CN109088728B - Electric power system debugging tool encrypted communication method based on shared secret key - Google Patents

Abstract

The invention discloses a method for encrypting communication of a power system debugging tool based on a shared secret key. The same secret key is used for communication in all communication environments under the existing secret key sharing mechanism, and the risk that a malicious attacker carries out reverse analysis to crack the secret key by acquiring a large number of communication samples exists. The invention presets a shared initialization key K_IntAnd a shared key set K_GAnd appointing the same encryption and corresponding decryption algorithms; in the communication process, the communication initiator and the communication receiver use the initialization key K in a mode of checking random numbers_IntImplementing a communication key K_TThe mechanism that the communication receiver designates and negotiates and confirms the communication key together realizes the method that the two parties use different shared keys for each communication, and improves the security of encrypted communication.

Description

Electric power system debugging tool encrypted communication method based on shared secret key

Technical Field

The invention belongs to the field of power system communication, and particularly relates to a power system debugging tool encryption communication method based on a shared key.

Background

In a communication protocol of a power system secondary equipment debugging tool, private plaintext transmission is often adopted, and the method is convenient for abnormal information diagnosis in use of the tool, but brings risks of information leakage in secondary equipment and has potential safety hazards.

In power system debugging tool encrypted communication, encrypted communication based on a shared key is a common communication method. According to the method, the two communication parties realize encrypted communication by sharing a preset symmetric key based on an agreed encryption algorithm. The method is simple to use and high in encryption efficiency, but the same key is used for communication with all devices, so that the risk that a malicious attacker carries out reverse analysis and key cracking by acquiring a large number of communication samples exists. Another encryption communication method is a communication mode based on an asymmetric key of a digital certificate, and the key of each communication is negotiated through the asymmetric key, so that the problem that the same key is used for each communication with different devices is solved; however, the algorithm of the asymmetric key method is complex, the execution efficiency is low, and the digital certificate needs to be downloaded before the first debugging, even the digital certificate needs to be managed and updated regularly, so that the maintenance and use cost is high.

Disclosure of Invention

The technical problem to be solved by the invention is as follows: the power system debugging tool encryption communication method based on the shared secret key solves the problem that a malicious attacker risks to crack the secret key by obtaining a large number of communication samples through reverse analysis because the same secret key is used for communication in all communication environments under the existing shared secret key mechanism, and achieves communication by using different shared secret keys each time based on a shared secret key group, so that the communication safety is improved, and the use is simple and reliable.

In order to achieve the purpose, the invention adopts the technical scheme that: a shared key based power system debugging tool encrypted communication method, comprising:

two communication parties agree to share an initial secret key K_IntAnd a key set K containing N set keys_GWherein N is more than or equal to 1; the two communication parties agree that the same encryption algorithm E (K, x) and the corresponding decryption algorithm are D (K, x), and the encryption and decryption satisfy x ≡ D (K, E (K, x)), wherein K is a secret key, and x is plaintext data;

the steps in the communication process are as follows:

step 1: communication initiator generates link request random number R_dAnd using the initial key K_IntEncryption with E (K)_Int，R_d) As a message T_{Req_C}A content sending communication link request;

step 2: the communication receiver passes R_d'＝D(K_Int,T_{Req_C}) Decryption of T_{Req_C}Obtaining a Link request random number R_d', randomly selecting a communication key K_TAnd generating a communication key authentication request random number R_d2And is combined withBy message I_{Rsp_C}Performing a communication link request response; communication key K_TIs K_GThe Tth group key is that T is more than or equal to 1 and less than or equal to N;

and step 3: communication initiator decipher message I_{Rsp_C}And after verifying the correctness of the connection request response message, generating a communication key verification random number R_d3And initiating a communication key K_TThe consistency verification request message T_{Req_V}；

And 4, step 4: decryption T of communication receiver_{Req_V}And verifies the negotiated communication key K_TAfter the correctness is reached, a message I of successful verification is sent_{OK_V}；

And 5: decryption I of communication sender_{OK_V}And verify I_{OK_V}The correctness of the test;

step 6: after the verification is passed, the two communication parties use K_TEncrypted communication is performed.

In addition to the above technical solution, the communication link request response message I_{Rsp_C}Has the structure of_{Rsp_C}＝E(K_Int,(R_d',T,R_d2) Where kit initial key, R)_d' is a decrypted link request random number, T is a group number of a key group corresponding to the communication key, R_d2A random number is requested for communication key authentication.

In addition to the above technical solution, a communication link request message I_{Rsp_C}The verification method comprises the following steps: by (R)_d”,T',R_d2')＝D(K_Int,I_{Rsp_C}) Decryption I_{Rsp_C}Obtaining the random number R of the link request after decrypting the response request message_d", the decrypted communication key group number T', and the decrypted communication key verification request random number R_d2'; if R is_d”＝＝R_dAnd the communication initiator judges that the communication link request message is correct.

In addition to the above technical solution, the communication key K_TThe consistency verification request message T_{Req_V}Has a structure of T_{Req_V}＝E(K_T',(R_d2',R_d3) In which K) is_T'is a communication key corresponding to the decrypted communication key group number T', R_d2' request random number for decrypted key authentication, R_d3The random number is verified for the newly generated communication key of the communication initiator.

In addition to the above technical solution, the communication key consistency verification request message T_{Req_V}The correctness verification method comprises the following steps: by (R)_d2”,R_d3')＝D(K_T,T_{Req_V}) Decryption of T_{Req_V}Obtaining the decrypted communication key verification request random number R_d2", the decrypted communication key verifies the random number R_d3'; if R is_d2”＝＝R_d2And the communication receiver judges that the communication key consistency verification request message is correct.

As a supplement to the above technical solution, the communication key consistency verification success message I_{OK_V}Has the structure of_{OK_V}＝E(K_T,R_d3') wherein R is_d3' to decrypt T_{Req_V}The subsequent communication key verifies the random number.

As a supplement to the above technical solution, the communication key consistency verification success message I_{OK_V}The correctness verification method comprises the following steps: by R_d3”＝D(K_T',T_{OK_V}) Decryption I_{OK_V}Obtaining the decrypted communication key verification random number R_d3"; if R is_d3”＝＝R_d3Then the communication key negotiation is considered to be successful, at this moment K_T'≡K_T。

The invention realizes a communication method that different symmetric keys are used in each communication and the keys are randomly designated by a communication receiver under a negotiation authentication mechanism based on random numbers by setting an initial key pair and a symmetric key group. The invention solves the problem that the traditional symmetric key communication uses the same key each time, and has the characteristics of no need of configuration, simple use and high encryption efficiency.

Drawings

Fig. 1 is a flowchart of an encrypted communication method for a power system debugging tool based on a shared key according to the present invention.

Detailed Description

The method of the present invention is further described in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the invention and can implement it, but the examples are not intended to limit the invention.

The embodiment provides an encrypted communication method for a power system debugging tool based on a shared key, as shown in fig. 1, the steps are as follows:

the two communication parties agree to adopt an AES-256 encryption algorithm, and the key length is 256 bits (32 bytes); both communication parties share 256-bit initial secret key K_IntAnd a key set K containing 1024 sets of 256-bit shared keys_G(ii) a Communication key K_TIs K_GThe Tth (T is more than or equal to 1 and less than or equal to 1024) group key; the encryption process of the encryption algorithm AES-256 is marked as E_AES-256(K, x), the decryption process is marked D_AES-256(K, x), where K is a 256-bit key and x is the minimum length of the plaintext to be encrypted and decrypted, which is 256 bits.

In the communication process:

1) communication initiator generates 256bit link request random number R_dAnd using the initial key K_IntEncryption with E_AES-256(K_Int，R_d) As a message T_{Req_C}The content initiates a communication link request;

2) initial key K for communication receiver_IntDecryption of T_{Req_C}I.e. R_d'＝D_AES-256(K_Int,T_{Req_C}) And obtaining the random number R of the link request after decryption_d' (256 bits); and randomly selecting K from the shared secret key group_TGenerating 256-bit communication key verification request random number R as communication key_d2；

3) The communication receiver requests the random number R by the decrypted connection_d', communication key K_TGroup number T, communication key authentication request random number R_d2As plaintext to initialize the key K_IntEncrypting, constructing and sending communication link request response message with structure I_{Rsp_C}＝E_AES-256(K_Int,(R_d',T,R_d2))；

4) Initialization key K for communication initiator_IntDecipher message I_{Rsp_C}I.e. (R)_d”,T',R_d2')＝D(K_Int,I_{Rsp_C}). After decryption, obtain I_{Rsp_C}Returned link request random number R_d", the decrypted communication key group number T', and the decrypted communication key verification request random number R_d2'; if R is_d”＝＝R_dJudging that the communication link request message is correct;

5) after the communication initiator verifies the correctness of the communication link request message, the key of the group number T' is determined as the communication key K_T', and generates a 256-bit communication key verification random number R_d3(ii) a Authentication of a request random number R with a communication key_d2', random number of communication key verification R_d3For plaintext input, by K_T' construction of communication key consistency verification request message as key and transmission, its structure is T_{Req_V}＝E_AES-256(K_T',(R_d2',R_d3))。

6) Communication key K for communication receiver_TDecryption of T_{Req_V}I.e. (R)_d2”,R_d3')＝D_AES-256(K_T,T_{Req_V}) Obtaining the decrypted communication key verification request random number R_d2", the decrypted communication key verifies the random number R_d3'; if R is_d2”＝＝R_d2Then, the communication key consistency verification request message is judged to be correct.

7) After the communication receiver verifies the correctness of the communication key consistency verification request message, the random number R is verified by the decrypted communication key_d3' as plaintext input, with a communication key K_TThe message which is successfully verified by encrypting and constructing the consistency of the communication key is sent, and the structure of the message is as follows: i is_{OK_V}＝E_AES-256(K_T,R_d3')。

8) Secret key K for communication receiver_T' decryption consistency verification success message I_{OK_V}I.e. R_d3”＝D_AES-256(K_T',T_{OK_V}) Obtaining the decrypted communication key verification random number R_d3"; if R is_d3”＝＝R_d3If the consistency verification is successful, the message I is considered to be a consistency verification success message_{OK_V}Successfully verified and the communication key agreement is determined to be successful, i.e. K_T'≡K_T。

9) Communication receiver authentication I_{OK_V}After passing, the two communication parties use K_TEncrypted communication is performed.

The foregoing embodiments have described some of the details of the present invention, but are not to be construed as limiting the invention, and those skilled in the art may make variations, modifications, substitutions and alterations herein without departing from the principles and spirit of the invention.

Claims (4)

1. A power system debugging tool encryption communication method based on a shared key is characterized by comprising the following steps:

two communication parties agree to share an initial secret key K_IntAnd a key set K containing N set keys_GWherein N is more than or equal to 1; the two communication parties agree that the same encryption algorithm E (K, x) and the corresponding decryption algorithm are D (K, x), and the encryption and decryption satisfy x ≡ D (K, E (K, x)), wherein K is a secret key, and x is plaintext data;

the steps in the communication process are as follows:

step 1: communication initiator generates link request random number R_dAnd using the initial key K_IntEncryption with E (K)_Int，R_d) As a message T_{Req_C}A content sending communication link request;

step 2: the communication receiver passes R_d'＝D(K_Int,T_{Req_C}) Decryption of T_{Req_C}Obtaining a Link request random number R_d', randomly selecting a communication key K_TAnd generating a communication key authentication request random number R_d2And by message I_{Rsp_C}Performing a communication link request response; communication key K_TIs K_GThe Tth group key is that T is more than or equal to 1 and less than or equal to N;

and step 3: communication initiator decipher message I_{Rsp_C}And after verifying the correctness of the connection request response message, generating a communication key verification random number R_d3And initiating a communication key K_TThe consistency verification request message T_{Req_V}；

And 4, step 4: decryption T of communication receiver_{Req_V}And verifies the negotiated communication key K_TAfter the correctness is reached, a message I of successful verification is sent_{OK_V}；

And 5: decryption I of communication sender_{OK_V}And verify I_{OK_V}The correctness of the test;

step 6: after the verification is passed, the two communication parties use K_TCarrying out encrypted communication;

communication link request response message I_{Rsp_C}Has the structure of_{Rsp_C}＝E(K_Int,(R_d',T,R_d2) In which K) is_IntInitial secret key, R_d' is a decrypted link request random number, T is a group number of a key group corresponding to the communication key, R_d2Requesting a random number for communication key authentication;

communication key K_TThe consistency verification request message T_{Req_V}Has a structure of T_{Req_V}＝E(K_T',(R_d2',R_d3) In which K) is_T'is a communication key corresponding to the decrypted communication key group number T', R_d2' request random number for decrypted key authentication, R_d3Verifying a random number for a newly generated communication key of a communication initiator;

communication key consistency verification success message I_{OK_V}Has the structure of_{OK_V}＝E(K_T,R_d3') wherein R is_d3' to decrypt T_{Req_V}The subsequent communication key verifies the random number.

2. The encrypted communication method for the power system debugging tool based on the shared secret key as claimed in claim 1, wherein: communication link request message I_{Rsp_C}The verification method comprises the following steps: by (R)_d”,T',R_d2')＝D(K_Int,I_{Rsp_C}) Decryption I_{Rsp_C}Obtaining the random number R of the link request after decrypting the response request message_d", the decrypted communication key group number T', and the decrypted communication key verification request random number R_d2'; if R is_d”＝＝R_dThe communication initiator determines the communication link requestThe message is solved correctly.

3. The encrypted communication method for the power system debugging tool based on the shared secret key as claimed in claim 1, wherein: communication key consistency verification request message T_{Req_V}The correctness verification method comprises the following steps: by (R)_d2”,R_d3')＝D(K_T,T_{Req_V}) Decryption of T_{Req_V}Obtaining the decrypted communication key verification request random number R_d2", the decrypted communication key verifies the random number R_d3'; if R is_d2”＝＝R_d2And the communication receiver judges that the communication key consistency verification request message is correct.

4. The encrypted communication method for the power system debugging tool based on the shared secret key as claimed in claim 1, wherein: communication key consistency verification success message I_{OK_V}The correctness verification method comprises the following steps: by R_d3”＝D(K_T',T_{OK_V}) Decryption I_{OK_V}Obtaining the decrypted communication key verification random number R_d3"; if R is_d3”＝＝R_d3Then the communication key negotiation is considered to be successful, at this moment K_T'≡K_T。

Images