CN115834026A - Safety encryption method based on industrial protocol - Google Patents

Abstract

The invention relates to a safety encryption method based on an industrial protocol. The invention uses the root key to carry out SM4 encryption operation on the HASH value, and hashes out three-level data encryption keys. Encrypting data by using an SM4 algorithm and a hashed three-level encryption key, and repackaging the protocol characteristic HASH data and the encrypted data into a data packet; and recalculating the checksum of the data packet, and sending the encrypted data packet. And carrying out state secret SM4 encryption operation on the HASH value by using the root key, and hashing to obtain a three-level data decryption key. And decrypting the data packet content by using the data decryption key through an SM4 cryptographic algorithm, re-encapsulating the data packet content, removing the HASH field of the coordination characteristic, and restoring the plaintext data packet. The invention solves the problem of safe encryption of data in an industrial environment, and realizes one packet and one cipher of encrypted data by participating in key hashing through characteristic parameters and time parameters coordinated by industry; the deployment is completely transparent, and the existing topological structure is not required to be modified.

Description

A Safe Encryption Method Based on Industrial Protocol

technical field

The invention belongs to the technical field of data encryption, and relates to a safe encryption method based on industrial protocols.

Background technique

Currently, encryption products in the market are mainly based on virtual private network (VPN). The market for VPN-related technologies and products is very mature. At present, the most used VPN products are mainly IPSec VPN and SSLVPN. The key exchange protocol (IKE protocol) generates a data encryption key after key negotiation, and uses this key to encapsulate and encrypt the transmitted data. SSL is generally used for mobile office workers, and generally requires the installation of client software or Client plugin.

The current standard VPN technology and products also have certain deficiencies and defects, some of which are often exploited by hackers. For example, because IPSec VPN products use DH exchange, there are vulnerabilities that cannot resist "man-in-the-middle" attacks. The secret key negotiation process The identity of the negotiator will be leaked, and the encryption algorithms are mainly international algorithms, and the algorithms are relatively open. In addition, IKE negotiates the use of pre-shared keys for identity authentication, which has problems such as low security, backward technology, and non-compliance with my country's relevant password policies. With the rapid integration of informatization and industrialization, many national key infrastructures Facing security challenges, the inventive device dynamically generates encryption keys based on the characteristics of industrial protocols to ensure the security of data transmission and provide a more adaptable and safer all-round data security encryption solution for industrial business scenarios.

Due to the above problems in the current VPN products, and the complex and cumbersome configuration of the traditional VPN, the industrial environment needs to connect many nodes and the bandwidth is small, the traditional VPN needs to change the existing network topology, and the key negotiation will increase additional bandwidth overhead, so through Traditional VPN products simply cannot be deployed in industrial environments.

Therefore, a secure encryption method based on industrial protocols is designed, which is deployed in a transparent manner without any modification to the existing network topology. The encryption key is dynamically generated based on the characteristics of industrial protocols. The device can perform in-depth analysis of the content of industrial protocols. Customers You can customize the industrial coordination feature attributes involved in the key calculation. The encryption key is based on a factory preset root key + industrial coordination feature + time parameter, and is generated by hashing the root key and the national secret algorithm to ensure that the key can be real-time It is updated without additional key negotiation data, reducing network bandwidth overhead, and the root key is preset to ensure the absolute security of the key.

Contents of the invention

The purpose of the present invention is to provide a secure encryption method based on industrial protocols, including encryption key calculation, data encryption encapsulation, decryption key calculation and data decryption.

The specific steps of encryption key operation are as follows:

The network card receives plaintext data packets, and the industrial protocol deep analysis module performs in-depth analysis on the data packets, such as register types, function codes, access types, PLC addresses, and register addresses of the modbus protocol.

Query the predefined protocol feature library, that is, the content that needs to participate in the key operation. The predefined protocol feature library can be any few fields of the in-depth analysis result, and the protocol feature data in the data packet is calculated by the national secret SM3 algorithm 256-bit HASH value (hash value), and then the first 128 bits are located in the last 128 bits for XOR operation, and the final 128-bit protocol characteristic HASH value.

Get the current time of the system and read the root key.

Use the root key to perform national secret SM4 encryption operation on the calculated 128-bit HASH value, and hash out the first-level key; use the root key to perform SM4 operation on the current time, and hash out the second-level key; the first-level key and The secondary key XOR operation hashes out the tertiary data encryption key.

The process of data encryption and encapsulation is as follows:

Receive plaintext packets and obtain packet payload data.

Use the PKCS7Padding method to pad the data to be encrypted. Because the SM4 algorithm is used, the length of the encrypted data must be an integer multiple of the key length of the SM4 algorithm.

Use the SM4 algorithm and the hashed three-level encryption key to encrypt the data, repackage the data packet with the protocol characteristic HASH data and encrypted data; recalculate the checksum of the data packet, including the IP header checksum and TCP/UDP header check Checksum; send encrypted data packet.

The specific steps of the decryption key operation are as follows:

The network card receives the ciphertext data packet and obtains the payload data of the data packet, in which the first 128 bits are the protocol characteristic HASH value, and the latter is the encrypted data.

Get the current time of the system and read the root key.

Use the root key to perform national secret SM4 encryption operation on the first 128-bit protocol characteristic HASH value, and hash out the first-level key; use the root key to perform SM4 operation on the current time, and hash out the second-level key; first-level key Exclusive OR operation with the secondary key to hash the tertiary data decryption key.

The data decryption process is as follows:

The network card receives the ciphertext data packet, and uses the data decryption key to decrypt the content of the data packet through the SM4 national secret algorithm.

The industrial protocol in-depth analysis module performs in-depth analysis on the decrypted data packets, such as register types, function codes, access types, PLC addresses, register addresses, etc. of the modbus protocol.

Query the predefined protocol feature library, that is, the content that needs to participate in the key operation. The predefined protocol feature library is any few fields of the in-depth analysis result, and the protocol feature data in the data packet is calculated by the national secret SM3 algorithm 256 Bit HASH value, then the first 128 bits are placed in the last 128 bits for XOR operation, and the final 128-bit protocol characteristic HASH value is obtained.

Compare the obtained protocol characteristic HASH value with the HASH value of the received data packet payload header, if the comparison is consistent, the data is correct, otherwise the data may be tampered with and discarded directly.

Re-encapsulate the content of the data packet, remove the coordination feature HASH field, restore the plaintext data packet; forward the data packet.

The industrial network environment has the characteristics of many data nodes, complex network structure, and relatively low bandwidth. The deployment of traditional encryption products in the industrial network environment has greatly changed the network, is not easy to deploy, increases bandwidth overhead, and is also vulnerable to network attacks. Many unstable factors. The invention solidifies the root key inside the device and cannot be obtained from the outside, completes the data encryption through the three-level key system of protocol features and time parameter hashing, and solves the problem of data security encryption in the industrial environment; through the characteristics of industrial coordination Parameters and time parameters participate in key hashing to realize encrypted data for one package and one encryption; SM3 national secret algorithm is used to ensure the integrity and correctness of data; it is deployed in a completely transparent manner without any modification to the existing topology.

Description of drawings

Figure 1 is the encryption key calculation process;

Figure 2 is the process of data encryption encapsulation;

Fig. 3 is a flow chart of decryption key operation;

Figure 4 is the data decryption verification process;

Fig. 5 is a schematic diagram of the content of the data packet before and after encryption.

Detailed ways

A secure encryption method based on industrial protocols, including encryption key calculation, data encryption encapsulation, decryption key calculation and data decryption:

As shown in Figure 1, the encryption key operation specifically includes the following steps:

The network card receives the plaintext data message;

Send the plaintext message to the industrial protocol deep analysis module for analysis. If the analysis is successful, query the predefined protocol feature library that needs to participate in the key operation (the data that needs to participate in the key operation is defined by the user in advance), if it is not industrial protocol data Or if the in-depth analysis fails, the data five-tuple (data source address, destination address, source port, destination port, protocol) is used as the protocol feature data;

Calculate the HASH value of the protocol feature data through the SM3 algorithm, output 256-bit HASH data, and then use the first 128 bits and the last 128-bit XOR operation to obtain the protocol feature HASH data, and use it as a primary key hash parameter;

Use the root key to hash the first-level key on the protocol feature HASH data through the SM4 algorithm;

Use the root key to hash the secondary key for the current time of the system through the SM4 algorithm;

Through the XOR operation of the first-level key and the second-level key, the third-level data encryption key is hashed;

As shown in Figure 2, the process of data encryption and encapsulation is as follows:

Receive plaintext packets;

Obtain packet payload data;

Use the PKCS7Padding method to pad the data to be encrypted. Because the SM4 algorithm is used, the length of the encrypted data must be an integer multiple of the key length of the SM4 algorithm;

The PKCS7Padding method is specifically: before data encryption, the data needs to be aligned according to the integer of the key length. Assuming that the data length needs to be filled with n (n>0) bytes to be aligned, then n bytes are filled, and each byte is It is n; if the data itself is already aligned, fill a piece of data whose length is the block size, and each byte is the block size.

Data encryption using SM4 algorithm and hashed three-level encryption key;

Repackage the data packet with the protocol characteristic HASH data and encrypted data;

Recalculate the checksum of the data packet, including the IP header checksum and the TCP/UDP header checksum;

Send encrypted data packets;

As shown in Figure 3, the decryption key calculation process is as follows:

The network card receives encrypted data packets;

Obtain the first 128 bits of data of the payload data, and obtain the protocol characteristic HASH data. This data is the HASH value of the industrial protocol characteristic data in plain text, and the decryption key is hashed through this data;

Use the root key to hash the first-level key on the protocol feature HASH data through the SM4 algorithm;

Use the root key to hash the secondary key for the current time of the system through the SM4 algorithm;

Through the XOR operation of the first-level key and the second-level key, the third-level data decryption key is hashed;

As shown in Figure 4, data decryption specifically includes the following steps:

Receive encrypted data packets;

Extract the 128-bit protocol characteristic HASH data before the packet payload data;

Decryption key through protocol HASH data and system time hash;

Decrypt encrypted payload data;

Perform in-depth analysis of industrial protocols on the decrypted data;

If the industrial protocol is successfully parsed, query the predefined protocol feature library that needs to participate in the key operation, and then calculate the HASH value of the protocol feature data through the SM3 algorithm, and use the first 128 bits and the last 128 bits of XOR operation to obtain the decrypted protocol feature HASH data; if the industrial protocol analysis fails, the five-tuple data will be used as the characteristic data of the industrial protocol;

The decrypted HASH data is compared with the HASH or quintuple HASH in the received payload data. If the comparison is successful, it indicates that the data is normal; if the comparison fails, it indicates that the data has been tampered with or decrypted incorrectly, and is discarded directly;

Re-encapsulate the plaintext data message and recalculate the checksum of the message, including the checksum of the IP header and the TCP or UDP header;

Send the decrypted data packet;

As shown in Figure 5, the payload data is the actual industrial protocol data, which is the data behind the TCP or UDP header. The data encryption of the present invention does not modify the IP header and TCP/UDP header data, so there is no need to modify the existing topology structure, and it can be directly and transparently connected in series Just enter.

Claims (2)

1. A security encryption method based on an industrial protocol, characterized in that: comprising encryption key calculation, data encryption encapsulation, decryption key calculation and data decryption verification; The specific steps of encryption key operation are as follows: The network card receives plaintext data packets, and the industrial protocol deep analysis module performs in-depth analysis on the data packets; queries the predefined protocol feature library that needs to participate in the key operation, and the predefined protocol feature library is any field of the deep analysis result, and the The protocol features in the data packet are calculated with a 256-bit HASH value by the national secret SM3 algorithm, and then the first 128 bits are placed in the last 128 bits for XOR operation, and the final 128-bit protocol feature HASH value is obtained; Obtain the current time of the system and read the root key; Use the root key to perform national secret SM4 encryption operation on the calculated 128-bit HASH value, and hash out the first-level key; use the root key to perform SM4 operation on the current time, and hash out the second-level key; the first-level key and Exclusive OR operation of the secondary key to hash the tertiary data encryption key; The process of data encryption and encapsulation is as follows: Receive the plaintext data packet and obtain the data packet load data; use the PKCS7Padding method to fill and align the data that needs to be encrypted, and use the SM4 algorithm and hashed three-level encryption key to encrypt the data; repackage the data packet with the protocol feature HASH data and encrypted data ;Recalculate the checksum of the data packet, including the checksum of the IP header and the checksum of the TCP/UDP header; send the encrypted data packet; The specific steps of data decryption key operation are as follows: The network card receives the ciphertext data packet and obtains the payload data of the data packet, in which the first 128 bits are the protocol characteristic HASH value, and the latter is the encrypted data; Obtain the current time of the system and read the root key; Use the root key to carry out the national secret SM4 encryption operation on the first 128 bits of the protocol characteristic HASH value, and hash out the first-level key; use the root key to perform SM4 operation on the current time, and hash out the second-level key; first-level encryption Key and the secondary key are XORed, and the third-level data decryption key is hashed; The data decryption process is as follows: The network card receives the ciphertext data packet, and uses the data decryption key to decrypt the content of the data packet through the SM4 national secret algorithm; The industrial protocol deep analysis module performs in-depth analysis on the decrypted data packets, and queries the predefined protocol feature library that needs to participate in the key operation. The predefined protocol feature library is any field of the deep analysis result, and the The protocol feature library calculates the 256-bit HASH value through the national secret SM3 algorithm, and then the first 128 bits are placed in the last 128 bits for XOR operation, and the final 128-bit protocol feature HASH value is obtained; Compare the obtained protocol feature HASH value with the HASH value of the received data packet payload header. If the comparison is consistent, the data is correct, otherwise the data may be tampered with and discarded directly; re-encapsulate the content of the data packet, remove the coordination feature HASH field, and restore the plaintext Packet; forward a packet. 2. The security encryption method based on industrial protocol as claimed in claim 1, characterized in that: said industrial protocol deep analysis module carries out deep analysis to data packet, including register type, function code, access type, PLC address, register address.

Images