CN111917790A - Hybrid encryption method for Internet of things security - Google Patents

Hybrid encryption method for Internet of things security Download PDF

Info

Publication number
CN111917790A
CN111917790A CN202010794304.5A CN202010794304A CN111917790A CN 111917790 A CN111917790 A CN 111917790A CN 202010794304 A CN202010794304 A CN 202010794304A CN 111917790 A CN111917790 A CN 111917790A
Authority
CN
China
Prior art keywords
key
node
opensll
data
public key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202010794304.5A
Other languages
Chinese (zh)
Inventor
钱承山
宗文杰
孙宁
毛伟民
王彭辉
赵贤
茹清晨
蒋丹阳
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nanjing University of Information Science and Technology
Original Assignee
Nanjing University of Information Science and Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nanjing University of Information Science and Technology filed Critical Nanjing University of Information Science and Technology
Priority to CN202010794304.5A priority Critical patent/CN111917790A/en
Publication of CN111917790A publication Critical patent/CN111917790A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/06Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/045Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H04L9/3066Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Mathematical Physics (AREA)
  • Pure & Applied Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Mathematical Optimization (AREA)
  • Mathematical Analysis (AREA)
  • General Physics & Mathematics (AREA)
  • Algebra (AREA)
  • Computer And Data Communications (AREA)

Abstract

The invention discloses a hybrid encryption method for the security of the Internet of things, which combines an ECC encryption algorithm and a D-H key exchange algorithm and comprises the following steps: generating an ECC public key and a private key: applying a secure socket layer password library OpenSLL, and obtaining and selecting an elliptic curve in the OpenSLL through an API function; generating a key parameter g, and generating a corresponding public key and a corresponding private key according to the key parameter g; ECC signature and signature verification: an ECSSA _ sign () function in OpenSLL is used for completing a data signature function, and an ECSSA _ verify () function is used for completing verification of a corresponding data signature in OpenSLL so as to ensure that data is not modified in the transmission process; generation of shared session key: and acquiring the public key data of the opposite party through a D-H secret key exchange algorithm, and generating respective session keys at the two nodes. The invention improves the network transmission safety performance.

Description

Hybrid encryption method for Internet of things security
Technical Field
The invention belongs to the technical field of network security, and particularly relates to a hybrid encryption method for the security of an Internet of things.
Background
The internet of things is a network which connects any article with the internet by using Radio Frequency Identification (RFID), a sensor, an infrared sensor, a global positioning system, a laser scanner and other information acquisition devices according to an agreed protocol, and performs information exchange and communication to realize intelligent Identification, positioning, tracking, monitoring and management. The market of the Internet of things is rapidly developed, the number of terminals is greatly increased, potential safety hazards are large, and the safety links in the industrial chain of the Internet of things are low in percentage. The internet of things business goes deep into a plurality of industries, the life of people is influenced in all directions, and corresponding safety problems can bring serious threats even including life and property safety.
The safety of the Internet of things means that hardware, software and data in the system of the Internet of things are protected and are not damaged, changed and leaked due to accidental or malicious reasons, the Internet of things system can continuously, reliably and normally operate, and the service of the Internet of things is not interrupted. The internet of things security comprises all technical means or management means for solving or relieving security threats existing in the internet of things network technology application process, and also comprises the security threats per se and related activities. The security threat and the security technology of the internet of things are the most basic expression of the meaning of network security.
At present, many security problems still exist in nodes of the internet of things and need to be solved urgently.
Disclosure of Invention
Aiming at the defects in the prior art, the invention provides an encryption algorithm combining an asymmetric encryption algorithm and a D-H key exchange algorithm to encrypt data, thereby solving the safety problem existing in the node of the Internet of things. The internet of things nodes also use transport layer security protocols to create secure connections to the cloud. But to realize real security, the nodes of the internet of things must also obtain the security of an application layer. This means that not just the communication pipe, the node itself needs to be authenticated. In addition to channel authentication, the application layer should establish encryption and data integrity checking mechanisms to protect data flowing through the pipe.
In order to achieve the purpose, the invention adopts the following technical scheme:
a mixed encryption method for the security of the Internet of things is characterized in that an ECC encryption algorithm and a D-H key exchange algorithm are combined, and the steps are as follows:
s1, generating an ECC public key and a private key: applying a secure socket layer password library OpenSLL, and obtaining and selecting an elliptic curve in the OpenSLL through an API function; generating a key parameter g according to the selected elliptic curve, and generating a corresponding public key and a corresponding private key according to the obtained key parameter g;
s2, ECC signature and signature verification: an ECSSA _ sign () function in OpenSLL is used for completing a data signature function, and an ECSSA _ verify () function is used for completing verification of a corresponding data signature in OpenSLL so as to ensure that data is not modified in the transmission process;
s3, generation of shared session key: and acquiring the public key data of the opposite party through a D-H secret key exchange algorithm, and generating respective session keys at the two nodes.
In order to optimize the technical scheme, the specific measures adopted further comprise:
further, in step S1, the key parameter g contains basic parameters of the selected ellipse, including the name and radius of the elliptic curve.
Further, in step S1, generating a corresponding public key and a corresponding private key according to the obtained key parameter g specifically includes:
A. b is two nodes in the network, and the A node randomly generates a random number x1Node B randomly generates a random number x2;x1,x2Respectively corresponding to respective private keys as two nodes, order A2=x1*g,B2=x2*g,A2、B2Respectively correspondingly as two sectionsThe respective public keys of the points.
Further, step S3 includes: the A node obtains the public key data of the B node by inquiring the data stored in the block chain in the Raft server cluster.
Further, step S3 specifically includes:
when the node A obtains the public key B of the node B2Calculating H ═ x1*B2By its own private key x, by means of D-H key exchange1Public key B with exchanged node A2Obtaining a symmetric key H; obtaining A of A node by B node2Calculate H*=x2*A2Then exchanged by D-H secret key, with its own private key x2Public key A with exchanged node B2Get the symmetric key H*
Further, in step S3, a symmetric session key is determined by the function ECDH _ computer _ key () in OpenSLL.
The invention has the beneficial effects that: the combination of the ECC encryption algorithm and the D-H key exchange algorithm can improve the network transmission security. The exchanged secret key is a public key in a secret key pair generated by an asymmetric cryptographic algorithm such as ECC (error correction code) and the like, and each node of the private key is independently stored and is not exposed to anyone, so that the communication safety is ensured; it has been ensured that the identity of all visitors entering the network is more authentic.
Drawings
FIG. 1: the hybrid encryption algorithm program flow chart of the invention.
FIG. 2: the schematic diagram of the Diffie-Hellman key exchange method in the hybrid encryption method is disclosed.
FIG. 3: the ECC algorithm program flow chart in the hybrid encryption method of the invention.
Detailed Description
The present invention will now be described in further detail with reference to the accompanying drawings.
It should be noted that the terms "upper", "lower", "left", "right", "front", "back", etc. used in the present invention are for clarity of description only, and are not intended to limit the scope of the present invention, and the relative relationship between the terms and the terms is not limited by the technical contents of the essential changes.
The invention provides a hybrid encryption method for the security of the Internet of things, which combines an ECC encryption algorithm and a D-H key exchange algorithm and comprises the following steps:
s1, generating an ECC public key and a private key: the application security socket layer password library OpenSLL is characterized in that on a computer network, OpenSSL is a software library package of an open source code, and an application program can use the package to carry out security communication, so that eavesdropping is avoided, and the identity of a connector at the other end is confirmed. A plurality of elliptic curves exist in OpenSLL, firstly, the elliptic curves in the OpenSLL are obtained through an API function, and one elliptic curve is selected; and generating a key parameter g according to the selected elliptic curve, wherein g contains some basic parameters of the ellipse, such as the name, radius and the like of the elliptic curve. And generating a corresponding public key and a corresponding private key according to the acquired key parameter g.
ECC algorithm principle: ECC is also called elliptic curve cryptography algorithm. The method is a public key cryptographic algorithm based on a mathematical elliptic curve. Let l be an integer greater than 3, in the elliptic curve y2=x3+ dx + e is formed by a homography-based y2=x3A solution set of + dx + emodp (a, b) and o as an infinity point, and 4d3+27e2Constant not equal to 0mod l. l1=(a1,b1) And l2=(a2,b2) Are two points on the elliptic curve, resulting from the addition and subtraction operations that define the elliptic curve:
Figure BDA0002624886870000031
from the above formula, it can be obtained that two points on the ellipse are added and also on the ellipse, so the following equation can be obtained: kl + l + … + l o, k being the number of l. From k and point l, point o can be found, but it is difficult if it is known that o and l find k. This is called the discrete logarithm problem of the point group on the elliptic curve. ECC is an algorithm derived from this, i.e., k as the private key and o as the public key.
S2, ECC signature and signature verification: and then, the ECSSA _ verify () function is used in the OpenSLL to complete the verification of the corresponding data signature so as to ensure that the data is not modified in the transmission process.
S3, generation of shared session key: and acquiring the public key data of the opposite party through a D-H secret key exchange algorithm, and generating respective session keys at the two nodes.
D-H algorithm principle: the D-H algorithm is not used for encryption or decryption, but for transmission and distribution of keys. It is very secure since it is very difficult to compute discrete logarithms over a finite field. For example, two people negotiate on an insecure network, one is a and one is B, to confirm the shared secret used for the conversation. A and B firstly define a very large prime number x and its original root y, then A randomly generates a number a only known by itself, and A is calculated1=yamod x and A1Sending the data to the B; b randomly generating a number B only known by self, and calculating B1=ybmod x, and B1Sending the data to A; then A calculates k ═ B1 amod x; b calculating k*=A1 bmodx. The following formula is derived according to the combination law of multiplication and exchange and multiplication:
k*=A1 bmod x=(yamod x)bmodx=yabmod x=(ybmod x)amodx=B1 amod x=k
even if x, y, A are obtained by eavesdropper in the whole process1、B1These four data, but if the key k is wanted, the discrete logarithms a and b must first be calculated. The values of a, b and x are larger during the call, otherwise, all values of modx may be obtained by enumeration.
According to the D-H key exchange principle, if a party in communication wants to generate a session key of this time, public key data of the other party is acquired. For example, when the node a communicates with the node B, the node a obtains public key data of the node B by querying data stored in a block chain in the Raft server cluster, and finally generates a session key at the node a. The principle of the node B is the same as that of the node a. The symmetric session key is determined in OpenSLL by the function ECDH _ computer _ key ().
The present invention proposes ECDH, where EC is in the meaning of "encapsulating curves", DH is in the meaning of "Diffie-Hellman", and ECDH is a combination of ECC and D-H.
In the embodiment of the present invention, during key exchange, generating a corresponding public key and a corresponding private key according to the obtained key parameter g specifically includes: A. and B is two nodes in the network, and both have elliptic curve base points g. Node A randomly generates random number x1Node B randomly generates a random number x2;x1,x2Respectively corresponding to respective private keys as two nodes, order A2=x1*g,B2=x2*g,A2、B2And the public keys are respectively corresponding to the two nodes. When A is to A2When it is transmitted to B and B sends B2When the X is transmitted to A, the X is stolen by an eavesdropper but the problem of logarithm in ECC is difficult to solve, so that the eavesdropper cannot calculate the X1x2. When A obtains B of B2Can calculate H ═ x1*B2I.e. by exchanging its own private key x by means of a D-H key1Public key B with A2A symmetric key H is obtained. Obtaining A of A by the same way as B2Calculate H*=x2*A2Then exchange its own private key x by D-H key2Public key A with B2A symmetric key H is obtained*
The mathematical formula is used to deduce:
H=x1*B2=x1*(x2*g)=(x1*x2)*g=(x2*x1)*g=x2*(x1*g)=x2*A2=H*
i.e., A, B, both nodes get the same key.
The use of the ECC encryption algorithm in combination with the D-H key exchange algorithm improves security. The exchanged secret key is a public key in a secret key pair generated by an asymmetric cryptographic algorithm such as ECC (error correction code) and the like, and each node of the private key is independently stored and is not exposed to anyone, so that the communication safety is ensured; the invention can ensure that the identities of all visitors entering the network are more authentic.
The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above-mentioned embodiments, and all technical solutions belonging to the idea of the present invention belong to the protection scope of the present invention. It should be noted that modifications and embellishments within the scope of the invention may be made by those skilled in the art without departing from the principle of the invention.

Claims (6)

1. A hybrid encryption method for the security of the Internet of things is characterized in that the hybrid encryption method is formed by combining an ECC encryption algorithm and a D-H key exchange algorithm and comprises the following steps:
s1, generating an ECC public key and a private key: applying a secure socket layer password library OpenSLL, and obtaining and selecting an elliptic curve in the OpenSLL through an API function; generating a key parameter g according to the selected elliptic curve, and generating a corresponding public key and a corresponding private key according to the obtained key parameter g;
s2, ECC signature and signature verification: an ECSSA _ sign () function in OpenSLL is used for completing a data signature function, and an ECSSA _ verify () function is used for completing verification of a corresponding data signature in OpenSLL so as to ensure that data is not modified in the transmission process;
s3, generation of shared session key: and acquiring the public key data of the opposite party through a D-H secret key exchange algorithm, and generating respective session keys at the two nodes.
2. The hybrid encryption method according to claim 1, wherein in step S1, the key parameter g contains basic parameters of the selected ellipse, including the name and radius of the elliptic curve.
3. The hybrid encryption method according to claim 1, wherein in step S1, the generation of the corresponding public key and private key according to the obtained key parameter g specifically comprises:
A. b is two nodes in the network, and the A node randomly generates a random number x1Node B randomly generates a random number x2;x1,x2Respectively corresponding to respective private keys as two nodes, order A2=x1*g,B2=x2*g,A2、B2And the public keys are respectively corresponding to the two nodes.
4. The hybrid encryption method according to claim 3, wherein step S3 includes: the A node obtains the public key data of the B node by inquiring the data stored in the block chain in the Raft server cluster.
5. The hybrid encryption method according to claim 4, wherein the step S3 specifically includes:
when the node A obtains the public key B of the node B2Calculating H ═ x1*B2By its own private key x, by means of D-H key exchange1Public key B with exchanged node A2Obtaining a symmetric key H; obtaining A of A node by B node2Calculate H*=x2*A2Then exchanged by D-H secret key, with its own private key x2Public key A with exchanged node B2Get the symmetric key H*
6. The hybrid encryption method according to claim 1, wherein in step S3, a symmetric session key is determined by a function ECDH _ compute _ key () in OpenSLL.
CN202010794304.5A 2020-08-10 2020-08-10 Hybrid encryption method for Internet of things security Pending CN111917790A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202010794304.5A CN111917790A (en) 2020-08-10 2020-08-10 Hybrid encryption method for Internet of things security

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202010794304.5A CN111917790A (en) 2020-08-10 2020-08-10 Hybrid encryption method for Internet of things security

Publications (1)

Publication Number Publication Date
CN111917790A true CN111917790A (en) 2020-11-10

Family

ID=73283407

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202010794304.5A Pending CN111917790A (en) 2020-08-10 2020-08-10 Hybrid encryption method for Internet of things security

Country Status (1)

Country Link
CN (1) CN111917790A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114039727A (en) * 2021-12-09 2022-02-11 施耐德电气(中国)有限公司 Data transmission method and device, intelligent terminal and gateway equipment

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080130895A1 (en) * 2006-10-25 2008-06-05 Spyrus, Inc. Method and System for Deploying Advanced Cryptographic Algorithms
CN105812142A (en) * 2016-03-10 2016-07-27 西京学院 Strong forward-secure digital signature method for combining fingerprint, ECDH and ECC
CN109687957A (en) * 2018-12-26 2019-04-26 无锡泛太科技有限公司 A kind of RFID authentication method of the public-key cryptography scheme based on ellipse-hyperbolic

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080130895A1 (en) * 2006-10-25 2008-06-05 Spyrus, Inc. Method and System for Deploying Advanced Cryptographic Algorithms
CN105812142A (en) * 2016-03-10 2016-07-27 西京学院 Strong forward-secure digital signature method for combining fingerprint, ECDH and ECC
CN109687957A (en) * 2018-12-26 2019-04-26 无锡泛太科技有限公司 A kind of RFID authentication method of the public-key cryptography scheme based on ellipse-hyperbolic

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
李明: "IPSec中IKE协议的分析和ECC算法的改进", 《中国优秀博硕士学位论文全文数据库(硕士)信息科技辑》 *
赵艳杰: "基于区块链的物联网信息安全传输与存储研究", 《中国优秀博硕士学位论文全文数据库(硕士)信息科技辑》 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114039727A (en) * 2021-12-09 2022-02-11 施耐德电气(中国)有限公司 Data transmission method and device, intelligent terminal and gateway equipment

Similar Documents

Publication Publication Date Title
US10116443B1 (en) Pairing verification in supersingular isogeny-based cryptographic protocols
Saqib et al. A lightweight three factor authentication framework for IoT based critical applications
US10313124B1 (en) Public key validation in supersingular isogeny-based cryptographic protocols
US9106410B2 (en) Identity based authenticated key agreement protocol
EP3005608B1 (en) Authentication
Li et al. iTLS: Lightweight transport-layer security protocol for IoT with minimal latency and perfect forward secrecy
Haakegaard et al. The elliptic curve diffie-hellman (ecdh)
CN108886468A (en) System and method for distributing the keying material and certificate of identity-based
CN114710275B (en) Cross-domain authentication and key negotiation method based on blockchain in Internet of things environment
US10630476B1 (en) Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems
CN104301108A (en) Signcryption method based from identity environment to certificateless environment
CN117155564A (en) Bidirectional encryption authentication system and method
Schmidt Requirements for password-authenticated key agreement (PAKE) schemes
Shen et al. A secure and practical RFID ownership transfer protocol based on Chebyshev polynomials
US10880278B1 (en) Broadcasting in supersingular isogeny-based cryptosystems
CN110809000B (en) Service interaction method, device, equipment and storage medium based on block chain network
CN111953489A (en) SM2 algorithm-based key exchange device and method for collecting service of power generation unit
CN111917790A (en) Hybrid encryption method for Internet of things security
CN101888383B (en) Method for implementing extensible trusted SSH
Lin et al. Research on authentication and key negotiation based on smart water environment
Islam et al. Improved remote login scheme based on ECC
Chattaraj et al. An efficient two-server authentication and key exchange protocol for accessing secure cloud services
Shekhawat et al. Quantum-resistance blockchain-assisted certificateless data authentication and key exchange scheme for the smart grid metering infrastructure
Xia et al. A Quantum-Resistant Identity Authentication and Key Agreement Scheme for UAV Networks Based on Kyber Algorithm
Momeni et al. An Energy-Efficient Multiple-Factor Authentication Protocol for Critical Infrastructure IoT Systems

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20201110

RJ01 Rejection of invention patent application after publication