CN101521667A - Method and device for safety data communication - Google Patents

Method and device for safety data communication Download PDF

Info

Publication number
CN101521667A
CN101521667A CN200910020501A CN200910020501A CN101521667A CN 101521667 A CN101521667 A CN 101521667A CN 200910020501 A CN200910020501 A CN 200910020501A CN 200910020501 A CN200910020501 A CN 200910020501A CN 101521667 A CN101521667 A CN 101521667A
Authority
CN
China
Prior art keywords
data
terminal
layer
key
sending terminal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN200910020501A
Other languages
Chinese (zh)
Other versions
CN101521667B (en
Inventor
王晓春
连军政
柳建
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Yuweng Information Technology Co.,Ltd.
Original Assignee
SHANDONG YUWENG INFORMATION TECHNOLOGY Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by SHANDONG YUWENG INFORMATION TECHNOLOGY Co Ltd filed Critical SHANDONG YUWENG INFORMATION TECHNOLOGY Co Ltd
Priority to CN2009100205015A priority Critical patent/CN101521667B/en
Publication of CN101521667A publication Critical patent/CN101521667A/en
Application granted granted Critical
Publication of CN101521667B publication Critical patent/CN101521667B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Landscapes

  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

The invention relates to the field of data communication, in particular to a method and a device for safety data communication. The safety data communication device comprises a data terminal, a communication network and hardware cryptoequipment, wherein the data terminal comprises a data sending terminal and a data receiving terminal, and is divided into application layers, a transport layer, a network layer, a data link layer and a physical layer; and the data sending terminal and the data receiving terminal in the data terminal are provided with the hardware cryptoequipment respectively. The method and the device are characterized in that the application layers of the data terminal are all provided with code agent modules which can analyze terminal configuration, and an IP layer of the data terminal is provided with a code module which can carry out encryption processing on the data. The method and the device do not need to change the prior network hardware and software program, can more carefully control the user permission, visitable resources, services and files, and set up a visit control mechanism based on application. The method and the vice have the advantages of wide applicability, simple operation and safety data transmission, and the like.

Description

A kind of safe data communications method and device
Technical field:
The present invention relates to data communication field, specifically a kind of safe data communications method and device.
Background technology:
The predecessor of Internet is that U.S. Department of Defense is used for experimental study and the mininet developed, and the network hardware is controlled by the people of identity safety, and the fail safe of network can be guaranteed by physical means, does not need to formulate security protocol.Fast development and extensive use along with Internet, the safety issue of its basic agreement TCP/IP manifests day by day, have a large amount of insecure users and unknown routing node on the Internet, when data were passed through these unknown networks, fail safe can't be guaranteed.
Data security transmission protection mechanism normally depends on cryptographic technique, and cryptographic technique provides the various cryptographic service mechanism of safeguard protection.Which layer that cryptographic service is placed in the network stack is the problem of a more complicated, and it has a significant impact the enforcement characteristic and the degree of service.Three kinds of solutions are arranged at present:
The first, cryptographic service is placed on data link layer.Because generally need through a large amount of intermediate nodes between the network terminal, this makes that the cost of key management and encryption and decryption is very big, on this level, also there is not practical security mechanism.
The second, cryptographic service is placed on network layer.IPSec provides a standard for the authentication and the encryption of IP layer, and is transparent to using, and need not change corresponding application.Its problem is that mainly it realizes complicatedly, has with a large amount of NAT technology of using in the network and to conflict, and there is certain defective etc. in the support of dynamic routing.
The 3rd, cryptographic service is placed on transport layer.SSL provides the standard that authenticates and encrypt in application layer.SSL provides a cover different sockets, has the application program of demand for security to rewrite.Generally, SSL only supports the application based on Web.
Summary of the invention:
The present invention is directed to the network layer ipsec encryption realizes complicated, transport layer SSL encrypts and supports to use single problem, propose a kind of advantage that had both had the existing password service mechanism in IP data encrypting and deciphering technical field, can solve the secure data communication method and system of existing network layer and transport layer cryptographic service defective again.
The technical measures that the present invention adopts are:
A kind of safe data communications method is characterized in that being equipped with hardware encryption equipment at data sending terminal and data receiver, and the application layer of data terminal is provided with the password proxy module, and the IP layer is provided with crypto module, and carries out the following step:
Step 1: the password proxy module in the data terminal application layer is resolved user's configuration, and draws the feature five-tuple of IP stream.
Step 2: data terminal issues the feature five-tuple from application layer to the IP layer.
Step 3: after data sending terminal IP layer crypto module intercepted and captured the IP traffic of feature five-tuple, data cached bag, beginning cipher key change.
Step 4: the password proxy module request opposite end asymmetric public key of data sending terminal IP course application layer.
Step 5: data sending terminal IP layer receives the asymmetric public key that application layer issues.
Step 6: data sending terminal uses the opposite end asymmetric public key to encrypt the unique hardware characteristic information of this terminal hardware encryption device and the true random number of this generation.
Step 7: data sending terminal sends the cipher key change request to data receiver.
Step 8: data receiver receives the cipher key change request.
Step 9: data receiver uses the asymmetric privacy keys in this terminal hardware encryption device that the information that receives is decrypted, and the true random number after the deciphering is as the request key.
Step 10: data receiver according to the unique hardware characteristic information of the hardware encryption equipment that receives to application layer password proxy module acquisition request opposite end asymmetric public key.
Step 11: data receiver uses the opposite end asymmetric public key to encrypt the unique hardware characteristic information of this terminal hardware encryption device and the true random number of this generation, and sends the cipher key change request to data sending terminal.
Step 12: after data sending terminal receives the cipher key change request, use the asymmetric privacy keys in the hardware encryption equipment of this terminal to be decrypted, the true random number after the deciphering is as replying key.
Step 13: data sending terminal uses the request key that the data that will send are encrypted, and revises packet content and packet header.
Step 14: data sending terminal mails to data receiver with the data encrypted bag.
Step 15: data receiver uses the request key that the data after receiving are decrypted processing after receiving data.
Step 16: when data receiver was responded, data sending terminal and data receiver use were replied key and are carried out the encryption and decryption processing.
Step 17: data send and finish, and data sending terminal finishes to be connected with data receiver, and remove the sensitive information that both sides consult.
The feature five-tuple that parses in the step 1 of the present invention is source IP, source port, protocol type, purpose IP, destination interface.When the user was configured to IP traffic feature five-tuple, the password proxy module in the data terminal application layer need not carry out user's configuration is resolved; When the user is configured to program name, then need to parse the feature five-tuple according to program name.
A kind of safe data communication equipment, comprise two data terminals, communication network, hardware encryption equipment, wherein comprise data sending terminal in the data terminal, data receiver, data terminal is divided into application layer, transport layer, network layer, data link layer, physical layer, data sending terminal in the data terminal and data receiver are respectively equipped with hardware encryption equipment, the application layer that it is characterized in that data terminal is equipped with the password proxy module, the password proxy module can be resolved terminal configuration, the IP layer of data terminal is provided with crypto module, and crypto module can carry out encryption and decryption to data to be handled.
Hardware encryption equipment adopts low speed encryption device USB Key and high-speed encryption equipment PCI password card among the present invention, and the user chooses a kind of according to rate request.
Hardware encryption equipment among the present invention is provided with can not be by the outer key memory block of derivation equipment and unique hardware characteristics information, and the unsymmetrical key of its identity of storaging mark is right in advance.Application layer password proxy module is stored the asymmetric public key of all data terminals for inquiry.
The advantage of integrated network layer of the present invention and two kinds of cryptographic service of transport layer, revised defective, neither need to change existing network hardware, do not need to revise existing software program yet, can to user's authority and can accessed resources, service, file carry out more careful control, foundation realizes secure data communication end to end based on the access control mechanisms of using, and has remarkable advantages such as applicability is wide, easy and simple to handle, data transmission security.
Embodiment:
The initiator of each communication is as data sending terminal, and the opposing party is a data receiver.Example implements to be divided into the quadravalence section:
Phase I, configuration phase.
1, data sending terminal application layer password proxy module is resolved user's configuration, if the user is configured to IP traffic feature five-tuple, then directly uses; The user is configured to application name else if, then parses the feature five-tuple of corresponding IP stream.
2, data sending terminal application layer password proxy module issues data flow feature five-tuple to IP layer crypto module.
3, data sending terminal IP layer crypto module preserved configuration.
4, data receiver is according to same arrangements of steps.
Second stage connects the interchange key stage, and program is as follows:
1, after data sending terminal IP layer crypto module intercepted and captured the IP traffic of specifying five-tuple, data cached bag began to connect.
2, data sending terminal IP layer crypto module is to application layer password proxy module request msg receiving terminal asymmetric public key, and application layer password proxy module returns the asymmetric public key of storage in advance.
3, data sending terminal IP layer crypto module uses the data receiver asymmetric public key to encrypt the unique hardware characteristics information of this terminal hardware encryption device and the true random number of this generation, combination key exchange request msg.
4, data sending terminal IP layer crypto module sends the cipher key change request.
5, after data receiver IP layer crypto module received the cipher key change request, use the asymmetric privacy keys in this terminal hardware encryption device to be decrypted, true random number after the deciphering is called the request key as the symmetry algorithm key of data sending terminal when data receiver sends data.
6, data receiver IP layer crypto module obtains the data sending terminal asymmetric public key according to the unique hardware characteristic information of the hardware encryption equipment that receives to this terminal applies layer crypto module agency, and application layer password proxy module returns the asymmetric public key of storage in advance.
7, data receiver IP layer crypto module uses the data sending terminal asymmetric public key to encrypt the unique hardware characteristics information of this terminal password equipment and the true random number of this generation, combination key exchange request msg.
8, data receiver IP layer crypto module sends the cipher key change request.
9, after data sending terminal IP layer crypto module received the cipher key change request, use the asymmetric privacy keys in this terminal hardware encryption device to be decrypted, true random number after the deciphering is called and replys key as the symmetry algorithm key of data receiver when data sending terminal sends data.
Phase III, data communication phase.
1, data sending terminal IP layer crypto module uses the request key that the content after the packet IP head that sends is encrypted, and modification packet header and verification and back send, and data receiver is decrypted processing with the request key to data.
When 2, data receiver was responded, both sides used the key of replying of negotiation to carry out crypto-operation.
3, in the data communication process, both sides' timed sending key according to demand change request, consult to change key.
The quadravalence section connects ending phase.
1, the data communication both sides finish to connect according to IP layer data carried by data protocol type.If transport layer is a Transmission Control Protocol, initiatively finish to connect according to the connection status field in the Transmission Control Protocol; If transport layer is a udp protocol, according to the configuration end connection of application layer password proxy module.
2, connect to finish after, the data communication both sides remove the sensitive information of storing in internal memory and the hardware encryption equipment that is connected, and comprise digital certificate, key and hardware characteristics information.
The advantage of integrated network layer of the present invention and two kinds of cryptographic service of transport layer has been revised defective, Neither need to change existing network hardware, also do not need to revise existing software program, can be to using The authority at family and resource, service, the file that can access carry out more careful control, set up Based on the access control mechanisms of using, realize end-by-end security data communications method and system, Have the remarkable advantages such as applicability is wide, easy and simple to handle, data transmission security.

Claims (9)

1, a kind of safe data communications method is characterized in that being equipped with hardware encryption equipment at data sending terminal and data receiver, and the application layer of data terminal is provided with the password proxy module, and the IP layer is provided with crypto module, and carries out the following step:
Step 1: the password proxy module in the data terminal application layer is resolved user's configuration, and draws the feature five-tuple of IP stream.
Step 2: data terminal issues the feature five-tuple from application layer to the IP layer.
Step 3: after data sending terminal IP layer crypto module intercepted and captured the IP traffic of feature five-tuple, data cached bag, beginning cipher key change.
Step 4: the password proxy module request opposite end asymmetric public key of data sending terminal IP course application layer.
Step 5: data sending terminal IP layer receives the asymmetric public key that application layer issues.
Step 6: data sending terminal uses the opposite end asymmetric public key to encrypt the unique hardware characteristic information of this terminal hardware encryption device and the true random number of this generation.
Step 7: data sending terminal sends the cipher key change request to data receiver.
Step 8: data receiver receives the cipher key change request.
Step 9: data receiver uses the asymmetric privacy keys in this terminal hardware encryption device that the information that receives is decrypted, and the true random number after the deciphering is as the request key.
Step 10: data receiver according to the unique hardware characteristic information of the hardware encryption equipment that receives to application layer password proxy module acquisition request opposite end asymmetric public key.
Step 11: data receiver uses the opposite end asymmetric public key to encrypt the unique hardware characteristic information of this terminal hardware encryption device and the true random number of this generation, and sends the cipher key change request to data sending terminal.
Step 12: after data sending terminal receives the cipher key change request, use the asymmetric privacy keys in the hardware encryption equipment of this terminal to be decrypted, the true random number after the deciphering is as replying key.
Step 13: data sending terminal uses the request key that the data that will send are encrypted, and revises packet content and packet header.
Step 14: data sending terminal mails to data receiver with the data encrypted bag.
Step 15: data receiver uses the request key that the data after receiving are decrypted processing after receiving data.
Step 16: when data receiver was responded, data sending terminal and data receiver use were replied key and are carried out the encryption and decryption processing.
Step 17: data send and finish, and data sending terminal finishes to be connected with data receiver, and remove the sensitive information that both sides consult.
2, a kind of safe data communications method according to claim 1 is characterized in that the feature five-tuple that parses in the described step 1 is source IP, source port, protocol type, purpose IP, destination interface.
3, a kind of safe data communications method according to claim 1 is characterized in that when the user is configured to IP traffic feature five-tuple, and the password proxy module in the data terminal application layer need not carry out user's configuration is resolved.
4, a kind of safe data communication equipment, comprise two data terminals, communication network, hardware encryption equipment, wherein comprise data sending terminal in the data terminal, data receiver, data terminal is divided into application layer, transport layer, network layer, data link layer, physical layer, data sending terminal in the data terminal and data receiver are respectively equipped with hardware encryption equipment, the application layer that it is characterized in that data terminal is equipped with the password proxy module, the password proxy module can be resolved terminal configuration, the IP layer of data terminal is provided with crypto module, and crypto module can carry out encryption to data.
5, a kind of safe data communication equipment according to claim 4 is characterized in that hardware encryption equipment adopts low speed encryption device USB Key.
6 a kind of safe data communication equipments according to claim 4 is characterized in that hardware encryption equipment adopts high-speed encryption equipment PCI password card.
7, a kind of safe data communication equipment according to claim 4, it is characterized in that being provided with in the hardware encryption equipment can not be by the outer key memory block of derivation equipment and unique hardware characteristics information, and the unsymmetrical key of its identity of storaging mark is right in advance.
8, a kind of safe data communication equipment according to claim 4 is characterized in that hardware encryption equipment can produce true random number, has symmetry algorithm and asymmetric arithmetic function.
9, a kind of safe data communication equipment according to claim 4 is characterized in that application layer password proxy module stores the asymmetric public key of all data terminals in advance, can be issued to IP layer crypto module.
CN2009100205015A 2009-04-15 2009-04-15 Method and device for safety data communication Active CN101521667B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN2009100205015A CN101521667B (en) 2009-04-15 2009-04-15 Method and device for safety data communication

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN2009100205015A CN101521667B (en) 2009-04-15 2009-04-15 Method and device for safety data communication

Publications (2)

Publication Number Publication Date
CN101521667A true CN101521667A (en) 2009-09-02
CN101521667B CN101521667B (en) 2012-04-04

Family

ID=41082040

Family Applications (1)

Application Number Title Priority Date Filing Date
CN2009100205015A Active CN101521667B (en) 2009-04-15 2009-04-15 Method and device for safety data communication

Country Status (1)

Country Link
CN (1) CN101521667B (en)

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012160421A1 (en) * 2011-05-20 2012-11-29 Shenoy Gurudatt Systems and methods for device based secure access control using encryption
CN103997483A (en) * 2013-02-20 2014-08-20 联想(北京)有限公司 Information safety control method and apparatus, and electronic device
CN105430017A (en) * 2015-12-31 2016-03-23 国网山东临朐县供电公司 Data secure communication method
CN105491015A (en) * 2015-11-21 2016-04-13 国网山东潍坊市寒亭区供电公司 Data communication and storage method
CN107664337A (en) * 2017-08-21 2018-02-06 珠海格力电器股份有限公司 Air conditioning system, and control method and device of air conditioning unit equipment
CN108965215A (en) * 2017-05-26 2018-12-07 中国科学院沈阳自动化研究所 A kind of dynamic security method and system of more fusion coordination and responses
CN109359445A (en) * 2018-09-25 2019-02-19 浙江齐治科技股份有限公司 A kind of database password management system and method
CN109450937A (en) * 2018-12-24 2019-03-08 深圳市华讯方舟卫星产业科技有限公司 Information secure communications method, system, network interface card and storage medium
CN117955741A (en) * 2024-03-26 2024-04-30 河北久维电子科技有限公司 Encryption communication method and system of Modbus protocol communication equipment

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101055861B1 (en) * 2003-08-08 2011-08-09 케이코 오가와 Communication system, communication device, communication method and communication program for realizing it
CN101227474A (en) * 2008-02-01 2008-07-23 中兴通讯股份有限公司 Method for identifying authority of conversation initialized protocol user in soft switching network

Cited By (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012160421A1 (en) * 2011-05-20 2012-11-29 Shenoy Gurudatt Systems and methods for device based secure access control using encryption
CN103997483A (en) * 2013-02-20 2014-08-20 联想(北京)有限公司 Information safety control method and apparatus, and electronic device
CN105491015B (en) * 2015-11-21 2018-07-20 国网山东潍坊市寒亭区供电公司 A kind of communication of data and storage method
CN105491015A (en) * 2015-11-21 2016-04-13 国网山东潍坊市寒亭区供电公司 Data communication and storage method
CN105430017B (en) * 2015-12-31 2018-10-09 国网山东临朐县供电公司 Data safety communication means
CN105430017A (en) * 2015-12-31 2016-03-23 国网山东临朐县供电公司 Data secure communication method
CN108965215A (en) * 2017-05-26 2018-12-07 中国科学院沈阳自动化研究所 A kind of dynamic security method and system of more fusion coordination and responses
US11102226B2 (en) 2017-05-26 2021-08-24 Shenyang Institute Of Automation, Chinese Academy Of Sciences Dynamic security method and system based on multi-fusion linkage response
CN107664337A (en) * 2017-08-21 2018-02-06 珠海格力电器股份有限公司 Air conditioning system, and control method and device of air conditioning unit equipment
CN107664337B (en) * 2017-08-21 2019-11-19 珠海格力电器股份有限公司 Air-conditioning system, the control method of air-conditioner set equipment and device
CN109359445A (en) * 2018-09-25 2019-02-19 浙江齐治科技股份有限公司 A kind of database password management system and method
CN109450937A (en) * 2018-12-24 2019-03-08 深圳市华讯方舟卫星产业科技有限公司 Information secure communications method, system, network interface card and storage medium
CN117955741A (en) * 2024-03-26 2024-04-30 河北久维电子科技有限公司 Encryption communication method and system of Modbus protocol communication equipment

Also Published As

Publication number Publication date
CN101521667B (en) 2012-04-04

Similar Documents

Publication Publication Date Title
CN101521667B (en) Method and device for safety data communication
Sridhar et al. Intelligent security framework for iot devices cryptography based end-to-end security architecture
CN103354498B (en) A kind of file encryption transmission method of identity-based
CN107105060A (en) A kind of method for realizing electric automobile information security
Garg et al. An efficient and secure data storage in Mobile Cloud Computing through RSA and Hash function
CN111245862A (en) System for safely receiving and sending terminal data of Internet of things
CN101247407A (en) Network authentication service system and method
CN109787761A (en) A kind of equipment certification and key distribution system and method based on physics unclonable function
CN105429962B (en) A kind of general go-between service construction method and system towards encryption data
Nyamtiga et al. Enhanced security model for mobile banking systems in Tanzania
CN105516062B (en) Method for realizing L2 TP over IPsec access
TW201537937A (en) Unified identity authentication platform and authentication method thereof
Rongyu et al. A PK-SIM card based end-to-end security framework for SMS
CN111935213A (en) Distributed trusted authentication virtual networking system and method
CN102281303A (en) Data exchange method
CN103379103A (en) Linear encryption and decryption hardware implementation method
Lin et al. Research on PUF-based security enhancement of narrow-band Internet of Things
KR102400260B1 (en) In-vehicle communication system based on edge computing using attribute-based access control and method thereof
CN210839642U (en) Device for safely receiving and sending terminal data of Internet of things
Khan et al. An HTTPS approach to resist man in the middle attack in secure SMS using ECC and RSA
Yazdanpanah et al. Secure SMS Method Based on Social Networks
CN117201200B (en) Data safety transmission method based on protocol stack
Ying-lan et al. Research and implementation of key technology based on internet encryption and authentication
Asante et al. Analysis of security vulnerabilities in wifi-protected access pre-shared key
Lee Towards an accountable and private Internet

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
C10 Entry into substantive examination
SE01 Entry into force of request for substantive examination
C14 Grant of patent or utility model
GR01 Patent grant
C56 Change in the name or address of the patentee
CP02 Change in the address of a patent holder

Address after: 264200 No. 108-1, Shenyang Road, Weihai, Shandong

Patentee after: Shandong Yuweng Information Technology Co., Ltd.

Address before: 264200, Shandong province Weihai economic and Technological Development Zone Artemisia wood market No. 401

Patentee before: Shandong Yuweng Information Technology Co., Ltd.

PE01 Entry into force of the registration of the contract for pledge of patent right

Denomination of invention: Method and device for safety data communication

Effective date of registration: 20151109

Granted publication date: 20120404

Pledgee: Weihai commercial bank Limited by Share Ltd

Pledgor: Shandong Yuweng Information Technology Co., Ltd.

Registration number: 2015990000977

PLDC Enforcement, change and cancellation of contracts on pledge of patent right or utility model
PC01 Cancellation of the registration of the contract for pledge of patent right

Date of cancellation: 20161102

Granted publication date: 20120404

Pledgee: Weihai commercial bank Limited by Share Ltd

Pledgor: Shandong Yuweng Information Technology Co., Ltd.

Registration number: 2015990000977

PE01 Entry into force of the registration of the contract for pledge of patent right

Denomination of invention: Method and device for safety data communication

Effective date of registration: 20161102

Granted publication date: 20120404

Pledgee: Weihai City Commercial Bank Limited by Share Ltd high tech branch

Pledgor: Shandong Yuweng Information Technology Co., Ltd.

Registration number: 2016990000935

PLDC Enforcement, change and cancellation of contracts on pledge of patent right or utility model
CP03 Change of name, title or address
CP03 Change of name, title or address

Address after: 264200 No. 12-1, Chuhe North Road, chucun Town, gaoqu District, Weihai City, Shandong Province

Patentee after: Yuweng Information Technology Co.,Ltd.

Address before: No. 108-1, Shenyang Road, Weihai, Shandong 264200

Patentee before: SHANDONG FISHERMAN INFORMATION TECHNOLOGY Co.,Ltd.

PC01 Cancellation of the registration of the contract for pledge of patent right
PC01 Cancellation of the registration of the contract for pledge of patent right

Date of cancellation: 20211222

Granted publication date: 20120404

Pledgee: Weihai City Commercial Bank Limited by Share Ltd. high tech branch

Pledgor: SHANDONG FISHERMAN INFORMATION TECHNOLOGY CO.,LTD.

Registration number: 2016990000935