CN111917790A - Hybrid encryption method for Internet of things security - Google Patents
Hybrid encryption method for Internet of things security Download PDFInfo
- Publication number
- CN111917790A CN111917790A CN202010794304.5A CN202010794304A CN111917790A CN 111917790 A CN111917790 A CN 111917790A CN 202010794304 A CN202010794304 A CN 202010794304A CN 111917790 A CN111917790 A CN 111917790A
- Authority
- CN
- China
- Prior art keywords
- key
- node
- opensll
- data
- public key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 18
- 238000012795 verification Methods 0.000 claims abstract description 8
- 230000005540 biological transmission Effects 0.000 claims abstract description 7
- 238000004891 communication Methods 0.000 description 6
- 238000012937 correction Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- FFBHFFJDDLITSX-UHFFFAOYSA-N benzyl N-[2-hydroxy-4-(3-oxomorpholin-4-yl)phenyl]carbamate Chemical compound OC1=C(NC(=O)OCC2=CC=CC=C2)C=CC(=C1)N1CCOCC1=O FFBHFFJDDLITSX-UHFFFAOYSA-N 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/045—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L9/3066—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Mathematical Physics (AREA)
- Pure & Applied Mathematics (AREA)
- Physics & Mathematics (AREA)
- Mathematical Optimization (AREA)
- Mathematical Analysis (AREA)
- General Physics & Mathematics (AREA)
- Algebra (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention discloses a hybrid encryption method for the security of the Internet of things, which combines an ECC encryption algorithm and a D-H key exchange algorithm and comprises the following steps: generating an ECC public key and a private key: applying a secure socket layer password library OpenSLL, and obtaining and selecting an elliptic curve in the OpenSLL through an API function; generating a key parameter g, and generating a corresponding public key and a corresponding private key according to the key parameter g; ECC signature and signature verification: an ECSSA _ sign () function in OpenSLL is used for completing a data signature function, and an ECSSA _ verify () function is used for completing verification of a corresponding data signature in OpenSLL so as to ensure that data is not modified in the transmission process; generation of shared session key: and acquiring the public key data of the opposite party through a D-H secret key exchange algorithm, and generating respective session keys at the two nodes. The invention improves the network transmission safety performance.
Description
Technical Field
The invention belongs to the technical field of network security, and particularly relates to a hybrid encryption method for the security of an Internet of things.
Background
The internet of things is a network which connects any article with the internet by using Radio Frequency Identification (RFID), a sensor, an infrared sensor, a global positioning system, a laser scanner and other information acquisition devices according to an agreed protocol, and performs information exchange and communication to realize intelligent Identification, positioning, tracking, monitoring and management. The market of the Internet of things is rapidly developed, the number of terminals is greatly increased, potential safety hazards are large, and the safety links in the industrial chain of the Internet of things are low in percentage. The internet of things business goes deep into a plurality of industries, the life of people is influenced in all directions, and corresponding safety problems can bring serious threats even including life and property safety.
The safety of the Internet of things means that hardware, software and data in the system of the Internet of things are protected and are not damaged, changed and leaked due to accidental or malicious reasons, the Internet of things system can continuously, reliably and normally operate, and the service of the Internet of things is not interrupted. The internet of things security comprises all technical means or management means for solving or relieving security threats existing in the internet of things network technology application process, and also comprises the security threats per se and related activities. The security threat and the security technology of the internet of things are the most basic expression of the meaning of network security.
At present, many security problems still exist in nodes of the internet of things and need to be solved urgently.
Disclosure of Invention
Aiming at the defects in the prior art, the invention provides an encryption algorithm combining an asymmetric encryption algorithm and a D-H key exchange algorithm to encrypt data, thereby solving the safety problem existing in the node of the Internet of things. The internet of things nodes also use transport layer security protocols to create secure connections to the cloud. But to realize real security, the nodes of the internet of things must also obtain the security of an application layer. This means that not just the communication pipe, the node itself needs to be authenticated. In addition to channel authentication, the application layer should establish encryption and data integrity checking mechanisms to protect data flowing through the pipe.
In order to achieve the purpose, the invention adopts the following technical scheme:
a mixed encryption method for the security of the Internet of things is characterized in that an ECC encryption algorithm and a D-H key exchange algorithm are combined, and the steps are as follows:
s1, generating an ECC public key and a private key: applying a secure socket layer password library OpenSLL, and obtaining and selecting an elliptic curve in the OpenSLL through an API function; generating a key parameter g according to the selected elliptic curve, and generating a corresponding public key and a corresponding private key according to the obtained key parameter g;
s2, ECC signature and signature verification: an ECSSA _ sign () function in OpenSLL is used for completing a data signature function, and an ECSSA _ verify () function is used for completing verification of a corresponding data signature in OpenSLL so as to ensure that data is not modified in the transmission process;
s3, generation of shared session key: and acquiring the public key data of the opposite party through a D-H secret key exchange algorithm, and generating respective session keys at the two nodes.
In order to optimize the technical scheme, the specific measures adopted further comprise:
further, in step S1, the key parameter g contains basic parameters of the selected ellipse, including the name and radius of the elliptic curve.
Further, in step S1, generating a corresponding public key and a corresponding private key according to the obtained key parameter g specifically includes:
A. b is two nodes in the network, and the A node randomly generates a random number x1Node B randomly generates a random number x2;x1,x2Respectively corresponding to respective private keys as two nodes, order A2=x1*g,B2=x2*g,A2、B2Respectively correspondingly as two sectionsThe respective public keys of the points.
Further, step S3 includes: the A node obtains the public key data of the B node by inquiring the data stored in the block chain in the Raft server cluster.
Further, step S3 specifically includes:
when the node A obtains the public key B of the node B2Calculating H ═ x1*B2By its own private key x, by means of D-H key exchange1Public key B with exchanged node A2Obtaining a symmetric key H; obtaining A of A node by B node2Calculate H*=x2*A2Then exchanged by D-H secret key, with its own private key x2Public key A with exchanged node B2Get the symmetric key H*。
Further, in step S3, a symmetric session key is determined by the function ECDH _ computer _ key () in OpenSLL.
The invention has the beneficial effects that: the combination of the ECC encryption algorithm and the D-H key exchange algorithm can improve the network transmission security. The exchanged secret key is a public key in a secret key pair generated by an asymmetric cryptographic algorithm such as ECC (error correction code) and the like, and each node of the private key is independently stored and is not exposed to anyone, so that the communication safety is ensured; it has been ensured that the identity of all visitors entering the network is more authentic.
Drawings
FIG. 1: the hybrid encryption algorithm program flow chart of the invention.
FIG. 2: the schematic diagram of the Diffie-Hellman key exchange method in the hybrid encryption method is disclosed.
FIG. 3: the ECC algorithm program flow chart in the hybrid encryption method of the invention.
Detailed Description
The present invention will now be described in further detail with reference to the accompanying drawings.
It should be noted that the terms "upper", "lower", "left", "right", "front", "back", etc. used in the present invention are for clarity of description only, and are not intended to limit the scope of the present invention, and the relative relationship between the terms and the terms is not limited by the technical contents of the essential changes.
The invention provides a hybrid encryption method for the security of the Internet of things, which combines an ECC encryption algorithm and a D-H key exchange algorithm and comprises the following steps:
s1, generating an ECC public key and a private key: the application security socket layer password library OpenSLL is characterized in that on a computer network, OpenSSL is a software library package of an open source code, and an application program can use the package to carry out security communication, so that eavesdropping is avoided, and the identity of a connector at the other end is confirmed. A plurality of elliptic curves exist in OpenSLL, firstly, the elliptic curves in the OpenSLL are obtained through an API function, and one elliptic curve is selected; and generating a key parameter g according to the selected elliptic curve, wherein g contains some basic parameters of the ellipse, such as the name, radius and the like of the elliptic curve. And generating a corresponding public key and a corresponding private key according to the acquired key parameter g.
ECC algorithm principle: ECC is also called elliptic curve cryptography algorithm. The method is a public key cryptographic algorithm based on a mathematical elliptic curve. Let l be an integer greater than 3, in the elliptic curve y2=x3+ dx + e is formed by a homography-based y2=x3A solution set of + dx + emodp (a, b) and o as an infinity point, and 4d3+27e2Constant not equal to 0mod l. l1=(a1,b1) And l2=(a2,b2) Are two points on the elliptic curve, resulting from the addition and subtraction operations that define the elliptic curve:
from the above formula, it can be obtained that two points on the ellipse are added and also on the ellipse, so the following equation can be obtained: kl + l + … + l o, k being the number of l. From k and point l, point o can be found, but it is difficult if it is known that o and l find k. This is called the discrete logarithm problem of the point group on the elliptic curve. ECC is an algorithm derived from this, i.e., k as the private key and o as the public key.
S2, ECC signature and signature verification: and then, the ECSSA _ verify () function is used in the OpenSLL to complete the verification of the corresponding data signature so as to ensure that the data is not modified in the transmission process.
S3, generation of shared session key: and acquiring the public key data of the opposite party through a D-H secret key exchange algorithm, and generating respective session keys at the two nodes.
D-H algorithm principle: the D-H algorithm is not used for encryption or decryption, but for transmission and distribution of keys. It is very secure since it is very difficult to compute discrete logarithms over a finite field. For example, two people negotiate on an insecure network, one is a and one is B, to confirm the shared secret used for the conversation. A and B firstly define a very large prime number x and its original root y, then A randomly generates a number a only known by itself, and A is calculated1=yamod x and A1Sending the data to the B; b randomly generating a number B only known by self, and calculating B1=ybmod x, and B1Sending the data to A; then A calculates k ═ B1 amod x; b calculating k*=A1 bmodx. The following formula is derived according to the combination law of multiplication and exchange and multiplication:
k*=A1 bmod x=(yamod x)bmodx=yabmod x=(ybmod x)amodx=B1 amod x=k
even if x, y, A are obtained by eavesdropper in the whole process1、B1These four data, but if the key k is wanted, the discrete logarithms a and b must first be calculated. The values of a, b and x are larger during the call, otherwise, all values of modx may be obtained by enumeration.
According to the D-H key exchange principle, if a party in communication wants to generate a session key of this time, public key data of the other party is acquired. For example, when the node a communicates with the node B, the node a obtains public key data of the node B by querying data stored in a block chain in the Raft server cluster, and finally generates a session key at the node a. The principle of the node B is the same as that of the node a. The symmetric session key is determined in OpenSLL by the function ECDH _ computer _ key ().
The present invention proposes ECDH, where EC is in the meaning of "encapsulating curves", DH is in the meaning of "Diffie-Hellman", and ECDH is a combination of ECC and D-H.
In the embodiment of the present invention, during key exchange, generating a corresponding public key and a corresponding private key according to the obtained key parameter g specifically includes: A. and B is two nodes in the network, and both have elliptic curve base points g. Node A randomly generates random number x1Node B randomly generates a random number x2;x1,x2Respectively corresponding to respective private keys as two nodes, order A2=x1*g,B2=x2*g,A2、B2And the public keys are respectively corresponding to the two nodes. When A is to A2When it is transmitted to B and B sends B2When the X is transmitted to A, the X is stolen by an eavesdropper but the problem of logarithm in ECC is difficult to solve, so that the eavesdropper cannot calculate the X1x2. When A obtains B of B2Can calculate H ═ x1*B2I.e. by exchanging its own private key x by means of a D-H key1Public key B with A2A symmetric key H is obtained. Obtaining A of A by the same way as B2Calculate H*=x2*A2Then exchange its own private key x by D-H key2Public key A with B2A symmetric key H is obtained*。
The mathematical formula is used to deduce:
H=x1*B2=x1*(x2*g)=(x1*x2)*g=(x2*x1)*g=x2*(x1*g)=x2*A2=H*
i.e., A, B, both nodes get the same key.
The use of the ECC encryption algorithm in combination with the D-H key exchange algorithm improves security. The exchanged secret key is a public key in a secret key pair generated by an asymmetric cryptographic algorithm such as ECC (error correction code) and the like, and each node of the private key is independently stored and is not exposed to anyone, so that the communication safety is ensured; the invention can ensure that the identities of all visitors entering the network are more authentic.
The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above-mentioned embodiments, and all technical solutions belonging to the idea of the present invention belong to the protection scope of the present invention. It should be noted that modifications and embellishments within the scope of the invention may be made by those skilled in the art without departing from the principle of the invention.
Claims (6)
1. A hybrid encryption method for the security of the Internet of things is characterized in that the hybrid encryption method is formed by combining an ECC encryption algorithm and a D-H key exchange algorithm and comprises the following steps:
s1, generating an ECC public key and a private key: applying a secure socket layer password library OpenSLL, and obtaining and selecting an elliptic curve in the OpenSLL through an API function; generating a key parameter g according to the selected elliptic curve, and generating a corresponding public key and a corresponding private key according to the obtained key parameter g;
s2, ECC signature and signature verification: an ECSSA _ sign () function in OpenSLL is used for completing a data signature function, and an ECSSA _ verify () function is used for completing verification of a corresponding data signature in OpenSLL so as to ensure that data is not modified in the transmission process;
s3, generation of shared session key: and acquiring the public key data of the opposite party through a D-H secret key exchange algorithm, and generating respective session keys at the two nodes.
2. The hybrid encryption method according to claim 1, wherein in step S1, the key parameter g contains basic parameters of the selected ellipse, including the name and radius of the elliptic curve.
3. The hybrid encryption method according to claim 1, wherein in step S1, the generation of the corresponding public key and private key according to the obtained key parameter g specifically comprises:
A. b is two nodes in the network, and the A node randomly generates a random number x1Node B randomly generates a random number x2;x1,x2Respectively corresponding to respective private keys as two nodes, order A2=x1*g,B2=x2*g,A2、B2And the public keys are respectively corresponding to the two nodes.
4. The hybrid encryption method according to claim 3, wherein step S3 includes: the A node obtains the public key data of the B node by inquiring the data stored in the block chain in the Raft server cluster.
5. The hybrid encryption method according to claim 4, wherein the step S3 specifically includes:
when the node A obtains the public key B of the node B2Calculating H ═ x1*B2By its own private key x, by means of D-H key exchange1Public key B with exchanged node A2Obtaining a symmetric key H; obtaining A of A node by B node2Calculate H*=x2*A2Then exchanged by D-H secret key, with its own private key x2Public key A with exchanged node B2Get the symmetric key H*。
6. The hybrid encryption method according to claim 1, wherein in step S3, a symmetric session key is determined by a function ECDH _ compute _ key () in OpenSLL.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202010794304.5A CN111917790A (en) | 2020-08-10 | 2020-08-10 | Hybrid encryption method for Internet of things security |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202010794304.5A CN111917790A (en) | 2020-08-10 | 2020-08-10 | Hybrid encryption method for Internet of things security |
Publications (1)
Publication Number | Publication Date |
---|---|
CN111917790A true CN111917790A (en) | 2020-11-10 |
Family
ID=73283407
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202010794304.5A Pending CN111917790A (en) | 2020-08-10 | 2020-08-10 | Hybrid encryption method for Internet of things security |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN111917790A (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN114039727A (en) * | 2021-12-09 | 2022-02-11 | 施耐德电气(中国)有限公司 | Data transmission method and device, intelligent terminal and gateway equipment |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080130895A1 (en) * | 2006-10-25 | 2008-06-05 | Spyrus, Inc. | Method and System for Deploying Advanced Cryptographic Algorithms |
CN105812142A (en) * | 2016-03-10 | 2016-07-27 | 西京学院 | Strong forward-secure digital signature method for combining fingerprint, ECDH and ECC |
CN109687957A (en) * | 2018-12-26 | 2019-04-26 | 无锡泛太科技有限公司 | A kind of RFID authentication method of the public-key cryptography scheme based on ellipse-hyperbolic |
-
2020
- 2020-08-10 CN CN202010794304.5A patent/CN111917790A/en active Pending
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080130895A1 (en) * | 2006-10-25 | 2008-06-05 | Spyrus, Inc. | Method and System for Deploying Advanced Cryptographic Algorithms |
CN105812142A (en) * | 2016-03-10 | 2016-07-27 | 西京学院 | Strong forward-secure digital signature method for combining fingerprint, ECDH and ECC |
CN109687957A (en) * | 2018-12-26 | 2019-04-26 | 无锡泛太科技有限公司 | A kind of RFID authentication method of the public-key cryptography scheme based on ellipse-hyperbolic |
Non-Patent Citations (2)
Title |
---|
李明: "IPSec中IKE协议的分析和ECC算法的改进", 《中国优秀博硕士学位论文全文数据库(硕士)信息科技辑》 * |
赵艳杰: "基于区块链的物联网信息安全传输与存储研究", 《中国优秀博硕士学位论文全文数据库(硕士)信息科技辑》 * |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN114039727A (en) * | 2021-12-09 | 2022-02-11 | 施耐德电气(中国)有限公司 | Data transmission method and device, intelligent terminal and gateway equipment |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10116443B1 (en) | Pairing verification in supersingular isogeny-based cryptographic protocols | |
Saqib et al. | A lightweight three factor authentication framework for IoT based critical applications | |
US10313124B1 (en) | Public key validation in supersingular isogeny-based cryptographic protocols | |
US9106410B2 (en) | Identity based authenticated key agreement protocol | |
EP3005608B1 (en) | Authentication | |
Li et al. | iTLS: Lightweight transport-layer security protocol for IoT with minimal latency and perfect forward secrecy | |
Haakegaard et al. | The elliptic curve diffie-hellman (ecdh) | |
CN108886468A (en) | System and method for distributing the keying material and certificate of identity-based | |
CN114710275B (en) | Cross-domain authentication and key negotiation method based on blockchain in Internet of things environment | |
US10630476B1 (en) | Obtaining keys from broadcasters in supersingular isogeny-based cryptosystems | |
CN104301108A (en) | Signcryption method based from identity environment to certificateless environment | |
CN117155564A (en) | Bidirectional encryption authentication system and method | |
Schmidt | Requirements for password-authenticated key agreement (PAKE) schemes | |
Shen et al. | A secure and practical RFID ownership transfer protocol based on Chebyshev polynomials | |
US10880278B1 (en) | Broadcasting in supersingular isogeny-based cryptosystems | |
CN110809000B (en) | Service interaction method, device, equipment and storage medium based on block chain network | |
CN111953489A (en) | SM2 algorithm-based key exchange device and method for collecting service of power generation unit | |
CN111917790A (en) | Hybrid encryption method for Internet of things security | |
CN101888383B (en) | Method for implementing extensible trusted SSH | |
Lin et al. | Research on authentication and key negotiation based on smart water environment | |
Islam et al. | Improved remote login scheme based on ECC | |
Chattaraj et al. | An efficient two-server authentication and key exchange protocol for accessing secure cloud services | |
Shekhawat et al. | Quantum-resistance blockchain-assisted certificateless data authentication and key exchange scheme for the smart grid metering infrastructure | |
Xia et al. | A Quantum-Resistant Identity Authentication and Key Agreement Scheme for UAV Networks Based on Kyber Algorithm | |
Momeni et al. | An Energy-Efficient Multiple-Factor Authentication Protocol for Critical Infrastructure IoT Systems |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
RJ01 | Rejection of invention patent application after publication |
Application publication date: 20201110 |
|
RJ01 | Rejection of invention patent application after publication |