CN104010301A - Multi-element random garble encryption algorithm for wireless safe communication - Google Patents

Abstract

Data transmission safety becomes an eternal topic since appearance of wireless communication, especially since large-scale application of WiFi, WEP, WAP, WAP2 and other safety protocols gradually become powerless, people begin to need a safer algorithm. By means of the study on current main wireless safety protocols, a safer multi-element random garble encryption algorithm is put forward. According to the algorithm, the probability of secret key reveal caused by interception of a data package during authentication is reduced through an authentication key and at least three elements with the unique attribute in the multi-element part, a code book carries out a series of changes on data to be transmitted with the coding theory as the basis, a data package with incomplete information is generated, the incomplete data package is sent to a client side, the client side carries out decoding through the comparison of information in the data package and the code book, and the data are safely transmitted; the channel technology guarantees normal data exchanging of other client sides even when the client side suffers from vicious flow attacks.

Description

For the polynary random change code encryption algorithm of wireless security communication

Technical field

The present invention relates to the cryptographic algorithm of data security in a kind of network communication, be especially applicable to wireless security communication.

Background technology

At present, for the cryptographic algorithm in wireless telecommunications, the particularly cryptographic algorithm in WiFi, WEP has been proved dangerous, WAP, WAP2 are also about to become dangerous, because along with development and the research of people to these security protocols of hardware technology, the unlocked time of key will become shorter and shorter, that is to say the possibility that uses the wireless network of these security protocols that existence is divulged a secret.

At present, the security protocols such as WAP are single to the checking of key, be that the verification msg that same key produces is anywhere all the same, such result is exactly that we can build a table, be used for preserving the result of the authenticating documents that all keys produce, then by Hash get rid of, a series of means such as parallel computation become the time of untiing key to only have several hours and even only have a few minutes.

For solving the WAP of current use, the first-class problem of key authentication data sheet that the agreements such as WAP2 exist, by the diversification to when certification element, the verify data cryptographic algorithm of at least quaternary including key is provided, simultaneously, ensure in all units, except key, all units all have unique attribute and part unit is only once effective, reduce the data of verification process to be intercepted and captured and crack key may, simultaneously, in communication process, except the encryption that itself provides, random change code superencipher based on coding theory is also provided, ensure the data security in communication process.

Summary of the invention

Wireless telecommunications, particularly wireless security communication, its core basic point one is safety certification, the 2nd, safe transmission, because the particularity of wireless telecommunications, is doomed whole communication process all may be exposed to during malice monitors, in any case that is to say, all communication informations are all can be by complete eavesdropping, thus the safety of wireless telecommunications in data integrity without any way, unless you are exactly incomplete by the data of wireless transmission itself.Whole wireless telecommunications, I am divided into two parts, and a part is certification link, authorizes the authority of certain client-access network, and this link is responsible for by the polynary part in polynary random change code encryption algorithm; Two for communication link, and this link is the most important thing, can say data security 90% all in this link, therefore this part is completed by the random change code encryption part in polynary random change code encryption algorithm.Explain with regard to these two links how polynary random change code encryption algorithm guarantees data security below.

One: safety certification link

For this polynary random change code encryption algorithm, the authentication element that the responsible certification link of polynary part is used has multiple, below, the demonstration of polynary part in just using most basic quaternary encryption as this polynary random change code encryption algorithm, meanwhile, quaternary is also the minimum requirements of polynary part in this polynary accidental enciphering algorithm.

Certification, we have the outpost of the tax office of not walking around together, that is exactly the transmission of key, this is also the common fault of all wireless security algorithm, so all algorithms that cracks key are all for this process at present substantially, generally speaking, what when we authenticate, will do is exactly to send authentication request, then wait for the rear transmission security key of authentication points response, so, a package that includes key has just generated and has been transmitted, and we know that all data of wireless transmission all can be intercepted and captured, so, this package has been intercepted and captured, so, we are by certain means, just can untie this package, obtain key.But, if we change this process, then in the package that comprises key, add other things packet that even we transmit not to contain key, in any case cracking, nature all cannot obtain key.Just explain orally below and how to realize the certification that does not comprise key authentication packet.

In the time of certification, the first thing that we will do is to set up contact, namely client sends the request connecting to certification end, then to start to generate a segment length be that the character string S of 512 bytes sends client in certification end, and the unique identifier J of client to S and the errorless rear beginning of verification using S and own client is as parameter, computing show that a length is the character string H of 256 bytes, this character string H will be sent to certification end, then certification end utilize that client sends character string H computing, draw the unique identifier of client, also have key and the random one section of reference character generating as parameter computing generation authorization key with the character string S generating before and unique identifier J simultaneously, here, the reference character generating can be transmitted to client after generation, also be to complete and encrypt rear transmission by character string S, client to just start after reference character same service end equally start to go out authenticate key (certification end is called authorization key) using character string S, client unique identifier J, key as calculation of parameter and then utilize before character string S this part of authenticate key is encrypted, then send certification end to, after certification end receives, deciphering obtains authenticate key, then contrast authorization key, if the same, certification is passed through exactly, if different, authentification failure so.

Because the verification process of the quaternary of demonstration here, no matter so be that client or service end have been used four parameters while calculating authenticated/authorized key: the random length generating is the character string S of 512 bytes, client unique identifier J, key, reference character, and whole verification process key is not transmitted, what transmit is to do with four elements above the authenticate key that parameter generates, and in design in these four elements S and J be random generation, and J is unique, that is to say in four elements has three to have uniqueness, so just ensure to build similar Hash table, the table of the quick search key of rainbow table and so on, can only decipher by the method for exhaustion, and the prerequisite that will use the method for exhaustion is complete other three elements except key that get.And in the transport process of these three elements, only has character string S expressly or after only entering the encryption of base class cryptographic algorithm to transmit, other data are all encrypted by random change code calculation, the possibility of complete these information of acquisition that this just makes is smaller, simultaneously, having two elements because middle is random generations, so cause a key to have the authenticate key that countless versions is possible, the authenticate key of different verification process does not contrast value.

To finding out here, whole process is but more seldom to untie, but strengthen accordingly amount of calculation, if the client of same time certification is often or simply by the undying certification of people, so likely cause certification end computing capability deficiency and user and the certified user of the normal certification of impact, so will use passage technology below perfectly to address this problem.

Complete on the basis of certification for the first time, while again certification, we have not just needed so complicated process, because certification needs authenticate key for the first time, so verification process is complicated incomparable, if but authentication success is once, just need not be so complicated while again certification, and if the process that repeats to authenticate for the first time just mean and will generate again authenticate key, although the unlocked possibility of authenticate key is very little, we can do safelyr completely.So we can generate one section of random string by certification end after authentication success for the first time, send to client, by the time while again certification, use the unique identifier of this section of random string and client to generate authenticate key again as parameter and send to certification end, and certification end had been preserved the identification code of this client before, generate authorization key again so also can directly do parameter with identification code and this section of random string, by the time client directly contrasts after sending again authenticate key, just can complete and authenticate, complete certification rear no matter success or failure, all again generate and transmit random string next time, so just can ensure the uniqueness of authorizing, as for the problem of uniqueness, because do not transmit unique identifier in the process of again authorizing, there is no the participation of key yet, therefore other client can not generate correct authenticate key again, if correct, physical machine that this client place is described is not donor on hand, become unsuccessful nonsensical.

Another about the key in literary composition and base class cryptographic algorithm, in literary composition, make a general reference when key, in every case all conduct certification authority no matter be password might as well, or certificate or file, be all referred to as key in this article.As for base class cryptographic algorithm, in this article refer to not passing through before polynary random change code encryption algorithm for encryption, the algorithm that the original information that will transmit is done the encryption process, as AES.As nothing particularly points out, base class cryptographic algorithm is general reference herein.

Two: safe transmission link

We know, due to wireless telecommunications particularity, all packets are can be by complete eavesdropping, so strict, the data of wireless transmission all can be decrypted, can be decrypted if do not grudge any data by wireless transmission of input computing capability, no matter how powerful how being difficult to of cryptographic algorithm that is exactly also you with regard to the result causing cracked, as long as do not grudge capital, all can be unlocked, certainly, untiing rear your data of wireless transmission has also just been obtained by others naturally.

If but is the information of wireless transmission itself just imperfect? so just mean that is afraid of that you spend the information of the intercepting and capturing that huge cost unties, acquisition be also incomplete information.Produced so again another problem, that is exactly how to allow incomplete data become complete, completes whole transport process.For this problem, access to your password and originally just can solve, certainly, and the code book in the non-traditional meaning of this code book, the code book here does not play translation.Strict, the character that this section is known as code book is a part for the information that itself will transmit! Why so say, before answering this problem, will first say another problem, that is exactly binary system and coding!

We know, computer or even electronic equipment, as long as there is computing capability, none is not binary system, that is to say computer be in fact be only familiar with binary, for computer, character string that it doesn't matter also it doesn't matter numeral, all the things are all 0 and 1 for computer all, this also just produces a problem, that is exactly that people is not familiar with the binary system uncomfortable binary system of people in other words, so, just there is coding to occur, unique effect of encoding is exactly by unfamiliar people Binary Zero and the familiar thing of 1 string conversion adult, such as word, image, sound etc., but no matter encode how to compile, after all he or 0 and 1 string, that is to say that coding is the specific expression form of 0 and 1 string in fact.The information that we can will transmit us is so made amendment, such as the fixing number that adds deduct, does by the time receiving terminal receive that add or deduct that fixing number becomes again later again? answer is fine, for coding, as long as when expression final, 0 and 1 string is that original string, his form of expression will be duplicate so, that is to say, the data that we can need to transmit us are completely done a conversion, make the loss of learning part that must transmit, then be sent to receiving terminal by having lacked a part of information, receiving terminal is recovered this part of disappearance again, like this even information be blocked and crack halfway, also can not obtain complete information, thereby ensure the confidentiality of information.

Whole algorithm full name is polynary random change code encryption algorithm, polynary part has got across above, so, what is the random code that becomes? refer at random unfixed and unpredictable, becoming code is that the string to 0 and 1 of telling about above converts, and adding up is exactly that the unfixed and unpredictable information to transmitting is done the conversion on original 0 and 1 string.Certainly, easily, reduction is difficult in conversion, and information transmission is to need decoding, that is to say the stochastic transformation of doing that we can not be real, just becomes meaningless even if not so received the cryptographic algorithm so of cannot decoding! So we need to allow the transmitting terminal of information and receiving terminal know how this part information converts, so we will use previously mentioned code book.In itself, code book is the character string of one section of regular length, and size is 10K, and the inside is one section of ASII character.Because the each character of ASII character takies a byte, its decimal system interval is 0-128, therefore what preserve in code book is why the numeral of 10*1024 0-128 (is used ASII character instead of use digital, in order to save space) certainly, originally be that these 10240 numerals are random at generating cipher, such result is exactly that the formation of code book is unpredictable! Because generating, he there is no algorithm, confusion, and unordered, unpredictable, the feature of code book that Here it is.(can not use orderly algorithm, otherwise algorithm is cracked, code book so is also just cracked accordingly, and information encryption will be a joke).

We have obtained a unordered code book, and the random basis that becomes code has also just had, next want What for? yes has become code at random! A how randomized? I do like this:

A given segment information, length is unfixing, but can not exceed 10K, be referred to as A(in fact this length limit and there is no much meanings, because I did not also meet a TCP or UTP data package size exceedes 10K's) we carry out a base class cryptographic algorithm to him and encrypt, obtain an other segment information, it is referred to as B by we, and at this time this segment information still has can decryptedly reducing of coding, so what next we will do is exactly to say that this segment information after encryption becomes 0 and 1 string, namely ignore fall coding problem (note in whole process coding in fact or exist, just ignored, if do not understood, please refer to binary system above and the problem of coding) then we will add up the length L of B, obtain that we just need to generate the character string X of another one ASII after L, length is 4L, this section of character is the carrier of information, except doing carrier, do not have other meanings there is no other purposes yet, so be random generation, and the random benefit generating is exactly disorderly, naturally also just strengthened and cracked difficulty.Obtain after X, we also need a random number K, one is less than 10240 random number, this random number K is the starting point that we become code at random, after obtaining this K, we start to search in code book, start to count to K from first, obtain the corresponding ASII character of K, at this moment we have just obtained namely corresponding that ten's digit of ASII character of several P(of one 0 to 128) if the decimal number of ASII character corresponding to our K is 68, the first step: carry out divided by 2 remainders 68, what obtain here is 0, represent that second step does subtraction (if 1 represent that second step does be addition), next second step: we in B, take out first byte (8 positions) cut this 68(subtraction be here pure be computing, there is no symbol, the consequent problem such as overflow hereinafter provides solution) obtained result S, to the 3rd step: we have mentioned an information carrier X that length is 4L above, we will use it now, for 68, we divided by 32 remainders (why divided by 32, that is because the information carrier length that we provide is 4L, that is to say we information expansion originally 4 times, basis is 8 positions, 4 times is exactly 32) 68 be 4 divided by 32 remainders, we count to 4th to nybble (totally 32 positions) is upper since the 1st at first of carrier X so, S is started to copy from the 5th of X, not enough place is namely since the 13rd constant (referring to that X is constant).So just complete the random change code of first byte of B, next conversion successively, parameter K has become namely K+1 character in code book of K+1, repeats, up to having converted.

Can find out from process above, in whole process, we expand information, become large 4 times, then will after real information conversion, stash, screen with a large amount of deceptive information, and the parameter that relies on code book to provide, directly real information has been carried out becoming code, displacement, such result does not have code book exactly, and the packet that substantially cannot untie us obtains real information.

Certainly, here there are several problems, the one, the problem in the useful life of code book, know, although code book is random generation, but use often, also just can be found out rule, so by limiting, can not forever use a code book useful life of code book, the access times of code book just are changed after having reached threshold value so we need to set a threshold value! Consider the computing capability of service end, this threshold value is set by service end, adds up and send prompting by client, and initial value is that to be code book reach threshold value after 1024 times for the message length of encrypting.Another one is exactly the problem that can overflow when the raw information after encrypting is done to signed magnitude arithmetic(al), because do not relate to coding during to the computing of raw information, that is to say that all positions are all information, a position can not be set again as overflow flag, therefore overflow flag is separated, by other data markers, therefore we need an overflow flag Z, the length of Z is 1/8th of B, i.e. a byte of Z corresponding B in position.For Z, a byte of each corresponding B, and this position is that an interval scale has overflowed, and is that 0 interval scale does not overflow.Then Z is placed in packet and is transmitted together.Also have problem be exactly we in remainder, if remainder is excessive, cause 8 of the position less thaies be left, what at this moment we needed is exactly winding, the 1st while is also the 33rd, so just solved a problem for a deficiency.

For the random change code part in polynary random change code encryption algorithm, explain orally, as for the structure for various packets in whole process, form, design gets up to have no difficulty, so just do not introduced, for the replacing problem of the code book of key point in literary composition, I think, there are two kinds of solutions, one is to be generated by service end, then pass to client, the benefit of doing be like this exactly each code book be independently not cause because code book above reveals the problem totally revealed, but likely because being blocked and cracking, information cause code book to be revealed, another kind method is Transfer Parameters, use aforementioned scheme, Transfer Parameters, on the basis of original code book, generate new code book, benefit can not be intercepted code book exactly like this, once but harm be exactly initial password this revealed, so next all code books are all likely revealed.But, because the corresponding code book of client, so even if code book has been revealed also and only can be had influence on a client here, other can not be affected.So the replacing problem of code book can depend on the circumstances, and selects the first under default situations.Another: the code book size providing herein, for 10K does not represent that restriction size is 10K, just provides as a default value, and size is restriction not, but can not be less than 10K, and concrete code book length setting need be considered service end hardware ability to bear.

Three: passage technology, channel multiplexing, passage bridge joint and covert channel

What is meant by passage technology, why be used for? for this problem, we mentioned above, because the amount of calculation of verification process is larger, so likely cause the resource of whole certification end all to turn to authentication verification to affect normal service if there is client ceaselessly to authenticate, this is possible, because the priority of authentication verification is higher than normal service.And we can not ensure that the client of successful connection is maliciously, if malice, to attack once initiate class of traffic, so whole network all cannot normally be worked; In order to address this problem, I have designed passage technology, and this noun of passage is not strange, but here, passage has been redefined.

Passage refers in whole wireless telecommunications process, the circuit of client and service end exchange message, the definition of Here it is passage, and, in whole conversation procedure, client can only be used this passage, and this passage of service end also receives only the data that sent by corresponding client.As for principle, be an application of Intel Virtualization Technology in fact, we know, physical resource is limited, but we can divide physical resource by Intel Virtualization Technology, become multiple virtual resources independent of each other, the basis of Here it is passage technology.Use after passage technology, we can carry out resource division to all passages, it is confirmable that each passage takies how many resources, the consequence of doing be like this exactly no matter client initiate how powerful attack, can only consume at most the resource that we provide, a because corresponding passage of client, no matter how, client can only consume at most the resource that this passage is corresponding, and interchannel is independent of each other, that is to say that the utilization rate of other passages likely only has 1% to be even less than even this passage utilization rate is 100%.

Channel multiplexing, be in number of channels deficiency but client occur many again in the situation that, many times, client is all normal use, but the restriction of dividing because of passage in some situation, cause the situation that occurs that passage has been expired but also have client-requested to connect, but a client takies and only take a passage, this is unmodifiable, in some application scenario particularly under important events, we can not refuse the normal connection request of client, so, there is channel multiplexing technology.

Channel multiplexing technology is that a passage is invented to multiple passages for client in fact, shares the resource of physical channel between these tunnels.(note: passage technology is that each passage exclusively enjoys resource, and channel multiplexing being all resources when shared this passage of the tunnel under prepass) like this, just solved the problem of number of channels deficiency.

As for passage bridge joint, the reason of appearance is very simple.When channel resource normal when a client but responsible this client is not enough, in order to meet the demand of client, can temporarily the slack resources of other passages be allocated to this passage, so just can in the situation that not affecting other passages, improve the load capacity of this passage.

Client takies one and only take this principle of passage and can not become, no matter be channel multiplexing might as well or passage bridge joint might as well, all can not run counter to this principle.

But as for covert channel, the appearance of this design is in order to meet some particular/special requirement occasions, such as requiring radio listening silence need to receive information at any time time, equipment electric weight is not enough but the special occasions such as while requiring to extend call duration time as much as possible.For passage technology, for guarantee channel is released as soon as possible after conversation end, between client and service end, there is a kind of packet of heartbeat packet by name, client tells that by sending heartbeat packet the current client of service end is still online, when service end does not receive after heartbeat packet, just represent the off-line of client of this passage, at this moment will discharge this passage and wait for the connection of next client, but, previously mentioned special occasions client cannot send heartbeat packet, and need to keep this session, at this moment just need to show that this session is the session of covert channel, service end just can not carried out the action of reclaiming to this passage like this, unless client is clearly sent the packet of conversation end and is arrived the longest term of validity of passage.

Passage technology is not a part for polynary random change code encryption algorithm, it is a safe additional project as this algorithm, the weak problem of anti-class of traffic attacking ability that special this algorithm of solution causes because amount of calculation is excessive, in addition, strict, polynary random change code encryption algorithm both can use altogether, also can separately use, and every part can well ensure fail safe, no matter be wire communication or wireless telecommunications.

Claims (4)

1. formed by polynary random change code encryption algorithm and passage technology for the polynary random change code encryption algorithm of wireless security communication, it is characterized by polynary random its algorithm groups of change code encryption algorithm become (a) polynary part by minimum into four elements calculate authenticate key, ensure the safety of verification process; (b) the random code part that becomes, by based on coding theory, taking code book as source, is done random change code to the data that will transmit; (c) passage technology ensure whole wireless network suffer class of traffic or resource consumption class while attack, ensure the communication security of other clients and communication unimpeded.

2. (a) according to claim 1, the character string S that its algorithmic procedure is one section of regular length of (1) certification end generation sends client to after expressly or only encrypting with base class cryptographic algorithm, (2) client to character string S and confirm after taking S as code book, use the random code encryption algorithm that becomes to be encrypted client unique identifier J, after the character string H of one section of regular length of generation, send certification end to; (3) client obtains client unique identifier J to deciphering after H, then generate a reference character string and send client as code book to after by random change code encryption with S, if also there are other elements, get back to (2) and continue to transmit other elements; (4) service end is taking S, J, reference character string, key as parameter generation authorization key, if also have other elements, other elements are also as parameter; (5) client to and decrypt after reference character string taking S, J, reference character string, key as parameter and generate authenticate key, if also have other elements, other elements are also as parameter; (6) client transmits authenticate key to service end, and service end contrast authenticate key and authorization key, complete certification.

3. (b) according to claim 1, its algorithmic procedure is (1) exchange or preset password basis; (2) information that will transmit is done to the encryption of base class cryptographic algorithm and obtain B; (3) read the length L of B, use random function to generate the character string X that a segment length is 4L, generate random number K simultaneously; (4) code book is searched to K byte, reading of content, and convert the decimal number P of ASII code correspondence to, then carries out divided by 2 remainders P, determines that (5) do subtraction or do addition; (5) generate Z, length is 1/2L, first byte of B is added to reducing according to the result of (4) and obtain result Q, and whether be recorded to Z has and overflow simultaneously; (6) P is carried out, divided by 32 remainders operations, obtaining result T, get X first to nybble, count to T position, then Q is copied since T position; (7) judge whether to become code and complete, if completed, finish, do not complete K and become K+1 and get back to (4) step.

4. (c) according to claim 1 is characterized by passage technology based on Intel Virtualization Technology, the passage bridging technology that distributes for the channel multiplexing technology of client-side extensions, for temporary resource is for the covert channel technology of special occasions.