt the secure communication message using the SM4 algorithm to obtain the complete plaintext message.

16. The CTC system based on the SM4 algorithm as described in claim 15, characterized in that, Each of the CTC communication devices is also equipped with a weak encryption algorithm. When the secure communication negotiation is not completed, the plaintext message to be sent is encrypted according to the weak encryption algorithm to form a secure communication message.

Images