CN111917790A - Hybrid encryption method for Internet of things security - Google Patents

Abstract

The invention discloses a hybrid encryption method for Internet of Things security. The ECC encryption algorithm is combined with the D-H secret key exchange algorithm. The steps are as follows: generating an ECC public key and a private key; The API function obtains and selects an elliptic curve in OpenSLL; then generates the key parameter g, and generates the corresponding public key and private key according to the key parameter g; ECC signature and signature verification: use the ECSSA_sign() function in OpenSLL to complete the data Signature function, use the ECSSA_verify() function in OpenSLL to complete the verification of the corresponding data signature to ensure that the data is not modified during the transmission process; the generation of the shared session key: obtain the public key of the other party through the D‑H key exchange algorithm data, and generate respective session keys at the two nodes. The invention improves the security performance of network transmission.

Description

A hybrid encryption method for IoT security

technical field

The invention belongs to the technical field of network security, in particular to a hybrid encryption method for Internet of Things security.

Background technique

The Internet of Things is the use of radio frequency identification (RFID), sensors, infrared sensors, global positioning systems, laser scanners and other information collection equipment, according to the agreed protocol, to connect any item with the Internet for information exchange and A network that communicates to achieve intelligent identification, positioning, tracking, monitoring and management. The IoT market is developing rapidly, the number of terminals has increased sharply, and there are great security risks. The security link in the IoT industry chain accounts for a low proportion. The Internet of Things business penetrates into many industries and affects people's lives in an all-round way. The corresponding security problems will also bring serious threats, even including life and property safety.

IoT security means that IoT hardware, software and data in their systems are protected from being damaged, altered, or leaked by accidental or malicious reasons. IoT systems can run continuously, reliably and normally, and IoT services are not interrupted. IoT security includes all technical means or management means to solve or mitigate the security threats existing in the application of IoT network technology, as well as these security threats themselves and related activities. IoT security threats and IoT security technologies are the most basic manifestations of the meaning of network security.

At present, there are still many security problems in IoT nodes that need to be solved urgently.

SUMMARY OF THE INVENTION

Aiming at the deficiencies in the prior art, the present invention provides an encryption algorithm combining an asymmetric encryption algorithm and a D-H secret key exchange algorithm to encrypt data, thereby solving the security problems existing in the IoT nodes. IoT nodes also use Transport Layer Security to create secure connections to the cloud. But to achieve true security, IoT nodes must also acquire application-layer security. This means that not only the communication pipes, but the nodes themselves also need to be authenticated. In addition to channel authentication, the application layer should establish encryption and data integrity checking mechanisms to protect the data flowing through the pipeline.

To achieve the above object, the present invention adopts the following technical solutions:

A hybrid encryption method for Internet of Things security. The hybrid encryption method is combined with an ECC encryption algorithm and a D-H key exchange algorithm. The steps are as follows:

S1. Generate ECC public key and private key: Apply the secure socket layer cryptographic library OpenSLL, first obtain and select an elliptic curve in OpenSLL through the API function; then generate the key parameter g according to the selected elliptic curve, according to the obtained key The parameter g generates the corresponding public key and private key;

S2, ECC signature and signature verification: use the ECSSA_sign() function in OpenSLL to complete the data signature function, and use the ECSSA_verify() function in OpenSLL to complete the verification of the corresponding data signature to ensure that the data is not modified during transmission;

S3. Generation of a shared session key: Obtain the public key data of the other party through the D-H key exchange algorithm, and generate respective session keys at the two nodes.

In order to optimize the above technical solutions, the specific measures taken also include:

Further, in step S1, the key parameter g includes the basic parameters of the selected ellipse, including the name and radius of the ellipse curve.

Further, in step S1, generating the corresponding public key and private key according to the obtained key parameter g is specifically:

A and B are two nodes in the network. Node A randomly generates a random number x ₁ , and node B randomly generates a random number x ₂ ; x ₁ , x ₂ correspond to the respective private keys of the two nodes, let A ₂ =x ₁ *g, B ₂ =x ₂ *g, A ₂ and B ₂ correspond to the respective public keys of the two nodes.

Further, step S3 includes: node A obtains the public key data of node B by querying the data stored in the blockchain in the Raft server cluster.

Further, step S3 specifically includes:

When node A obtains the public key B ₂ of node B, it calculates H=x ₁ *B ₂ . Through DH key exchange, the symmetric key H is obtained from its own private key x ₁ and the public key B ₂ of node A after the exchange. ; Similarly, node B obtains A ₂ of node A and calculates H ^* = x ₂ *A ₂ , and then through DH key exchange, the symmetric key is obtained from its own private key x ₂ and the public key A ₂ of node B after the exchange H ^* .

Further, in step S3, the symmetric session key is determined by the function ECDH_compute_key() in OpenSLL.

The beneficial effect of the present invention is that the combination of the ECC encryption algorithm and the D-H key exchange algorithm can improve the security performance of network transmission. The exchanged key is the public key in the key pair generated by asymmetric cryptographic algorithms such as ECC, and the private key is stored separately for each node and is not exposed to anyone, thus ensuring the security of communication; The identity of the visitor is more authentic.

Description of drawings

Fig. 1: The flow chart of the mixed encryption algorithm program of the present invention.

Figure 2: A schematic diagram of the Diffie-Hellman key exchange method in the hybrid encryption method of the present invention.

Figure 3: The flow chart of the ECC algorithm program in the hybrid encryption method of the present invention.

Detailed ways

The present invention will now be described in further detail with reference to the accompanying drawings.

It should be noted that the terms such as "up", "down", "left", "right", "front", "rear", etc. quoted in the invention are only for the convenience of description and clarity, and are not used for Limiting the applicable scope of the present invention, the change or adjustment of the relative relationship shall be regarded as the applicable scope of the present invention without substantially changing the technical content.

The invention provides a hybrid encryption method for Internet of Things security. The hybrid encryption method is combined with an ECC encryption algorithm and a D-H secret key exchange algorithm, and the steps are as follows:

S1. Generate ECC public and private keys: Apply the secure socket layer cryptographic library OpenSLL. On computer networks, OpenSSL is an open source software library package. Applications can use this package for secure communication, avoid eavesdropping, and confirm at the same time. The identity of the other end of the connection. There are many elliptic curves in OpenSLL. First, get the elliptic curve in OpenSLL through the API function and select an elliptic curve; then generate the key parameter g according to the selected elliptic curve, where g contains some basic parameters of the ellipse, such as elliptic curve name, radius, etc. Generate the corresponding public key and private key according to the obtained key parameter g.

ECC algorithm principle: ECC is also called elliptic curve cryptographic algorithm. It is a public key cryptographic algorithm based on mathematical elliptic curves. Let l be an integer greater than 3, the elliptic curve y ² =x ³ +dx+e is formed by a solution set (a,b) based on the congruence y ² =x ³ +dx+emodp and a point at infinity The o of , and 4d ³ +27e ² ≠0modl constant. l ₁ =(a ₁ , b ₁ ) and l ₂ =(a ₂ , b ₂ ) are two points on the elliptic curve, which are obtained by the addition and subtraction operations that define the elliptic curve:

According to the above formula, it can be obtained that the two points on the ellipse are added together on the ellipse, so the following formula can be obtained: kl=l+l+...+l=o, where k is the number of l. Point o can be found from k and point l, but it is more difficult to find k if o and l are known. This is called the discrete logarithm problem of point groups on elliptic curves. ECC is the algorithm derived from this, that is, k as the private key and o as the public key.

S2, ECC signature and signature verification: use the ECSSA_sign() function in OpenSLL to complete the data signature function, and then use the ECSSA_verify() function in OpenSLL to complete the verification of the corresponding data signature to ensure that the data is not modified during transmission.

S3. Generation of a shared session key: Obtain the public key data of the other party through the D-H key exchange algorithm, and generate respective session keys at the two nodes.

Principle of DH algorithm: DH algorithm is not used for encryption or decryption, but for the transmission and distribution of keys. Since it is very difficult to compute discrete logarithms over finite fields, it is quite secure. For example, there are two people negotiating on an insecure network, one is A and one is B, to confirm the shared password used for this conversation. First A and B agree on a large prime number x and its original root y, then A randomly generates a number a that only it knows, calculates A ₁ =y ^a modx, and sends A ₁ to B; B Randomly generate a number b that only you know, calculate B ₁ =y ^b modx, and send B ₁ to A; then A calculates k=B ₁ ^a mod x; B calculates k ^* =A ₁ ^b modx. According to the law of exchange of multiplication and the law of combination of multiplication, the following formula is derived:

k ^* =A ₁ ^b mod x=(y ^a mod x) ^b modx=y ^ab mod x=(y ^b mod x) ^a modx=B ₁ ^a mod x=k

In the whole process, even if the eavesdropper obtains the four data of x, y, A ₁ , and B ₁ , if he wants to obtain the key k, he must first calculate the discrete logarithms a and b. During the call, the values of a, b, and x should be made larger, otherwise it is possible to obtain all the values of modx by enumeration.

According to the D-H key exchange principle, in order to generate this session key on the communicating party, the public key data of the other party must be obtained. For example, when node A and node B want to communicate, node A obtains the public key data of node B by querying the data stored in the blockchain in the Raft server cluster, and finally generates a session key at A. Node B and A node correspond to the same principle. The symmetric session key is determined in OpenSLL by the function ECDH_compute_key().

The present invention proposes ECDH, wherein EC means "elliptic curves", DH means "Diffie-Hellman", and ECDH is the combination of ECC and D-H.

In the embodiment of the present invention, when the secret key is exchanged, the corresponding public key and private key are generated according to the obtained key parameter g as follows: A and B are two nodes in the network, both of which have an elliptic curve base point g. Node A randomly generates a random number x ₁ , and node B randomly generates a random number x ₂ ; x ₁ and x ₂ correspond to the respective private keys of the two nodes, let A ₂ =x ₁ *g, B ₂ =x ₂ * g, A ₂ and B ₂ correspond to the respective public keys of the two nodes. When A passes A ₂ to B and B passes B ₂ to A, it is stolen by the eavesdropper, but it is difficult to solve the logarithm problem in ECC, so the eavesdropper cannot calculate x ₁ x ₂ . When A obtains B ₂ of B, it can calculate H=x ₁ *B ₂ , that is, the symmetric key H is obtained from its own private key x ₁ and A's public key B ₂ through DH key exchange. Similarly, B obtains A ₂ of A and calculates H ^* =x ₂ *A ₂ , and then obtains the symmetric key H ^* from its own private key x ₂ and B's public key A ₂ through DH key exchange.

Deduced from the mathematical formula:

H=x ₁ *B ₂ =x ₁ *(x ₂ *g)=(x ₁ *x ₂ )*g=(x ₂ *x ₁ )*g=x ₂ *(x ₁ *g)=x ₂ *A ₂ =H ^*

That is, two nodes A and B have obtained the same key.

Using the ECC encryption algorithm combined with the D-H key exchange algorithm will improve the security performance. The exchanged key is the public key in the key pair generated by asymmetric cryptographic algorithms such as ECC, and the private key is stored separately for each node and is not exposed to anyone, thus ensuring the security of communication; the present invention can ensure access to the network The identities of all visitors are more authentic.

The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above-mentioned embodiments, and all technical solutions that belong to the idea of the present invention belong to the protection scope of the present invention. It should be pointed out that for those skilled in the art, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims (6)

1. A hybrid encryption method for the security of the Internet of things is characterized in that the hybrid encryption method is formed by combining an ECC encryption algorithm and a D-H key exchange algorithm and comprises the following steps:

s1, generating an ECC public key and a private key: applying a secure socket layer password library OpenSLL, and obtaining and selecting an elliptic curve in the OpenSLL through an API function; generating a key parameter g according to the selected elliptic curve, and generating a corresponding public key and a corresponding private key according to the obtained key parameter g;

s2, ECC signature and signature verification: an ECSSA _ sign () function in OpenSLL is used for completing a data signature function, and an ECSSA _ verify () function is used for completing verification of a corresponding data signature in OpenSLL so as to ensure that data is not modified in the transmission process;

s3, generation of shared session key: and acquiring the public key data of the opposite party through a D-H secret key exchange algorithm, and generating respective session keys at the two nodes.

2. The hybrid encryption method according to claim 1, wherein in step S1, the key parameter g contains basic parameters of the selected ellipse, including the name and radius of the elliptic curve.

3. The hybrid encryption method according to claim 1, wherein in step S1, the generation of the corresponding public key and private key according to the obtained key parameter g specifically comprises:

A. b is two nodes in the network, and the A node randomly generates a random number x₁Node B randomly generates a random number x₂；x₁，x₂Respectively corresponding to respective private keys as two nodes, order A₂＝x₁*g，B₂＝x₂*g，A₂、B₂And the public keys are respectively corresponding to the two nodes.

4. The hybrid encryption method according to claim 3, wherein step S3 includes: the A node obtains the public key data of the B node by inquiring the data stored in the block chain in the Raft server cluster.

5. The hybrid encryption method according to claim 4, wherein the step S3 specifically includes:

when the node A obtains the public key B of the node B₂Calculating H ═ x₁*B₂By its own private key x, by means of D-H key exchange₁Public key B with exchanged node A₂Obtaining a symmetric key H; obtaining A of A node by B node₂Calculate H^*＝x₂*A₂Then exchanged by D-H secret key, with its own private key x₂Public key A with exchanged node B₂Get the symmetric key H^*。

6. The hybrid encryption method according to claim 1, wherein in step S3, a symmetric session key is determined by a function ECDH _ compute _ key () in OpenSLL.

Images