Ukey full-link national secret encryption communication method based on SM3 and SM4

Abstract

The application discloses a Ukey full-link national secret encryption communication method based on SM3 and SM4, and relates to the technical field of communication encryption. The method comprises the following steps: obtaining a physically unclonable function output value of a Ukey client, and performing SM3 hash operation on the physically unclonable function output value to obtain a device fingerprint; inputting the device fingerprint into an SM4 key derivation function as an entropy source to generate an initial session key; using the initial session key to perform SM4 encryption on an identity authentication request of the Ukey client to obtain an encrypted authentication request; after receiving the encrypted authentication request, a server uses the initial session key to perform decryption, and searches a preset key library for a corresponding device fingerprint; the server generates a random number, performs SM3 hash on the random number to obtain a challenge value, encrypts the challenge value using the initial session key, and then sends the challenge value; the Ukey client decrypts the challenge value, performs SM3 hash on a local random number, and then compares the challenge value and the local random number byte by byte; if the challenge value and the local random number are consistent, the session key is confirmed to be valid; and subsequent communication payloads are all subjected to SM4 encryption using the session key and are attached with SM3 hash digests.

Description

Technical Field

[0001] This invention relates to the field of communication encryption technology, specifically to a Ukey full-link national cryptographic encryption communication method based on SM3 and SM4. Background Technology

[0002] U-key-based authentication and encrypted communication are widely used technologies in the field of information security. In existing U-key communication schemes, the generation of the initial key typically relies on a static seed or pre-set key stored internally. This static key binding method is susceptible to device spoofing due to the reading or copying of data within the chip. Furthermore, the entropy source upon which the key derivation process depends is of low quality, easily leading to key predictability and reducing the overall security of the communication link.

[0003] After session key negotiation, existing technologies typically only perform symmetric encryption on the communication payload, lacking a continuous verification mechanism for the integrity of transmitted data. Attackers may compromise the integrity of communication content and the synchronization state of the session by tampering with the ciphertext or performing replay attacks, and relying solely on symmetric encryption algorithms cannot effectively detect such tampering. Furthermore, when the server authenticates the client, conventional challenge-response mechanisms often directly transmit plaintext random numbers or simple transformed values ​​over the network, leaving exploitable channels for man-in-the-middle attacks and replay attacks, making it difficult for the server to verify whether the communicating partner is a legitimate physical device entity.

[0004] To address the risks of counterfeiting caused by the loose binding between keys and device physical characteristics in existing technologies, as well as the security vulnerabilities in data integrity protection and challenge response mechanisms in session links, a solution is needed that can deeply bind key derivation to the chip's unique physical characteristics and simultaneously perform encryption protection and integrity verification on the payload throughout the entire communication process. Summary of the Invention

[0005] The purpose of this invention is to provide a Ukey full-link national cryptographic encryption communication method based on SM3 and SM4, so as to solve the problems of counterfeiting risk caused by the loose binding between the key and the physical characteristics of the device in the existing technology, as well as the security risks of data integrity protection and challenge response mechanisms in the session link.

[0006] To achieve the above objectives, this invention provides the following technical solution: This invention provides a Ukey end-to-end national cryptographic encryption communication method based on SM3 and SM4. This method utilizes a combination of physically unclonable functions and national cryptographic algorithms to establish a highly secure encrypted channel between the Ukey client and the server. Specifically, the output value of the physically unclonable function of the Ukey client is obtained, and an SM3 hash operation is performed on the output value to obtain a device fingerprint. This device fingerprint is used as an entropy source and input into an SM4 key derivation function to generate an initial session key, thereby achieving an inseparable binding between the session key and a specific physical device, eliminating the possibility of key duplication on unauthorized devices. The Ukey client uses the initial session key to encrypt the authentication request using SM4 to obtain an encrypted authentication request. After receiving the request, the server decrypts it using the same initial session key to obtain the authentication request, and retrieves a pre-stored device fingerprint corresponding to the information carried in the request from a pre-set key library for consistency comparison, thereby completing the initial verification of the Ukey's identity.

[0007] The server generates a random number, performs an SM3 hash on the random number to obtain a challenge value, and then uses the initial session key to encrypt the challenge value using SM4 to obtain an encrypted challenge value, which is then sent to the Ukey client. Upon receiving the encrypted challenge value, the Ukey client decrypts it using the initial session key to obtain the challenge value, performs an SM3 hash on the corresponding randomly number stored locally to obtain a local hash value, and compares the decrypted challenge value with the local hash value byte-by-byte. If they match, the session key is confirmed to be valid, and it is also proven that both parties possess the same entropy source information, completing two-way authentication. This process uses a combination of Chinese national cryptographic hashing and block ciphers to construct a challenge-response mechanism, effectively defending against man-in-the-middle attacks and replay attacks.

[0008] After key confirmation, all subsequent communication payloads between the Ukey client and the server are encrypted using the initial session key as the working key with SM4 encryption, and an SM3 hash digest is appended to each data packet. Because the working key is strongly associated with the device fingerprint, even if the communication is intercepted, the content cannot be decrypted without the same physical chip. The appended packet digest allows the receiver to promptly verify data integrity, preventing tampering and repudiation.

[0009] In a preferred implementation, when acquiring the physical unclonable function output value of the Ukey client, a preset excitation signal is applied to the physical unclonable function circuit within the Ukey chip. The analog response output by the acquisition circuit is converted from analog to digital to obtain the original response sequence. This original response sequence is then concatenated with the unique identifier of the Ukey chip to form a physical unclonable function output value that is unique and unpredictable. This hybrid output allows the device fingerprint to carry more physical features, enhancing the fingerprint's distinguishability and security strength.

[0010] In one technical solution of the present invention, the process of generating an initial session key using the device fingerprint as an entropy source includes: concatenating the device fingerprint with a first random number generated by the Ukey client and inputting the concatenation into the extended round function of the SM4 encryption algorithm; and using the 128-bit intermediate value output by the extended round function as the initial session key. This derivation method introduces a random factor, ensuring that different session keys can be generated even if the same device negotiates multiple times, thus satisfying forward security requirements.

[0011] Preferably, the authentication request is encrypted using the SM4 electronic codebook mode. The authentication request data is encrypted in 128-bit blocks and then concatenated. A message authentication code protected by the initial session key is appended to the end of the payload. The authentication code is obtained by encrypting the payload digest using SM4. In this way, the server can verify the integrity and authenticity of the authentication request while decrypting it.

[0012] The preferred method for the server to process encrypted authentication requests is as follows: The ciphertext portion is decrypted using the initial session key using SM4 to obtain the plaintext authentication request. The Ukey identifier field is extracted from the plaintext. The server then searches for a pre-stored device fingerprint associated with this identifier in its pre-configured keystore and compares the pre-stored device fingerprint with the hash value of the device fingerprint obtained from the decrypted information. This step integrates device fingerprint verification with regular identifier lookup, reducing additional negotiation overhead.

[0013] When generating the challenge value, the server uses a hardware random number generator to produce a second 256-bit random number. The SM3 algorithm is then used to hash this second random number to obtain a first hash value. This first hash value is used as the challenge value, and then encrypted using the initial session key in feedback link mode with SM4 encryption to obtain the encrypted challenge value. The hardware random number generator ensures the randomness of the challenge, while the feedback link mode improves the ability of the ciphertext to mask the statistical characteristics of the plaintext.

[0014] Accordingly, when the Ukey client decrypts the challenge value, it uses the initial session key to perform SM4 decryption on the encrypted challenge value in feedback link mode to obtain the decryption challenge value. It then extracts the second random number stored locally and performs SM3 hashing to obtain the local hash value. Finally, it compares the decryption challenge value with the local hash value byte by byte, starting from the first byte. If all bytes are equal, it returns a verification success flag. This byte-by-byte comparison avoids information leakage caused by timing-side channel differences.

[0015] Once the challenge and response verification is successful, the Ukey client sends an acknowledgment message encrypted with the initial session key to the server, which then marks the initial session key as a valid working key. For each subsequent data packet transmission, the payload data is first encrypted using SM4 with the working key to obtain ciphertext. Then, the byte stream concatenated with the packet sequence number is hashed using SM3 to obtain a packet digest, which is appended to the ciphertext before transmission. This packet-level integrity protection mechanism ensures that any tampering with the ciphertext or its order will result in a digest mismatch, thus enhancing end-to-end security.

[0016] Furthermore, the SM4 encryption of the payload data introduces a ciphertext block chaining mode: the payload data is divided into 128-bit blocks, and when each block is encrypted using the working key, the ciphertext of the previous block is used as a feedback parameter in the current block encryption; for trailing blocks less than 128 bits, PKCS7 padding is used to complete the block before encryption. The chaining mode allows the same plaintext block to generate different ciphertexts, resisting analytical attacks.

[0017] For packet digest generation, the packet sequence number is converted to an 8-byte big-endian representation, concatenated with the ciphertext byte stream to form the data to be hashed. The SM3 hash function is then used to iteratively compress the data to be hashed to obtain a 256-bit digest. The first 128 bits are then truncated as the packet digest and embedded at a fixed position at the end of the data packet. This design reduces the additional length while ensuring check strength, balancing security and transmission efficiency.

[0018] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0019] The system obtains the physical unclonable function output value of the Ukey client and performs an SM3 hash operation on this output value to obtain the device fingerprint. This device fingerprint is then used as the entropy source input to the SM4 key derivation function to generate the initial session key. The analog response output from the physical unclonable function circuit is converted from analog to digital to obtain the original response sequence. This sequence is then concatenated with the chip's unique identifier as the output value, ensuring that the device fingerprint is directly generated from uncontrollable physical random differences during chip manufacturing. This difference is unclonable, unpredictable, and the complete analog response characteristics cannot be read from the chip; any attempt to probe it will alter the physical properties. Using this device fingerprint as the unique entropy source of the SM4 key derivation function uniquely binds the generated initial session key to the specific physical chip. Even if different Ukey chips have the same identifier, their derived initial session keys will be completely different due to the different outputs of their physical unclonable functions. Attackers cannot obtain a valid session key by copying static data within the chip or extracting firmware code.

[0020] The Ukey client generates a local hash value using SM3 hashing with a locally stored second random number. This hash value is then compared byte-by-byte with the decrypted challenge value to verify the validity of the session key. Both the server and client use the same second random number as the basis for the challenge response. This random number is generated and stored locally only during the initialization phase and is not directly transmitted over the network. Only the SM3 hash value encrypted with the initial session key appears in the transmission path; this is the encrypted challenge value. Even if an attacker intercepts this ciphertext, they cannot decrypt the plaintext challenge value because they cannot obtain the initial session key derived from the device's physical unique characteristics. This comparison method, which returns a verification success flag only when each byte is completely identical, eliminates the possibility of man-in-the-middle attacks based on hash collisions infiltrating the session during the verification process through partial matching. After confirming the validity of the session key, each data packet is encrypted using SM4 with the working key. Then, an SM3 hash is used to obtain a packet digest, which is appended to the ciphertext and sent. The packet digest calculation couples the ciphertext with the sequence number of the sequential data packets. The receiver can independently verify whether the encrypted data of each data packet is complete and whether the packet sequence number is continuous. Any tampering with the ciphertext or replaying the data packets in the correct order will cause the digest verification to fail, thus achieving end-to-end packet-by-packet data integrity protection. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0022] Figure 1 This is a flowchart of the Ukey full-link national cryptographic encryption communication method based on SM3 and SM4;

[0023] Figure 2 This is a flowchart of the Ukey client device fingerprint and initial session key generation process;

[0024] Figure 3 This is a flowchart of the encryption and decryption verification process for identity authentication requests;

[0025] Figure 4 This is a flowchart of the challenge value generation and verification process. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] See Figure 1 This invention provides a Ukey end-to-end national cryptographic encryption communication method based on SM3 and SM4, including: obtaining the physical unclonable function output value of the Ukey client; performing an SM3 hash operation on the physical unclonable function output value to obtain a device fingerprint; using the device fingerprint as an entropy source input to an SM4 key derivation function to generate an initial session key; using the initial session key to encrypt the Ukey client's authentication request using SM4 to obtain an encrypted authentication request; after receiving the encrypted authentication request, the server decrypts it using the initial session key to obtain the authentication request and retrieves the corresponding device fingerprint from a preset key library; the server generates a random number, performs an SM3 hash on the random number to obtain a challenge value, and performs an SM4 encryption on the challenge value using the initial session key to obtain an encrypted challenge value; the Ukey client receives the encrypted challenge value, decrypts it using the initial session key to obtain the challenge value, performs an SM3 hash on the local random number and compares it byte-by-byte with the challenge value; if the comparison matches, the validity of the session key is confirmed, and all subsequent communication payloads are encrypted using the initial session key as the working key using SM4, and an SM3 hash digest is appended to each data packet.

[0028] Example 1:

[0029] In specific implementation, please refer to Figure 2The process of obtaining the physically unclonable function (PUC) output value from the Ukey client is as follows: The Ukey chip integrates a PUC circuit. The Ukey client's main controller applies a preset excitation signal to the PUC circuit. The preset excitation signal is a predefined digital level sequence with a length of 256 bits, which is read from the read-only memory by the Ukey client firmware during the initialization phase. Driven by the preset excitation signal, the PUC circuit utilizes the unique physical characteristics generated by random process deviations during chip manufacturing to output an analog response signal. The analog-to-digital converter samples and quantizes the analog response signal with 12-bit precision to obtain a digitized original response sequence, which is a set of 256 12-bit sampled values. Subsequently, the unique identifier of the Ukey chip is read from the protected memory area of ​​the Ukey chip. The unique identifier is a 64-bit binary sequence, burned into the chip at the factory. The original response sequence is concatenated with the unique identifier in order from high to low bits, with the original response sequence placed in the high-order part and the unique identifier placed in the low-order part. The resulting bit string is used as the PUC output value.

[0030] The implementation of obtaining a device fingerprint by performing an SM3 hash operation on the output value of the Physically Unclonable Function (PUCF) is as follows: The PUCF output value is used as the input message for the SM3 hash function. The SM3 hash function pads the input message by first adding a "1" bit to the end of the message, then adding several "0" bits, making the length of the padded message modulo 512 remainder 448. Finally, a 64-bit bit string is appended, which is the binary representation of the input message length. After padding, the SM3 hash function groups the message into 512-bit blocks and initializes eight 32-bit registers with initial values ​​specified by the national cryptographic standard SM3. Then, 64 rounds of iterative compression are performed on each message block, using a constant table and Boolean functions to obtain a 256-bit hash value, which is used as the device fingerprint. The device fingerprint is stored in the secure memory area of ​​the Ukey client.

[0031] The process of generating the initial session key using the device fingerprint as the entropy source input to the SM4 key derivation function is as follows: The Ukey client calls a random number generator to generate a first random number, which is a 128-bit binary sequence. The device fingerprint and the first random number are XORed bit-by-bit to obtain a 128-bit XOR result. This XOR result is used as the key and input into the extended round function of the SM4 encryption algorithm. The extended round function of the SM4 encryption algorithm is implemented as follows: First, the 128-bit key is XORed bit-by-bit with the 128-bit system parameter FK to obtain an initial intermediate value. The system parameter FK is a fixed constant value specified by the SM4 algorithm. Then, the initial intermediate value is split into four 32-bit words and iterated 32 times according to the SM4 key expansion algorithm. Each iteration uses the round constant CK and a fixed nonlinear transformation, which includes S-box substitution and linear shift. After the fourth iteration, the four 32-bit words output at this point are concatenated into a 128-bit intermediate value, which is used as the initial session key. The initial session key is stored in the secure memory of the Ukey client and marked as the session encryption key for subsequent communication.

[0032] Example 2:

[0033] In specific implementation, please refer to Figure 3 The process of obtaining an encrypted authentication request by encrypting the Ukey client's authentication request using the initial session key using SM4 is as follows: The authentication request data to be sent is obtained. This data includes the Ukey identifier field and a device fingerprint hash value pre-calculated and embedded by the Ukey client. The authentication request data is divided into 128-bit blocks. If the last block is less than 128 bits, padding bytes are added to the end of the last block using PKCS7 padding, with each padding byte equal to the number of padding bytes, until the last block reaches 128 bits. Each 128-bit plaintext block is encrypted using the initial session key in SM4 electronic codebook mode. SM4 electronic codebook mode encryption involves inputting the 128-bit plaintext block and the initial session key into an SM4 block encryption function, which performs round key addition, round iterative transformation, and reverse transformation to output a 128-bit ciphertext block. All ciphertext blocks are then concatenated sequentially according to the original plaintext block order to obtain the ciphertext portion. The complete authentication request data is hashed using the SM3 hash function to obtain a 256-bit payload digest. The payload digest is then encrypted using SM4 with the initial session key to obtain the authentication code. Specifically, the payload digest is divided into 128-bit blocks, and each 128-bit block is encrypted using the initial session key using SM4. The encrypted blocks are then concatenated to form the authentication code. The authentication code is appended to the end of the ciphertext portion, with the ciphertext portion preceding the authentication code, forming the encrypted authentication request.

[0034] After receiving the encrypted authentication request, the server decrypts it using the initial session key to obtain the identity authentication request and retrieves the corresponding device fingerprint from the pre-set key library. The process is as follows: The server separates the ciphertext and authentication code portions from the encrypted authentication request according to a predetermined length offset. The ciphertext portion is the byte sequence after removing the trailing authentication code from the encrypted authentication request. The server uses the initial session key to perform SM4 decryption on the ciphertext portion, dividing it into 128-bit blocks. For each 128-bit ciphertext block, the server performs SM4 decryption using the initial session key. SM4 decryption is the inverse process of SM4 encryption, outputting a 128-bit plaintext block. All the decrypted plaintext blocks are concatenated sequentially, and the trailing PKCS7 padding bytes are removed. The removal method involves reading the value of the last byte as the padding length and truncating the corresponding number of trailing bytes to obtain the plaintext identity authentication request. The Ukey identifier field is parsed from the plaintext identity authentication request. The Ukey identifier field is a fixed-length string at a fixed offset in the plaintext identity authentication request. Using the Ukey identifier field as the search key, a search is performed in the server's pre-configured keystore, which stores the correspondence between the Ukey identifier field and pre-stored device fingerprints. If a matching record is found, the corresponding pre-stored device fingerprint is retrieved. The pre-stored device fingerprint is a 256-bit value obtained by hashing the output value of the Physically Unclonable Function (PUFC) stored by the server during Ukey device registration using SM3 hashing. The decrypted device fingerprint hash value is extracted from the plaintext authentication request. The decrypted device fingerprint hash value is a 256-bit value calculated and inserted by the Ukey client when generating the authentication request. The pre-stored device fingerprint and the decrypted device fingerprint hash value are compared byte by byte. If all bytes are equal, the device fingerprint is considered to match, and the subsequent challenge value generation process continues.

[0035] Example 3:

[0036] In specific implementation, please refer to Figure 4The server generates a random number, performs an SM3 hash on the random number to obtain a challenge value, and then uses the initial session key to encrypt the challenge value using SM4 to obtain an encrypted challenge value. The process is as follows: The server calls a hardware random number generator to generate a second random number. The hardware random number generator is a physical random source based on semiconductor thermal noise. The server acquires a 256-bit binary sequence through an acquisition interface, which serves as the second random number. The server uses the SM3 algorithm to hash the second random number to obtain a first hash value. The message padding process of the SM3 algorithm is as follows: A "1" bit is appended to the end of the binary sequence of the second random number, followed by several "0" bits, until the message length modulo 512 leaves a remainder of 448. Then, a 64-bit length field is appended, with the value of the length of the second random number in bits. The padded message is grouped into 512-bit blocks. The eight 32-bit registers of the SM3 algorithm are initialized to constants specified in the national cryptographic standard. Each message block undergoes 64 rounds of iterative compression, using message extension words, compression functions, and permutation functions to output a 256-bit hash value, which is used as the first hash value. The server uses this first hash value as the challenge value. The server processes the challenge value using SM4 encrypted feedback link mode with the initial session key. The process is as follows: the server calls a hardware random number generator to generate a 128-bit initialization vector, which is used in conjunction with the initial session key. The challenge value is then divided into 128-bit blocks. For the last block less than 128 bits, PKCS7 padding is used, with the padding byte value equal to the number of padding bytes. The initialization vector is bitwise XORed with the first 128-bit plaintext block of the challenge value. The XOR result is then encrypted using the initial session key using SM4 block encryption to obtain the first ciphertext block. For the second and subsequent plaintext blocks of the challenge value, the previous ciphertext block is used as the feedback input block. This feedback input block is bitwise XORed with the current plaintext block, and the XOR result is then encrypted using the initial session key using SM4 block encryption to obtain the current ciphertext block. The initialization vector is then concatenated with all ciphertext blocks sequentially, with the initialization vector placed at the beginning and the ciphertext blocks following in order. The concatenated result is used as the encryption challenge value.

[0037] The Ukey client receives the encrypted challenge value, decrypts it using the initial session key to obtain the challenge value, and compares it byte-by-byte with the challenge value after performing SM3 hashing on a local random number. The process is as follows: The Ukey client receives the encrypted challenge value sent by the server, extracts the initialization vector from the first 128 bits of the encrypted challenge value, and the remaining bytes after the initialization vector are the ciphertext data. The Ukey client uses the initial session key to process the encrypted challenge value using SM4 decryption feedback link mode, dividing the ciphertext data into 128-bit blocks. Using the initialization vector as the first feedback input block, the first ciphertext block is decrypted using SM4 block decryption with the initial session key. The decryption output is XORed with the initialization vector to obtain the first plaintext block. For subsequent ciphertext blocks, the previous ciphertext block is used as the feedback input block, and the current ciphertext block is decrypted using SM4 block decryption with the initial session key. The decryption output is XORed with the previous ciphertext block to obtain the current plaintext block. All plaintext blocks are concatenated in order, and the PKCS7 padding bytes are removed to obtain the decryption challenge value. The Ukey client extracts a second random number from its local storage. This second random number is a 256-bit value generated by the random number generator within the Ukey chip when the initial session key is generated and stored in a secure storage area. The Ukey client performs an SM3 hash operation on this second random number to obtain a 256-bit local hash value. The Ukey client compares the decryption challenge value with the local hash value byte by byte, starting from the first byte. If any byte is not equal during the comparison, the comparison is immediately terminated and a verification failure flag is returned; if all bytes are equal, a verification success flag is returned, which is a predefined value of 0x5A.

[0038] Example 4:

[0039] In practice, if the byte-by-byte comparison is consistent, the process of the Ukey client sending an acknowledgment message to the server is as follows: The Ukey client constructs an acknowledgment message containing a one-byte verification success flag field and a four-byte session identifier field. The verification success flag field has a predefined value of 0x5A, and the session identifier field is filled with a 32-bit unsigned integer allocated when the Ukey client generates the session. The acknowledgment message is divided into 128-bit blocks. If the last block is less than 128 bits, padding bytes are added to the end, with the value of the padding bytes equal to the number of padding bytes, ensuring that the last block is 128 bits long. Each 128-bit plaintext block is encrypted using the initial session key using SM4. The SM4 encryption operation includes round key addition, 32 rounds of iterative transformation, and reverse transformation, outputting a 128-bit ciphertext block. All ciphertext blocks are concatenated in their original order to form the encrypted acknowledgment message. The Ukey client then sends the encrypted acknowledgment message to the server via the data link.

[0040] After receiving the confirmation message, the server marks the initial session key as a valid working key as follows: The server receives the encrypted confirmation message from the data link, decrypts the encrypted confirmation message using the initial session key using SM4, divides the ciphertext data into 128-bit blocks, and performs SM4 decryption on each block. SM4 decryption is the reverse process of SM4 encryption. The plaintext blocks are output, concatenated, and padded bytes are removed to obtain the confirmation message. The server reads the verification success flag field in the confirmation message. If the value of the verification success flag field is 0x5A, the session key validity is considered to have been verified. The server maintains a session key state table in memory, which stores the entry corresponding to the initial session key. Each entry contains the key value and a status flag. The server updates the status flag to valid, thus marking the initial session key as a valid working key.

[0041] For each subsequent data packet transmission, the payload data is first encrypted using SM4 with the working key to obtain ciphertext. Then, the byte stream concatenated with the ciphertext and the data packet sequence number is hashed using SM3 to obtain a packet digest. The packet digest is then appended to the ciphertext before transmission. The process is as follows: The sender obtains the payload data to be transmitted, which is a byte sequence of arbitrary length transmitted by the application layer. The payload data is divided into 128-bit blocks. For the last block that is less than 128 bits, padding bytes are added to the end to make it complete. The value of the padding bytes is equal to the number of padding bytes. Each 128-bit plaintext block is encrypted using SM4 with the working key. All ciphertext blocks are concatenated sequentially to form the ciphertext. Afterward, the sender maintains a 64-bit data packet sequence number counter. The counter value is incremented by 1 for each data packet sent, and the data packet sequence number is the current counter value. The data packet sequence number is converted to an 8-byte big-endian byte sequence. The ciphertext byte stream is then concatenated immediately after the big-endian byte sequence to form the data to be hashed. The SM3 hash function is called to perform a hash operation on the data to be hashed. The message padding process of the SM3 hash function is as follows: add a bit "1" to the end of the data to be hashed, then add a bit "0" until the message length modulo 512 leaves a remainder of 448, and finally append 64 bits of the length of the data to be hashed. Then, message grouping and 64 rounds of iterative compression are performed, outputting a 256-bit packet digest. The packet digest is directly appended to the ciphertext in binary form to form a complete data packet. The sender sends the complete data packet to the receiver through the communication channel. After receiving the data packet, the receiver separates the ciphertext and packet digest according to the known data packet length, calculates the SM3 hash of the concatenated data (ciphertext and data packet sequence number) in the same way, and compares the calculation result byte-by-byte with the received packet digest. If they match, the data integrity verification is successful.

[0042] Example 5:

[0043] In practical implementation, the process of using the working key to encrypt the payload data using SM4 to obtain the ciphertext is as follows: Obtain the payload data to be encrypted, which is a sequence of application message bytes that needs to be transmitted securely. Divide the payload data into 128-bit blocks, starting from the beginning of the payload data and sequentially extracting 128 consecutive bits as a plaintext block. If the remaining bytes at the end of the payload data are less than 128 bits, perform PKCS7 padding on the last plaintext block. The PKCS7 padding method is as follows: calculate the number of bytes to be padded. , The value is ,in For the length of the payload data in bytes, when When it is exactly a multiple of 16 The value is 16, and it is added to the end of the last plaintext block. Each padding byte is a number of bytes, and the value of each padding byte is [value missing]. The final plaintext block after padding reaches a length of 128 bits. Encryption uses ciphertext block chaining mode, which requires an initialization vector. This initialization vector is generated by the sender using a random number generator, producing a 128-bit random sequence, and is used in conjunction with the working key. Let the initialization vector be... The working key is denoted as The plaintext block sequence obtained after dividing and filling the payload data is denoted as ,in This represents the total number of plaintext blocks after padding. Ciphertext Blocks The generation method is shown in the following formula, where Take from 1 to Integers:

[0044]

[0045] In the formula, Indicates working key The SM4 block cipher function serves as the key. It receives 128 bits of input, and after 32 rounds of iterative transformation and reverse transformation, it outputs 128 bits of ciphertext. This represents a bitwise XOR operation on two 128-bit sequences; For the first Each 128-bit plaintext block; For the first Each encrypted block, when hour This is the initialization vector. For each plaintext block... , and Bit-by-bit XOR, the result of which is used as input to the SM4 block cipher function, using the working key. Encryption is performed, and the output 128-bit result is used as the ciphertext block. All ciphertext blocks are divided according to The sequences are concatenated in order, and an initialization vector is placed at the very beginning of the concatenation result. This process forms complete ciphertext data. The ciphertext data consists of an initialization vector occupying the first 128 bits, followed by sequentially concatenated ciphertext blocks. During decryption, the receiver extracts the initialization vector from the ciphertext data. And the sequence of ciphertext blocks, for each ciphertext block Use working key Perform SM4 decryption operation Then decrypt the output and XOR yields plaintext blocks Decryption operation This is the SM4 block decryption function. The reverse process.

[0046] The process of hashing the byte stream concatenated with ciphertext and packet sequence numbers using SM3 to obtain a packet digest is as follows: The sender maintains a packet sequence number for each packet. The packet sequence number is a monotonically increasing 64-bit unsigned integer starting from 0, incrementing by 1 for each complete packet sent. The packet sequence number is converted to an 8-byte big-endian representation, with the most significant byte located at the lowest address. The ciphertext data generated in the previous step is retrieved. The ciphertext data is a byte sequence containing the initialization vector and the ciphertext block concatenation result. The 8-byte big-endian packet sequence number is placed before the beginning of the ciphertext data and stored contiguously in memory with the ciphertext data to be hashed. The structure of the data to be hashed is: the 8-byte packet sequence number first, followed by the ciphertext data byte sequence. The SM3 hash function is called to iteratively compress the data to be hashed. First, the SM3 hash function performs message padding on the data. The padding method is as follows: append a bit "1" to the end of the data, then append a bit "0" until the length of the padded message modulo 512 leaves a remainder of 448. Finally, append a 64-bit unsigned integer, the value of which is the original length of the data to be hashed. The padded message is divided into multiple message groups of 512 bits each. The SM3 hash function uses eight 32-bit registers. The initial values ​​are set to eight constants specified in the SM3 standard. For each message group, 132 32-bit message words are generated using the message expansion function, and 64 rounds of compression iterations are performed, with each round using round constants. ( From 0 to 63, hour , hour ) and Boolean functions , and permutation functions , After each iteration, the values ​​of all 32-bit registers are updated. After all message groups have been processed, the values ​​of the eight registers are concatenated to output a 256-bit digest value. The first 128 bits of the 256-bit digest value are truncated to form a packet digest, using the high 128 bits. This packet digest is appended to the ciphertext data at a fixed position at the end of the ciphertext data; that is, the packet sequence number is not included in the final transmitted packet. The final transmitted packet structure is: ciphertext data first, followed by the 128-bit packet digest. Upon receiving the packet, the receiver extracts the ciphertext data and packet digest, obtains the corresponding packet sequence number from its own received packet sequence number counter, constructs the data to be hashed in the same way, calculates the SM3 hash, truncates the first 128 bits, and compares it byte-by-byte with the received packet digest. If they match, the integrity verification passes.

[0047] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A Ukey full-link national cryptographic encryption communication method based on SM3 and SM4, characterized in that, include: Get the output value of the physical unclonable function from the Ukey client. The device fingerprint is obtained by performing an SM3 hash operation on the output value of the physically unclonable function; The device fingerprint is used as the entropy source and input into the SM4 key derivation function to generate the initial session key; The initial session key is used to encrypt the Ukey client's authentication request using SM4 to obtain an encrypted authentication request. After receiving the encrypted authentication request, the server uses the initial session key to decrypt and obtain the identity authentication request, and retrieves the corresponding device fingerprint from the preset key library; The server generates a random number, performs an SM3 hash on the random number to obtain a challenge value, and uses the initial session key to encrypt the challenge value using an SM4 hash to obtain an encrypted challenge value. The Ukey client receives the encrypted challenge value, decrypts it using the initial session key to obtain the challenge value, performs an SM3 hash on the local random number, and compares it byte by byte with the challenge value. If the comparison is consistent, the validity of the session key is confirmed. All subsequent communication payloads are encrypted with SM4 using the initial session key as the working key, and an SM3 hash digest is appended to each data packet.

2. The Ukey full-link national cryptographic encryption communication method based on SM3 and SM4 according to claim 1, characterized in that, The process of obtaining the physical unclonable function output value of the Ukey client includes: Apply a preset excitation signal to the physically non-clonable function circuitry within the Ukey chip. The original response sequence is obtained by acquiring the analog response output of the physically non-clonable function circuit and performing analog-to-digital conversion. The original response sequence is concatenated with the unique identifier of the Ukey chip and used as the output value of the physical unclonable function.

3. The Ukey full-link national cryptographic encryption communication method based on SM3 and SM4 according to claim 1, characterized in that, The step of using the device fingerprint as an entropy source input to the SM4 key derivation function to generate the initial session key includes: The device fingerprint is concatenated with the first random number generated by the Ukey client and then input into the extended round function of the SM4 encryption algorithm. The 128-bit intermediate value output by the extended round function is used as the initial session key.

4. The Ukey full-link national cryptographic encryption communication method based on SM3 and SM4 according to claim 1, characterized in that, The step of using the initial session key to encrypt the Ukey client's authentication request using SM4 to obtain an encrypted authentication request includes: The authentication request data is divided into 128-bit blocks and then encrypted using the SM4 electronic codebook mode. The encrypted ciphertext blocks are concatenated in their original order, and an authentication code obtained by SM4 encryption of the payload digest using the initial session key is appended to the end of the payload.

5. The Ukey full-link national cryptographic encryption communication method based on SM3 and SM4 according to claim 1, characterized in that, After receiving the encryption authentication request, the server uses the initial session key to decrypt and obtain the identity authentication request, and retrieves the corresponding device fingerprint from a preset key library, including: The server uses the initial session key to perform SM4 decryption on the ciphertext portion of the encrypted authentication request to obtain the plaintext authentication request. Extract the Ukey identifier field from the plaintext authentication request, and search for the pre-stored device fingerprint associated with the Ukey identifier field in the server's pre-configured key store. Compare whether the pre-stored device fingerprint is consistent with the hash value of the device fingerprint obtained after decryption.

6. The Ukey full-link national cryptographic encryption communication method based on SM3 and SM4 according to claim 1, characterized in that, The server generates a random number, performs an SM3 hash on the random number to obtain a challenge value, and uses the initial session key to perform an SM4 encryption on the challenge value to obtain an encrypted challenge value, including: The server uses a hardware random number generator to generate a second 256-bit random number. The first hash value is obtained by hashing the second random number using the SM3 algorithm. The first hash value is used as the challenge value, and the challenge value is processed using the initial session key in SM4 encrypted feedback link mode to obtain the encrypted challenge value.

7. The Ukey full-link national cryptographic encryption communication method based on SM3 and SM4 according to claim 1, characterized in that, The Ukey client receives the encrypted challenge value, decrypts it using the initial session key to obtain the challenge value, performs an SM3 hash on a local random number, and compares it byte-by-byte with the challenge value, including: The Ukey client uses the initial session key to process the encryption challenge value using SM4 decryption feedback link mode to obtain the decryption challenge value. Extract the second random number stored locally on the Ukey client, and perform an SM3 hash on the second random number to obtain the local hash value. The decryption challenge value is compared with the local hash value byte by byte, starting from the first byte. If all bytes are equal, a verification success flag is returned.

8. The Ukey full-link national cryptographic encryption communication method based on SM3 and SM4 according to claim 1, characterized in that, If the comparison is consistent, the validity of the session key is confirmed. All subsequent communication payloads are then encrypted using the initial session key as the working key with SM4, and an SM3 hash digest is appended to each data packet, including: If the byte-by-byte comparison matches, the Ukey client sends an acknowledgment message to the server, which is encrypted using the initial session key using SM4. After receiving the confirmation message, the server marks the initial session key as a valid working key; In subsequent data packet transmissions, the payload data is first encrypted using SM4 with the working key to obtain ciphertext, and then the byte stream concatenated with the data packet sequence number is hashed using SM3 to obtain a packet digest. The packet digest is then appended to the ciphertext and sent.

9. The Ukey full-link national cryptographic encryption communication method based on SM3 and SM4 according to claim 8, characterized in that, The step of using the working key to encrypt the payload data using SM4 to obtain ciphertext includes: The payload data is divided into 128-bit blocks, and each block is encrypted using the aforementioned working key with SM4 encryption. The previous block of ciphertext is introduced as a feedback parameter during the encryption process to achieve the ciphertext block chaining mode; For tail blocks that are less than 128 bits, PKCS7 padding is used to complete the encryption.

10. The Ukey full-link national cryptographic encryption communication method based on SM3 and SM4 according to claim 8, characterized in that, The step of hashing the byte stream concatenated with the ciphertext and the data packet sequence number using SM3 to obtain the packet digest includes: Convert the data packet sequence number to an 8-byte big-endian representation and concatenate it with the ciphertext byte stream to form the data to be hashed; The SM3 hash function is called to iteratively compress the data to be hashed, resulting in a 256-bit digest. The first 128 bits of the digest are truncated and used as a packet digest, which is then embedded at a fixed position at the end of the data packet.

Images