CN109428867B - Message encryption and decryption method, network equipment and system - Google Patents
Message encryption and decryption method, network equipment and system Download PDFInfo
- Publication number
- CN109428867B CN109428867B CN201710763841.1A CN201710763841A CN109428867B CN 109428867 B CN109428867 B CN 109428867B CN 201710763841 A CN201710763841 A CN 201710763841A CN 109428867 B CN109428867 B CN 109428867B
- Authority
- CN
- China
- Prior art keywords
- network device
- key
- field
- sub
- value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
A message encryption and decryption method, network equipment and system are provided, the method comprises: the method comprises the steps that a first network device and a second network device negotiate in advance to determine an original key, then the first network device generates a sub-key set by using the original key, further determines a sub-key from the sub-key set, and performs encryption processing by using the sub-key and a first field of a serial number of a data message generated by the first network device, so that an encryption field is generated, the first network device replaces the first field of the serial number by using the encryption field, then obtains a modified data message, and sends the modified data message to the second network device.
Description
Technical Field
The present application relates to the field of information technologies, and in particular, to a message encryption and decryption method, a network device, and a system.
Background
At present, with the wide application of network communication in more and more government departments and enterprise institutions, the continuous increase of shared information and online services, and network attack and crime activities are rampant. How to prevent the leakage and the tampering of confidential information in the network, prevent and attack information crime, and guarantee the network and the information safety presents a serious challenge for people. Network communication is confronted with a great number of attacks in various ways every day, and the attacks can be divided into active attacks and passive attacks. Active attacks refer to selectively destroying information in various ways, such as modifying, deleting, forging, adding, replaying, out-of-order spoofing, and the like. Passive attack refers to interception, stealing, deciphering, etc. without interfering the normal operation of the network system. Among them, replay is an important attack means.
The replay attack means that an attacker firstly intercepts data packets which are normally communicated by two communication peers through a network, then the data packets are left intact or modified, and after waiting for a period of time, the data packets are sent to a receiver of the data packets, namely 'replay'. The purpose of playback is to impersonate a legitimate party to communicate with another party. The reason why a replay mode is adopted instead of directly sending a forged data packet is that some systems encrypt and authenticate partial information, the forged data packet may not obtain the trust of a data packet receiver, and the aim can be achieved by replaying an originally legal data packet.
In order to solve the problem of replay attack, in each security network protocol (IPSec) header, a unique and monotonically increasing sequence number is included, and a replay packet is actively screened out through a sequence number of each packet and a "sliding" receiving window, but because the sequence number is monotonically increased, guessing is easy, and a replay prevention mechanism is easily disabled.
Disclosure of Invention
In view of this, the present application provides a message encryption and decryption method, a network device and a system, so as to solve the problem of effectively preventing replay attack.
In a first aspect, an embodiment of the present application provides a message encryption method, where the method includes: the method comprises the steps that a first network device and a second network device negotiate in advance to determine an original key, then the first network device generates a sub-key set by using the original key, further determines a sub-key from the sub-key set, and performs encryption processing by using the sub-key and a first field of a serial number of a generated data message so as to generate an encrypted field, the first network device replaces the first field of the serial number of the data message by using the encrypted field, then obtains a modified data message, and sends the modified data message to the second network device.
Because the serial number in the data message is encrypted, even if an attacker intercepts the data message, the attacker cannot decrypt the original serial number, so that the problem of replay attack can be effectively prevented.
The method comprises the steps that a first network device and a second network device negotiate in advance to determine an original key mainly through IKE negotiation, the negotiation process is that the first network device sends an Internet key exchange IKE negotiation request message to the second network device, and the value of a preset identification bit in the IKE negotiation request message indicates that the first network device supports serial number encryption transmission; and then the second network equipment sends an IKE negotiation response message to the first network equipment, wherein the value of a preset identification bit in the IKE negotiation response message indicates that the second network equipment supports the encrypted transmission of the serial number, and an original key is generated by using the key seed in the negotiation process.
Furthermore, the first network device splits the original key negotiated with the second network device into N fields, then copies the N fields into M fields, and generates a set of subkeys composed of M fields, which is done to increase the randomness and complexity of the subkeys and avoid being guessed by an attacker.
In a possible design, the method for the first network device to determine one sub-key from the sub-key set may be that the first network device modulo M by a second field included in a sequence number of the data packet to obtain a modulus value; and then, with the modulus value as an index value, finding a subkey corresponding to the index value from the subkey set. The advantage of this is that the serial numbers are different, so the module values corresponding to the modules are different, so the determined subkey is also dynamic, so the attacker is difficult to crack and obtain the subkey, thereby improving the reliability of the encryption method.
In one possible design, the first network device performs an exclusive or operation on a first field included in a serial number of the data packet and the determined sub-key to obtain an encrypted field. In general, to ensure that the length of the data packet is as constant as possible, the number of bytes of the subkey is generally the same as the number of first fields. If the length of the data message is longer, the overhead will be increased, and if the length of the data message is shorter, the data message will be easily cracked by an attacker. In contrast, the xor encryption method does not require inverting the xor operation in the decryption process, so the decryption process is relatively simple.
In addition, the first field above may be an upper byte part or a lower byte part of the sequence number, and assuming that the sequence number includes L bytes, the first field may be an upper byte part of L/2 bytes of the sequence number, and the second field is a lower byte part of L/2 bytes of the sequence number; or the first field may be a lower byte portion of L/2 bytes of the sequence number, and the second field is an upper byte portion of L/2 bytes of the sequence number.
In a second aspect, corresponding to the above encryption method, an embodiment of the present invention further provides a message decryption method, where the method includes that after receiving a data message sent by a first network device, a second network device determines a sub-key in the same manner as the first network device, and then decrypts a sequence number in the received data message using the sub-key, where the decryption method corresponds to the encryption method, that is, a first field included in the sequence number of the received data message and the determined sub-key are decrypted to obtain a decrypted field, and then the decrypted field is used to replace the first field in the sequence number of the data message, so as to obtain a decrypted message.
Therefore, even if the serial number in the data message is encrypted, the second network equipment can correctly decrypt the data message according to a decryption method to obtain the original serial number, and an attacker cannot decrypt the original serial number even if intercepting the data message, so that the problem of replay attack can be effectively prevented.
Of course, the second network device performs the IKE negotiation procedure with the first network device in advance, and the negotiation procedure is consistent with the above, and therefore is not described herein again. In addition, the manner in which the set of subkeys is generated and the process of determining subkeys from the set of subkeys is also consistent with the above.
The method for decrypting the message by the second network device corresponds to the encryption method, and in one possible design, if the encryption operation adopted by the first network device is exclusive-or, the second network device performs exclusive-or operation on a first field contained in the serial number of the received data message and the determined sub-key to obtain a decryption field; in another possible design, if the encryption operation adopted by the first network device is the exclusive or, the second network device first negates the received sequence number, and then performs the exclusive or operation on the first field included in the sequence number of the received data packet and the determined subkey, so as to obtain the decryption field. In contrast, the xor encryption method does not require inverting the xor operation in the decryption process, so the decryption process is relatively simple.
In a third aspect, an embodiment of the present application further provides a network device, where the network device has a function of implementing a message encryption behavior in the foregoing method example in the first aspect. The functions can be realized by hardware, and the functions can also be realized by executing corresponding software by hardware. The hardware or the software includes one or more modules corresponding to the above-described functions.
In a possible design, the structure of the network device includes a determining unit, an encrypting unit, a processing unit, and a sending unit, which may execute corresponding functions in the foregoing method example, for specific reference, detailed description in the method example is given, and details are not repeated here.
In a fourth aspect, an embodiment of the present application further provides a first network device, where the first network device has a function of implementing a message encryption behavior in the method example of the first aspect. The functions may be implemented by hardware. The first network device comprises a communication interface, a processor and a memory, wherein the processor calls the instruction stored in the memory to execute the following processing:
determining a sub-key from the sub-key set, encrypting a first field contained in a serial number of a generated data message and the determined sub-key to obtain an encrypted field, and replacing the first field in the serial number of the data message by using the encrypted field to obtain a modified data message; and then sending the data message containing the serial number ciphertext to the second network equipment through the communication interface.
Because the serial number in the data message is encrypted, even if an attacker intercepts the data message, the attacker cannot decrypt the original serial number, so that the problem of replay attack can be effectively prevented.
Wherein, the pre-negotiation of the first network device and the second network device to determine the original key mainly adopts IKE negotiation, and the negotiation process is that, before determining the sub-key, the processor is further configured to: exchanging an Internet Key Exchange (IKE) negotiation request message sent to the second network device through the communication interface, wherein a value of a predetermined identification bit in the IKE negotiation request message is a first value, and the first value indicates that serial number encryption transmission is supported; and receiving an IKE negotiation response message sent by the second network equipment through the communication interface, wherein the processor determines that the second network equipment supports the encrypted transmission of the sequence number under the condition that a preset identification bit in the IKE negotiation response message is also a first value. And generates an original key using the key seed during the negotiation process.
Further, the processor splits the original key negotiated and determined with the second network device into N fields; and copying the N fields into M fields, and generating a subkey set consisting of the M fields. This is done to increase the randomness and complexity of the subkeys to avoid guessing by an attacker.
In one possible design, the processor modulo M by a second field included in the serial number to obtain a modulus value; and then, with the modulus value as an index value, finding a subkey corresponding to the index value from the subkey set.
In one possible design, the processor performs exclusive or operation on a first field contained in a serial number of a data message and the determined sub-key to obtain an encrypted field. In general, to ensure that the length of the data packet is as constant as possible, the number of bytes of the subkey is generally the same as the number of first fields.
In addition, the first field above may be an upper byte part or a lower byte part of the sequence number, and assuming that the sequence number includes L bytes, the first field may be an upper byte part of L/2 bytes of the sequence number, and the second field is a lower byte part of L/2 bytes of the sequence number; or the first field may be a lower byte portion of L/2 bytes of the sequence number, and the second field is an upper byte portion of L/2 bytes of the sequence number.
In a fifth aspect, an embodiment of the present application further provides a second network device, where the second network device has a function of implementing a message decryption behavior in the method example in the second aspect. The functions can be realized by hardware, and the functions can also be realized by executing corresponding software by hardware. The hardware or the software includes one or more modules corresponding to the above-described functions.
In a possible design, the structure of the second network device includes a determining unit, a receiving unit, a decrypting unit, and a processing unit, which may execute corresponding functions in the foregoing method example, for specific reference, detailed description in the method example is given, and details are not repeated here.
In a sixth aspect, an embodiment of the present application further provides another structure of a second network device, where the second network device has a function of implementing a message decryption behavior in the method example in the second aspect. The functions may be implemented by hardware. The network equipment comprises a communication interface, a processor and a memory, wherein the processor and the memory are connected through a bus; the processor calls the instruction stored in the memory to execute the method, which is not described in detail herein.
In a seventh aspect, this embodiment of the present application further provides a computer storage medium, where a software program is stored, and when the software program is read and executed by one or more processors, the software program may implement the method provided by the first aspect or any one of the designs of the first aspect.
In an eighth aspect, embodiments of the present application further provide a computer storage medium, where a software program is stored, and when the software program is read and executed by one or more processors, the software program may implement the method provided by the second aspect or any one of the designs of the second aspect.
In a ninth aspect, the present application further provides a computer program product containing instructions, which when run on a computer, causes the computer to execute the message encryption method according to the above aspects or various possible implementations.
In a tenth aspect, the present application further provides a computer program, which when run on a computer, causes the computer to execute the message decryption method described in the above aspects or various possible implementations.
In the application, because the subkey is transmitted in the encryption channel determined by negotiation between the first network device and the second network device and is dynamically changed, the encrypted data message has high security, and in addition, the subkey for encrypting the serial number is determined in a modulo mode, so that the randomness is high, and the encrypted serial number can not be guessed, thereby effectively preventing replay attack.
Drawings
Fig. 1 is a schematic diagram of a system architecture according to an embodiment of the present application;
fig. 2 is a schematic diagram of a system architecture based on IKE negotiation according to an embodiment of the present disclosure;
fig. 3 is a schematic flowchart of a message encryption method according to an embodiment of the present application;
fig. 4 is a schematic diagram of an IKE negotiation interaction provided in an embodiment of the present application;
fig. 5a to 5b are schematic diagrams illustrating positions of message reserved fields according to an embodiment of the present application;
fig. 6 is a schematic flowchart of a message decryption method according to an embodiment of the present application;
FIG. 7 is a first apparatus diagram of a network device according to an embodiment of the present application;
fig. 8 is a second apparatus diagram of a network device according to an embodiment of the present application;
fig. 9 is a schematic structural diagram of a network device according to an embodiment of the present application.
Detailed Description
The present application will be described in further detail below with reference to the accompanying drawings.
The message encryption and decryption method in the present application is applicable to various system architectures, and fig. 1 is a schematic diagram of a system architecture applicable to the present application. As shown in fig. 1, the system architecture includes: a sending end server 101, a sending end gateway 102, a receiving end gateway 103, and a receiving end server 104.
In order to ensure the security of data packet transmission between the sending-end gateway 102 and the receiving-end gateway 103, an IPSec protocol is used between the sending-end gateway 102 and the receiving-end gateway 103 to transmit the packet.
It should be noted that IPSec is a three-layer tunnel encryption protocol (IETF) established by the internet engineering task force (internet engineering task force) to ensure security and confidentiality of data transmitted over the internet. IPSec provides security services to IP packets at the Internet Protocol (IP) layer. The IPSec protocol itself defines how to add fields to IP packets to guarantee the integrity, privacy and authenticity of the IP packets, and how to encrypt the packets. Using IPsec, data can be securely transmitted over the public network. IPsec provides protection between two hosts, between two security gateways, or between a host and a security gateway.
IPSec includes two protocols, the Authentication Header (AH) (protocol number 51) and the Encapsulated Security Payload (ESP) (protocol number 50). The AH may provide data source verification and data integrity checking functions; ESP provides functions of encrypting IP packets in addition to data verification and integrity check functions. The security features of the IPSec protocol are 1, data confidentiality, i.e. the IPSec sender encrypts the packets before transmitting them over the network. 2. Data integrity, namely, the IPSec receiver authenticates a packet sent by the sender to ensure that data is not tampered during transmission. 3. Data source authentication, i.e., the IPSec receiver authenticates the source address of the IPSec packet. This service is based on a data integrity service. 4. Anti-replay attacks, i.e., IPSec recipients can detect and deny the receipt of stale or duplicate messages.
The replay attack means that an attacker firstly intercepts data packets normally communicated by two communication peers through a network, then the data packets are left intact or modified, and after waiting for a period of time, the data packets are sent to a receiver of the data packets, namely 'replay'. The purpose of playback is to impersonate a legitimate party to communicate with another party. The reason why an attacker adopts a replay mode rather than directly sending a forged data packet is that some systems encrypt and authenticate part of information, the forged data packet may not obtain the trust of a data packet receiver, and the goal can be achieved by replaying an originally legal data packet. For example, in mobile IP, registration occurs when a mobile node discovers a handoff of its network from one link to another. The purpose of registration is to make the mobile node get routing service of foreign agent on foreign link and inform the home agent of the care-of address of the mobile node. The registration message is a User Datagram Protocol (UDP) packet contained within an IP packet. If an attacker intercepts the packet, modifies the care-of address field, and retransmits the message, the attacker registers with a fake care-of address. Then all packets sent to the mobile node in the network are forwarded to the care-of address where the attacker is registered, and the mobile node will not receive any information.
Although the message is transmitted by using the IPSec protocol, the receiver can detect and refuse to receive the outdated or repeated message, and replay attack can be prevented to a certain extent, because the serial number of the message transmitted by the IPSec protocol is a plaintext, and the serial number has the characteristic of monotonous increment or decrement, once an attacker intercepts a message, the serial number of a subsequent message is easily guessed according to the serial number of the message, so that the sender and the receiver are simulated to communicate, and the receiver simply analyzes the serial number, if the message is judged not to be repeated or outdated, the message is considered to be legal, so that the illegal message of the attacker cannot be accurately identified, and the replay prevention function of the IPSec protocol is easily failed.
In the prior art, an additional check field is added to perform an additional check mode on the serial number of the packet, so that an attacker can obtain an effective serial number but cannot pass the packet verification.
Considering that the existing IPSec packet further includes an Internet Key Exchange (IKE) protocol, the main function of IKE negotiation is to implement key negotiation between two communication parties, verify whether the identities of the two communication parties are legal through the negotiation process, and establish a Security Association (SA) under the legal condition. Based on the above reasons, embodiments of the present application provide a message encryption and decryption method, which combines and utilizes an IKE negotiation mechanism, generates a key by using a key seed determined by IKE negotiation, and encrypts a sequence number of a plaintext into a ciphertext by using the key, so that an attacker cannot decrypt the key, and even if the attacker intercepts a data message, the attacker cannot guess a subsequent sequence number, thereby effectively preventing replay attack.
In detail, the main functions of the IKE protocol included in the IPSec message are to securely negotiate, distribute, manage keys, verify identities, and establish a security association over an insecure network. SA is an agreement between both parties, and correct IPSec processing can be performed only if all information of the agreement is known. For example, when it is agreed to use ESP for encapsulation, AH cannot be used for decapsulation; similarly, when agreement is good to use 3DES encryption, it cannot be decrypted using AES.
To ensure that IPSec communication is successfully conducted, the IKE protocol performs a two-phase negotiation. These two phases are Main Mode (Main Mode) negotiation and fast Mode (Quick Mode) negotiation, respectively.
1. Main mode (also referred to as phase 1) IKE negotiation establishes a secure channel between two computers called ISAKMP SA. The secure channel is mainly used for protecting the security negotiation.
2. Fast mode (also referred to as phase 2) IKE negotiation establishes a channel between two computers to protect data. Since this phase involves the creation of an SA, the SA established during fast mode is referred to as an IPSec SA. During fast mode, the cryptographic material will be refreshed, or a new key generated if necessary. A protective sheath for protecting specific IP traffic is also selected during this period.
After the negotiation, a shared key material, i.e., a key seed (SKEYSEED), can be generated. The calculation formula of the key seed is as follows:
SKEYSEED＝prf(Ni|Nr,gΛir) … … … … … … … … … … equation [1]
SKEYSEED＝{SK_d|SK_ai|SK_ar|SK_ei|SK_er|SK_pi|SK_pr}
Prf + (SKEYSEED, Ni | Nr | spiii | spiir) … … … … … equation [2]
Where SK _ d is used for the second-stage extended key (only it is undivided), SK _ ai and SK _ ar are used as MAC keys for the initiator and responder, respectively, SK _ ei and SK _ er are used as encryption keys for the initiator and responder, respectively, and SK _ pi and SK _ pr are used for authentication payload calculation for the initiator and responder.
In addition, through the negotiation, the two parties can determine whether decryption is needed subsequently when receiving the data message sent by the other party according to the negotiation result, for example, if the negotiation result is that the other party does not support encryption, the sender does not encrypt the data message to be sent but directly sends the data message to the receiving side, and meanwhile, the receiving side receives the data message, does not perform decryption operation but directly obtains the serial number for verification. Of course, if the negotiation result is that the other party supports encryption, the sender encrypts the data message to be sent, and then sends the encrypted data message to the receiving side, and meanwhile, the receiving side receives the data message and performs decryption operation.
Specifically, the message encryption and decryption method provided in the embodiment of the present application includes a message encryption method and a message decryption method, and a communication system to which the message encryption and decryption method provided in the embodiment of the present application is applied is shown in fig. 2, where fig. 2 mainly includes the following processes: the SA negotiation of IKE is established between the sending-end gateway 102 and the receiving-end gateway 103, then the sending-end gateway 102 encrypts the IPSec message by using the encryption algorithm determined by the negotiation to generate an encrypted IPSec message, and then sends the encrypted IPSec message to the receiving-end gateway 103, wherein the receiving-end gateway 103 decrypts the encrypted data message by using the decryption algorithm determined by the negotiation, and restores the encrypted data message to obtain the serial number of the original IPSec message.
The following is a detailed explanation of the two processes, namely, the encryption process and the decryption process, respectively.
As shown in fig. 3, a flow diagram of a message encryption method provided in an embodiment of the present application includes the following specific steps:
It should be noted that before performing step 301, the first network device needs to determine that the second network device of the opposite end supports encrypted transmission, that is, the second network device receives the encrypted data packet and can decrypt the encrypted data packet. Therefore, before performing step 301, an IKE negotiation process needs to be performed between the first network device and the second network device, and an interaction diagram of the negotiation is shown in fig. 4, which includes:
step 401, the first network device sends an IKE negotiation request message to the second network device.
Step 402, the first network device receives an IKE negotiation response message sent by the second network device.
The IKE negotiation request message sent by the first network equipment carries a preset identification bit, the preset identification bit is a first value, the first value indicates that the first network equipment supports the encrypted transmission of the serial number, if the second network equipment also supports the encrypted transmission of the serial number, the IKE negotiation response message fed back by the second network equipment also carries the preset identification bit, and the value with the preset identification is also the first value. In this way, the first network device may determine that the second network device supports encrypted transmission of the sequence number according to the first value of the identification bit in the IKE negotiation response message.
When the first network device determines that the second network device of the opposite terminal supports encryption transmission, the first network device performs the encryption process described in the above fig. 3 on the data message, and then sends the encrypted data message to the second network device; otherwise, the first network device omits the encryption process and directly sends the unencrypted data message to the second network device. Therefore, the network equipment which does not support encrypted transmission can be compatible, and the problem of communication failure is avoided.
The identification bits used by the first network device and the second network device are RESERVED fields that are not used in the IKE message, for example, the first network device identifies whether the first network device supports encryption of the sequence number by using a first bit of 7 bits of RESERVED in a Security Association Payload header, and occupies a 10 th bit in the entire Payload header. As shown in fig. 5a, E indicates the flag bit used, a value of 0 indicates that encryption of the sequence number is not supported, and a value of 1 indicates that encryption of the sequence number is supported. Thus, when the second network device receives the IKE negotiation request message, the first bit in the RESERVED field in the Security Association payload header is analyzed and determined, if the value is 1, the first network device is considered to support encryption of the data message, and subsequently, when the data message sent by the first network device is received, the first network device is decrypted first.
As shown in fig. 5b, E may indicate the flag used, a value of 0 may indicate that encryption of the sequence number is not supported, and a value of 1 may indicate that encryption of the sequence number is supported. The second network equipment receives the IKE negotiation request message, judges the value of the identification bit in the load, if the value is 1, the first network equipment is considered to support the encryption of the data message, and then, when the data message sent by the first network equipment is received, the second network equipment firstly carries out decryption operation.
In addition, when the first network device and the second network device of the opposite terminal complete the IKE negotiation and determine that the opposite terminal supports encrypted transmission, the first network device first generates an original key by using a key seed formula determined by the negotiation, and then generates a sub-key set by using the original key. Specifically, the first network device splits an original key negotiated and determined with the second network device into N fields; the first network device then copies the N fields into M fields, thereby generating a set of subkeys consisting of M fields, where M is typically greater than N.
For example, the original Key value in table one is split into 8 2 bytes, the 8 2 bytes are arranged in descending order of value, and a Key table shown in table two with the length of 100 is sequentially and circularly filled.
| 0x2fe0 | 0x1fd9 | 0x1ee1 | 0x1fe5 | 0x1fa0 | 0x11a1 | 0x21c3 | 0x1fe9 |
Watch two
| 0x2fe0 | 0x21c3 | 0x1fe9 | 0x1fe5 | 0x1fd9 | 0x1fa0 | 0x1ee1 |
| …… | 0x1fe5 | 0x1fd9 | 0x1fa0 | 0x1ee1 |
In addition, after splitting the original Key value in the first table into 8 2 bytes, each 2 byte in the first table may also be deformed, and then the deformed 2 bytes are used to generate the Key table, where the deformation method may be adding 1 or other existing methods, which are not described herein again.
In a possible design, the first network device determines a sub-key from the set of sub-keys, and the determining method may be that the first network device modulo M by a second field included in a sequence number of the data packet to obtain a modulus value; and the first network equipment searches the subkey corresponding to the index value from the subkey set by taking the modulus value as the index value.
For example, the lower 16 bits 0x1b21 of the serial number 0xefac 0x1b21 are modulo M (for example, M is 100) to obtain a modulo value 45, and the 45 th subkey 0x1fd9 in the Key table in the lookup table two is obtained. Of course, in addition, in the IKE negotiation stage, the first network device and the second network device may negotiate to designate a certain index number of the sub-KEY set as a sub-KEY, for example, to designate the 45 th value 0x1fd9 in the KEY table in table two as the sub-KEY. Obviously, the sub-keys can be determined more dynamically by using a modular approach, and are not easy to be cracked by an attacker.
After the sub-key is determined, the serial number may be encrypted by using the determined sub-key, and in one possible design, the first network device performs an exclusive or operation on a first field included in the serial number of the data packet and the determined sub-key to obtain an encrypted field. For example, the sub-key 0x1fd9 and the high 16-bit 0xefac of the sequence number are subjected to exclusive or operation to obtain a new encryption value 0xf075, the high 16-bit 0xefac of the sequence number is replaced by the new encryption value 0xf075 to obtain a new sequence number 0xf0750x1b21, the sequence number in the original data packet is replaced by the new sequence number 0xf0750x1b21, and the data packet after replacement is sent to the second network device at the opposite end. Therefore, the second network equipment can restore the original serial number by adopting the exclusive-or operation, and the decryption algorithm is very simple and convenient.
In general, to ensure that the length of the data packet is as constant as possible, the number of bytes of the subkey is generally the same as the number of first fields. On one hand, the XOR operation is convenient to perform, on the other hand, the overhead is increased when the length of the data message is lengthened, and the data message is easy to crack by an attacker when the length of the data message is shortened. It should be noted that, the above encryption method may also be used in the same way or in place of the above encryption method, that is, the first field included in the serial number of the data packet and the determined subkey are subjected to the same or operation to obtain the encrypted field. Compared with an exclusive-or encryption mode, the exclusive-or operation is adopted, the second network device needs to perform the exclusive-or operation after negation when decrypting, and the decryption process is relatively complex.
In the above example, the first field is the upper 16 bits 0xefac of the sequence number, and the second field is the lower 16 bits 0x1b21, it should be noted that in other possible designs, the first field may not be a half byte of the sequence number, for example, the sequence number is 4 bytes, the first field is a 1-byte portion, and the second field is a 3-byte portion, and this division may also be implemented by performing a modulo determination on the second field to determine a subkey, and then performing an encryption operation. Similarly, in the above example, the first field may also be the lower 16 bits 0x1b21 of the sequence number, and the second field may be the upper 16 bits 0xefac, i.e., the upper 16 bits are modulo to obtain a modulus value, and then the lower 16 bits are encrypted with the key value corresponding to the modulus value.
Corresponding to the above message encryption method, the embodiment of the present application further describes in detail a specific process of the message decryption method, and specific steps are shown in fig. 6.
In step 602, the second network device determines a subkey from the set of subkeys.
Similar to the above message encryption method, the second network device has already finished the IKE negotiation with the first network device before receiving the data message sent by the first network device, generates the original key by using the key seed formula determined by the negotiation, and then generates the sub-key set by using the original key, wherein the generation method of the sub-key set is the same as that described above, and therefore, the description is omitted here.
That is, the second network device determines the sub-key set according to the same method as the first network device, and further determines a sub-key from the sub-key set according to the same rule as the first network device, for example, the first network device determines the sub-key by taking the modulus of the second field and using the modulus as the index value, and then the second network device determines the sub-key according to the same rule.
In a possible design, the second network device modulo a second field included in the sequence number of the data packet to obtain a module value; and the second network equipment uses the modulus value as an index value, and finds out the subkey corresponding to the index value from the subkey set.
For example, still taking the serial number 0xefac 0x1b21 as an example, in the above, the first network device encrypts the data packet with the 45 th sub-Key 0x1fd9 in the Key table of table 2 to obtain the new serial number 0xf0750x1b21, and then the second network device receives the data packet containing the serial number 0xf0750x1b21, and performs an exclusive or operation on the high 16-bit 0xf075 of the 0xf0750x1b21 by using the 45 th sub-Key 0x1fd9 to obtain the new decryption value 0xefac, and then replaces the high 16-bit 0xf075 of the serial number with the new decryption value 0xefac to obtain the new serial number 0xefac 0x1b21, that is to restore the original serial number corresponding to the data packet sent by the first network device. Of course, if the first network device adopts other rules to determine the sub-key and encrypts the serial number by using the sub-key, for example, the xor operation is performed on the lower byte portion to obtain a new encrypted value, then the second network device also performs the xor operation on the lower byte portion to obtain a new decrypted value.
In another possible design, if the first network device performs an exclusive or operation on the first field included in the sequence number of the data packet and the determined sub-key to obtain the encrypted field, the second network device needs to perform an exclusive or operation after negation when decrypting. For example, if the first network device performs an exclusive-nor operation on the high 16 bits 0xf075 of 0xf0750x1b21 by using the 45 th subkey 0x1fd9, the second network device needs to first negate the serial number 0xf0750x1b21 of the data message, and then decrypt the negated serial number according to the method in the above example.
For the above method flows, the present application provides a network device, and specific execution content of the network device may refer to the embodiment corresponding to the above message encryption method.
Fig. 7 is a schematic structural diagram of a first network device provided in the present application, and as shown in fig. 7, the first network device includes:
a generating unit 701, configured to generate a data packet.
A determining unit 702, configured to determine a sub-key from a sub-key set, where the sub-key set includes M sub-keys, the M sub-keys are generated according to N fields obtained by splitting an original key, the original key is determined by negotiating in advance between the first network device and the second network device, and M is greater than or equal to N.
An encrypting unit 703 is configured to encrypt a first field included in a sequence number of the data packet and the determined sub-key to obtain an encrypted field, where the sequence number includes multiple fields.
A processing unit 704, configured to replace a first field in the sequence number of the data packet with the encrypted field, so as to obtain a modified data packet.
A sending unit 705, configured to send the modified data packet to the second network device.
Optionally, the determining unit 702 is specifically configured to: performing modulus operation on M by using a second field contained in the serial number to obtain a modulus value; and searching the subkey corresponding to the index value from the subkey set by taking the modulus value as the index value.
Optionally, the encryption unit 703 is specifically configured to: and carrying out exclusive OR operation on a first field contained in a serial number of the data message and the determined sub-key to obtain an encrypted field, wherein the number of bytes of the determined sub-key is the same as that of the first field.
If the sequence number includes L bytes, the first field is an upper byte portion of L/2 bytes of the sequence number, and the second field is a lower byte portion of L/2 bytes of the sequence number; or the first field is a lower byte part of L/2 bytes of the sequence number, and the second field is an upper byte part of L/2 bytes of the sequence number.
The first network device further comprises: a generating unit 701, configured to split an original key negotiated and determined with the second network device into N fields; and copying the N fields into M fields, and generating a subkey set consisting of the M fields.
Optionally, the sending unit 705 is further configured to: sending an Internet Key Exchange (IKE) negotiation request message to the second network equipment, wherein the value of an identification bit in the IKE negotiation request message indicates that the IKE negotiation request message supports serial number encryption transmission;
the network device further includes: a receiving unit 706, further configured to receive an IKE negotiation response message sent by the second network device;
optionally, the determining unit 702 is further configured to determine that the second network device supports encrypted transmission of a sequence number according to a value of an identification bit in the IKE negotiation response message.
Fig. 8 is a schematic structural diagram of a second network device corresponding to the message decryption method provided in the present application, where as shown in fig. 8, the second network device includes: a determination unit 801, a reception unit 802, a decryption unit 803, and a processing unit 804; specifically, the method comprises the following steps:
a receiving unit 801, configured to receive a data packet sent by a first network device.
A determining unit 802, configured to determine a sub-key from a sub-key set, where the sub-key set includes M sub-keys, the M sub-keys are generated according to N fields obtained by splitting an original key, the original key is determined by negotiating in advance between a first network device and a second network device, and M is greater than or equal to N.
A decryption unit 803, configured to decrypt a first field included in a sequence number of a received data packet and the determined sub-key to obtain a decrypted field, where the sequence number includes multiple fields.
The processing unit 804 is configured to replace a first field in the sequence number of the data packet with the decryption field, so as to obtain a decrypted packet.
Optionally, the determining unit 802 is specifically configured to: performing modulus operation on M by using a second field contained in the serial number to obtain a modulus value; and searching the subkey corresponding to the index value from the subkey set by taking the modulus value as the index value.
Optionally, the decryption unit 803 is specifically configured to: and carrying out exclusive OR operation on a first field contained in the serial number of the received data message and the determined sub-key to obtain a decryption field, wherein the number of bytes of the determined sub-key is the same as that of the first field.
If the sequence number includes L bytes, the first field is an upper byte portion of L/2 bytes of the sequence number, and the second field is a lower byte portion of L/2 bytes of the sequence number; or the first field is a lower byte part of L/2 bytes of the sequence number, and the second field is an upper byte part of L/2 bytes of the sequence number.
The second network device further comprises:
a generating unit 805, configured to split an original key negotiated and determined with the first network device into N fields; and the N fields are copied into M fields, and a subkey set consisting of the M fields is generated.
Optionally, the receiving unit 802 is further configured to receive an IKE negotiation request message sent by the first network device, where a value of an identification bit in the IKE negotiation request message indicates that the first network device supports sequence number encrypted transmission;
the second network device further comprises:
a sending unit 806, configured to send an IKE negotiation response message to the first network device, where a value of the identification bit in the IKE negotiation response message indicates that the second network device supports encrypted transmission of a sequence number.
Fig. 9 is a schematic structural diagram of another network device provided in the present application, where the network device may execute the above-mentioned message encryption method or message decryption method, as shown in fig. 9, the network device 900 includes: a communication interface 901, a processor 902, a memory 903, and a bus system 904;
the memory 903 stores programs. In particular, the program may include program code including computer operating instructions. The memory 903 may be a random-access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Only one memory is shown in the figure, but of course, the memory may be provided in plural numbers as necessary. The memory 903 may also be a memory in the processor 902.
The memory 903 stores the following elements, executable modules or data structures, or a subset thereof, or an expanded set thereof:
and (3) operating instructions: including various operational instructions for performing various operations.
Operating the system: including various system programs for implementing various basic services and for handling hardware-based tasks.
Specifically, if the method performed by network device 900 is a message encryption method, then network device 900 corresponds to sending-end gateway 102 in fig. 2, and in connection with fig. 3, communication interface 901 is configured to perform step 305, i.e., sending the modified data message to a second network device. If the method performed by the network device 900 is a message decryption method, the network device 900 corresponds to the receiving-end gateway 103 in fig. 2, and in conjunction with fig. 6, the communication interface 901 is configured to perform step 601, that is, receive the data message sent by the first network device.
Similarly, if the method performed by the network device 900 is a message encryption method, the processor 902 is configured to perform steps 301 to 304 in fig. 3. If the method performed by the network device 900 is a message decryption method, the processor 902 is configured to perform steps 602-604 of fig. 6. For details of the execution of the processor 902, reference is made to the description of the foregoing method embodiments, which are not described in detail herein.
The processor 902 may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuits of hardware or instructions in the form of software in the processor 902. The processor 902 may be a general purpose processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components. The various methods, steps, and logic blocks disclosed in the embodiments of the present application may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like. The steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module may be located in ram, flash memory, rom, prom, or eprom, registers, etc. storage media as is well known in the art. The storage medium is located in the memory 903, and the processor 902 reads the information in the memory 903 and performs the above method steps in conjunction with its hardware.
From the above, it can be seen that: in the embodiment of the application, because the sub-key is transmitted in the encryption channel determined by negotiation between the first network device and the second network device and is dynamically changed, the encrypted data message has high security, and in addition, the sub-key for encrypting the serial number is determined in a modulo mode, so that the randomness is high, and the encrypted serial number can not be guessed, thereby effectively preventing replay attack; the first network device and the second network device only use the unused reserved field to identify whether to encrypt the data message, so that the length of the data message is not increased, and the overhead is not increased.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, embodiments of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
Embodiments of the present invention are described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It will be apparent to those skilled in the art that various modifications and variations can be made in the embodiments of the present invention without departing from the scope of the invention. Thus, if such modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present application and their equivalents, the present application is also intended to encompass such modifications and variations.
Claims (17)
1. A method for encrypting a message, the method comprising:
the first network equipment generates a data message;
the first network equipment determines a sub-key from a sub-key set, wherein the sub-key set comprises M sub-keys, the M sub-keys are generated according to N fields obtained by splitting an original key, the original key is determined by pre-negotiation between the first network equipment and second network equipment, and M is greater than or equal to N;
the first network equipment encrypts a first field contained in a serial number of the data message and the determined sub-key to obtain an encrypted field, wherein the serial number contains a plurality of fields;
the first network equipment replaces a first field in the serial number of the data message by using the encrypted field, so as to obtain a modified data message;
and the first network equipment sends the modified data message to the second network equipment.
2. The method of claim 1, wherein the set of subkeys further includes an index value corresponding to each subkey, and wherein the determining, by the first network device, a subkey from the set of subkeys comprises:
the first network equipment modulo M by a second field contained in the serial number to obtain a modulus value;
and the first network equipment searches the subkey corresponding to the index value from the subkey set by taking the modulus value as the index value.
3. The method according to claim 1 or 2, wherein the first network device encrypts a first field included in a sequence number of the data packet and the determined subkey to obtain an encrypted field, and includes:
and the first network equipment carries out exclusive OR operation on a first field contained in the serial number of the data message and the determined sub-key to obtain an encrypted field, wherein the byte number of the determined sub-key is the same as that of the first field.
4. The method of any of claims 1 to 2, wherein before the first network device determines the first subkey from the set of subkeys, further comprising:
the first network equipment sends an Internet Key Exchange (IKE) negotiation request message to the second network equipment, wherein the value of a preset identification bit in the IKE negotiation request message is set as a first value, and the first value indicates that serial number encryption transmission is supported;
the first network equipment receives an IKE negotiation response message sent by the second network equipment, and the value of a preset identification bit in the IKE negotiation response message is set as the first value;
and the first network equipment determines that the second network equipment supports the encrypted transmission of the sequence number according to the value of the preset identification bit in the IKE negotiation response message.
5. A message decryption method is characterized in that the method comprises the following steps:
the second network equipment receives the data message sent by the first network equipment;
the second network device determines a sub-key from a sub-key set, wherein the sub-key set comprises M sub-keys, the M sub-keys are generated according to N fields obtained by splitting an original key, the original key is determined by pre-negotiation between the first network device and the second network device, and M is greater than or equal to N;
the second network device decrypts a first field contained in a serial number of the received data message and the determined sub-key to obtain a decrypted field, wherein the serial number contains a plurality of fields;
and the second network equipment replaces the first field in the serial number of the data message by using the decryption field, so as to obtain the decrypted data message.
6. The method of claim 5, wherein the set of subkeys further includes an index value corresponding to each subkey, and wherein the second network device determines a subkey from the set of subkeys, comprising:
the second network equipment modulo M by a second field contained in the serial number of the data message to obtain a modulus value;
and the second network equipment uses the modulus value as an index value, and finds out the subkey corresponding to the index value from the subkey set.
7. The method according to claim 5 or 6, wherein the second network device decrypts the first field included in the sequence number of the data packet and the determined subkey to obtain a decrypted field, and includes:
and the second network equipment performs exclusive-or operation on a first field contained in the serial number of the data message and the determined sub-key to obtain a decryption field, wherein the number of bytes of the determined sub-key is the same as that of the first field.
8. The method of any of claims 5 to 6, wherein before the second network device determines the first subkey from the set of subkeys, further comprising:
the second network equipment receives an Internet Key Exchange (IKE) negotiation request message sent by the first network equipment, wherein the value of a preset identification bit in the IKE negotiation request message is set as a first value, and the first value indicates that serial number encryption transmission is supported;
and if the second network equipment supports encrypted transmission of the sequence number, the second network equipment sends an IKE negotiation response message to the first network equipment, wherein the value of the preset identification bit in the IKE negotiation response message is set as the first value.
9. A first network device, comprising: a communication interface, a processor, and a memory;
the processor calls the instructions stored in the memory to perform the following processes:
generating a data message;
determining a sub-key from a sub-key set, wherein the sub-key set comprises M sub-keys, the M sub-keys are generated according to N fields obtained by splitting an original key, the original key is determined by pre-negotiation between the first network device and the second network device, and M is greater than or equal to N;
encrypting a first field contained in a serial number of the data message and the determined sub-key to obtain an encrypted field, wherein the serial number contains a plurality of fields;
replacing a first field in the serial number of the data message by using the encrypted field, thereby obtaining a modified data message;
and sending the modified data message to the second network equipment through the communication interface.
10. The network device of claim 9, wherein the processor is specifically configured to:
performing modulus operation on M by using a second field contained in the serial number to obtain a modulus value;
and searching the subkey corresponding to the index value from the subkey set by taking the modulus value as the index value.
11. The network device of claim 9 or 10, wherein the processor is specifically configured to:
and carrying out exclusive OR operation on a first field contained in the serial number of the data message and the determined sub-key to obtain an encrypted field, wherein the number of bytes of the determined sub-key is the same as that of the first field.
12. The network device of any of claims 9 to 10, wherein the processor is further configured to:
an Internet Key Exchange (IKE) negotiation request message sent to the second network device through the communication interface, wherein a value of a predetermined identification bit in the IKE negotiation request message is set to a first value, and the first value indicates that serial number encrypted transmission is supported;
receiving an IKE negotiation response message sent by the second network equipment through the communication interface, wherein the value of a preset identification bit in the IKE negotiation response message is set as the first value;
and determining that the second network equipment supports the encrypted transmission of the sequence number according to the value of the preset identification bit in the IKE negotiation response message.
13. A second network device, comprising: a communication interface, a processor, and a memory;
the processor calls the instructions stored in the memory to perform the following processes:
receiving a data message sent by first network equipment through the communication interface;
determining a sub-key from a sub-key set, where the sub-key set includes M sub-keys, the M sub-keys are generated according to N fields obtained by splitting an original key, the original key is determined by pre-negotiation between the first network device and the second network device, and M is greater than or equal to N;
decrypting a first field contained in a serial number of a received data message and the determined sub-key to obtain a decrypted field, wherein the serial number contains a plurality of fields;
and replacing the first field in the serial number of the data message by using the decryption field, thereby obtaining the decrypted data message.
14. The network device of claim 13, wherein the processor is specifically configured to:
performing modulus operation on M by using a second field contained in the serial number of the data message to obtain a modulus value;
and searching the subkey corresponding to the index value from the subkey set by taking the modulus value as the index value.
15. The network device of claim 13 or 14, wherein the processor is specifically configured to:
and carrying out exclusive or operation on a first field contained in the serial number of the data message and the determined sub-key to obtain a decryption field, wherein the number of bytes of the determined sub-key is the same as that of the first field.
16. The network device of any of claims 13 to 14,
receiving an Internet Key Exchange (IKE) negotiation request message sent by the first network equipment through the communication interface, wherein the value of a predetermined identification bit in the IKE negotiation request message is set as a first value, and the first value indicates that serial number encryption transmission is supported;
and if the encrypted transmission of the sequence number is supported, sending an IKE negotiation response message to the first network equipment through the communication interface, wherein the value of the preset identification bit in the IKE negotiation response message is set as the first value.
17. A communication system comprising a first network device implementing any of the preceding claims 9 to 12 and a second network device implementing any of the preceding claims 13 to 16.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710763841.1A CN109428867B (en) | 2017-08-30 | 2017-08-30 | Message encryption and decryption method, network equipment and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710763841.1A CN109428867B (en) | 2017-08-30 | 2017-08-30 | Message encryption and decryption method, network equipment and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109428867A CN109428867A (en) | 2019-03-05 |
| CN109428867B true CN109428867B (en) | 2020-08-25 |
Family
ID=65502143
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710763841.1A Active CN109428867B (en) | 2017-08-30 | 2017-08-30 | Message encryption and decryption method, network equipment and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109428867B (en) |
Families Citing this family (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110138750A (en) * | 2019-04-23 | 2019-08-16 | 上海数据交易中心有限公司 | Encryption method, apparatus and system, storage medium, the terminal of configuration file |
| CN110798316A (en) * | 2019-09-20 | 2020-02-14 | 西安瑞思凯微电子科技有限公司 | Encryption key generation method, decryption key generation method, encryption key generation program, decryption key generation program, and decryption program |
| CN110635908B (en) * | 2019-09-29 | 2023-03-24 | 杭州尚尚签网络科技有限公司 | Management method for supporting billions of keys for electronic contract |
| CN110730071A (en) * | 2019-10-29 | 2020-01-24 | 南方电网科学研究院有限责任公司 | Power distribution communication equipment safety access authentication method, device and equipment |
| CN111556075B (en) * | 2020-05-14 | 2022-05-03 | 中国人民解放军国防科技大学 | Data transmission path restoration method and system based on non-interactive key negotiation |
| CN112134884B (en) * | 2020-09-23 | 2022-10-14 | 普联技术有限公司 | Message serial number updating method |
| CN112332940B (en) * | 2020-11-06 | 2024-03-12 | 北京东土科技股份有限公司 | Data transmission method based on time synchronization network and related equipment |
| CN112511548B (en) * | 2020-12-02 | 2022-09-16 | 中电科鹏跃电子科技有限公司 | Method and device for preventing replay attack |
| CN113810363B (en) * | 2021-07-29 | 2023-06-20 | 蜂巢能源科技有限公司 | Message encryption and decryption method and electronic equipment |
| CN114329104B (en) * | 2021-12-23 | 2022-07-08 | 珠海市鸿瑞信息技术股份有限公司 | Message encryption transmission system and method based on electric power distribution |
| CN114285675B (en) * | 2022-03-07 | 2022-07-12 | 杭州优云科技有限公司 | Message forwarding method and device |
| CN118646598A (en) * | 2024-08-13 | 2024-09-13 | 浙江桢数科技有限公司 | Data encryption transmission method based on random key |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7298847B2 (en) * | 2002-02-07 | 2007-11-20 | Nokia Inc. | Secure key distribution protocol in AAA for mobile IP |
| CN101262405A (en) * | 2008-04-11 | 2008-09-10 | 华南理工大学 | High-speed secure virtual private network channel based on network processor and its realization method |
| CN101471784A (en) * | 2007-12-29 | 2009-07-01 | 北京天融信网络安全技术有限公司 | Method for implementing IPSEC resistance of replay aggression |
| CN102075427A (en) * | 2011-01-18 | 2011-05-25 | 中兴通讯股份有限公司 | Security association-based IPSec message processing method and device |
| CN102843235A (en) * | 2012-09-06 | 2012-12-26 | 汉柏科技有限公司 | Message encrypting/decrypting method |
| CN105071987A (en) * | 2015-07-28 | 2015-11-18 | 中国工程物理研究院计算机应用研究所 | Path quality analysis method of encrypted network based on flow analysis |
| CN106788989A (en) * | 2016-11-30 | 2017-05-31 | 华为技术有限公司 | A kind of method and apparatus for setting up safe encryption channel |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| TWI227082B (en) * | 2003-06-20 | 2005-01-21 | Accton Technology Corp | A synchronous system and method for processing a packet |
| US9237015B2 (en) * | 2013-07-24 | 2016-01-12 | Cisco Technology, Inc. | Compact and efficient communication security through combining anti-replay with encryption |
-
2017
- 2017-08-30 CN CN201710763841.1A patent/CN109428867B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US7298847B2 (en) * | 2002-02-07 | 2007-11-20 | Nokia Inc. | Secure key distribution protocol in AAA for mobile IP |
| CN101471784A (en) * | 2007-12-29 | 2009-07-01 | 北京天融信网络安全技术有限公司 | Method for implementing IPSEC resistance of replay aggression |
| CN101262405A (en) * | 2008-04-11 | 2008-09-10 | 华南理工大学 | High-speed secure virtual private network channel based on network processor and its realization method |
| CN102075427A (en) * | 2011-01-18 | 2011-05-25 | 中兴通讯股份有限公司 | Security association-based IPSec message processing method and device |
| CN102843235A (en) * | 2012-09-06 | 2012-12-26 | 汉柏科技有限公司 | Message encrypting/decrypting method |
| CN105071987A (en) * | 2015-07-28 | 2015-11-18 | 中国工程物理研究院计算机应用研究所 | Path quality analysis method of encrypted network based on flow analysis |
| CN106788989A (en) * | 2016-11-30 | 2017-05-31 | 华为技术有限公司 | A kind of method and apparatus for setting up safe encryption channel |
Non-Patent Citations (2)
| Title |
|---|
| IPsec anti-replay algorithm without bit-shifting;Xiangyang Zhang et al;《IETF draft-zhang-ipsecme-anti-replay-07》;20111031;全文 * |
| IPSEC的抗重放原理及其实现;丛延奇;《湖南工程学院学报》;20031231;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109428867A (en) | 2019-03-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109428867B (en) | Message encryption and decryption method, network equipment and system | |
| CN110190955B (en) | Information processing method and device based on secure socket layer protocol authentication | |
| CN113067828B (en) | Message processing method, device, server, computer equipment and storage medium | |
| EP3205048B1 (en) | Generating a symmetric encryption key | |
| CN114503507A (en) | Secure publish-subscribe communications method and apparatus | |
| Petullo et al. | MinimaLT: minimal-latency networking through better security | |
| JP2016511620A (en) | Master key encryption function for transmitter and receiver pairing as a countermeasure to thwart key recovery attacks | |
| US20150229621A1 (en) | One-time-pad data encryption in communication channels | |
| Zhou | Further analysis of the Internet key exchange protocol | |
| US10841840B2 (en) | Processing packets in a computer system | |
| Igoe et al. | AES Galois counter mode for the secure shell transport layer protocol | |
| CN112040485A (en) | Local area network key agreement method, system and computer readable storage medium | |
| JP2020537428A (en) | Equipment and methods for data transmission | |
| CN110832806B (en) | ID-based data plane security for identity-oriented networks | |
| Navaz et al. | Security Aspects of Mobile IP | |
| KR101979157B1 (en) | Non-address network equipment and communication security system using it | |
| CN114039812B (en) | Data transmission channel establishment method, device, computer equipment and storage medium | |
| Prakash et al. | Data security in wired and wireless systems | |
| Praptodiyono et al. | Enhancing IPsec performance in mobile IPv6 using elliptic curve cryptography | |
| CN101360096B (en) | System safety planning method applied to digital medical treatment | |
| Aayush et al. | Understanding SSL protocol and its cryptographic weaknesses | |
| Rawal et al. | No-sum IPsec Lite: Simplified and lightweight Internet security protocol for IoT devices | |
| El Bakry et al. | Implementation of a hybrid encryption scheme for sms/multimedia messages on android | |
| US20080059788A1 (en) | Secure electronic communications pathway | |
| Bonde | Wireless Security |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |