Dynamic key encryption communication method in monitoring system

Abstract

The invention discloses a dynamic key encryption communication method in a monitoring system, and the method comprises the steps: S1, generating a random dynamic key and a convolution matrix after monitoring equipment is started; s2, the monitoring equipment initiates a connection establishment request, encrypts the serial number SN of the monitoring equipment and the authentication key through the master key, and sends the serial number SN and the authentication key to the server; s3, the server side verifies the serial number SN and the authentication key of the monitoring equipment, if the key is correct, a correct response is returned, and otherwise, a wrong response is returned; s4, if the monitoring equipment receives the correct response, the monitoring equipment sends the dynamic key generation method and the dynamic key initial value to the server side together, and the server side replies the response to the monitoring equipment after receiving the command; and S5, then the monitoring equipment and the server side communicate according to the agreed dynamic key, and the key needs to be regenerated every time the request response is completed, the key is hidden in the form of the dynamic key, so that the security of information interaction is ensured, the number of encryption rounds can be reduced, and the encryption and decryption efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electronic information, in particular to a dynamic key encryption communication method in a monitoring system. BACKGROUND

[0002] At present, most encryption and decryption are three-layer keys of master key + authentication key + temporary key. In order to hide the temporary key, a third-party key distribution server is increased to distribute the temporary key for a limited time, and the temporary key is always unchanged in the long connection scene. When the temporary key is unchanged for a long time and the key is not complex enough, there is a risk that the ciphertext is decrypted and the information is leaked. Therefore, it is urgent to develop a dynamic key encryption communication method in a monitoring system.

[0003] In view of this, the present application is proposed. SUMMARY

[0004] The purpose of the present application is to provide a dynamic key encryption communication method in a monitoring system, which solves the problem that the temporary key is always unchanged in the long connection scene, hides the key in the form of dynamic key, not only ensures the security of information interaction, but also reduces the encryption round number, improves the encryption and decryption efficiency, has a broad application prospect, and is conducive to popularization and application.

[0005] In order to achieve the above purpose, the present application provides a dynamic key encryption communication method in a monitoring system, which comprises the following steps: S1: generating a random dynamic key and a convolution matrix after the monitoring device is started; S2: the monitoring device initiates a connection request, and sends the monitoring device serial number SN and the authentication key after being encrypted by the master key to the server; S3: the server verifies the serial number SN and the authentication key of the monitoring device, and returns a correct response if the key is correct, otherwise returns an error response; S4: if the monitoring device receives a correct response, the monitoring device sends the dynamic key generation method and the dynamic key initial value to the server, and the server replies to the monitoring device after receiving the command; S5: then the monitoring device and the server communicate according to the agreed dynamic key, and a new key is generated every time a request response is completed, the monitoring device encrypts the request message with the new key and sends it to the server, and the server processes the received request message with the new key; then the server processes the response message with the new key and sends it to the monitoring device, and the monitoring device processes the received response message with the new key.

[0006] Preferably, the monitoring device has the same master key as the server, which is a very complex key determined by the software developer, only appearing in the source code and not stored in any database or file, the master key is used to decrypt the authentication key and will not be transmitted over the network, thereby ensuring the security of the key.

[0007] Preferably, the authentication key is held by the monitoring device, and when establishing a connection with the server, the monitoring device serial number SN and the authentication key are encrypted and sent to the server, and the authentication key is compared with the authentication key stored in the server. If correct, the connection is established, otherwise the connection is refused; the authentication keys of different monitoring devices are different, and the monitoring device can modify the authentication key by itself. When the monitoring device modifies the authentication key, it needs to be modified when establishing a connection with the server. When modifying, the key stored in the server is updated synchronously. If the authentication process fails multiple times, the source address will be locked and the server will not be connected for a period of time.

[0008] Preferably, the dynamic key is dynamically updated, and the server and the monitoring device update once for each interaction. The monitoring device encrypts the request with the current dynamic key, the server decrypts the request with the current dynamic key, and the reply is encrypted with the current dynamic key and sent to the monitoring device. This process is considered as an interaction. The dynamic key is negotiated in the chain building stage. If the connection is not disconnected, the dynamic update is maintained. If the decryption fails during the interaction process, the connection may be hijacked and a new connection needs to be established.

[0009] Preferably, the message includes a chain building message and a negotiation message. The chain building message includes a packet header, a control word, a source address + destination address + packet count, SN + authentication key + time. The packet header and the control word are not encrypted. The source address + destination address + packet count field is encrypted by the authentication key. The SN + authentication key + time is encrypted by the master key. The time is added to increase the security and readability of the field. After receiving the message, the server first decrypts the SN + authentication key + time field with the master key, then decrypts the source address + destination address + packet count field with the authentication key, and then compares the SN + authentication key with the value in the database. If all the above are correct, the connection is successfully established.

[0010] Preferably, the negotiation message includes a packet header, a control word, a source address + destination address + packet count, SN + dynamic key generation method + time. The packet header and the control word are not encrypted. The source address + destination address + packet count field is encrypted by the authentication key. The SN + dynamic key generation method + time is encrypted by the authentication key.

[0011] Preferably, the dynamic key generation method includes the following steps: SS1: as Figure 2As shown, m0 in the figure represents the current input quantity, which is one byte in size, and the input quantity can be a packet count; SS2: m1-m8 represent the last round key value, which is 8 bytes, and c0-c7 are 8 bytes of newly generated keys; SS3: D0 to D7 represent convolution delays; SS4: The plus sign in the circle represents the XOR operation, for example, c0=m0+m2+m6+m8, which is expressed by the generating polynomial as: f(x)=1+x^2+x^6+x^8; SS5: The output key can be represented by 8*8=64 bits, that is, the key convolution matrix, which occupies 8 bytes; SS6: The convolution matrix represented by the figure is: .

[0012] The application provides a dynamic key encryption communication method in a monitoring system, which has the following beneficial effects.

[0013] 1. The application solves the problem of keeping the temporary key unchanged in the long connection scene, and for the encryption communication under the point-to-point connection, a special key distribution server is not needed, the key is hidden in the form of dynamic key, which not only can improve the data transmission security, but also can reduce the encryption rounds and improve the encryption and decryption efficiency.

[0014] 2. The standard AES encryption has 10 rounds of byte substitution, matrix transformation and round key addition, which aims to hide the key and plaintext and ensure information security. At the same time, the 10 rounds of encryption time is very long, especially in the MCU environment, the encryption time is unacceptable, the encryption key of the application is dynamic, only the plaintext needs to be hidden, and multiple rounds of encryption are not necessary, thereby reducing the encryption rounds and improving the encryption and decryption efficiency. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 The application provides a flow chart of a dynamic key encryption communication method in a monitoring system; Figure 2 It is a structure block diagram of a link establishment message; Figure 3 It is a structure block diagram of a negotiation message; Figure 4 It is a flow chart of a dynamic key generation method. DETAILED DESCRIPTION

[0016] The application will be further described below in combination with specific embodiments and drawings to help understand the content of the application.

[0017] As Figure 1As shown, a flow chart of a dynamic key encryption communication method in a monitoring system provided by the application. The dynamic key encryption communication method in the monitoring system comprises the following steps: S1: after the monitoring device is started, a random dynamic key and a convolution matrix are generated; S2: the monitoring device initiates a connection establishment request, and sends the monitoring device serial number SN and the authentication key after being encrypted by the master key to the server; S3: the server verifies the serial number SN and the authentication key of the monitoring device, and returns a correct response if the key is correct, otherwise returns an error response; S4: if the monitoring device receives the correct response, the monitoring device sends the dynamic key generation method and the dynamic key initial value to the server, and the server replies to the monitoring device after receiving the command; S5: then the monitoring device and the server communicate according to the agreed dynamic key, and a new key is generated every time a request response is completed, the monitoring device encrypts the request message with the new key and sends it to the server, and the server processes the received request message with the new key; then the server processes the response message with the new key and sends it to the monitoring device, and the monitoring device processes the received response message with the new key.

[0018] The master key of the monitoring device and the server is the same, which is an extremely complex key determined by the software developer and only appears in the source code, and will not be stored in any database and file. The master key is used to decrypt the authentication key and will not be transmitted on the network, thereby ensuring the security of the key.

[0019] The authentication key is held by the monitoring device, and when the connection with the server is established, the monitoring device serial number SN and the authentication key are encrypted and sent to the server, and compared with the authentication key saved by the server. If correct, the connection is established, otherwise the connection is refused; the authentication keys of different monitoring devices are different, and the monitoring device is allowed to modify it by itself. When the monitoring device modifies the authentication key, it needs to be connected with the server, and the key saved by the server is updated synchronously when the authentication process occurs multiple times. If the source address is locked for a period of time, it is not allowed to establish a connection with the server.

[0020] The dynamic key is dynamically updated, and the server and the monitoring device update it once every time they complete an interaction. The monitoring device encrypts the request with the current dynamic key, the server decrypts the request with the current dynamic key, and sends the reply response to the monitoring device after encrypting it with the current dynamic key. This process is considered as an interaction. The dynamic key is calculated in the connection establishment stage, and is dynamically updated as long as the monitoring device and the server are not disconnected. If the decryption error occurs during the interaction process, the connection may be hijacked, and a new connection needs to be established.

[0021] The message includes a link establishment message and a negotiation message. As shown in Figure 2 FIG. 1 is a structural block diagram of the link establishment message. The link establishment message includes a packet header, a control word, a source address + destination address + packet count, and SN + authentication key + time. The packet header and the control word are not encrypted. The source address + destination address + packet count is encrypted by the authentication key. The SN + authentication key + time is encrypted by the master key. The time is added to increase the security and unreadability of the field. After receiving the message, the server decrypts the SN + authentication key + time field by the master key, decrypts the source address + destination address + packet count field by the authentication key, and compares the SN + authentication key with the value in the database. If all the above are correct, the connection is successfully established.

[0022] As shown in Figure 3 FIG. 2 is a structural block diagram of the negotiation message. The negotiation message includes a packet header, a control word, a source address + destination address + packet count, and SN + dynamic key generation method + time. The packet header and the control word are not encrypted. The source address + destination address + packet count is encrypted by the authentication key. The SN + dynamic key generation method + time is encrypted by the authentication key.

[0023] As shown in Figure 4 FIG. 3 is a flow chart of the dynamic key generation method. The dynamic key generation method includes the following steps: SS1: m0 in the figure represents the current input, which is one byte. The input can be the packet count. SS2: m1-m8 represent the last round key value, which is 8 bytes. c0-c7 are the newly generated 8-byte keys. SS3: D0 to D7 represent convolution delays. SS4: The plus sign in the circle represents the XOR operation. For example, c0=m0+m2+m6+m8. The generating polynomial is f(x)=1+x^2+x^6+x^8. SS5: The output key can be represented by 8*8=64 bits, i.e., the key convolution matrix, which occupies 8 bytes. SS6: The convolution matrix represented by the figure is: .

[0024] The application solves the problem that the temporary key is always unchanged in the long connection scene, and in view of the encrypted communication under the point-to-point connection, a special key distribution server is not needed, the key is hidden in the form of dynamic key, the data transmission security can be improved, the encryption round number can be reduced, and the encryption and decryption efficiency can be improved. The standard AES encryption has 10 rounds of byte substitution, matrix transformation and round key addition, the purpose is to hide the key and plaintext, and ensure information security. At the same time, the encryption time of 10 rounds is very long, especially in the MCU environment, the encryption time is unacceptable, the encryption key of the application is dynamic, only the plaintext needs to be hidden, and multiple rounds of encryption are not needed, so that the encryption round number is reduced, and the encryption and decryption efficiency is improved.

[0025] In this paper, specific examples are applied to elaborate the inventive concept in detail, and the above embodiment is only used to help understand the core idea of the application. It should be pointed out that any obvious modification, equivalent replacement or other improvement made by those skilled in the art without departing from the inventive concept should be included in the protection scope of the application.

Claims

1. A dynamic key encrypted communication method in a monitoring system, characterized in that, Includes the following steps: S1: After the monitoring device is started, it generates a random dynamic key and a convolution matrix; S2: The monitoring device initiates a connection establishment request, and sends the monitoring device serial number (SN) and authentication key to the server after being encrypted with the master key; S3: The server verifies the serial number (SN) and authentication key of the monitoring device. If the key is correct, it returns a correct response; otherwise, it returns an incorrect response. S4: If the monitoring device receives a correct response, the monitoring device will send the dynamic key generation method and the initial value of the dynamic key to the server. After receiving the command, the server will reply to the monitoring device with a response. S5: After that, the monitoring device and the server communicate according to the agreed dynamic key. Each time a request and response is completed, a new key must be generated. The monitoring device encrypts the request message with the new key and sends it to the server. The server processes the received request message with the new key. The server then processes the response message with the new key and sends it to the monitoring device, which in turn processes the received response message with the new key.

2. The dynamic key encryption communication method in a monitoring system according to claim 1, characterized in that, The master key of the monitoring device is the same as that of the server. It is an extremely complex key determined by the software developer and only appears in the source code. It is not stored in any database or file. The master key is used to decrypt the authentication key and is not transmitted over the network, thus ensuring the security of the key.

3. The dynamic key encryption communication method in a monitoring system according to claim 2, characterized in that, The authentication key is held by the monitoring device. When establishing a connection with the server, the monitoring device's serial number (SN) and the authentication key are encrypted and sent to the server. The authentication key is compared with the key stored on the server. If they match, the connection is established; otherwise, the connection is rejected. Different monitoring devices have different authentication keys, which can be modified by the monitoring device itself. When the monitoring device modifies the authentication key, it needs to do so when establishing a connection with the server. During the modification, the key stored on the server is updated synchronously. If multiple errors occur during the authentication process, the source address is locked, and no connection to the server is allowed for a period of time.

4. The dynamic key encryption communication method in a monitoring system according to claim 3, characterized in that, The dynamic key is updated dynamically. It is updated every time the server and the monitoring device complete an interaction. The monitoring device encrypts the request with the current dynamic key, the server decrypts the request with the current dynamic key, and sends the reply to the monitoring device after encrypting it with the current dynamic key. This process is considered as one interaction. The calculation method of the dynamic key is negotiated during the connection establishment phase. As long as the connection between the monitoring device and the server is not broken, it will be kept dynamically updated. If an error occurs during decryption during the interaction, the connection may be hijacked and a new connection needs to be established.

5. The dynamic key encryption communication method in a monitoring system according to claim 4, characterized in that, The message includes a connection establishment message and a negotiation message. The connection establishment message includes a header, control word, source address + destination address + packet count, SN + authentication key + time. The header and control word fields are not encrypted. The source address + destination address + packet count fields are encrypted with the authentication key, and the SN + authentication key + time is encrypted with the master key. The time is added to increase the confidentiality and unreadableness of this field. After receiving the message, the server first decrypts the SN + authentication key + time field with the master key. After successful decryption, it decrypts the source address + destination address + packet count field with the authentication key. Then, it compares the SN + authentication key with the value in the database. If all of the above are correct, the connection is successfully established.

6. The dynamic key encryption communication method in a monitoring system according to claim 5, characterized in that, The negotiation message includes a header, control word, source address + destination address + packet count, SN + dynamic key generation method + time. The header and control word fields are not encrypted, while the source address + destination address + packet count fields are encrypted with the authentication key, and the SN + dynamic key generation method + time fields are encrypted with the authentication key.

7. The dynamic key encryption communication method in a monitoring system according to claim 6, characterized in that, The dynamic key generation method includes the following steps: SS1: As shown in Figure 2, m0 represents the current input quantity, which is one byte in size. This input quantity can be a packet count. SS2: m1-m8 represent the key value of the previous round, which is 8 bytes, and c0-c7 are the newly generated 8-byte key; SS3: D0 to D7 represent convolution delays; SS4: The plus sign in the circle represents the XOR operation. For example, c0 = m0 + m2 + m6 + m8, which can be expressed as the generator polynomial: f(x) = 1 + x^2 + x^6 + x^8. SS5: The output key can be represented by 8*8=64 bits, i.e., the key convolution matrix, which occupies 8 bytes; SS6: The convolution matrix represented in this figure is: .

Images