CN107846686B - Secret key synchronization method and device for cluster multi-base station encryption communication system - Google Patents

Secret key synchronization method and device for cluster multi-base station encryption communication system Download PDF

Info

Publication number
CN107846686B
CN107846686B CN201711417508.1A CN201711417508A CN107846686B CN 107846686 B CN107846686 B CN 107846686B CN 201711417508 A CN201711417508 A CN 201711417508A CN 107846686 B CN107846686 B CN 107846686B
Authority
CN
China
Prior art keywords
data
kmc
synchronous
synchronized
key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201711417508.1A
Other languages
Chinese (zh)
Other versions
CN107846686A (en
Inventor
李璐
杨旸
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Chengdu 30rtom Mobile Communication Co ltd
Original Assignee
Chengdu 30rtom Mobile Communication Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Chengdu 30rtom Mobile Communication Co ltd filed Critical Chengdu 30rtom Mobile Communication Co ltd
Priority to CN201711417508.1A priority Critical patent/CN107846686B/en
Publication of CN107846686A publication Critical patent/CN107846686A/en
Application granted granted Critical
Publication of CN107846686B publication Critical patent/CN107846686B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]

Abstract

The invention relates to the field of encryption communication systems of flexible networking of multiple base stations, in particular to a key synchronization method and device of a cluster multiple base station encryption communication system. The invention comprises that when the m-th KMC corresponds to the encrypted terminal, the data K to be synchronizedAWhen the data K to be synchronized is changed, the mth KMC sends the data K to be synchronizedACorresponding ciphertext data cipherAStoring the data into a database Buffer table, and storing the data K to be synchronizedACorrespondingly storing the corresponding identification parameters; detecting that the data K to be synchronized corresponding to the nth KMC exists in a local database Buffer table by the mth KMCAThen the data K to be synchronized is obtainedACorresponding ciphertext data cipherAAfter processing, synchronous encrypted data E is formed, and then the synchronous encrypted data E is synchronized to the nth KMC; the nth KMC carries out verification according to the synchronous encrypted data E and obtains data K to be synchronizedA。

Description

Secret key synchronization method and device for cluster multi-base station encryption communication system
Technical Field
The invention relates to the field of encryption communication systems of flexible networking of multiple base stations, in particular to a key synchronization method and device of a cluster multiple base station encryption communication system.
Background
In the design of a cluster multi-base-station encryption communication system, a mode of adopting a multi-base station and a single KMC (key management center) is common, but in actual use, there are many situations that the base stations need to be individually networked or mixed networked temporarily, and it is required to ensure that an encryption terminal can be used under each base station, which cannot be accomplished under the condition of single KMC. In order to meet the above requirements, the simplest and most effective method is to configure a KMC for each base station, but the encrypted terminal information stored in each KMC, including the key information, must be the same so as to satisfy that the encrypted terminal can be normally used under each base station, and to satisfy the consistency of data of each KMC in the system, data synchronization between KMCs must be ensured. Due to the encryption system, a synchronization mechanism of the database cannot be used simply, because data stored in each KMC data is in a ciphertext form, and a local protection key of each KMC is different, the data stored in the database is different, so that a special data synchronization protocol needs to be established for data synchronization between the KMCs. At present, papers, patents and related products for researching the design of a cluster multi-base-station encryption communication system describe the flexible networking encryption communication system of multiple base stations very little, so that a simple and reliable method suitable for key synchronization under the cluster multi-base-station encryption communication system is provided, and the practical necessity exists.
Disclosure of Invention
The technical problem to be solved by the invention is as follows: aiming at the problems in the prior art, a key synchronization method and device for a cluster multi-base station encryption communication system are provided. The method or the device meets the requirement of flexible networking of the cluster multi-base station encryption communication system through simple and reliable key synchronization under the cluster multi-base station encryption communication system; data synchronization between the KMCs is realized, the practicability requirement is met, and the consistency of KMC data in the system is ensured.
The technical scheme adopted by the invention is as follows:
a key synchronization method of a cluster multi-base station encryption communication system comprises the following steps:
configuring corresponding KMC for each base station to form a cluster multi-base station encryption communication system;
when the m-th KMC corresponds to the encrypted terminal to-be-synchronized data KAWhen the data K to be synchronized is changed, the mth KMC sends the data K to be synchronizedACorresponding ciphertext data cipherAStoring the data into a database Buffer table, and storing the data K to be synchronizedACorrespondingly storing the corresponding identification parameters;
the mth KMC and the nth KMC perform password-based authentication and key agreement to obtain an agreement key between the mth KMC and the nth KMC;
detecting that the data K to be synchronized corresponding to the nth KMC exists in a local database Buffer table by the mth KMCAThen the data K to be synchronized is obtainedACorresponding ciphertext data cipherAAfter processing, synchronous encrypted data E is formed, and then the synchronous encrypted data E is synchronized to the nth KMC;
the nth KMC carries out verification according to the synchronous encrypted data E and obtains data K to be synchronizedA；
Wherein the content of the first and second substances,ciphertext data cipherAThe method is formed by encrypting synchronous data through a local key; wherein synchronizing the data comprises: identification number, operation type, randomly generated serial number and data K to be synchronized of encryption terminal AA。
Further, the specific process of synchronizing the synchronous encrypted data E to the corresponding KMC is as follows:
cipher text data cipherAAfter the decryption is carried out through the local decryption key, the secondary encryption is carried out through a corresponding KMC negotiation key; then, performing data frame format package on the secondarily encrypted data to form a synchronous encrypted data frame E;
after receiving the synchronous encrypted data frame E, the corresponding KMC carries out synchronous encrypted data validity verification;
after the validity verification of the synchronous encrypted data passes, carrying out synchronous encrypted data decryption by using a negotiation key obtained by negotiation to obtain synchronous data;
verifying whether the operation type in the synchronous encrypted data frame format is consistent with the decrypted operation type, if so, using KAUsing K to encrypt the data of terminal AAUpdating;
wherein, the synchronous encrypted data E refers to: checking a header, operating type, generating time, synchronizing data packet and CRC; wherein the synchronous data packet is data K to be synchronizedAAfter the ciphertext is decrypted by the local key, the ciphertext is obtained by performing secondary encryption by the negotiation key.
Further, the specific process of verifying the validity of the synchronous encrypted data is as follows:
step 11: firstly, judging that the synchronous initiating message is a synchronous initiating message according to a check head of a synchronous encrypted data frame E, then verifying a check bit, if the check bit is correct, then verifying the generation time, if the difference value between the generation time and the current time is less than a time threshold value, indicating that the generation time is effective, then decrypting the synchronous data by using the negotiation key to obtain an identification number, an operation type, a serial number and a K number of an encryption terminal AAExecuting step 12; otherwise, the check head judges whether the synchronous initiating message is judged, the check bit is incorrect or judges that the difference value between the generation time and the current time is greater thanThe inter threshold value is determined as the data K to be synchronizedAInvalid synchronization data;
step 12: verifying whether the operation type in the E format of the synchronous encrypted data frame is consistent with the decrypted operation type, and if so, using KAUsing K to encrypt the data of terminal AAUpdating, namely after the updating is finished, the nth KMC sends a confirmation prompt packet to the mth KMC, and the mth KMC receives the confirmation prompt packet and then transmits the data K to be synchronizedADeleting; if the data K is not consistent with the data K to be synchronized, the nth KMC does not carry out the data K to be synchronizedAUpdating, wherein the nth KMC sends an exception prompt packet to the mth KMC, and the mth KMC receives the exception prompt packet and then transmits the data K to be synchronizedAAnd (5) deleting.
Furthermore, the key synchronization method also comprises the step that the nth KMC obtains the data K to be synchronizedAThen, the nth KMC generates a synchronous reply message F, and the mth KMC performs synchronous data validity verification after receiving the synchronous reply message F; after the validity verification of the synchronous data passes, the synchronization is completed; wherein, the synchronous encrypted data F refers to: checking a header, operating type, generating time, verifying a synchronous data packet and CRC; the verification synchronization packet refers to the operation type and the serial number.
Further, the specific process of validity verification of the synchronization data is as follows;
step 21: firstly, judging that the synchronous reply message is a synchronous reply message according to a synchronous reply message F check head, then verifying a check bit, if the check bit is correct, then verifying the generation time, if the difference value between the generation time and the current time is less than a time threshold value, indicating that the generation time is effective, then decrypting synchronous data by using the negotiation key to obtain an operation type and a serial number plaintext, and executing the step 22; if the check head judges that the message is not synchronous, the check bit is incorrect or the difference value between the generation time and the current time is larger than the time threshold value, the data K to be synchronized is determinedAInvalid synchronization data;
step 22: verifying whether the operation type in the frame format of the synchronous encrypted data is consistent with the decrypted operation type, and if so, deleting the data K to be synchronized from the Buffer tableAThe corresponding identification parameters finish the data synchronization; otherwiseConsider data K to be synchronizedAThe m KMC sends an abnormal prompt packet to the n KMC, and the n KMC receives the abnormal prompt packet and then synchronizes the data KAAnd (5) deleting.
Further, the successful key agreement of the corresponding KMC means that after the KMC successfully agrees with the authentication key of other KMCs, it is checked that the corresponding synchronization data exists in the database Buffer table.
Further, the identification parameter refers to an operation type, a corresponding relation with the nth KMC, and ciphertext data ciphertextAA serial number; the corresponding relation with the nth KMC refers to the identity information (such as the number or IP of the nth KMC and the signature data generated by the identity information) of the nth KMC.
The key synchronization device based on the key synchronization method comprises the following steps:
each base station is configured and set with a corresponding KMC to form a cluster multi-base-station encryption communication system;
data K to be synchronizedAA storage module used for storing the data K to be synchronized of the encrypted terminal corresponding to the mth KMCAWhen the data K to be synchronized is changed, the mth KMC sends the data K to be synchronizedACorresponding ciphertext data cipherAStoring the data into a database Buffer table of the KMC, wherein the identification parameters corresponding to the data need to be correspondingly stored during storage;
the key negotiation module is used for carrying out password-based authentication and key negotiation on the mth KMC and the nth KMC to obtain a key negotiation between the mth KMC and the nth KMC;
a synchronous data module used for the mth KMC to detect that the data K to be synchronized corresponding to the nth KMC exists in the Buffer table of the local databaseAThen the data K to be synchronized is obtainedACorresponding ciphertext data cipherAAfter processing, synchronous encrypted data E is formed, and then the synchronous encrypted data E is synchronized to the nth KMC; the nth KMC carries out verification according to the synchronous encrypted data E and obtains data K to be synchronizedA。
Wherein, the ciphertext data cipherAThe method is formed by encrypting synchronous data through a local key; wherein synchronizing the data comprises: encryption terminal AIdentification number of, operation type of, randomly generated serial number of and data to be synchronized KA。
In summary, due to the adoption of the technical scheme, the invention has the beneficial effects that:
the cluster multi-base-station encryption communication system can carry out networking at will, and because the encryption terminal information stored in each KMC database is the same, the encryption terminal can also carry out service under any networking, the encryption communication requirement of multi-base-station flexible networking is effectively met, temporary keys are used during encryption transmission each time, the keys are different each time, and data leakage can be effectively prevented.
Drawings
The invention will now be described, by way of example, with reference to the accompanying drawings, in which:
fig. 1 is a key synchronization flow chart under a clustered multi-base station encryption communication system.
Detailed Description
All of the features disclosed in this specification, or all of the steps in any method or process so disclosed, may be combined in any combination, except combinations of features and/or steps that are mutually exclusive.
Any feature disclosed in this specification may be replaced by alternative features serving equivalent or similar purposes, unless expressly stated otherwise. That is, unless expressly stated otherwise, each feature is only an example of a generic series of equivalent or similar features.
Description of the invention:
1. data K to be synchronizedAThe key is generated by negotiation between the encryption terminal and the KMC when the encryption terminal accesses the network, and is used when communication is carried out between the encryption terminals, and when the versions of the KMC connected between the encryption terminal and the KMC when the encryption terminal accesses the network are different, renegotiation is needed. By adopting the method, the conversation between the encrypted terminals is not influenced under the condition that any KMC is randomly added into the network, quits the network and is independently networked (namely, only one version of K exists in the network into which any terminal is added)A)。
2. The KMC refers to a key management center.
A key synchronization method under a cluster multi-base station encryption communication system comprises the following specific steps: when a cluster multi-base-station encryption communication system environment is built, a KMC is configured for each base station, TCP/IP connection is adopted between the KMCs, and after the KMC is started, password-based authentication and key agreement are carried out between the KMC and all other KMCs in the system to obtain an agreement key between the KMCs.
The data synchronization method comprises the following steps:
when the encrypted terminal data K to be synchronized stored on the KMCAAfter the change, the data K to be synchronized needs to be synchronizedASynchronizing to other KMCs in the system, in order to ensure the reliability of the synchronized data, the data K to be synchronized needs to be synchronizedAFirstly, the data is stored in a database of the KMC through local key encryption protection, and the data K to be synchronized needs to be storedACorresponding identification parameters and data K to be synchronizedACiphertext is stored in one-to-one correspondence and data K to be synchronizedACorresponding KMC change updates data to be synchronized KAAfter the synchronization is successful, the data K to be synchronized is sentADeleted from the database. The method comprises the following specific steps:
(1) the KMC encrypts the identification number, operation type (introduced in figure 1), serial number (randomly generated) and data K to be synchronized of the terminal AAThe local encryption key is used together for encryption protection and is recorded as ciphertext data cipherACiphertext data cipherAAnd storing the data into a Buffer table of the database, wherein the Buffer table is a database table for caching the data to be synchronized. The Buffer table design includes the following: operation type, corresponding identification parameters with other KMCs (which can be numbers or IP of other KMCs), and ciphertext data cipherAAnd a serial number. Cipher text data cipherAWhen the operation type is stored in the Buffer table, the operation type corresponding to the record, the corresponding relation with other KMCs and the serial number need to be filled in the Buffer table;
(2) after the authentication key negotiation between the mth KMC and the nth KMC is successful, the mth KMC checks that the data K to be synchronized corresponding to the nth KMC exists in a Buffer table of a local databaseA(this determination is made by the mth KMC checking the synchronization data Ciper in the identification parameter of the local database Buffer tableAWith the number of the nth KMC orIP, whereby the data K to be synchronized corresponding to the nth KMC is considered to existA) And if so, taking the identification parameter from the Buffer table, and packaging the data frame format according to the table 1 to obtain the synchronous initiating message E.
TABLE 1 synchronous encrypted data frame format
Figure BDA0001522310410000071
Wherein, two bytes of the check head are fixed values, can take any value, represent synchronous initiating message or synchronous reply message; the operation type is one byte, and can be defined as operations such as adding and deleting encrypted terminal information, for example, 0x01 represents adding encrypted terminal information, 0x02 represents deleting encrypted terminal information, and 0x03 represents updating encrypted terminal information; the generation time represents the time of generation of the message, and the difference between the time of generation of the message and 1/1970 is converted into 4 bytes for validity judgment; the synchronous data packet is data which needs to be synchronized currently, the ciphertext exists, and the obtained K isAAfter the ciphertext is decrypted by using the local protection key, encryption protection is carried out by using the key obtained by negotiation, wherein the value of M depends on the length of the synchronous data; the check bit is used for checking the previous 4 items of content, and the value of C depends on the adopted checking mode and the length of the synchronous data;
(3) the mth KMC sends the message E to the nth KMC, the nth KMC analyzes the message E according to the frame format shown in figure 1 after receiving the message E, firstly, whether the message is synchronously initiated is judged according to the head, then, the check bit is verified, if the check bit is correct, the generation time is verified, the difference value between the generation time and the current time is judged, if the difference value is greater than a specified time threshold value, the data K to be synchronized is determinedAIf the generation time is valid, the synchronous data is decrypted by using the key obtained by negotiation to obtain the identification number, the operation type, the serial number and the K of the encryption terminal AAVerifying whether the operation type in the synchronous encrypted data frame format is consistent with the decrypted operation type, and if so, using KAUsing K to encrypt the data of terminal AAUpdating(ii) a If not, the operation is not carried out, an abnormal prompt packet is sent to the sender, and the sender deletes the message after sending the abnormal prompt packet.
(4) After the data is updated, the nth KMC generates a synchronous reply message F, the format of the synchronous reply message also uses the data frame format shown in the table 2, the content of the synchronous data packet is verified to be the operation type and the serial number, the encryption protection is also carried out by using the key obtained by negotiation, and the message F is replied to the KMC;
the data frame format is packed as shown in table 2, resulting in a synchronization reply message F,
Figure BDA0001522310410000081
the check head, operation type, generation time and check bit are the same as those in table 1; the verification of the synchronous data packet as a verification synchronous data packet refers to the operation type and the serial number; the check bit is used for checking the previous 4 items of content, and the value of C depends on the adopted checking mode and the length of the synchronous data
(5) After receiving the message F, the mth KMC analyzes the message according to the frame format shown in Table 2, firstly judges whether to reply the message synchronously according to the header, then verifies the check bit, verifies the generation time if the check bit is correct, judges the difference value between the generation time and the current time, and determines the data K to be synchronized if the difference value is greater than a specified time threshold valueAIf the generation time is valid, decrypting the synchronous data by using a key obtained by negotiation to obtain an operation type and a serial number plaintext, verifying whether the operation type in the frame format of the synchronous encrypted data is consistent with the decrypted operation type, and if so, deleting a record corresponding to the serial number from the Buffer table to finish the data synchronization; if the operation type in the decrypted data or the encrypted data frame format cannot be used by the key obtained by negotiation and the decrypted operation type are not consistent, otherwise, the data K to be synchronized is consideredAThe m KMC sends an abnormal prompt packet to the n KMC, and the n KMC receives the abnormal prompt packet and then synchronizes the data KAAnd (5) deleting.
The first embodiment is as follows:
the system comprises 3 base stations, each base station is provided with one KMC (KMC 1, KMC2 and KMC3, each KMC has the IP and communication ports of other two KMCs, each KMC is connected through TCP/IP, and the system also comprises an encryption terminal A.
The KMC1, the KMC2 and the KMC3 are powered on, and the KMC is actively connected to the other two KMCs after being powered on, so that the KMC which is powered on later is successfully connected to the KMC which is powered on earlier, and assuming that the KMC1, the KMC2 and the KMC3 are powered on in sequence, the KMC2 is successfully connected to the KMC1 after being powered on, and the KMC3 is successfully connected to the KMC1 and the KMC2 after being powered on, which is described below by a main station from the perspective of the KMC 3.
After the KMC3 connects to the KMC1 and the KMC2, the KMC1 and the KMC2 respectively perform password-based authentication and key agreement, assuming that the key agreed between the KMC3 and the KMC1 is K1, and the key K2 is agreed with the KMC 2. After the negotiation is successful, the KMC3 maintains long connection of TCP/IP with the KMC1 and the KMC 2.
Information of the encryption terminal A is added on the KMC3, and the KMC3 encrypts the data K to be synchronized of the terminal AAThe method comprises the steps of recording the data into a database, adding two new records in a database Buffer table, filling the IP address of a KMC1 in a corresponding relation column of other KMCs for distinguishing the record as a message needing to be synchronized to a KMC1, filling the IP address of a KMC2 in the other record, filling the operation types of the two records with 0x01, randomly generating serial numbers, and filling the synchronous data as the information of an identification number + the operation type + the serial number + A of an encryption terminal A, and carrying out encryption protection. A is data K to be synchronizedAAfter the ciphertext is decrypted by the local key, the secondary encryption is carried out by the negotiation key;
when the KMC3 detects that data exist in the database Buffer table, the data in the Buffer table is obtained as a List according to the IP address of the KMC which is currently connected and the IP addresses of the KMC1 and the KMC2, wherein the List comprises two records, one is data Msg1 which needs to be synchronized to the KMC1, and the other is data Msg2 which needs to be synchronized to the KMC 2. The KMC3 will generate a synchronization initiation message to the KMC1, packaged in the data frame format of table 1: header fill 0xaa, 0x31, representing this message as a synchronization initiation message; operation type fill in 0x 01; converting the difference between the current time and 1/1970 into 4 bytes, and filling the 4 bytes in the generation time; decrypting the synchronous data packet of the Msg1 by using a local protection key to obtain a plaintext, encrypting the plaintext by using K1 to obtain a ciphertext, and filling the ciphertext into a synchronous data bit; the CRC is used to check the content of the previous 4 items to obtain CRC bits, and the CRC bits are filled in. A synchronization initiation message is sent to KMC 1. The synchronization initiation message of the KMC2 is generated as same, and is sent to the KMC 2.
When the KMC1 receives the synchronization initiating message, firstly, it analyzes according to the data frame format in Table 1, judges if the header is 0xaa, 0x31, if so, calculates the value of CRC bit, compares it with the received CRC, if the result is the same, compares the generated time with the current time of KMC1, if the result exceeds the validity period of the message, it determines the data K to be synchronizedAIf the data is invalid synchronous data, the data is not processed, if the data is valid, the synchronous data bits are decrypted by using a key K1 obtained by the negotiation between the KMC1 and the KMC3, the information of the identification number + the operation type + the serial number + A of the encryption terminal A is obtained, the operation type is compared with the operation type of the data frame format, and the content of the database is updated by the identification number of the encryption terminal A and the information of the A if the operation type is the same, wherein the information of the A needs to be added in the database because the operation type is 0x01, and the local protection key is used for encryption protection. The KMC2 processes the received synchronization message in the same manner.
After the KMC1 updates the database, it generates a synchronization reply message F, packaged in the data frame format of table 2: the check header fills in 0xaa and 0x32, which represents that the message is a synchronous reply message; operation type fills out operation type 0x01 in the synchronization initiation message; the time of generation is filled out as when synchronizing the origination message to the current time of KMC 1; verifying that the synchronous data packet fills in the operation type and serial number acquired from the synchronous initiating message, and encrypting the synchronous data bits by using K1; the CRC is used to check the content of the previous 4 items to obtain CRC bits, and the CRC bits are filled in. The synchronization reply message is sent to KMC 3. The KMC2 generates a synchronization reply message in the same way as the KMC1, and sends the resulting synchronization reply message to the KMC 3.
After receiving the synchronous reply message of KMC1, KMC3 parses the message according to the data frame format in Table 2, checks the header, CRC bits, and determines the generation timeAnd decrypting and verifying the synchronous data packet by using K1 to obtain an operation type and a serial number, judging whether the operation type is consistent with the operation type of the data frame format, and deleting the data K to be synchronized from the Buffer table if the operation type is consistent with the operation type of the data frame formatAThe corresponding identification parameters finish the data synchronization; otherwise, the data K to be synchronized is consideredAThe m KMC sends an abnormal prompt packet to the n KMC, and the n KMC receives the abnormal prompt packet and then synchronizes the data KAAnd (5) deleting. After the KMC3 receives the synchronization reply message of the KMC2, the processing mode is the same, and finally the KMC3 completes the encryption of the data K to be synchronized of the terminal AAAnd KMC1 and KMC2 also have data K to be synchronized of the encryption terminal AA。
And the encryption terminal A is used for carrying out encryption service in the environment of KMC1, the encryption terminal A can be normally used, and then the encryption terminal A is respectively placed in the environments of KMC2 and KMC3 for carrying out encryption service, and the encryption terminal A can be normally used.
The invention is not limited to the foregoing embodiments. The invention extends to any novel feature or any novel combination of features disclosed in this specification and any novel method or process steps or any novel combination of features disclosed.

Claims (6)

1. A key synchronization method of a cluster multi-base station encryption communication system is characterized by comprising the following steps:
configuring corresponding KMC for each base station to form a cluster multi-base station encryption communication system;
when the m-th KMC corresponds to the encrypted terminal to-be-synchronized data KAWhen the data K to be synchronized is changed, the mth KMC sends the data K to be synchronizedACorresponding ciphertext data cipherAStoring the data into a database Buffer table, and storing the data K to be synchronizedACorrespondingly storing the corresponding identification parameters;
the mth KMC and the nth KMC perform password-based authentication and key agreement to obtain an agreement key between the mth KMC and the nth KMC;
detecting that the data K to be synchronized corresponding to the nth KMC exists in a local database Buffer table by the mth KMCAWhen the temperature of the water is higher than the set temperature,then the data K to be synchronizedACorresponding ciphertext data cipherAAfter processing, synchronous encrypted data E is formed, and then the synchronous encrypted data E is synchronized to the nth KMC;
the nth KMC carries out verification according to the synchronous encrypted data E and obtains data K to be synchronizedA；
Wherein, the ciphertext data cipherAThe method is formed by encrypting synchronous data through a local key; wherein synchronizing the data comprises: identification number, operation type, randomly generated serial number and data K to be synchronized of encryption terminal AA(ii) a m and n are positive integers more than 0, and m is equal to n;
the specific process of forming the synchronous encrypted data E and synchronizing the synchronous encrypted data E to the corresponding KMC is as follows:
cipher text data cipherAAfter the decryption is carried out through the local decryption key, the secondary encryption is carried out through a corresponding KMC negotiation key; then, performing data frame format package on the secondarily encrypted data to form a synchronous encrypted data frame E;
after receiving the synchronous encrypted data frame E, the corresponding KMC carries out synchronous encrypted data validity verification;
after the validity verification of the synchronous encrypted data passes, carrying out synchronous encrypted data decryption by using a negotiation key obtained by negotiation to obtain synchronous data;
verifying whether the operation type in the synchronous encrypted data frame format is consistent with the decrypted operation type, if so, using KAUsing K to encrypt the data of terminal AAUpdating;
wherein, the synchronous encrypted data E refers to: checking a header, operating type, generating time, synchronizing data packet and CRC; wherein the synchronous data packet is data K to be synchronizedAAfter the ciphertext is decrypted by the local key, the ciphertext is obtained by performing secondary encryption by the negotiation key;
the validation process of the synchronous encrypted data specifically comprises the following steps:
step 11: firstly, judging that the synchronous encrypted data frame E is a synchronous initiating message according to a check head of the synchronous encrypted data frame E, then verifying a check bit, if the check bit is correct, then verifying the generation time, and if the generation time is equal to the generation timeIf the difference value of the current time is less than the time threshold value, indicating that the generation time is effective, decrypting the synchronous data by using the negotiation key to obtain the identification number, the operation type, the serial number and the K of the encryption terminal AAExecuting step 12; otherwise, the check head judges whether the synchronous initiating message is judged, the check bit is incorrect or the difference value between the generation time and the current time is judged to be larger than the time threshold value, and then the data K to be synchronized is determinedAInvalid synchronization data;
step 12: verifying whether the operation type in the E format of the synchronous encrypted data frame is consistent with the decrypted operation type, and if so, using KAUsing K to encrypt the data of terminal AAUpdating, namely after the updating is finished, the nth KMC sends a confirmation prompt packet to the mth KMC, and the mth KMC receives the confirmation prompt packet and then transmits the data K to be synchronizedADeleting; if the data K is not consistent with the data K to be synchronized, the nth KMC does not carry out the data K to be synchronizedAUpdating, wherein the nth KMC sends an exception prompt packet to the mth KMC, and the mth KMC receives the exception prompt packet and then transmits the data K to be synchronizedAAnd (5) deleting.
2. The key synchronization method as claimed in claim 1, further comprising obtaining the data K to be synchronized by the nth KMCAThen, the nth KMC generates a synchronous reply message F, and the mth KMC performs synchronous data validity verification after receiving the synchronous reply message F; after the validity verification of the synchronous data passes, the synchronization is completed; wherein, the synchronous encrypted data F refers to: checking a header, operating type, generating time, verifying a synchronous data packet and CRC; the verification synchronization packet refers to the operation type and the serial number.
3. The key synchronization method according to claim 2, wherein the specific process of validity verification of the synchronization data is;
step 21: firstly, according to the synchronous reply message F, the check head judges that the message is a synchronous reply message, then the check bit is verified, if the check bit is correct, the generation time is verified, if the difference value between the generation time and the current time is less than the time threshold value, the generation time is valid, then the negotiation secret key is used for decrypting the synchronous data,obtaining the operation type and the plain text of the serial number, and executing the step 22; if the check head judges that the message is not synchronous, the check bit is incorrect or the difference value between the generation time and the current time is larger than the time threshold value, the data K to be synchronized is determinedAInvalid synchronization data;
step 22: verifying whether the operation type in the frame format of the synchronous encrypted data is consistent with the decrypted operation type, and if so, deleting the data K to be synchronized from the Buffer tableAThe corresponding identification parameters finish the data synchronization; otherwise, the data K to be synchronized is consideredAThe m KMC sends an abnormal prompt packet to the n KMC, and the n KMC receives the abnormal prompt packet and then synchronizes the data KAAnd (5) deleting.
4. The key synchronization method according to one of claims 1 to 3, wherein the key agreement success of the corresponding KMC means that after the KMC successfully agrees with other KMC authentication keys, it checks that the database Buffer table has the corresponding synchronization data.
5. The key synchronization method according to claim 4, wherein the identification parameter refers to an operation type, a correspondence relationship with an nth KMC, and ciphertext data ciphertextAA serial number; the correspondence with the nth KMC refers to being the nth KMC identity information.
6. A key synchronization device based on the key synchronization method of claim 1, 2, 3 or 5, comprising:
each base station is configured and set with a corresponding KMC to form a cluster multi-base-station encryption communication system;
data K to be synchronizedAA storage module used for storing the data K to be synchronized of the encrypted terminal corresponding to the mth KMCAWhen the data K to be synchronized is changed, the mth KMC sends the data K to be synchronizedACorresponding ciphertext data cipherAStoring the data into a database Buffer table of the KMC, wherein the identification parameters corresponding to the data need to be correspondingly stored during storage;
the key negotiation module is used for carrying out password-based authentication and key negotiation on the mth KMC and the nth KMC to obtain a key negotiation between the mth KMC and the nth KMC;
a synchronous data module used for the mth KMC to detect that the data K to be synchronized corresponding to the nth KMC exists in the Buffer table of the local databaseAThen the data K to be synchronized is obtainedACorresponding ciphertext data cipherAAfter processing, synchronous encrypted data E is formed, and then the synchronous encrypted data E is synchronized to the nth KMC; the nth KMC carries out verification according to the synchronous encrypted data E and obtains data K to be synchronizedA;
Wherein, the ciphertext data cipherAThe method is formed by encrypting synchronous data through a local key; wherein synchronizing the data comprises: identification number, operation type, randomly generated serial number and data K to be synchronized of encryption terminal AA。
CN201711417508.1A 2017-12-25 2017-12-25 Secret key synchronization method and device for cluster multi-base station encryption communication system Active CN107846686B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201711417508.1A CN107846686B (en) 2017-12-25 2017-12-25 Secret key synchronization method and device for cluster multi-base station encryption communication system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201711417508.1A CN107846686B (en) 2017-12-25 2017-12-25 Secret key synchronization method and device for cluster multi-base station encryption communication system

Publications (2)

Publication Number Publication Date
CN107846686A CN107846686A (en) 2018-03-27
CN107846686B true CN107846686B (en) 2020-10-23

Family

ID=61684112

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201711417508.1A Active CN107846686B (en) 2017-12-25 2017-12-25 Secret key synchronization method and device for cluster multi-base station encryption communication system

Country Status (1)

Country Link
CN (1) CN107846686B (en)

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105208007A (en) * 2015-08-26 2015-12-30 中标软件有限公司 Data sharing system

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR101874043B1 (en) * 2011-07-08 2018-07-06 삼성전자주식회사 Method and apparatus for updating key in wireless communication system

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105208007A (en) * 2015-08-26 2015-12-30 中标软件有限公司 Data sharing system

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
基于Kerberos的VPN认证协议的研究与实现;吴兴，魏海平,杨飞,杨晟;《小型微型计算机系统》;20031231;第2页 *
移动通信环境下对称密钥分发安全机制;侯嘉，罗敏，李斌;《第十一届"保密通信与信息安全现状研讨会"》;20090831;第281-284页 *

Also Published As

Publication number Publication date
CN107846686A (en) 2018-03-27

Similar Documents

Publication Publication Date Title
CN111799867B (en) Mutual trust authentication method and system between charging equipment and charging management platform
US5297208A (en) Secure file transfer system and method
US6996723B1 (en) Data generating apparatus and data verifying apparatus
US9077521B2 (en) Method and system for secure communication
US7698556B2 (en) Secure spontaneous associations between networkable devices
US10057071B2 (en) Component for connecting to a data bus, and methods for implementing a cryptographic functionality in such a component
US20060282675A1 (en) Message authentication system, message transmission apparatus and message reception apparatus
CN105162599B (en) A kind of data transmission system and its transmission method
US9264404B1 (en) Encrypting data using time stamps
GB2384402A (en) Secure data transmission links
CN104836784B (en) A kind of information processing method, client and server
CN111614621B (en) Internet of things communication method and system
CN111181723B (en) Method and device for offline security authentication between Internet of things devices
KR102017758B1 (en) Health device, gateway device and method for securing protocol using the same
CN111699706B (en) Master-slave system for communication via bluetooth low energy connection
CN113452660B (en) Communication method of mesh network and cloud server, mesh network system and node device thereof
KR20210124368A (en) End-to-end double ratchet encryption using epoch key exchange
CN114172745A (en) Internet of things security protocol system
KR101481403B1 (en) Data certification and acquisition method for vehicle
WO2022161369A1 (en) Security management information processing method and apparatus for optical transport network
CN110049045B (en) Safety certification system for power line carrier
US20050086481A1 (en) Naming of 802.11 group keys to allow support of multiple broadcast and multicast domains
CN114142995B (en) Key security distribution method and device for block chain relay communication network
US11088835B1 (en) Cryptographic module to generate cryptographic keys from cryptographic key parts
CN106982115B (en) Synchronization method and system of block cipher mode

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant