Security access and access control method and system based on national cryptographic algorithm

Abstract

The invention discloses a security access and access control method and system based on a national cryptographic algorithm, and the method comprises the steps: a security access server KDC1 calculates an attribute token parameter ATD of a terminal TB after receiving related information of a connection request, encrypts the attribute token parameter ATD, and transmits the encrypted attribute token parameter ATD to the terminal TB; the terminal TB sends the encrypted data M and response information to the KDC1; the KDC1 calculates an attribute token parameter ATC, encrypts the attribute token parameter ATC, the encrypted data M and the response information, and sends the encrypted information to the terminal TA; the terminal TA calculates an attribute token TCMa, and obtains a session key KeyA according to the attribute token TCMa; and decrypting the encrypted data M according to the session key KeyA, verifying the TA identifier and the TB identifier obtained by decryption, if the verification is passed, successfully establishing the session key, and successfully establishing a heartbeat frame connection to the TB by the terminal TA according to the decrypted service IP and port of the TB.

Description

Technical Field

[0001] This invention relates to the field of secure access and access control technology, and in particular to a secure access and access control method and system based on Chinese cryptographic algorithms. Background Technology

[0002] Cross-domain trusted data sharing faces complex issues of secure access and access control. There are numerous participants, and they often distrust each other. Furthermore, the insecurity of cross-domain channels makes key sharing difficult. Currently, there is a lack of secure and efficient methods and systems for secure access and control. Summary of the Invention

[0003] To address the shortcomings of existing technologies, this invention provides a secure access and access control method and system based on national cryptographic algorithms; the system consists of a secure access server, an access initiator, and an accessed party.

[0004] On the one hand, it provides secure access and access control methods based on national cryptographic algorithms, including: When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. After receiving the relevant information for the connection request, the secure access server KDC1 calculates the attribute token parameter ATD of the terminal TB, encrypts the attribute token parameter ATD, and sends it to the terminal TB. Terminal TB generates an attribute token TCMb based on the attribute token parameter ATD, generates a session key KeyB based on the attribute token TCMb, and encrypts the service IP, port, TA identifier and TB identifier based on the session key KeyB to obtain encrypted data M. Then, the encrypted data M and the response information are sent to the secure access server KDC1. The secure access server KDC1 calculates the attribute token parameter ATC, encrypts the attribute token parameter ATC, encrypted data M, and response information, and sends them to the terminal TA. Terminal TA calculates the attribute token TCMa and obtains the session key KeyA based on the attribute token TCMa. It then decrypts the encrypted data M based on the session key KeyA and verifies the obtained TA identifier and TB identifier. If the verification is successful, the session key is successfully established. Terminal TA sends a heartbeat frame to TB based on the decrypted TB's service IP and port. If terminal TA receives a response frame from TB, the connection is successfully established; otherwise, it fails.

[0005] On the other hand, a secure access and control system based on national cryptographic algorithms is provided, including: terminal TA, terminal TB and secure access server KDC1; the secure access server KDC1 is connected to terminal TA and the secure access server KDC1 is connected to terminal TB. When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. After receiving the relevant information for the connection request, the secure access server KDC1 calculates the attribute token parameter ATD of the terminal TB, encrypts the attribute token parameter ATD, and sends it to the terminal TB. Terminal TB generates an attribute token TCMb based on the attribute token parameter ATD, generates a session key KeyB based on the attribute token TCMb, and encrypts the service IP, port, TA identifier and TB identifier based on the session key KeyB to obtain encrypted data M. Then, the encrypted data M and the response information are sent to the secure access server KDC1. The secure access server KDC1 calculates the attribute token parameter ATC, encrypts the attribute token parameter ATC, encrypted data M, and response information, and sends them to the terminal TA. Terminal TA calculates the attribute token TCMa and obtains the session key KeyA based on the attribute token TCMa. It then decrypts the encrypted data M based on the session key KeyA and verifies the obtained TA identifier and TB identifier. If the verification is successful, the session key is successfully established. Terminal TA sends a heartbeat frame to TB based on the decrypted TB's service IP and port. If terminal TA receives a response frame from TB, the connection is successfully established; otherwise, it fails.

[0006] Thirdly, it provides secure access and access control methods based on national cryptographic algorithms, including: When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. After receiving the relevant information for the connection request, the secure access server KDC1 sends the CDTD to the secure access server KDC2. Secure access server KDC2 sends CDTE to terminal TC; The terminal TC calculates KeyC; it encrypts the service IP port based on the session key KeyC to obtain M1, and sends M1 and the response message to the secure access server KDC2; Secure access server KDC2 sends CDTF to secure access server KDC1; Secure access server KDC1 sends CDTG to terminal TA; Terminal TA calculates KEYD. Terminal TA sends a heartbeat frame to TC based on the decrypted TC's service IP and port. If terminal TA receives a response frame from TC, the connection is successfully established; otherwise, it fails.

[0007] Fourthly, a secure access and control system based on national cryptographic algorithms is provided, including: terminal TA, terminal TB, secure access server KDC1 and secure access server KDC2; terminal TA is connected to secure access server KDC1; secure access server KDC1 is connected to secure access server KDC2, and secure access server KDC2 is connected to terminal TB. When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. After receiving the relevant information for the connection request, the secure access server KDC1 sends the CDTD to the secure access server KDC2. Secure access server KDC2 sends CDTE to terminal TC; The terminal TC calculates KeyC; it encrypts the service IP port based on the session key KeyC to obtain M1, and sends M1 and the response message to the secure access server KDC2; Secure access server KDC2 sends CDTF to secure access server KDC1; Secure access server KDC1 sends CDTG to terminal TA; Terminal TA calculates KEYD. Terminal TA sends a heartbeat frame to TC based on the decrypted TC's service IP and port. If terminal TA receives a response frame from TC, the connection is successfully established; otherwise, it fails.

[0008] The above technical solution has the following advantages or beneficial effects: System parameters are dynamically generated, and access control is jointly completed by the secure access server, the access initiator, and the accessed party. The combination of secure connection and access control results in high system security and a simple implementation process. There is no need to assign a fixed IP and port to the accessed party within the system, making network deployment more flexible and secure. Attached Figure Description

[0009] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0010] Figure 1 This is a flowchart of the method in Example 1. Detailed Implementation

[0011] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0012] Where there is no conflict, the embodiments and features in the embodiments of the present invention can be combined with each other.

[0013] All data acquisition in this embodiment is carried out in accordance with laws and regulations and with user consent, and the data is used legally.

[0014] Example 1 This embodiment provides a secure access and access control method based on Chinese cryptographic algorithms; like Figure 1 As shown, the secure access and access control method based on Chinese cryptographic algorithms includes: S101: When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. S102: After receiving the relevant information of the connection request, the secure access server KDC1 calculates the attribute token parameter ATD of the terminal TB, encrypts the attribute token parameter ATD and sends it to the terminal TB. S103: Terminal TB generates an attribute token TCMb based on the attribute token parameter ATD, generates a session key KeyB based on the attribute token TCMb, and encrypts the service IP, port, TA identifier and TB identifier based on the session key KeyB to obtain encrypted data M. Then, the encrypted data M and the response information are sent to the secure access server KDC1. S104: Secure access server KDC1 calculates attribute token parameter ATC, encrypts attribute token parameter ATC, encrypted data M and response information and sends them to terminal TA; S105: Terminal TA calculates the attribute token TCMa and obtains the session key KeyA based on the attribute token TCMa; it decrypts the encrypted data M based on the session key KeyA and verifies the TA identifier and TB identifier obtained from the decryption. If the verification is successful, the session key is successfully established. Terminal TA sends a heartbeat frame to TB based on the decrypted TB's service IP and port. If terminal TA receives a response frame from TB, the connection is successfully established; otherwise, it fails.

[0015] Furthermore, in step S101: before terminal TA sends the encrypted connection request information to secure access server KDC1 when terminal TA is preparing to establish a connection with terminal TB, the step further includes: S100-1: Terminal TA connects to the secure access server KDC1 and receives the attribute token ATa generated by the secure access server KDC1; S100-2: Terminal TB connects to the secure access server KDC1 and receives the attribute token ATb generated by the secure access server KDC1.

[0016] Furthermore, before S100-1, it also includes: S100-0: System permissions consist of N independent permission items, and The nth permission item is represented by shifting 1 left by n bits, and each permission item is represented by one bit.

[0017] In this embodiment, the system includes: terminal TA, terminal TB, and secure access server KDC1; wherein, secure access server KDC1 is connected to terminal TA and terminal TB respectively.

[0018] In this embodiment, system permissions include: TCP connection permissions, file access permissions, download permissions, cross-domain connection permissions, etc.

[0019] The secure access server KDC1 records the unique identifiers and permissions of all terminals within the domain. After the secure access server KDC1 goes online, it generates a 256-bit random number less than the order n of the SM2 curve for each permission item Pi and stores it in the structure member SMXToken1[i]. The secure access server KDC1 generates a 256-bit random number n0 that is less than the curve order n of SM2.

[0020] The beneficial effects of the above steps are: converting each permission item into bits ensures the independence of each permission item, while also facilitating subsequent retrieval and processing. The introduction of random numbers increases the difficulty of system parameter prediction and attack.

[0021] Further, in S100-1: Terminal TA connects to the secure access server KDC1 and receives the attribute token ATa generated by the secure access server KDC1, including: For terminal TA, m permissions are pre-assigned. For the j-th permission Taj, it is represented by shifting 1 to the left by i bits; where i is the permission item number of the j-th permission in terminal TA; Assume the terminal TA has the following permissions: Pa is a 64-bit unsigned number.

[0022] When terminal TA connects to secure access server KDC1, secure access server KDC1 first concatenates TA's identifier with a random number n0 to obtain the first concatenation result. Then, it performs the SM3 hash algorithm on the first concatenation result to generate a 32-byte hash value, and copies the 32-byte hash value to a 256-bit unsigned number ta. Calculation: tu0 = (ta + n0) % N; Where % represents the remainder of the summation of ta+n0 divided by N, and N represents the order of the SM2 curve; Iterate through each digit of Pa starting from 0. If the i-th digit is 1, then execute: tu = (tu0 + SMXToken1[i]) % N; Where, both tu0 and SMXToken1[i] represent unsigned numbers of 256 bits, and tu represents an intermediate variable; Calculate the attribute token ATa of the terminal TA by performing the SM2 fixed-point scalar multiplication tu.G: ATa = tu.G = (ta + n0 + Pa).G; Where, G is the SM2 base point; For the attribute token ATa of the terminal TA, use the session key key0 between the terminal TA and KDC1, and after encrypting it by invoking the SM4 algorithm, send it to the terminal TA. The session key key0 is obtained based on the SM2 standard key negotiation method.

[0023] Further, the S100-2: The terminal TB is connected to the secure access server KDC1, and receives the attribute token ATb generated by the secure access server KDC1, including: Pre-allocate k permissions for the terminal TB , and for the j-th permission Tbj is represented as 1 << i; where, is the permission item serial number of the j-th permission of the terminal TB; Let the permission of the terminal TB be , where, Pb is an unsigned number of 64 bits.

[0024] When the terminal TB is connected to the secure access server KDC1, the secure access server KDC1 first splices the identifier of TB and the random number n0 to obtain the first splicing result, then performs the SM3 hashing algorithm on the first splicing result to generate a 32-byte hash value, and copies the 32-byte hash value as an unsigned number tb of 256 bits, and calculates: tv0 = (tb + n0) % N; Traverse each bit of Pb starting from 0. If the i-th bit is 1, then execute: tv = (tv0 + SMXToken1[i]) % N; Perform the SM2 fixed-point scalar multiplication tb.G to calculate the attribute token ATa of the terminal TA: ATb = tb.G = (tb + n0 + Pb).G, For the attribute token ATb of the terminal TB, based on methods such as SM2 standard key negotiation, obtain the session key key1 between TA and KDC1, and after encrypting it by invoking the SM4 algorithm, send it to the terminal TB.

[0025] Further, in S101: when terminal TA prepares to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1, including: When terminal TA wants to connect to terminal TB, terminal TA first generates a 256-bit random number n1 less than n, calculates the fixed-point scalar multiplication n1.G, n1G=n1.G, and sets the connection permissions Pac=Tai0+Tai1+...+Taik, requiring that all permissions in Pac are in Pa; The connection permission Pac, random item n1G, terminal TB identifier, and connection request are encrypted using session key key0 and SM4 national cryptographic algorithm and then sent to the secure access server KDC1.

[0026] Further, in step S102: After receiving the relevant information of the connection request, the secure access server KDC1 calculates the attribute token parameter ATD of the terminal TB, encrypts the attribute token parameter ATD, and sends it to the terminal TB, including: S102-1: After receiving a connection request, the secure access server KDC1 uses the session key key0 to call the SM4 national cryptographic algorithm to decrypt the data. Based on the decryption result, it checks the status of terminal TA and terminal TB. If the status is abnormal or decryption fails, it returns an error message: Check if Pac & Pa equals the connection permission Pac. If it does not equal the connection permission Pac or the connection permission Pac is 0, the secure access server KDC1 returns an error message to the terminal TA; otherwise, the check passes. Here, Pa represents the permission of the terminal TA, and & represents the logical AND operation. Check the terminal TB's permission Pb, calculate Pac & Pb. If Pac & Pb is not equal to the connection permission Pac, the secure access server KDC1 returns an error message to the terminal TA; otherwise, the check passes. After the check is passed, the secure access server KDC1 generates a 256-bit random number n2 that is less than n; S102-2: Attribute token parameter ATD for the secure access server KDC1 computing terminal TB: First, the identifier of terminal TB is concatenated with noounce1, and then the SM3 hash algorithm is executed to generate a 32-byte hash value. This 32-byte hash value is then copied into a 256-bit unsigned number tb. The set of non-connection permission items pe = Pb - Pac is then calculated. Iterate through each digit of pe starting from 0. If the i-th digit is 1, then execute: tb1=(tb+ SMXToken1[i])%N; After tb1 is calculated, calculate the temporary variable tb2 = (n2 - tb1) % N; ATD0=tb2.G; ATD0+n1G = n1G+(n2-(tb+Pb-Pac)).G; ATD = ATD0 + n1G; Where tb1 and tb2 are both 256-bit unsigned temporary variables; the temporary parameter ATD0 is a point on the SM2 curve; The terminal TB's attribute token parameter ATD, the terminal TA's identifier, and the connection permission Pac are encrypted using the session key key1 and the national cryptographic algorithm SM4 before being sent to the terminal TB.

[0027] Further, in S103: the terminal TB generates an attribute token TCMb based on the attribute token parameter ATD, generates a session key KeyB based on the attribute token TCMb, encrypts the service IP, port, TA identifier, and TB identifier based on the session key KeyB to obtain encrypted data M, and then sends the encrypted data M and response information to the secure access server KDC1, including: Terminal TB first uses key1 to call the national cryptographic algorithm SM4 to decrypt and recover the data. According to the connection permission Pac, it checks the local access permission list. If terminal TA is allowed to access terminal TB, it calculates the attribute token TCMb and the session key KeyB. Otherwise, it returns an error message to the secure access server KDC1. The attribute token TCMb is a dot-matrix addition of ATD and ATb. TCMb=ATD+ATb=n1G+(n2-(tb+Pb-Pac)).G+(tb+n0+Pb).G= (N2+n0+Pac).G+n1G; Performing an SM3 hash on TCMb yields a 32-byte session key, KeyB. The session key KeyB is used to call the national cryptographic algorithm SM4 to encrypt the IP, port, TA identifier and TB identifier of the local listening service to obtain encrypted data M; then, the encrypted data M and the response information are encrypted using key1 and then sent to KDC1.

[0028] Further, in step S104: the secure access server KDC1 calculates the attribute token parameter ATC, encrypts the attribute token parameter ATC, encrypted data M, and response information, and sends them to the terminal TA, including: The secure access server KDC1 receives data from terminal TB. If it receives an error message, it returns an error message to TA; otherwise, it uses key1 to call the SM4 algorithm to decrypt the data and calculates the attribute token parameter ATC for terminal TA. Let the intermediate variable tu0 be the value ta of a 256-bit unsigned number: tu0=ta; First, calculate the set of non-connection permission items pd for terminal TA: pd = Pa - Pac; Iterate through all positions of the non-connection permission item set pd in terminal TA, starting from 0. If the i-th position is 1, then execute: tu1=(tu0+ SMXToken1[i])%N; After tu1 is calculated, calculate the temporary variable tu = (n2 - tu1) % N; ATC=tu.G =(n2-(ta+Pa-Pac)).G; Among them, the intermediate variables tu1 and tu are both 256-bit unsigned numbers; The attribute token parameter ATC, encrypted data M, and response information are encrypted using the SM4 algorithm via key0 and then sent to the terminal TA.

[0029] Further, in S105: Terminal TA calculates the attribute token TCMa and obtains the session key KeyA based on the attribute token TCMa; it decrypts the encrypted data M based on the session key KeyA, and verifies the TA identifier and TB identifier obtained from the decryption. If the verification is successful, the session key is successfully established. Terminal TA sends a heartbeat frame to TB based on the decrypted TB's service IP and port. If terminal TA receives a response frame from TB, the connection is successfully established; otherwise, it fails, including: After receiving the response information from the secure access server KDC1, the terminal TA uses key0 to call the SM4 algorithm to decrypt and obtain the recovered attribute token parameter ATC1. It then calculates the secure link attribute token TCMa. The value of the secure link attribute token TCMa is the sum of the three points ATC1, ATa, and n1G. TCMa=ATC+ATa +n1G = (ta+n0+Pa).G+(n2-(ta+Pa-Pac)).G = (n2+n0+Pac).G +n1G; Performing an SM3 hash on TCMa yields a 32-byte session key, KeyA. Decrypt the encrypted data M using KeyA. Verify the identifiers of TA and TB based on the decryption result. If successful, the session key is established successfully. Connect to the TB server using the decrypted IP and port of the terminal TB. The terminal TA sends a heartbeat frame encrypted with KEYA. If the terminal TA receives a response frame, the data connection is established successfully; otherwise, it fails.

[0030] Furthermore, the method also includes: After receiving the heartbeat frame, the terminal TB decrypts the heartbeat frame using KEY B. If the decrypted identifier field matches the identifier of TA, the decryption is successful, the data connection is established, and an acknowledgment frame is sent; otherwise, the data connection establishment fails.

[0031] Terminals TA and TB can only establish secure communication if they have the same permissions, while hiding the server's IP and port information. Both communicating parties and KDC can further check these permissions for access control. This scheme can effectively protect privacy information such as permissions and resist possible attacks.

[0032] Example 2 This embodiment provides a secure access and control system based on Chinese cryptographic algorithms; A secure access and control system based on Chinese cryptographic algorithms includes: terminal TA, terminal TB, and secure access server KDC1; the secure access server KDC1 is connected to terminal TA, and the secure access server KDC1 is connected to terminal TB. When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. After receiving the relevant information for the connection request, the secure access server KDC1 calculates the attribute token parameter ATD of the terminal TB, encrypts the attribute token parameter ATD, and sends it to the terminal TB. Terminal TB generates an attribute token TCMb based on the attribute token parameter ATD, generates a session key KeyB based on the attribute token TCMb, and encrypts the service IP, port, TA identifier and TB identifier based on the session key KeyB to obtain encrypted data M. Then, the encrypted data M and the response information are sent to the secure access server KDC1. The secure access server KDC1 calculates the attribute token parameter ATC, encrypts the attribute token parameter ATC, encrypted data M, and response information, and sends them to the terminal TA. Terminal TA calculates the attribute token TCMa and obtains the session key KeyA based on the attribute token TCMa. It then decrypts the encrypted data M based on the session key KeyA and verifies the obtained TA identifier and TB identifier. If the verification is successful, the session key is successfully established. Terminal TA sends a heartbeat frame to TB based on the decrypted TB's service IP and port. If terminal TA receives a response frame from TB, the connection is successfully established; otherwise, it fails.

[0033] Example 3 This embodiment provides a secure access and access control method based on Chinese cryptographic algorithms; Secure access and access control methods based on national cryptographic algorithms include: S301: When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. S302: After receiving the relevant information of the connection request, the secure access server KDC1 sends the CDTD to the secure access server KDC2. S303: Secure access server KDC2 sends CDTE to terminal TC; S304: The terminal TC calculates KeyC; it encrypts the service IP port based on the session key KeyC to obtain M1, and sends M1 and the response message to the secure access server KDC2; S305: Secure access server KDC2 sends CDTF to secure access server KDC1; S306: Secure access server KDC1 sends CDTG to terminal TA; S307: Terminal TA calculates KEYD. Terminal TA sends a heartbeat frame to TC based on the decrypted TC's service IP and port. If terminal TA receives a response frame from TC, the connection is successfully established; otherwise, it fails.

[0034] Furthermore, in S301: before terminal TA sends the encrypted connection request information to secure access server KDC1 when terminal TA is preparing to establish a connection with terminal TB, the following steps are also included: S300-1: The secure access server KDC1 records the unique identifier and permissions of all terminals within this domain. After the secure access server KDC1 goes online, it generates a 256-bit random number less than the SM2 curve order n for each permission item Pi and stores it in the structure member SMXToken1[i]. The secure access server KDC1 generates a 256-bit random number n0 less than the SM2 curve order n. S300-2: Secure access server KDC2, records the identifiers and permissions of all terminals within the domain. After going online, it generates a 256-bit random number less than n for each permission item Pi and stores it in the structure member SMXToken2[i]; it also generates a 256-bit random number n3 less than the curve order n of SM2. S300-3: Terminal TA connects to the secure access server KDC1 and receives the attribute token ATa generated by the secure access server KDC1; S300-4: Terminal TC connects to the secure access server KDC2 and receives the attribute token ATC generated by the secure access server KDC2.

[0035] Furthermore, in S300-3, the specific steps of the terminal TA connecting with the secure access server KDC1 and receiving the attribute token Ata generated by the secure access server KDC1 are the same as in Embodiment 1.

[0036] Further, in S300-4: the terminal TC connects to the secure access server KDC2 and receives the attribute token ATC generated by the secure access server KDC2, including: For the terminal TC, pre-assign n permissions. ; Let TC's permissions be... Pc is a 64-bit unsigned number.

[0037] When terminal TC connects to secure access server KDC2, secure access server KDC2 first concatenates TC's identifier with n3, then executes the SM3 hash algorithm to generate a 32-byte hash value. This 32-byte hash value is then copied into a 256-bit unsigned number tc. The calculation is as follows: tw0 = (tc + n3) % N; Iterate through each digit of Pc starting from 0. If the i-th digit is 1, then execute: tw=(tw0+ SMXToken2[i])%N; Where tw is a 256-bit unsigned temporary variable; The attribute token ATC of the terminal TC is calculated by performing SM2 fixed-point scalar multiplication: ATc = tw.G = (tc + n3 + Pc).G; Where G is the SM2 base point.

[0038] The attribute token ATC is encrypted and sent to TC, with the session key being key2. The session key key2 is generated using algorithms such as the key negotiation protocol in the SM2 standard.

[0039] Further, in S301: when terminal TA prepares to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1, specifically including: Terminal TA has a connection with the secure access server KDC1; Terminal TC has a connection with secure access server KDC2; When terminal TA wants terminal TC to connect, terminal TA first generates a 256-bit random number n4 less than n, calculates n4G=n4.G, and sets the connection permissions CDPac=Tai0+Tai1+...+Taik, requiring all permissions in CDPac to be in Pa; The identifiers of CDPac, n4G, terminal TC, secure access server KDC2, and cross-domain connection request are encrypted using the session key key0 between TA and KDC1 as the master key, and then sent to secure access server KDC1 using the national cryptographic algorithm SM4. The session key key0 between TA and KDC1 is obtained through key negotiation based on the SM2 standard.

[0040] Further, in step S302: After receiving the relevant information of the connection request, the secure access server KDC1 sends the CDTD to the secure access server KDC2, specifically including: After receiving a cross-domain connection request from terminal TA, the secure access server KDC1 calls SM4 to decrypt using key0 as the master key. If decryption fails, an error message is returned to terminal TA; if decryption succeeds, the working status of terminal TA is checked. If the working status is abnormal, an error message is returned to terminal TA. If the working status is normal, check if CDPac&Pa is equal to CDPac. If CDPac&Pa is not equal to CDPac or CDPac is equal to 0, return an error message to TA. If CDPac&Pa is equal to CDPac or CDPac is not equal to 0, the check passes. Here, CDPac represents cross-domain connection permission; Pa represents TA's permission. After the check is passed, the secure access server KDC1 generates a 256-bit random number n5 that is less than n; The secure access server KDC1 calculates the Cross-Domain Secure Connection Attribute Token (CDTD) parameter: nt = (n0 + n5 + CDPac) % N; CDTD = nt.G + n4G; Where nt represents the cross-domain secure connection attribute token coefficient; The CDTD, TA, TC, and CDPac information are encrypted using the KDC2 identifier as the public key and then sent to the secure access server KDC2 after being encrypted using SM9. If the connection between KDC1 and KDC2 fails, an error message is returned to the terminal TA.

[0041] Furthermore, S303: The secure access server KDC2 sends a CDTE to the terminal TC, specifically including: The secure access server KDC2 decrypts the data using the SM9 private key. The secure access server KDC2 checks the status of the terminal TC. If the status of the terminal TC is abnormal or decryption fails, it returns an error. If the terminal TC is functioning normally, generate a 256-bit random number n6 that is less than n, and calculate the Cross-Domain Secure Connection Attribute Token (CDTE) parameter: nt1=(n6+n0+n5-(tc+Pc-CDPac))%N CDTE = nt1.G + n4G Where nt1 represents the coefficient of the cross-domain secure connection attribute token parameter; The CDTE, TA identifier, and cross-domain connection permission CDPac are encrypted using key2 as the master key and then sent to the terminal TC after being encrypted using SM4.

[0042] Further, in S304: the terminal TC calculates KeyC; encrypts the service IP port, TA identifier, and TC identifier according to the session key KeyC to obtain M1, and sends M1 and the response message to the secure access server KDC2, specifically including: After terminal TC uses key2 as the master key to call SM4 for decryption, it checks the local access permission list according to the cross-domain connection permission CDPac. If terminal TA is allowed to access terminal TC, it calculates the attribute token CDTc and the session key; otherwise, it returns an error message to KDC2. CDTc = CDTE + ATc = (tc+n3+Pc).G+(n6+n0+n5-(tc+Pc-CDPac).G+n4G = (n3+n0+n5+n6+CDPac).G +n4G; Performing an SM3 hash on CDTc yields a 32-byte session key, KeyC. The IP port, TA identifier, and TC identifier information of the local listening service are encrypted using the SM4 algorithm called by KeyC to obtain M1. M1 and the response information are then encrypted using the SM4 algorithm called by key3 and sent to KDC2.

[0043] Further, step S305: Secure access server KDC2 sends CDTF to secure access server KDC1, specifically including: If the secure access server KDC2 receives the response information from TC, it calculates the cross-domain secure connection attribute token parameter CDTF; otherwise, it returns an error message to the secure access server KDC1. CDTF = (n3 + n6)G; The CDTF, M1, and response information are identified by KDC1 as the public key, encrypted using SM9, and then sent to KDC1.

[0044] Further, S306: The secure access server KDC1 sends CDTG to the terminal TA, specifically including: If the secure access server KDC1 receives a response from KDC2, it decrypts it using the SM9 private key; otherwise, it sends an error message to TA. Calculate the Cross-Domain Secure Connection Attribute Token parameter CDTG: Calculate the cross-domain secure connection attribute token parameter coefficient nm = (n5 + ta + Pa - CDPac)%N; CDTG is a point on the SM2 curve. First, a fixed-point scalar multiplication with nm as the coefficient is calculated to obtain the coordinates of a point. Then, a point subtraction operation is performed between CDTF and these coordinates to obtain CDTG. CDTG= CDTF -nm.G = (n3+n6+n5- ta-Pa +CDPac).G; The CDTG, M1, and response information are encrypted using the SM4 algorithm with key0 and then sent to the terminal TA.

[0045] Further, in step S307: Terminal TA calculates KEYD, and terminal TA sends a heartbeat frame to TC based on the decrypted TC's service IP and port. If terminal TA receives a response frame from TC, the connection is successfully established; otherwise, it fails. Specifically, this includes: After receiving the KDC1 response data, the terminal TA uses key0 to call the SM4 algorithm to decrypt the computed attribute token CDTa and the session key; CDTa is a point on the SM2 curve. First, calculate the fixed-point scalar multiplication with a coefficient of n4 to obtain the coordinates of a point. Then, perform point addition with CDTG and the point coordinates, and then perform point addition with ATa to obtain CDTa. CDTa = CDTG + n4G + ATa = (n3+n6 +n5- ta-Pa +CDPac+n4).G+ (ta+n0+Pa).G = (n3+n6+n5+n0+CDPac+n4).G Performing an SM3 hash on TCMa yields a 32-byte session key, KeyD. Decrypt M1 using the session key KeyD. Verify the identifiers of TA and TC based on the decryption result. If successful, the session key is successfully established. Connect to the server of terminal TC using the decrypted IP and port of terminal TC, and send a heartbeat frame encrypted with KEYD to terminal TC. If terminal TA receives a response frame, the data connection is successfully established; otherwise, it fails.

[0046] Furthermore, the method also includes: after the TC receives the heartbeat frame, if it successfully decrypts it with KEY C, the data connection is established and an acknowledgment frame is sent; otherwise, the data connection establishment fails.

[0047] Example 4 This embodiment provides a secure access and control system based on Chinese cryptographic algorithms, including: terminal TA, terminal TB, secure access server KDC1 and secure access server KDC2; terminal TA is connected to secure access server KDC1; secure access server KDC1 is connected to secure access server KDC2, and secure access server KDC2 is connected to terminal TB. When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. After receiving the relevant information for the connection request, the secure access server KDC1 sends the CDTD to the secure access server KDC2. Secure access server KDC2 sends CDTE to terminal TC; The terminal TC calculates KeyC; it encrypts the service IP port based on the session key KeyC to obtain M1, and sends M1 and the response message to the secure access server KDC2; Secure access server KDC2 sends CDTF to secure access server KDC1; Secure access server KDC1 sends CDTG to terminal TA; Terminal TA calculates KEYD. Terminal TA sends a heartbeat frame to TC based on the decrypted TC's service IP and port. If terminal TA receives a response frame from TC, the connection is successfully established; otherwise, it fails.

[0048] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A secure access and access control method based on national cryptographic algorithms, characterized in that: include: When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. After receiving the relevant information for the connection request, the secure access server KDC1 calculates the attribute token parameter ATD of the terminal TB, encrypts the attribute token parameter ATD, and sends it to the terminal TB. Terminal TB generates an attribute token TCMb based on the attribute token parameter ATD, generates a session key KeyB based on the attribute token TCMb, and encrypts the service IP, port, TA identifier and TB identifier based on the session key KeyB to obtain encrypted data M. Then, the encrypted data M and the response information are sent to the secure access server KDC1. The secure access server KDC1 calculates the attribute token parameter ATC, encrypts the attribute token parameter ATC, encrypted data M, and response information, and sends them to the terminal TA. Terminal TA calculates the attribute token TCMa and obtains the session key KeyA based on the attribute token TCMa. It then decrypts the encrypted data M based on the session key KeyA and verifies the obtained TA identifier and TB identifier. If the verification is successful, the session key is successfully established. Terminal TA sends a heartbeat frame to TB based on the decrypted TB's service IP and port. If terminal TA receives a response frame from TB, the connection is successfully established; otherwise, it fails.

2. The secure access and access control method based on national cryptographic algorithms as described in claim 1, characterized in that, When terminal TA prepares to establish a connection with terminal TB, before sending the encrypted connection request information to the secure access server KDC1, it also includes: Terminal TA connects to the secure access server KDC1 and receives the attribute token ATa generated by the secure access server KDC1. Terminal TB connects to the secure access server KDC1 and receives the attribute token ATb generated by the secure access server KDC1.

3. The secure access and access control method based on national cryptographic algorithms as described in claim 2, characterized in that, Terminal TA connects to the secure access server KDC1 and receives the attribute token ATa generated by the secure access server KDC1, including: For terminal TA, m permissions are pre-assigned. For the j-th permission Taj, it is represented by shifting 1 to the left by i bits; where i is the permission item number of the j-th permission in terminal TA. Assume the terminal TA has the following permissions: Pa is a 64-bit unsigned number; When terminal TA connects to secure access server KDC1, secure access server KDC1 first concatenates TA's identifier with a random number n0 to obtain the first concatenation result. Then, it performs the SM3 hash algorithm on the first concatenation result to generate a 32-byte hash value, and copies the 32-byte hash value to a 256-bit unsigned number ta. Calculation: tu0 = (ta + n0) % N; Where % represents the remainder of the summation of ta+n0 divided by N, and N represents the order of the SM2 curve; Iterate through each digit of Pa starting from 0. If the i-th digit is 1, then execute: tu = (tu0 + SMXToken1[i]) % N; Where tu0 and SMXToken1[i] both represent 256-bit unsigned numbers, and tu represents an intermediate variable; The attribute token ATa of the terminal TA is calculated by performing the SM2 fixed-point scalar multiplication tu.G: ATa = tu.G = (ta + n0 + Pa).G; Where G is the SM2 base point; The attribute token ATa of terminal TA is encrypted using the session key key0 of terminal TA and KDC1, and then sent to terminal TA after calling the SM4 algorithm.

4. The secure access and access control method based on national cryptographic algorithms as described in claim 1, characterized in that, When terminal TA prepares to establish a connection with terminal TB, terminal TA sends the relevant information of the connection request to the secure access server KDC1 after encryption, including: When terminal TA wants to connect to terminal TB, terminal TA first generates a 256-bit random number n1 less than n, calculates the fixed-point scalar multiplication n1.G, n1G=n1.G, and sets the connection permissions Pac=Tai0+Tai1+...+Taik, requiring that all permissions in Pac are in Pa; The connection permission Pac, random item n1G, terminal TB identifier, and connection request are encrypted using session key key0 and SM4 national cryptographic algorithm and then sent to the secure access server KDC1.

5. The secure access and access control method based on national cryptographic algorithms as described in claim 1, characterized in that, After receiving the connection request information, the secure access server KDC1 calculates the attribute token parameter ATD of the terminal TB, encrypts the attribute token parameter ATD, and sends it to the terminal TB, including: After receiving a connection request, the secure access server KDC1 uses the session key key0 to call the SM4 national cryptographic algorithm to decrypt the data. Based on the decryption result, it checks the status of terminal TA and terminal TB. If the status is abnormal or decryption fails, it returns an error message: Check if Pac & Pa equals the connection permission Pac. If it does not equal the connection permission Pac or the connection permission Pac is 0, the secure access server KDC1 returns an error message to the terminal TA; otherwise, the check passes. Here, Pa represents the permission of the terminal TA, and & represents the logical AND operation. Check the terminal TB's permission Pb, calculate Pac & Pb. If Pac & Pb is not equal to the connection permission Pac, the secure access server KDC1 returns an error message to the terminal TA; otherwise, the check passes. After the check is passed, the secure access server KDC1 generates a 256-bit random number n2 that is less than n; The attribute token parameter ATD for the secure access server KDC1 computing terminal TB: First, the identifier of terminal TB is concatenated with noounce1, and then the SM3 hash algorithm is executed to generate a 32-byte hash value. This 32-byte hash value is then copied into a 256-bit unsigned number tb. The set of non-connection permission items pe = Pb - Pac is then calculated. Iterate through each digit of pe starting from 0. If the i-th digit is 1, then execute: tb1=(tb+ SMXToken1[i])%N; tb2=(n2-tb1)%N; ATD0=tb2.G; ATD0+n1G = n1G+(n2-(tb+Pb-Pac)).G; ATD = ATD0 + n1G; Where tb1 and tb2 are both temporary variables of 256-bit unsigned numbers; the temporary parameter ATD0 is a point on the SM2 curve; The terminal TB's attribute token parameter ATD, the terminal TA's identifier, and the connection permission Pac are encrypted using the session key key1 and the national cryptographic algorithm SM4 before being sent to the terminal TB.

6. The secure access and access control method based on national cryptographic algorithms as described in claim 1, characterized in that, Terminal TB generates an attribute token TCMb based on the attribute token parameter ATD, generates a session key KeyB based on the attribute token TCMb, and encrypts the service IP, port, TA identifier, and TB identifier based on the session key KeyB to obtain encrypted data M. Then, it sends the encrypted data M and response information to the secure access server KDC1, including: Terminal TB first uses key1 to call the national cryptographic algorithm SM4 to decrypt and recover the data. According to the connection permission Pac, it checks the local access permission list. If terminal TA is allowed to access terminal TB, it calculates the attribute token TCMb and the session key KeyB. Otherwise, it returns an error message to the secure access server KDC1. The attribute token TCMb is a dot-matrix addition of ATD and ATb. TCMb=ATD+ATb=n1G+(n2-(tb+Pb-Pac)).G+(tb+n0+Pb).G= (N2+n0+Pac).G+n1G; Performing an SM3 hash on TCMb yields a 32-byte session key, KeyB. The session key KeyB is used to call the national cryptographic algorithm SM4 to encrypt the IP, port, TA identifier and TB identifier of the local listening service to obtain encrypted data M; then, the encrypted data M and the response information are encrypted using key1 and then sent to KDC1.

7. The secure access and access control method based on national cryptographic algorithms as described in claim 1, characterized in that, The secure access server KDC1 calculates the attribute token parameter ATC, encrypts the attribute token parameter ATC, encrypted data M, and response information, and sends them to the terminal TA, including: The secure access server KDC1 receives data from terminal TB. If it receives an error message, it returns an error message to TA; otherwise, it uses key1 to call the SM4 algorithm to decrypt the data and calculates the attribute token parameter ATC for terminal TA. Let the intermediate variable tu0 be the value ta of a 256-bit unsigned number: tu0=ta; First, calculate the set of non-connection permission items pd for terminal TA: pd = Pa - Pac; Iterate through all positions of the non-connection permission item set pd in terminal TA, starting from 0. If the i-th position is 1, then execute: tu1=(tu0+ SMXToken1[i])%N; tu = (n2 - tu1) % N; ATC=tu.G =(n2-(ta+Pa-Pac)).G; Among them, the intermediate variables tu1 and tu are both 256-bit unsigned numbers; The attribute token parameter ATC, encrypted data M, and response information are encrypted using the SM4 algorithm via key0 and then sent to the terminal TA.

8. A secure access and control system based on national cryptographic algorithms, characterized in that: include: Terminal TA, terminal TB, and secure access server KDC1; The secure access server KDC1 has a connection relationship with the terminal TA, and the secure access server KDC1 has a connection relationship with the terminal TB; When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. After receiving the relevant information for the connection request, the secure access server KDC1 calculates the attribute token parameter ATD of the terminal TB, encrypts the attribute token parameter ATD, and sends it to the terminal TB. Terminal TB generates an attribute token TCMb based on the attribute token parameter ATD, generates a session key KeyB based on the attribute token TCMb, and encrypts the service IP, port, TA identifier and TB identifier based on the session key KeyB to obtain encrypted data M. Then, the encrypted data M and the response information are sent to the secure access server KDC1. The secure access server KDC1 calculates the attribute token parameter ATC, encrypts the attribute token parameter ATC, encrypted data M, and response information, and sends them to the terminal TA. Terminal TA calculates the attribute token TCMa and obtains the session key KeyA based on the attribute token TCMa. It then decrypts the encrypted data M based on the session key KeyA and verifies the obtained TA identifier and TB identifier. If the verification is successful, the session key is successfully established. Terminal TA sends a heartbeat frame to TB based on the decrypted TB's service IP and port. If terminal TA receives a response frame from TB, the connection is successfully established; otherwise, it fails.

9. A secure access and access control method based on Chinese national cryptographic algorithms, characterized in that: include: When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. After receiving the relevant information for the connection request, the secure access server KDC1 sends the CDTD to the secure access server KDC2. Secure access server KDC2 sends CDTE to terminal TC; The terminal TC calculates KeyC; it encrypts the service IP port based on the session key KeyC to obtain M1, and sends M1 and the response message to the secure access server KDC2; Secure access server KDC2 sends CDTF to secure access server KDC1; Secure access server KDC1 sends CDTG to terminal TA; Terminal TA calculates KEYD. Terminal TA sends a heartbeat frame to TC based on the decrypted TC's service IP and port. If terminal TA receives a response frame from TC, the connection is successfully established; otherwise, it fails.

10. A secure access and control system based on national cryptographic algorithms, characterized in that, include: Terminal TA, terminal TB, secure access server KDC1, and secure access server KDC2; Terminal TA connects to secure access server KDC1; Secure access server KDC1 connects to secure access server KDC2, and secure access server KDC2 connects to terminal TB. When terminal TA is ready to establish a connection with terminal TB, terminal TA encrypts the relevant information of the connection request and sends it to the secure access server KDC1. After receiving the relevant information for the connection request, the secure access server KDC1 sends the CDTD to the secure access server KDC2. Secure access server KDC2 sends CDTE to terminal TC; The terminal TC calculates KeyC; it encrypts the service IP port based on the session key KeyC to obtain M1, and sends M1 and the response message to the secure access server KDC2; Secure access server KDC2 sends CDTF to secure access server KDC1; Secure access server KDC1 sends CDTG to terminal TA; Terminal TA calculates KEYD. Terminal TA sends a heartbeat frame to TC based on the decrypted TC's service IP and port. If terminal TA receives a response frame from TC, the connection is successfully established; otherwise, it fails.

Images