Link-layer communication encryption method and system

Abstract

The present disclosure relates to a link-layer communication encryption method and system, wherein for communication between service terminals and service systems, a terminal-side link encryption gateway and a service-side link encryption gateway are designed, and on the basis of device authentication, identity authentication and session key agreement are integrally designed and used, thereby implementing security authentication, and also obtaining a session key of an application between the terminal-side link encryption gateway and the service-side link encryption gateway, that is, a lightweight security authentication mechanism is implemented, and a dynamic session key is generated for each accessed service terminal, thereby enhancing the security of data communication and transmission. In the design solution, the communication data of the service terminals at a link layer is encrypted, thereby ensuring that intranet information is concealed, and protecting intranet service systems and devices from attacks; moreover, no real IP and MAC is configured for each gateway, thereby ensuring that a malicious user cannot perform targeted attacks on the gateway.

Description

A link-layer communication encryption method and system Technical Field

[0001] This invention relates to a link-layer communication encryption method and system, belonging to the field of data encryption technology. Background Technology

[0002] Network communication encryption methods are mechanisms for encrypting data during network transmission. Encryption and decryption primarily occur between two communicating nodes to ensure data security during transmission. The TCP / IP network model describes the hierarchical structure of data transmission in a network. When data is transmitted from the sender to the receiver, it undergoes multiple layers of encapsulation and decapsulation processes. Therefore, numerous communication encryption methods have been proposed for the TCP / IP network model, with mainstream ones including SSL and IPSec protocols. These protocols provide encryption and security protection for communication between terminals and business systems, as well as between subnets, at the application, transport, and network layers, and have been widely and comprehensively applied across various industries. However, with the expansion of business scenarios and the increasing security requirements, there is an urgent need to break through the traditional communication encryption mechanisms on the market and implement a link-layer-based communication encryption method. This method would achieve transparent encryption of upper-layer protocols, support multiple network environments, be compatible with existing network devices and topologies, and further improve the security level of business data during network transmission.

[0003] The existing network communication encryption construction process involves three types of entities: terminals, security gateways, and business systems. The channel construction process is shown in Figure 2.

[0004] Taking SSLVPN as an example, the specific communication encryption process is as follows: ① The SSLVPN module on the terminal performs identity authentication, cipher suite negotiation, and session key negotiation with the SSLVPN gateway. After successful authentication, the SSLVPN gateway issues a virtual address and business system routing configuration; ② The SSLVPN module on the terminal adds a virtual network card to the terminal and modifies the target IP to the next-hop gateway of the business system to the virtual address, so that the SSLVPN module can read data from the virtual network card to achieve encryption; ③ When data is transmitted upstream, the business APP sends the data with the target IP of the business system to the operating system, and the operating system sends the data to the virtual network card according to the routing; ④ The SSLVPN module polls the virtual network card to obtain the business plaintext data, encrypts the original network layer data, adds a new IP header, and sends it to the operating system, which then sends it to the physical network card according to the routing, where the new destination IP is the SSLVPN gateway address; ⑤ The SSLVPN gateway receives the data, decrypts it to obtain the original IP data, and sends it to the designated business system according to the original destination IP address.

[0005] Existing communication encryption technologies and methods have improved the security of terminal and business communications to a certain extent, but they have the following shortcomings:

[0006] (1) They can only achieve network layer data security protection, that is, the IP packet header in the business communication process is still visible to the outside, and cannot completely hide the network information of the internal business system, which poses a risk of being sniffed and attacked; in addition, as a network boundary security protection device, the VPN gateway is also very easy to become the target of network attacks after its own network information is exposed.

[0007] (2) Significant changes are required to the business system, business terminals and network topology. For example, in order to achieve network layer security protection, SSLVPN requires the client to be installed on the terminal and the network configuration of the terminal will be modified during the communication process; IPSecVPN requires the devices in the subnet to modify the routing gateway configuration to achieve data forwarding, which requires a high level of user network configuration capability. Summary of the Invention

[0008] The technical problem to be solved by the present invention is to provide a link-layer communication encryption method. By designing with link-layer encryption, the method ensures the hiding of intranet network information and protects intranet business systems and devices from attacks.

[0009] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs a link-layer communication encryption method, based on the data link created by the service terminal sequentially passing through the terminal-side link encryption gateway, the service-side link encryption gateway, and the service system, for the data frame uploaded by the service terminal to the terminal-side link encryption gateway, the following steps are performed:

[0010] Step A. The terminal-side link encryption gateway receives a data frame from the service terminal, performs device authentication for the service terminal corresponding to the data frame, and contacts the service-side link encryption gateway to perform identity authentication for the service terminal corresponding to the data frame. If both device authentication and identity authentication are successful, proceed to Step B.

[0011] Step B. The terminal-side link encryption gateway calls its session key from the most recent successful authentication state to encrypt and encapsulate the data frame, and sends it to the service-side link encryption gateway. The service-side link encryption gateway calls its session key from the most recent successful authentication state to parse and decrypt the data frame, and forwards it to the corresponding business system for querying. It then obtains the feedback result data frame and forwards it to the service-side link encryption gateway, and then proceeds to step C.

[0012] Step C. The service-side link encryption gateway calls its session key from the most recent successful authentication state to encrypt and encapsulate the received feedback result data frame, and sends it to the terminal-side link encryption gateway. The terminal-side link encryption gateway calls its session key from the most recent successful authentication state to parse and decrypt the data, and then forwards it to the service terminal.

[0013] As a preferred technical solution of the present invention: In step A, the terminal-side link encryption gateway performs device authentication based on the preset legal MAC addresses to determine whether the source MAC address corresponding to the received data frame is legal. If it is, the device authentication is currently successful, and the terminal-side link encryption gateway is contacted to perform identity authentication of the service terminal corresponding to the data frame; otherwise, the device authentication is currently unsuccessful, and the data frame is discarded.

[0014] As a preferred technical solution of the present invention: In step A, based on the current successful device authentication, the terminal-side link encryption gateway determines whether the service terminal corresponding to the data frame has successfully passed identity authentication. Then, it further determines whether the current time is within the preset authentication validity period from the last successful identity authentication time of the service terminal. If yes, the identity authentication is currently successful, and the process proceeds to step B; otherwise, the identity authentication is currently unsuccessful. The gateway then contacts the service-side link encryption gateway to perform identity authentication for the service terminal corresponding to the data frame. If the identity authentication is successful, the process proceeds to step B; if the identity authentication fails, the data frame is discarded. If the terminal-side link encryption gateway determines whether the service terminal corresponding to the data frame has failed identity authentication, the process proceeds to step B; if the identity authentication fails, the data frame is discarded.

[0015] As a preferred technical solution of the present invention: In step A, the terminal-side link encryption gateway contacts the service-side link encryption gateway and performs identity authentication of the service terminal corresponding to the data frame according to the following steps.

[0016] Step A1. The terminal-side link encryption gateway, based on its... and its Corresponding root key Combined with the current timestamp and the service terminal in the data frame , ECB key derivation function using the national standard cryptographic SM1 According to the following formula:

[0017]

[0018] Obtain the basic session key of the terminal-side link encryption gateway corresponding to the service terminal. Then proceed to step A2;

[0019] Step A2. The terminal-side link encryption gateway generates a preset byte random number. and combined with the basic session key The key derivation functions of the standard Chinese cryptographic SM1 are applied respectively. and the HMAC function of standard Chinese cryptographic SM3. According to the following formula:

[0020]

[0021]

[0022] Obtain authentication materials corresponding to the terminal-side link encryption gateway. and session key material authentication code Then proceed to step A3;

[0023] Step A3. The terminal-side link encryption gateway, based on its... Basic session key Random numbers and the service terminal in the data frame ECB key derivation function using the national standard cryptographic SM1 According to the following formula:

[0024]

[0025] Obtain the session key from the terminal-side link encryption gateway. Then proceed to step A4;

[0026] Step A4. The terminal-side link encryption gateway uses its... Authentication materials corresponding to the terminal-side link encryption gateway Session key material authentication code and the service terminal in the data frame Construct identity authentication request data and add it with the business terminal's... For source IP, service terminal The message header is updated with the source MAC address, the virtual IP address provided by the service-side link encryption gateway as the destination IP address, and the MAC address of the service system as the destination MAC address. An authentication request message is constructed and sent to the service-side link encryption gateway along the data link between the terminal-side link encryption gateway and the service-side link encryption gateway. Then, the process proceeds to step A5.

[0027] Step A5. The service-side link encryption gateway receives and parses the authentication request message to obtain the terminal-side link encryption gateway's... , business terminals , and combined with the current timestamp ECB key derivation function using the national standard cryptographic SM1 According to the following formula:

[0028]

[0029] Obtain the basic session key of the encryption gateway on the service side corresponding to the service terminal. ,in, This indicates the information obtained by the service-side link encryption gateway from the terminal-side link encryption gateway. The corresponding root key, and apply the base session key. For certified materials Decrypt to obtain a random number. Terminal-side link encryption gateway timestamp Terminal-side link encryption gateway Business terminals Business terminals Determine the current timestamp Is it located in self If the preset authentication process is within its validity period, proceed to step A6; otherwise, if authentication fails, discard the data frame.

[0030] Step A6. The service-side link encryption gateway performs encryption on the basic session key. Random numbers Current timestamp Terminal-side link encryption gateway Business terminals Business terminals HMAC function using standard Chinese cryptographic SM3 According to the following formula:

[0031]

[0032] Obtain the session key material authentication code corresponding to the business-side link encryption gateway. and judge and If they match, the service-side link encryption gateway uses the ECB key derivation function of the national cryptographic standard SM1. According to the following formula:

[0033]

[0034] Obtain the session key from the service-side link encryption gateway. Then proceed to step A7; otherwise, identity verification will fail.

[0035] Step A7. Apply session keys to the service-side link encryption gateway. The authentication success message and the moment of authentication success are encrypted to construct authentication success data, and the data is appended with the business-side gateway virtual IP as the source IP, the business system MAC as the source MAC, and the business terminal's IP address. For destination IP, service terminal The source and destination MAC addresses are updated, the message header is constructed, an identity authentication success message is constructed, and the message is sent to the terminal-side link encryption gateway along the data link between the service-side link encryption gateway and the terminal-side link encryption gateway. Then, the process proceeds to step A8.

[0036] Step A8. Apply session key to the terminal-side link encryption gateway. The authentication success message is decrypted to obtain the authentication success message and the moment of authentication success, indicating that authentication was successful.

[0037] As a preferred technical solution of the present invention: In step B, the service-side link encryption gateway parses the encrypted message from the terminal-side link encryption gateway, performs device authentication based on the preset legal MAC addresses, and determines whether the source MAC address is legal. If the source MAC address is legal, it further determines whether the identity authentication of the corresponding service terminal has been successful. If so, the service-side link encryption gateway further calls the session key of the most recent successful identity authentication state to decrypt the message; otherwise, the encrypted message is discarded. If the source MAC address is invalid, the encrypted message is discarded.

[0038] As a preferred embodiment of the present invention: In step B, the terminal-side link encryption gateway first calls its session key from the most recent successful authentication state to encrypt the IP header, target network transmission protocol header, and application data in the data frame, thus forming encrypted application data; then, based on the Ethernet header, it adds the information of the service terminal... For source IP, service terminal The packet header is constructed using the source MAC address, the virtual IP address provided by the business-side link encryption gateway as the destination IP address, and the MAC address of the business system as the destination MAC address. Finally, a checksum is generated for the packet header and the encrypted application data. The packet header, encrypted application data, and checksum are then encapsulated to form an encrypted packet, which is sent to the business-side link encryption gateway. The business-side link encryption gateway parses the received encrypted packet to obtain the encrypted application data. It then uses the session key from its most recent successful authentication state to decrypt the encrypted application data, obtains the data frame, and encapsulates and forwards it to the corresponding business system for querying.

[0039] In step C, the service-side link encryption gateway calls its session key from its most recent successful authentication state to encrypt the received feedback result data frame, forming encrypted feedback data. Then, based on the Ethernet header, it adds data with the service-side gateway's virtual IP as the source IP, the service system's MAC address as the source MAC address, and the service terminal's IP address as the source MAC address. For destination IP, service terminal The source and destination MAC addresses form the message header. Finally, a checksum for the message header and encrypted feedback data is generated. The message header, encrypted feedback data, and checksum are encapsulated to form an encrypted feedback message, which is sent to the terminal-side link encryption gateway. The terminal-side link encryption gateway parses the received encrypted feedback message to obtain the encrypted feedback data. Then, it calls the session key from the most recent successful authentication state to decrypt the encrypted feedback data, obtains the feedback result data frame, and encapsulates it for forwarding to the service terminal.

[0040] Corresponding to the above, the technical problem that this invention also needs to solve is to provide a system for a link-layer communication encryption method, modularly designing a gateway under link-layer encryption, efficiently implementing the design method, and ensuring data security and efficiency.

[0041] To solve the above-mentioned technical problems, the present invention adopts the following technical solution: The present invention designs a system for a link-layer communication encryption method, based on a data link created by a service terminal sequentially passing through a terminal-side link encryption gateway, a service-side link encryption gateway, and then to a service system. The structure of the terminal-side link encryption gateway is the same as that of the service-side link encryption gateway. Both the terminal-side link encryption gateway and the service-side link encryption gateway include a data capture module, a data parsing module, a device authentication module, an identity authentication module, a data encryption / decryption module, a device authentication library, a hardware cryptography module, and a data sending module.

[0042] In the terminal-side link encryption gateway, the data capture module polls the data frames and encrypted feedback messages in the network card's receive buffer queue; the data parsing module parses the data frames and encrypted feedback messages received by the data capture module; the device authentication library consists of preset legitimate MAC addresses, and the device authentication module authenticates the source MAC address of data frames from the service terminal based on the preset legitimate MAC addresses in the device authentication library; the identity authentication module, based on the hardware cryptography module, contacts the identity authentication module in the service-side link encryption gateway through the data sending module and the data capture module to authenticate the service terminal; the data encryption / decryption module encrypts data frames and decrypts encrypted feedback messages based on the hardware cryptography module; and the data sending module sends encrypted messages and feedback result data frames.

[0043] In the service-side link encryption gateway, the data capture module polls the network interface card (NIC) receive buffer queue for feedback result data frames and encrypted messages; the data parsing module parses the feedback result data frames and encrypted messages received by the data capture module; the device authentication library consists of preset legitimate MAC addresses, and the device authentication module authenticates the source MAC address of encrypted messages from the terminal-side link encryption gateway based on the preset legitimate MAC addresses in the device authentication library; the identity authentication module determines whether the service terminal's identity authentication has been successful based on the hardware cryptographic module; the data encryption / decryption module encrypts the feedback result data frames and decrypts the encrypted messages based on the hardware cryptographic module; and the data sending module sends the encrypted feedback messages and data frames.

[0044] The link-layer communication encryption method and system described in this invention, compared with the prior art, have the following technical advantages:

[0045] This invention presents a link-layer communication encryption method and system. Designed for communication between business terminals and business systems, it utilizes a terminal-side link encryption gateway and a business-side link encryption gateway. Based on device authentication, it integrates identity authentication and session key negotiation into a single design. This achieves secure authentication while simultaneously obtaining the session key between the terminal-side and business-side link encryption gateways, thus implementing a lightweight security authentication mechanism. A dynamic session key is generated for each accessing business terminal, enhancing the security of data communication and transmission. The design encrypts business terminal communication data at the link layer, ensuring the hiding of internal network information and protecting internal network business systems and devices from attacks. Furthermore, the gateway itself is not configured with actual IP and MAC addresses, preventing malicious users from launching targeted attacks. Attached Figure Description

[0046] Figure 1 is a schematic diagram of the system application architecture of the link layer communication encryption method designed in this invention;

[0047] Figure 2 is a schematic diagram illustrating the application of the link-layer communication encryption method designed in this invention.

[0048] Figure 3 is a schematic diagram of message construction under the link layer communication encryption method designed in this invention;

[0049] Figure 4 is a schematic diagram of the encryption gateway module in the link layer communication encryption method designed in this invention. Detailed Implementation

[0050] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0051] This invention addresses the shortcomings of existing technologies with the following design concept:

[0052] (1) Design a link layer identity authentication and key negotiation mechanism, which performs security authentication based on terminal communication information, completes key negotiation, and generates session keys;

[0053] (2) Design a link layer encrypted communication mechanism to securely encrypt communication data at the link layer, shield the differences between network layer and transport layer protocols, and at the same time hide the network information of devices inside the local area network to prevent malicious sniffing;

[0054] (3) Provide a link layer communication encryption system, including a terminal, a link encryption gateway and a business system; connect the link encryption gateway between the terminal and the business system to realize the secure authentication and encryption of communication data between the terminal and the business system, and at the same time provide data filtering and access control to resist various forms of network attacks.

[0055] Regarding the above design concept, this invention designs a link-layer communication encryption method. As shown in Figure 1, based on the data link created by the business terminal sequentially passing through the terminal-side link encryption gateway, the business-side link encryption gateway, and the business system, for the data frame uploaded by the business terminal to the terminal-side link encryption gateway, in practical applications, as shown in Figure 2, taking a TCP connection as an example, in the three-way handshake process under the TCP connection, device authentication and identity authentication are added. Specifically, step A is executed as follows, and then steps B to C are further executed to perform data communication.

[0056] Step A. The terminal-side link encryption gateway polls the data frames from the service terminals in its network card receive buffer queue, performs device authentication for the service terminal corresponding to the data frame, and contacts the service-side link encryption gateway to perform identity authentication for the service terminal corresponding to the data frame. If both device authentication and identity authentication are successful, proceed to Step B.

[0057] In step A, regarding the verification of whether device authentication and identity authentication are successful, in actual applications, for device authentication, the terminal-side link encryption gateway performs device authentication based on the preset legal MAC addresses to determine whether the source MAC address corresponding to the received data frame is valid. If it is, the device authentication is currently successful, and the terminal-side link encryption gateway is contacted to perform identity authentication for the service terminal corresponding to the data frame; otherwise, the device authentication is currently unsuccessful, and the data frame is discarded.

[0058] Regarding identity authentication, based on the current successful device authentication, the terminal-side link encryption gateway determines whether the service terminal corresponding to the data frame has successfully passed identity authentication. If so, it further determines whether the current time is within the preset authentication validity period from the last successful authentication time of the service terminal. If yes, the identity authentication is currently successful, and the process proceeds to step B; otherwise, the identity authentication fails, and the gateway contacts the service-side link encryption gateway to perform identity authentication for the service terminal corresponding to the data frame. If the identity authentication is successful, the process proceeds to step B; otherwise, the data frame is discarded. Similarly, if the terminal-side link encryption gateway determines whether the service terminal corresponding to the data frame has failed identity authentication, the process proceeds to step B; otherwise, the data frame is discarded.

[0059] In actual implementation, the terminal-side link encryption gateway shall follow steps A1 to A8 to contact the service-side link encryption gateway and perform identity authentication of the service terminal corresponding to the data frame.

[0060] Step A1. The terminal-side link encryption gateway, based on its... and its Corresponding root key Combined with the current timestamp and the service terminal in the data frame , ECB key derivation function using the national standard cryptographic SM1 According to the following formula:

[0061]

[0062] Obtain the basic session key of the terminal-side link encryption gateway corresponding to the service terminal. Then proceed to step A2.

[0063] Step A2. The terminal-side link encryption gateway generates a preset byte random number. and combined with the basic session key The key derivation functions of the standard Chinese cryptographic SM1 are applied respectively. and the HMAC function of standard Chinese cryptographic SM3. According to the following formula:

[0064]

[0065]

[0066] Obtain authentication materials corresponding to the terminal-side link encryption gateway. and session key material authentication code Then proceed to step A3.

[0067] Step A3. The terminal-side link encryption gateway, based on its... Basic session key Random numbers and the service terminal in the data frame ECB key derivation function using the national standard cryptographic SM1 According to the following formula:

[0068]

[0069] Obtain the session key from the terminal-side link encryption gateway. Then proceed to step A4.

[0070] Step A4. The terminal-side link encryption gateway uses its... Authentication materials corresponding to the terminal-side link encryption gateway Session key material authentication code and the service terminal in the data frame Construct identity authentication request data and add it with the business terminal's... For source IP, service terminal The message header is updated with the source MAC address, the virtual IP address provided by the service-side link encryption gateway as the destination IP address, and the MAC address of the service system as the destination MAC address. An authentication request message is constructed and sent to the service-side link encryption gateway along the data link between the terminal-side link encryption gateway and the service-side link encryption gateway. Then, the process proceeds to step A5.

[0071] Step A5. The service-side link encryption gateway receives and parses the authentication request message to obtain the terminal-side link encryption gateway's... , business terminals , and combined with the current timestamp ECB key derivation function using the national standard cryptographic SM1 According to the following formula:

[0072]

[0073] Obtain the basic session key of the encryption gateway on the service side corresponding to the service terminal. ,in, This indicates the information obtained by the service-side link encryption gateway from the terminal-side link encryption gateway. The corresponding root key, and apply the base session key. For certified materials Decrypt to obtain a random number. Terminal-side link encryption gateway timestamp Terminal-side link encryption gateway Business terminals Business terminals Determine the current timestamp Is it located in self If the preset authentication process is within its validity period, proceed to step A6; otherwise, if authentication fails, discard the data frame.

[0074] Step A6. The service-side link encryption gateway performs encryption on the basic session key. Random numbers Current timestamp Terminal-side link encryption gateway Business terminals Business terminals HMAC function using standard Chinese cryptographic SM3 According to the following formula:

[0075]

[0076] Obtain the session key material authentication code corresponding to the business-side link encryption gateway. and judge and If they match, the service-side link encryption gateway uses the ECB key derivation function of the national cryptographic standard SM1. According to the following formula:

[0077]

[0078] Obtain the session key from the service-side link encryption gateway. Then proceed to step A7; otherwise, identity authentication will fail.

[0079] Step A7. Apply session keys to the service-side link encryption gateway. The authentication success message and the moment of authentication success are encrypted to construct authentication success data, and the data is appended with the business-side gateway virtual IP as the source IP, the business system MAC as the source MAC, and the business terminal's IP address. For destination IP, service terminal Using the source and destination MAC addresses, update the message header, construct a successful authentication message, and send it along the data link between the service-side link encryption gateway and the terminal-side link encryption gateway to the terminal-side link encryption gateway, then proceed to step A8.

[0080] Step A8. Apply session key to the terminal-side link encryption gateway. The authentication success message is decrypted to obtain the authentication success message and the moment of authentication success, indicating that authentication was successful.

[0081] Step B. The terminal-side link encryption gateway first calls its session key from the most recent successful authentication state to encrypt the IP header, target network transport protocol header, and application data in the data frame, forming encrypted application data; then, as shown in Figure 3, based on the Ethernet header, it adds the service terminal's... For source IP, service terminal The source MAC address, the virtual IP address provided by the service-side link encryption gateway as the destination IP address, and the MAC address of the service system as the destination MAC address are used to form the message header. Finally, a checksum for the message header and encrypted application data is generated, and the message header, encrypted application data, and checksum are encapsulated to form an encrypted message, which is then sent to the service-side link encryption gateway.

[0082] The service-side link encryption gateway parses encrypted packets from the terminal-side link encryption gateway to obtain the source MAC address and encrypted application data. Based on the preset valid MAC addresses, it performs device authentication to determine whether the source MAC address is valid. If the source MAC address is valid, it further determines whether the identity authentication of the corresponding service terminal has been successful. If so, the service-side link encryption gateway further calls the session key of the most recent successful identity authentication state to decrypt the encrypted application data, obtain the data frame, encapsulate and forward it to the corresponding business system for querying, obtain the feedback result data frame, and forward it to the service-side link encryption gateway, and then proceed to step C; otherwise, the encrypted packet is discarded; if the source MAC address is invalid, the encrypted packet is discarded.

[0083] Step C. The service-side link encryption gateway uses its session key from the most recent successful authentication state to encrypt the received feedback result data frame, forming encrypted feedback data. Then, based on the Ethernet header, it adds the following: the service-side gateway's virtual IP as the source IP, the service system's MAC address as the source MAC address, and the service terminal's... For destination IP, service terminal The source and destination MAC addresses form the message header. Finally, a checksum for the message header and encrypted feedback data is generated. The message header, encrypted feedback data, and checksum are encapsulated to form an encrypted feedback message, which is sent to the terminal-side link encryption gateway. The terminal-side link encryption gateway parses the received encrypted feedback message to obtain the encrypted feedback data. Then, it calls the session key from the most recent successful authentication state to decrypt the encrypted feedback data, obtains the feedback result data frame, and encapsulates it for forwarding to the service terminal.

[0084] In practical applications of the above-mentioned link-layer communication encryption method, a corresponding system is further designed. This system is based on a data link created by the business terminal sequentially passing through the terminal-side link encryption gateway, the business-side link encryption gateway, and finally the business system. The structure of the terminal-side link encryption gateway is the same as that of the business-side link encryption gateway, as shown in Figure 4. Both the terminal-side link encryption gateway and the business-side link encryption gateway include a data capture module, a data parsing module, a device authentication module, an identity authentication module, a data encryption / decryption module, a device authentication library, a hardware cryptography module, and a data transmission module.

[0085] In the terminal-side link encryption gateway, the data capture module polls the data frames and encrypted feedback messages in the network card's receive buffer queue; the data parsing module parses the data frames and encrypted feedback messages received by the data capture module; the device authentication library consists of preset legitimate MAC addresses, and the device authentication module authenticates the source MAC addresses of data frames from the service terminal based on these preset legitimate MAC addresses; the identity authentication module, based on the hardware cryptography module, connects with the identity authentication module in the service-side link encryption gateway through the data sending module and the data capture module to authenticate the service terminal; the data encryption / decryption module encrypts data frames and decrypts encrypted feedback messages based on the hardware cryptography module; and the data sending module sends encrypted messages and feedback result data frames.

[0086] In the service-side link encryption gateway, the data capture module polls the network interface card (NIC) receive buffer queue for feedback result data frames and encrypted messages; the data parsing module parses the feedback result data frames and encrypted messages received by the data capture module; the device authentication library consists of preset legitimate MAC addresses, and the device authentication module authenticates the source MAC address of encrypted messages from the terminal-side link encryption gateway based on the preset legitimate MAC addresses in the device authentication library; the identity authentication module determines whether the service terminal's identity authentication has been successful based on the hardware cryptographic module; the data encryption / decryption module encrypts the feedback result data frames and decrypts the encrypted messages based on the hardware cryptographic module; and the data sending module sends the encrypted feedback messages and data frames.

[0087] In the design and application, since the encryption gateway actively captures data packets, the network topology on the terminal side and the service side does not need to be changed. The encryption gateway performs security authentication and binding of the terminal and the service system server based on the MAC address, ensuring the security and trustworthiness of the access device. At the same time, the terminal-side encryption gateway and the service-side encryption gateway perform identity authentication to generate dynamic session keys to achieve secure encryption of link data, hide communication information such as IP, and prevent malicious users from sniffing the network and tampering with data.

[0088] This invention addresses the connection between business terminals and business systems by designing a terminal-side link encryption gateway and a business-side link encryption gateway. Based on device authentication, it integrates identity authentication and session key negotiation into a single design. This achieves secure authentication while simultaneously obtaining the session key between the terminal-side and business-side link encryption gateways, thus implementing a lightweight security authentication mechanism. A dynamic session key is generated for each connected business terminal, enhancing the security of data communication and transmission. The design encrypts business terminal communication data at the link layer, ensuring the hiding of internal network information and protecting internal network business systems and devices from attacks. Furthermore, the gateway itself is not configured with an actual IP and MAC address, preventing malicious users from launching targeted attacks.

[0089] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A method of link layer communication encryption, characterized by, Based on the data link created by the business terminal sequentially passing through the terminal-side link encryption gateway, the business-side link encryption gateway, and then to the business system, the following steps are performed on the data frame uploaded by the business terminal to the terminal-side link encryption gateway: Step A. The terminal-side link encryption gateway receives a data frame from the service terminal, performs device authentication for the service terminal corresponding to the data frame, and contacts the service-side link encryption gateway to perform identity authentication for the service terminal corresponding to the data frame. If both device authentication and identity authentication are successful, proceed to Step B. Step B. The terminal-side link encryption gateway calls its session key from the most recent successful authentication state to encrypt and encapsulate the data frame, and sends it to the service-side link encryption gateway. The service-side link encryption gateway calls its session key from the most recent successful authentication state to parse and decrypt the data frame, and forwards it to the corresponding business system for querying. It then obtains the feedback result data frame and forwards it to the service-side link encryption gateway, and then proceeds to step C. Step C. The service-side link encryption gateway calls its session key from the most recent successful authentication state to encrypt and encapsulate the received feedback result data frame, and sends it to the terminal-side link encryption gateway. The terminal-side link encryption gateway calls its session key from the most recent successful authentication state to parse and decrypt the data, and then forwards it to the service terminal. In step A above, the terminal-side link encryption gateway contacts the service-side link encryption gateway to perform identity authentication of the service terminal corresponding to the data frame, as follows: Step A1. The terminal side link encryption gateway derives its , and salts thereof corresponding root key , combined with a current timestamp , and the service terminal in the data frame 、 , apply the standard SM1 ECB key derivation function According to the following formula: ； Obtaining a base session key for a terminal-side link encryption gateway corresponding to a service terminal Then proceed to step A2; Step A2. The terminal sidelink encryption gateway generates a preset byte random number and in conjunction with the base session key , respectively, the standard national secret SM1 key derivation function , and the HMAC function of the standard national secret SM3 According to the following formula: ； ； Obtaining authentication material corresponding to a terminal sidelink encryption gateway , and a session key material authentication code Then proceed to step A3; Step A3. The terminal sidelink encryption gateway derives its , base session key , random number , and the service terminal in the data frame , apply the standard SM1 ECB key derivation function According to the following formula: ； Obtaining session keys for terminal sidelink encryption gateways Then proceed to step A4; Step A4. The terminal side link encryption gateway with its authentication material corresponding to the terminal sidelink encryption gateway , session key material authentication code and the service terminal in the data frame , constructs identity authentication request data, and adds a business terminal's For source IP, service terminal The message header is updated with the source MAC address, the virtual IP address provided by the service-side link encryption gateway as the destination IP address, and the MAC address of the service system as the destination MAC address. An authentication request message is constructed and sent to the service-side link encryption gateway along the data link between the terminal-side link encryption gateway and the service-side link encryption gateway. Then, the process proceeds to step A5. Step A5. The service side link encryption gateway receives the identity authentication request message and parses it to obtain the terminal side link encryption gateway's , service terminal's 、 and in combination with a current timestamp , apply standard SM1 ECB key derivation function According to the following formula: ； Obtaining a base session key for a service terminal corresponding to a service sidelink encryption gateway wherein, representing a terminal sidelink encryption gateway known to the service sidelink encryption gateway corresponding root key, and apply the base session key authentication material Decrypting to obtain the random number terminal sidelink encryption gateway timestamp terminal sidelink encryption gateway , service terminal , service terminal , determine the current time stamp whether located in self If the preset authentication process is within its validity period, proceed to step A6; otherwise, if authentication fails, discard the data frame. Step A6. The service side link encryption gateway derives the base session key for the service side link encryption gateway , random number , current timestamp Terminal side link encryption gateway , service terminal , service terminal , the HMAC function of the standard national secret SM3 is applied According to the following formula: ； Obtaining a session key material authentication code corresponding to a service sidelink encryption gateway and determine With Whether consistent, is the business side link encryption gateway application standard SM1 ECB key derivation function According to the following formula: ； Obtaining session keys for a service sidelink encryption gateway Then proceed to step A7; otherwise, identity verification will fail. Step A7. Business side link encryption gateway application session key , the identity authentication success message and the moment of identity authentication success are encrypted, identity authentication success data is constructed, and the source IP is added as the virtual IP of the business side gateway, the source MAC is added as the MAC of the business system, and the destination IP is added as the IP of the business terminal For the purpose of IP, service terminal The source and destination MAC addresses are updated, the message header is constructed, an identity authentication success message is constructed, and the message is sent to the terminal-side link encryption gateway along the data link between the service-side link encryption gateway and the terminal-side link encryption gateway. Then, the process proceeds to step A8. Step A8. End-to-end link encryption gateway application session key The authentication success message is decrypted to obtain the authentication success message and the moment of authentication success, indicating that authentication was successful.

2. The method of claim 1, wherein: In step A, the terminal-side link encryption gateway performs device authentication based on preset valid MAC addresses to determine whether the source MAC address corresponding to the received data frame is valid. If it is valid, the device authentication is currently successful, and the terminal-side link encryption gateway is contacted to perform identity authentication of the service terminal corresponding to the data frame; otherwise, the device authentication fails and the data frame is discarded.

3. The method of claim 1 or 2, wherein: In step A, based on the current successful device authentication, the terminal-side link encryption gateway determines whether the service terminal corresponding to the data frame has successfully passed identity authentication. If so, it further determines whether the current time is within the preset authentication validity period from the last successful authentication time of the service terminal. If yes, the identity authentication is currently successful, and the process proceeds to step B; otherwise, the identity authentication fails. The gateway then contacts the service-side link encryption gateway to perform identity authentication for the service terminal corresponding to the data frame. If the authentication is successful, the process proceeds to step B; otherwise, the data frame is discarded. Similarly, if the terminal-side link encryption gateway determines whether the service terminal corresponding to the data frame has failed identity authentication, the process proceeds to step B; otherwise, the data frame is discarded.

4. The method of claim 1, wherein: In step B, the service-side link encryption gateway parses the encrypted message from the terminal-side link encryption gateway, performs device authentication based on the preset legal MAC addresses, and determines whether the source MAC address is valid. If the source MAC address is valid, it further determines whether the identity authentication of the corresponding service terminal has been successful. If so, the service-side link encryption gateway further calls the session key from the most recent successful identity authentication state to decrypt the message; otherwise, the encrypted message is discarded. If the source MAC address is invalid, the encrypted message is discarded.

5. The method of claim 1, wherein: In step B, the terminal-side link encryption gateway first calls its session key from the most recent successful authentication state to encrypt the IP header, target network transport protocol header, and application data in the data frame, forming encrypted application data; then, based on the Ethernet header, it adds the information of the service terminal. For source IP, service terminal The packet header is constructed using the source MAC address, the virtual IP address provided by the business-side link encryption gateway as the destination IP address, and the MAC address of the business system as the destination MAC address. Finally, a checksum is generated for the packet header and the encrypted application data. The packet header, encrypted application data, and checksum are then encapsulated to form an encrypted packet, which is sent to the business-side link encryption gateway. The business-side link encryption gateway parses the received encrypted packet to obtain the encrypted application data. It then uses the session key from its most recent successful authentication state to decrypt the encrypted application data, obtains the data frame, and encapsulates and forwards it to the corresponding business system for querying. In step C, the service-side link encryption gateway calls the session key from its most recent successful authentication state to encrypt the received feedback result data frame, thus forming encrypted feedback data. Then based on the Ethernet header, add the business side gateway virtual IP as the source IP, the MAC of the business system as the source MAC, the MAC of the business terminal as the destination MAC, and the destination IP of the business terminal as the destination IP. For the purpose of IP, service terminal The source and destination MAC addresses form the message header. Finally, a checksum for the message header and encrypted feedback data is generated. The message header, encrypted feedback data, and checksum are encapsulated to form an encrypted feedback message, which is sent to the terminal-side link encryption gateway. The terminal-side link encryption gateway parses the received encrypted feedback message to obtain the encrypted feedback data. Then, it calls the session key from the most recent successful authentication state to decrypt the encrypted feedback data, obtains the feedback result data frame, and encapsulates it for forwarding to the service terminal.

6. A system for implementing the method of link layer communication encryption according to claim 5, characterized in that: The data link created by the business terminal sequentially passes through the terminal-side link encryption gateway, the business-side link encryption gateway, and then to the business system. The structure of the terminal-side link encryption gateway is the same as that of the business-side link encryption gateway. Both the terminal-side link encryption gateway and the business-side link encryption gateway include a data capture module, a data parsing module, a device authentication module, an identity authentication module, a data encryption / decryption module, a device authentication library, a hardware cryptography module, and a data sending module. In the terminal-side link encryption gateway, the data capture module is used to poll the data frames and encrypted feedback messages in the network card's receive buffer queue; The data parsing module is used to parse the data frames and encrypted feedback messages received by the data capture module; The device authentication library consists of preset legal MAC addresses. The device authentication module is used to authenticate the source MAC address of data frames from business terminals based on the preset legal MAC addresses in the device authentication library. The identity authentication module is used to authenticate the business terminal by contacting the identity authentication module in the business-side link encryption gateway through the data sending module and the data capture module, based on the hardware cryptographic module; the data encryption and decryption module is used to encrypt data frames and decrypt encrypted feedback messages based on the hardware cryptographic module. The data sending module is used to send encrypted messages and feedback result data frames; In the service-side link encryption gateway, the data capture module is used to poll the feedback result data frames and encrypted messages on the network card's receive buffer queue; The data parsing module is used to parse the feedback result data frames and encrypted messages received by the data capture module; The device authentication library consists of preset legal MAC addresses. The device authentication module is used to authenticate the source MAC address of encrypted packets from the terminal-side link encryption gateway based on the preset legal MAC addresses in the device authentication library. The identity authentication module is used to determine, based on the hardware cryptographic module, whether the identity authentication of the business terminal has been successful so far; The data encryption / decryption module is used to encrypt the feedback result data frame and decrypt the encrypted message according to the hardware cryptographic module; the data sending module is used to send the encrypted feedback message and data frame.

Images