CN114205073B - Password reverse firewall and security defense method thereof - Google Patents
Password reverse firewall and security defense method thereof Download PDFInfo
- Publication number
- CN114205073B CN114205073B CN202010978321.4A CN202010978321A CN114205073B CN 114205073 B CN114205073 B CN 114205073B CN 202010978321 A CN202010978321 A CN 202010978321A CN 114205073 B CN114205073 B CN 114205073B
- Authority
- CN
- China
- Prior art keywords
- ciphertext
- public key
- random number
- reverse firewall
- password
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 61
- 230000007123 defense Effects 0.000 title abstract description 17
- 238000012545 processing Methods 0.000 claims abstract description 21
- 230000008569 process Effects 0.000 claims abstract description 19
- 238000000605 extraction Methods 0.000 claims abstract description 7
- 230000005540 biological transmission Effects 0.000 claims description 10
- 238000011084 recovery Methods 0.000 claims description 5
- 230000006870 function Effects 0.000 description 55
- 101150074181 PER2 gene Proteins 0.000 description 5
- 101150008094 per1 gene Proteins 0.000 description 5
- 238000004891 communication Methods 0.000 description 4
- 239000000284 extract Substances 0.000 description 4
- 101150064138 MAP1 gene Proteins 0.000 description 3
- 101150009249 MAP2 gene Proteins 0.000 description 3
- 238000013461 design Methods 0.000 description 3
- 238000010586 diagram Methods 0.000 description 3
- 238000012544 monitoring process Methods 0.000 description 3
- 239000000463 material Substances 0.000 description 2
- 230000004075 alteration Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000002347 injection Methods 0.000 description 1
- 239000007924 injection Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
- H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention discloses a password reverse firewall and a security defense method thereof, wherein the password reverse firewall comprises a first password reverse firewall and a second password reverse firewall, each password reverse firewall is used for processing messages transmitted between an entity and external information, and the method comprises the following steps: performing random number extraction on the first public key to obtain a first random number; performing public key re-randomization on the first public key according to the first random number to obtain a second public key; random number extraction is carried out on the first ciphertext to obtain a second random number, and ciphertext randomization processing is carried out on the first ciphertext according to the second random number to obtain a second ciphertext; and processing the second ciphertext according to the first random number to obtain a third ciphertext. Therefore, the number of random numbers generated by the password reverse firewall in the operation process is effectively reduced, the degree of dependence on a trusted random source is reduced, and the realizability is improved.
Description
Technical Field
The invention relates to the field of cryptography, in particular to a security defense method of a password reverse firewall and the password reverse firewall.
Background
The large-scale surveillance problem has received much attention from the cryptology and information security industries after a series of security events, represented by "prism gates". As one of the important possible means for large-scale monitoring, subversion attack (Subversion attack) has been the focus of the academic community because of its high concealment and wide hazard. The monitor can use special power and means to replace (subvert) the execution of the cryptographic algorithm used by the user in each stage of the construction and application of the cryptographic system, so that the execution is differentiated from the standard algorithm description to a certain extent, thereby realizing the acquisition of the user privacy. In some special cases, for users who do not have specific backdoor information, the subverted algorithm execution may be of a theoretical computationally unrecognizable nature to the standard algorithmic descriptions, which makes it quite difficult to defend against subversive attacks.
A Cryptographic Reverse Firewall (CRF) is one of the effective means to combat subversion attacks. As a trusted device, the trusted device can exist between a user computer and the outside in various forms, and processes all information entering and leaving the computer in a password protocol so as to achieve the purpose of preventing privacy of the user from being leaked. However, existing cryptographic reverse firewalls are designed to take into account only the form in which a CRF defends against an entity in a protocol, and CRF entities constructed directly according to such designs are theoretically not scalable and combinable. Moreover, if such a design is adopted, a large number of CRFs need to be set in practical application, and the deployment of such a large number of trusted modules obviously does not meet the industrial reality in consideration of the background of large-scale monitoring. In addition, in all the specific structures of the CRF currently, each time a protocol entity generates a random number, the CRF needs to regenerate a random number corresponding to the CRF, that is, the CRF needs to generate a trusted random number equal to the random number generated in the operation of the protocol, and this design needs to consume a large amount of trusted resources, and the practical feasibility is not high.
Disclosure of Invention
The present invention is directed to solving, at least to some extent, one of the technical problems in the related art. Therefore, a first objective of the present invention is to provide a method for defending a password reverse firewall, which can effectively reduce the number of random numbers generated by the password reverse firewall in the operation process, reduce the degree of dependence on a trusted random source, and improve the realizability.
The second objective of the present invention is to provide a password reverse firewall.
In order to achieve the above object, an embodiment of a first aspect of the present invention provides a method for protecting a password firewall against security, where the password firewall includes a first password firewall and a second password firewall, the first password firewall corresponds to a message sending entity, the second password firewall corresponds to a message receiving entity, each password firewall includes a first port and a second port, the first port is connected to the entity, the second port is connected to an external channel, and each password firewall is configured to process a message transmitted between the entity and the external information, and the method includes the following steps: the first port of the second password reverse firewall receives a first public key sent by the message receiving entity, an internal session unit is used for extracting a random number of the first public key to obtain a first random number, the public key is subjected to public key re-randomization processing according to the first random number to obtain a second public key, and the second public key is sent to the external channel through a corresponding second port; a second port of the first password reverse firewall receives the second public key from the external channel, the second public key is transmitted to the message sending entity through a corresponding first port by using an internal session unit, and the second public key is recorded; the first port of the first password reverse firewall receives a first ciphertext sent by the message sending entity, an internal session unit is used for extracting a random number from the first ciphertext to obtain a second random number, ciphertext randomization processing is carried out on the first ciphertext according to the second random number to obtain a second ciphertext, and the second ciphertext is sent to the external channel through a corresponding second port; and a second port of the second password reverse firewall receives the second ciphertext from the external channel, an internal session unit is utilized to process the second ciphertext according to the first random number to obtain a third ciphertext, and the third ciphertext is transmitted to the message receiving entity through a corresponding first port.
According to the security defense method of the password reverse firewall, firstly, a first port of a second password reverse firewall receives a first public key sent by a message receiving entity, an internal session unit is used for extracting a random number from the first public key to obtain a first random number, the first public key is subjected to public key re-randomization processing according to the first random number to obtain a second public key, the second public key is sent to an external channel through a corresponding second port, then, the second port of the first password reverse firewall receives the second public key from the external channel, an internal session unit is used for transmitting the second public key to the message sending entity through the corresponding first port and recording the second public key, further, the first port of the first password reverse firewall receives a first ciphertext sent by the message sending entity, an internal session unit is used for extracting the random number from the first ciphertext to obtain a second random number, the first ciphertext is subjected to ciphertext re-randomization processing according to the second random number to obtain a second ciphertext, the second ciphertext is sent to the external channel through the corresponding second port, and finally, the second password reverse firewall receives the second ciphertext through the internal session unit and receives the second ciphertext through the second port to obtain a third ciphertext. Therefore, the number of random numbers generated by the password reverse firewall in the operation process is effectively reduced, the degree of dependence on a trusted random source is reduced, and the realizability is improved.
In addition, the security defense method of the password reverse firewall according to the above embodiment of the present invention may further have the following additional technical features:
according to an embodiment of the present invention, the performing random number extraction on the first public key to obtain a first random number includes: encoding the first public key by using a first preset injective function so as to map the first public key to an input space of a first preset pseudorandom permutation function and obtain first encoding information; if the first coded information already exists, alarming and reminding are carried out, and all message transmission is blocked; if the first coding information does not exist, recording the first coding information, and replacing the first coding information by using the first preset pseudorandom replacement function and the key of the first preset pseudorandom replacement function to obtain the first random number, wherein the key of the first preset pseudorandom replacement function is injected from the outside or automatically generated when the second password reverse firewall is started.
According to an embodiment of the present invention, the performing public key re-randomization of the first public key according to the first random number to obtain a second public key includes: and performing public key re-randomization processing on the first public key according to the first random number by using a preset public key re-randomization function to obtain the second public key.
According to an embodiment of the present invention, the random number extracting the first ciphertext to obtain a second random number includes: encoding the first ciphertext by using a second preset injective function so as to map the first ciphertext to an input space of a second preset pseudorandom permutation function and obtain second encoding information; if the second coded information already exists, alarming and reminding are carried out, and all message transmission is blocked; if the second coding information does not exist, recording the second coding information, and replacing the second coding information by using a second preset pseudorandom replacement function and a key of the second preset pseudorandom replacement function to obtain a second random number, wherein the key of the second preset pseudorandom replacement function is injected from the outside or automatically generated when the first password reverse firewall is started.
According to an embodiment of the present invention, the randomizing the first ciphertext according to the second random number to obtain a second ciphertext includes: and carrying out ciphertext randomization again on the first ciphertext according to the second random number and the second public key by using a preset ciphertext randomization function so as to obtain the second ciphertext.
According to an embodiment of the present invention, the processing the second ciphertext according to the first random number to obtain a third ciphertext includes: and recovering the second ciphertext according to the first random number by using a preset ciphertext recovery function to obtain the third ciphertext.
According to an embodiment of the present invention, the messages received and sent by the first password reverse firewall and the second password reverse firewall both satisfy a six-tuple format, and if not, an alarm is performed, where the six-tuple format includes a protocol type identifier, a session identifier, a message sending entity identifier, a message receiving entity identifier, a message content, and joint data of the message.
According to an embodiment of the present invention, the method for defending against the security of the password reverse firewall further includes: after receiving the first public key, the second password reverse firewall generates the internal session unit and marks the internal session unit, wherein the marking information comprises the protocol type identifier, the session identifier and the message receiving entity identifier; after receiving the second ciphertext, the second password reverse firewall further searches whether the internal session unit exists, and if not, an alarm is given; if so, the internal session unit is run.
According to an embodiment of the present invention, the method for defending against the security of the password reverse firewall further includes: after receiving the second public key, the first password reverse firewall generates the internal session unit and marks the internal session unit, wherein the marking information comprises the protocol type identifier, the session identifier and the message sending entity identifier; after receiving the first ciphertext, the first password reverse firewall further searches whether the internal session unit exists, and if not, an alarm is given; if so, the internal session unit is run.
In order to achieve the above object, a cryptographic firewall according to an embodiment of the second aspect of the present invention includes the above-mentioned security defense method for a cryptographic firewall.
According to the password reverse firewall provided by the embodiment of the invention, the security defense method of the password reverse firewall is applied, the number of random numbers generated by the password reverse firewall in the operation process can be effectively reduced, the dependence degree on a trusted random source is reduced, and the realizability is improved.
Additional aspects and advantages of the invention will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the invention.
Drawings
FIG. 1 is a diagram illustrating an example of a cryptographic reverse firewall deployment according to an embodiment of the present invention;
FIG. 2 is a schematic diagram of the message transport protocol principle served by a cryptographic reverse firewall in accordance with an embodiment of the present invention;
FIG. 3 is a diagram illustrating a password reverse firewall communication method according to an embodiment of the present invention
FIG. 4 is a flowchart illustrating a method for defending against a password reverse firewall according to an embodiment of the present invention;
FIG. 5 is a flowchart illustrating a method for defending against a password reverse firewall according to an embodiment of the present invention;
FIG. 6 is a flowchart illustrating a method for defending against a password reverse firewall according to an embodiment of the present invention;
FIG. 7 is a flowchart illustrating a method for defending against a password reverse firewall according to an embodiment of the present invention;
fig. 8 is a flowchart illustrating a security defense method of a cryptographic reverse firewall according to an embodiment of the invention.
Detailed Description
Reference will now be made in detail to embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to the same or similar elements or elements having the same or similar function throughout. The embodiments described below with reference to the drawings are illustrative and intended to be illustrative of the invention and are not to be construed as limiting the invention.
Before introducing the password reverse firewall and the security defense method of the password reverse firewall in the embodiment of the present invention, a deployment manner of the password reverse firewall in the embodiment of the present invention is described with reference to fig. 1, and a principle of a message transmission protocol served by the password reverse firewall in the embodiment of the present invention is described with reference to fig. 2.
Specifically, as shown in fig. 1, the password reverse firewall in the embodiment of the present invention adopts a group service type architecture, that is, one password reverse firewall serves multiple computers in a local area network, and has a combinability, that is, when the number of hosts served by the password reverse firewall is arbitrarily increased, the types of protocols supported by the password reverse firewall are arbitrarily extended, and the calling mode and the operating environment of the served protocols are arbitrarily changed, the security protection performance of the password reverse firewall against each protocol session is not reduced.
Further, as shown in fig. 2, a message transmission protocol related to the cryptographic reverse firewall in the embodiment of the present invention is based on a public key encryption system PE = (KeyGen, enc, dec), where KeyGen is a key generation algorithm, enc is an encryption algorithm, and Dec is a decryption algorithm.
For example, in the protocol, the sender of the message is Alice, the receiver is Bob, the initial input of the protocol is to input a message m to Alice, the final output is to output a message m 'by Bob, and the correctness of the protocol is represented by m' = m, then the specific mode of the protocol operation is: first, bob runs the key generation algorithm to produce the public-private key pair (pk, sk) ← KeyGen (1) λ ) And sending the public key pk to a sender Alice of the message in the protocol, then Alice runs c ← Enc (pk, m) and sends c to Bob, and finally Bob decrypts c with m '← Dec (sk, c) and outputs m', wherein sk is a corresponding private key used for encrypting to obtain the public key of c.
The following describes a cryptographic reverse firewall and a security defense method of the cryptographic reverse firewall according to an embodiment of the present invention with reference to the drawings.
Specifically, as shown in fig. 3, the password reverse firewall includes a first password reverse firewall and a second password reverse firewall, the first password reverse firewall is configured to correspond to a message sending entity, the second password reverse firewall is configured to correspond to a message receiving entity, each password reverse firewall includes a first port and a second port, the first port is connected to the entity, the second port is connected to an external channel, and each password reverse firewall is configured to process a message transmitted between the entity and external information.
Further, as shown in fig. 4, the method for defending against the security of the password reverse firewall includes the following steps:
s101, a first port of a second password reverse firewall receives a first public key sent by a message receiving entity, an internal session unit is used for extracting a random number from the first public key to obtain a first random number, public key re-randomization processing is carried out on the first public key according to the first random number to obtain a second public key, and the second public key is sent to an external channel through a corresponding second port.
That is, the second cryptographic reverse firewall receives the first public key pk sent from the information receiving entity through the first port, and obtains the first random number r through the internal session unit 1 Performing public key re-randomization process on the first public key pkTo obtain the second public key pk ', and to send the second public key pk' to the external channel through the corresponding second port.
S102, a second port of the first password reverse firewall receives a second public key from an external channel, the second public key is transmitted to the message sending entity through the corresponding first port by using the internal session unit, and the second public key is recorded.
That is, the first cryptographic reverse firewall receives the second public key pk ' from the external channel through the second port, records the second public key pk ' through the internal session unit, and transparently transmits the second public key pk ' to the messaging entity through the corresponding first port.
S103, the first port of the first password reverse firewall receives a first ciphertext sent by the message sending entity, the internal session unit is used for extracting a random number from the first ciphertext to obtain a second random number, the ciphertext is subjected to ciphertext randomization processing according to the second random number to obtain a second ciphertext, and the second ciphertext is sent to an external channel through a corresponding second port.
That is, the first cryptographic reverse firewall receives the first cipher text c sent by the message sending entity through the first port, and obtains the second random number r through the internal session unit 2 And carrying out ciphertext randomization processing on the first ciphertext c to obtain a second ciphertext c ', and sending the second ciphertext c' to an external channel through a corresponding second port.
And S104, a second port of the second password reverse firewall receives a second ciphertext from the external channel, the internal session unit is utilized to process the second ciphertext according to the first random number to obtain a third ciphertext, and the third ciphertext is transmitted to the message receiving entity through the corresponding first port.
That is, the second cryptographic reverse firewall receives the second cipher text c' from the external channel through the second port and according to the first random number r through the internal session unit 1 Processing the second ciphertext c 'to obtain a third ciphertext c ", and transmitting the third ciphertext c' to the message receiving entity through the corresponding first port。
Therefore, the security defense method of the password reverse firewall extracts the random number of the first public key to obtain the first random number, randomizes the public key again according to the first random number to obtain the second public key, extracts the random number of the first ciphertext to obtain the second random number, randomizes the first ciphertext again according to the second random number to obtain the second ciphertext, and processes the second ciphertext according to the first random number to obtain the third ciphertext, so that the number of the random numbers generated by the password reverse firewall in the operation process is effectively reduced, the dependence degree on a credible random source is reduced, and the realizability is improved.
Specifically, as shown in fig. 5, the random number extraction of the first public key to obtain the first random number includes:
s201, encode the first public key by using a first preset injective function to map the first public key to an input space of a first preset pseudorandom permutation function and obtain first encoded information.
That is, the first public key pk may be encoded by a first preset injective function Map1, so as to Map the first public key pk to an input space of a first preset pseudorandom permutation function Per1 and obtain first encoding information r pk ←Map1(pk)。
Alternatively, the first preset injective function Map1 may be preset to
Wherein,
is a ciphertext space.
S202, if the first coded information already exists, alarm reminding is carried out, and all message transmission is blocked.
It will be appreciated that if the internal session element of the second cryptographic reverse firewall detects the first encoded information r pk If the password exists, the internal conversation unit will alarm and remind, and block all message transmission in the second password reverse firewall.
S203, if the first coding information does not exist, recording the first coding information, and replacing the first coding information by using a first preset pseudorandom replacement function and a key of the first preset pseudorandom replacement function to obtain a first random number, wherein the key of the first preset pseudorandom replacement function is injected from the outside or automatically generated when the second password reverse firewall is started.
It will be appreciated that if the first encoded information r is pk If not, recording the first coding information r in the list pk And using the first predetermined pseudo-random permutation function Per1 and the secret key s of the first predetermined pseudo-random permutation function 1 For the first coded information r pk Permuting to obtain a first random number r 1 ←Per1(s 1 ，r pk ) Wherein the secret key s of the first predetermined pseudo-random permutation function 1 And the second password is injected from the outside or automatically generated when the reverse firewall is started.
Alternatively, the first predetermined pseudo-random permutation function Per1 may be predetermined as
Wherein,
is a key space.
Further, performing public key re-randomization on the first public key according to a first random number to obtain a second public key, including:
and performing public key re-randomization processing on the first public key according to the first random number by using a preset public key re-randomization function to obtain a second public key.
That is, the function Keymaul can be re-randomized according to the first random number r by the preset public key 1 Performing public key rerandomization pk' ← Keymaul on the first public key pk (pk, r) 1 ) To obtain the second public key pk'.
Further, as shown in fig. 6, the random number extraction on the first ciphertext to obtain a second random number includes:
s301, the first ciphertext is encoded by using a second preset injective function so as to map the first ciphertext to an input space of a second preset pseudorandom permutation function and obtain second encoding information.
That is, the first ciphertext c may be encoded by the second predetermined bijective function Map2 to Map the first ciphertext c to the input space of the second predetermined pseudorandom permutation function Per2 and obtain the second encoding information r c ←Map2(c)。
Alternatively, the second preset injective function Map2 may be preset to
Wherein,
is a public key space.
S302, if the second coded information already exists, alarm reminding is carried out, and all message transmission is blocked.
It will be appreciated that if the internal session element of the first cryptographic reverse firewall detects the second encoded information r c If the password exists, the internal session unit will alarm and prompt, and block all message transmission in the first password reverse firewall.
And S303, if the second coded information does not exist, recording the second coded information, and replacing the second coded information by using a second preset pseudorandom replacement function and a key of the second preset pseudorandom replacement function to obtain a second random number, wherein the key of the second preset pseudorandom replacement function is injected from the outside or automatically generated when the first password reverse firewall is started.
It will be appreciated that if the second encoded information r is c If not, recording the second coding information r in the list c And using a second predetermined pseudo-random permutation function Per2 and a secret key s of the second predetermined pseudo-random permutation function 2 For the second coded information r c Permuting to obtain a first random number r 2 ←Per2(s 2 ，r c ) Wherein the secret key s of the second predetermined pseudo-random permutation function 2 The first password is reversed and the firewall is started from the outsidePartially injected or automatically generated.
Alternatively, the first preset pseudorandom permutation function Per2 may be preset to
Wherein,
is a key space.
Therefore, the password reverse firewall of the embodiment of the invention adopts a pseudo-random replacement strategy, two pseudo-random replacement functions Per1 and Per2 are embedded in the password reverse firewall, and a secret key s of the pseudo-random replacement function is generated in a mode of external injection or self generation at the starting stage of the password reverse firewall 1 And s 2 And when the transmitted public key or ciphertext needs to be pseudo-randomized in the protocol operation process, firstly, the public key or ciphertext to be processed is coded by using a single-shot function, then, the coded public key or ciphertext is mapped into an input space of a pseudo-random permutation function, then, the pseudo-random permutation function is used for carrying out permutation on the coded public key or ciphertext, and finally, the random number obtained by the permutation is used for carrying out re-randomization on the public key or ciphertext to be processed to obtain the correspondingly processed public key or ciphertext.
And adopting an online watchdog strategy, monitoring data passing through the password reverse firewall in real time by an online watchdog module with an alarm function, and alarming when the risk of subversion attack is detected, for example, establishing a list aiming at each pseudorandom permutation to record all data input into the permutation under the current permutation key, checking the input before each time of the pseudorandom permutation is called, and once the input is found to be repeated (collided) with a certain record in the list, alarming by the password reverse firewall, simultaneously cutting off all communication between a computer and the outside, and pausing the operation of a network protocol.
When generating the first public key pk, the following condition is satisfied: the probability that the two randomly generated public keys are equal is smaller than or equal to a first preset value, and the probability that two ciphertexts generated by encrypting two randomly generated legal plaintexts by using the two randomly generated public keys are equal is smaller than or equal to the first preset value.
It can be understood that, when the first public key pk is generated, two randomly generated public keys (pk) are satisfied 0 ，sk 0 ) Equal probability is less than or equal to the first preset value Pr [ pk 0 ＝pk 1 ]≦ negl (λ), and two legal plaintext m randomly generated using two randomly generated public key pairs 0 And m 1 The probability that two ciphertexts generated by encryption are equal is less than or equal to a first preset value Pr [ Enc (pk) a ，m b )＝Enc(pk c ，m d )]Is less than or equal to negl (lambda), wherein,
and (a, b) ≠ c, d.
Further, the randomizing the ciphertext to the first ciphertext according to the second random number to obtain a second ciphertext includes:
and performing ciphertext randomization processing on the first ciphertext according to the second random number and the second public key by using a preset ciphertext randomization function to obtain a second ciphertext.
That is, the function Rerand can be re-randomized according to the second random number r by the preset cipher text 2 And the second public key pk 'to process the first ciphertext c through ciphertext recrandalization process c' ← Rerand (pk, c, r) 2 ) To obtain a second ciphertext c'.
Further, processing the second ciphertext according to the first random number to obtain a third ciphertext, includes:
and recovering the second ciphertext according to the first random number by using a preset ciphertext recovery function to obtain a third ciphertext.
That is, the ciphertext recovery function CKeymanl may be preset according to the first random number r 1 Recovering the second ciphertext c '. No.. CKeymarl (c', r) 1 ) To obtain a third ciphertext c ".
Optionally, in the embodiment of the present invention, taking the El-Gamal public key encryption system as an example, the public key re-randomization function Keymaul may be designed as:
accordingly, the ciphertext recovery function CKeymaul may be designed to:
the ciphertext randomizing function Rerand may be designed as:
further, the messages received and sent by the first password reverse firewall and the second password reverse firewall both meet the six-element group format, and if the messages do not meet the six-element group format, alarm reminding is performed, wherein the six-element group format comprises a protocol type identifier, a session identifier, a message sending entity identifier, a message receiving entity identifier, message content and combined data of the messages.
That is to say, if in the running process of the protocol, the messages received and sent by the first password reverse firewall and the second password reverse firewall do not satisfy the six-tuple format, an alarm is given, and meanwhile, the first password reverse firewall and the second password reverse firewall are prohibited from exchanging information.
Further, as shown in fig. 7, the method for defending against a password reverse firewall further includes:
s401, after receiving the first public key, the second password reverse firewall generates an internal session unit and marks the internal session unit, wherein the marking information comprises a protocol type identifier, a session identifier and a message receiving entity identifier.
It will be appreciated that the corresponding internal session element in the second cryptographic reverse firewall may be determined by the tagging information including the protocol class identification, the session identification, and the message receiving entity identification.
S402, after receiving the second ciphertext, the second password reverse firewall further searches whether the internal session unit exists, and if not, an alarm is given; if so, the internal session unit is run.
It should be understood that if the second password reverse firewall finds that the internal session unit does not exist after searching the marking information of the internal session unit, an alarm is given, meanwhile, all communication in the second password reverse firewall is blocked, and if the internal unit exists, the internal session unit is operated.
Further, as shown in fig. 8, the method for defending against a password reverse firewall further includes:
s501, after receiving the second public key, the first password reverse firewall generates an internal session unit and marks the internal session unit, wherein the marking information comprises a protocol type identifier, a session identifier and a message sending entity identifier.
It will be appreciated that the corresponding internal session element in the first cryptographic reverse firewall may be determined by a protocol class identification, a session identification, and a messaging entity identification.
S502, after receiving the first ciphertext, the first password reverse firewall further searches whether the internal session unit exists, and if not, an alarm is given; if so, the internal session unit is run.
It should be understood that if the first password reverse firewall finds that the internal session unit does not exist after looking up the marking information of the internal session unit, an alarm is given, meanwhile, all communication in the first password reverse firewall is blocked, and if the internal unit exists, the internal session unit is operated.
In summary, according to the security defense method of the password firewall reversal according to the embodiment of the present invention, first, the first port of the second password firewall reversal receives the first public key sent by the message receiving entity, the internal session unit extracts the random number from the first public key to obtain the first random number, and randomizes the first public key again according to the first random number to obtain the second public key, and sends the second public key to the external channel through the corresponding second port, then, the second port of the first password firewall reversal receives the second public key from the external channel, the internal session unit passes the second public key through the corresponding first port to the message sending entity, and records the second public key, and further, the first port of the first password firewall reversal receives the first ciphertext sent by the message sending entity, the internal session unit extracts the random number from the first ciphertext to obtain the second random number, and randomizes the first ciphertext again according to the second random number to obtain the second ciphertext, and sends the second ciphertext to the external channel, and finally, the second password firewall receives the second ciphertext through the corresponding second port to obtain the second random number through the second port, and randomizes the second random number through the second port to obtain the second random number. Therefore, the number of random numbers generated by the password reverse firewall in the operation process is effectively reduced, the degree of dependence on a trusted random source is reduced, and the realizability is improved.
Further, based on the foregoing security defense method for a password reverse firewall in the embodiment of the present invention, an embodiment of the present invention further provides a password reverse firewall, which includes the security defense method for a password reverse firewall in the embodiment of the present invention.
It should be noted that, the specific implementation of the password reverse firewall in the embodiment of the present invention corresponds to the specific implementation of the security defense method of the password reverse firewall in the foregoing embodiment of the present invention, and therefore, the detailed description is omitted here.
In summary, according to the password reverse firewall in the embodiment of the present invention, by applying the security defense method of the password reverse firewall, the number of random numbers generated by the password reverse firewall in the operation process can be effectively reduced, the degree of dependence on a trusted random source is reduced, and the realizability is improved.
It should be noted that the logic and/or steps represented in the flowcharts or otherwise described herein, such as an ordered listing of executable instructions that can be considered to implement logical functions, can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For the purposes of this description, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection (electronic device) having one or more wires, a portable computer diskette (magnetic device), a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via for instance optical scanning of the paper or other medium, then compiled, interpreted or otherwise processed in a suitable manner if necessary, and then stored in a computer memory.
It should be understood that portions of the present invention may be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, the various steps or methods may be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any one or combination of the following technologies, which are well known in the art, may be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application specific integrated circuit having an appropriate combinational logic gate circuit, a Programmable Gate Array (PGA), a Field Programmable Gate Array (FPGA), or the like.
In the description of the specification, reference to the description of "one embodiment," "some embodiments," "an example," "a specific example," or "some examples" or the like means that a particular feature, structure, material, or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the invention. In this specification, the schematic representations of the terms used above do not necessarily refer to the same embodiment or example. Furthermore, the particular features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.
In the description of the present invention, it is to be understood that the terms "central," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," "clockwise," "counterclockwise," "axial," "radial," "circumferential," and the like are used in the orientations and positional relationships indicated in the drawings for convenience in describing the invention and to simplify the description, and are not intended to indicate or imply that the referenced devices or elements must have a particular orientation, be constructed and operated in a particular orientation, and are therefore not to be considered limiting of the invention.
Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of the feature. In the description of the present invention, "a plurality" means at least two, e.g., two, three, etc., unless specifically limited otherwise.
In the present invention, unless otherwise expressly stated or limited, the terms "mounted," "connected," "secured," and the like are to be construed broadly and can, for example, be fixedly connected, detachably connected, or integrally formed; can be mechanically or electrically connected; they may be directly connected or indirectly connected through intervening media, or they may be connected internally or in any other suitable relationship, unless expressly stated otherwise. The specific meanings of the above terms in the present invention can be understood by those skilled in the art according to specific situations.
In the present invention, unless expressly stated or limited otherwise, the first feature "on" or "under" the second feature may be directly contacting the second feature or the first and second features may be indirectly contacting each other through intervening media. Also, a first feature "on," "over," and "above" a second feature may be directly or diagonally above the second feature, or may simply indicate that the first feature is at a higher level than the second feature. A first feature being "under," "below," and "beneath" a second feature may be directly under or obliquely under the first feature, or may simply mean that the first feature is at a lesser elevation than the second feature.
Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention, and that variations, modifications, substitutions and alterations can be made to the above embodiments by those of ordinary skill in the art within the scope of the present invention.
Claims (7)
1. A method for protecting against a password reverse firewall, wherein the password reverse firewall comprises a first password reverse firewall and a second password reverse firewall, the first password reverse firewall is configured for a message sending entity, the second password reverse firewall is configured for a message receiving entity, each password reverse firewall comprises a first port and a second port, the first port is connected to the entity, the second port is connected to an external channel, and each password reverse firewall is configured to process a message transmitted between the entity and the external information, the method comprising:
the first port of the second password reverse firewall receives a first public key sent by the message receiving entity, an internal session unit is used for extracting a random number of the first public key to obtain a first random number, the public key is subjected to public key re-randomization processing according to the first random number to obtain a second public key, and the second public key is sent to the external channel through a corresponding second port;
a second port of the first password reverse firewall receives the second public key from the external channel, the second public key is transmitted to the message sending entity through a corresponding first port by using an internal session unit, and the second public key is recorded;
the first port of the first password reverse firewall receives a first ciphertext sent by the message sending entity, an internal session unit is used for extracting a random number from the first ciphertext to obtain a second random number, ciphertext randomization processing is carried out on the first ciphertext according to the second random number to obtain a second ciphertext, and the second ciphertext is sent to the external channel through a corresponding second port;
the second port of the second password reverse firewall receives the second ciphertext from the external channel, an internal session unit is used for processing the second ciphertext according to the first random number to obtain a third ciphertext, and the third ciphertext is transmitted to the message receiving entity through a corresponding first port;
the random number extraction of the first public key to obtain a first random number comprises:
encoding the first public key by using a first preset injective function so as to map the first public key to an input space of a first preset pseudorandom permutation function and obtain first encoding information;
if the first coded information already exists, alarming and reminding are carried out, and all message transmission is blocked;
if the first coding information does not exist, recording the first coding information, and replacing the first coding information by using the first preset pseudorandom replacement function and a key of the first preset pseudorandom replacement function to obtain the first random number, wherein the key of the first preset pseudorandom replacement function is injected from the outside or automatically generated when the second password reverse firewall is started;
the random number extraction of the first ciphertext to obtain a second random number comprises:
encoding the first ciphertext by using a second preset injective function so as to map the first ciphertext to an input space of a second preset pseudorandom permutation function and obtain second encoding information;
if the second coded information already exists, alarming and reminding are carried out, and all message transmission is blocked;
if the second coding information does not exist, recording the second coding information, and replacing the second coding information by using a second preset pseudorandom replacement function and a key of the second preset pseudorandom replacement function to obtain a second random number, wherein the key of the second preset pseudorandom replacement function is injected from the outside or automatically generated when the first password reverse firewall is started.
2. The method of claim 1, wherein the performing public key re-randomization of the first public key according to the first random number to obtain a second public key comprises:
and performing public key re-randomization processing on the first public key according to the first random number by using a preset public key re-randomization function to obtain the second public key.
3. The method of claim 1, wherein the ciphertext derandomization of the first ciphertext according to the second random number to obtain a second ciphertext comprises:
and carrying out ciphertext randomization again on the first ciphertext according to the second random number and the second public key by using a preset ciphertext randomization function so as to obtain the second ciphertext.
4. The method of claim 1, wherein the processing the second ciphertext according to the first random number to obtain a third ciphertext comprises:
and recovering the second ciphertext according to the first random number by using a preset ciphertext recovery function to obtain the third ciphertext.
5. The method as claimed in any one of claims 1 to 4, wherein the messages received and sent by the first and second cryptographic reverse firewalls satisfy a six-tuple format, and if not, an alarm alert is performed, wherein the six-tuple format includes a protocol type identifier, a session identifier, a message sending entity identifier, a message receiving entity identifier, a message content and joint data of the message.
6. The method of claim 5, wherein the method further comprises:
after receiving the first public key, the second password reverse firewall generates the internal session unit and marks the internal session unit, wherein the marking information comprises the protocol type identifier, the session identifier and the message receiving entity identifier;
after receiving the second ciphertext, the second password reverse firewall further searches whether the internal session unit exists, and if not, alarms and reminds; if so, the internal session unit is run.
7. The method of claim 5, wherein the method further comprises:
after receiving the second public key, the first password reverse firewall generates the internal session unit and marks the internal session unit, wherein the marking information comprises the protocol type identifier, the session identifier and the message sending entity identifier;
after receiving the first ciphertext, the first password reverse firewall further searches whether the internal session unit exists, and if not, alarms and reminds; if so, the internal session unit is run.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010978321.4A CN114205073B (en) | 2020-09-17 | 2020-09-17 | Password reverse firewall and security defense method thereof |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010978321.4A CN114205073B (en) | 2020-09-17 | 2020-09-17 | Password reverse firewall and security defense method thereof |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114205073A CN114205073A (en) | 2022-03-18 |
| CN114205073B true CN114205073B (en) | 2023-01-17 |
Family
ID=80644644
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010978321.4A Active CN114205073B (en) | 2020-09-17 | 2020-09-17 | Password reverse firewall and security defense method thereof |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114205073B (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115134361B (en) * | 2022-06-20 | 2024-04-26 | 中汽创智科技有限公司 | Cross-platform communication method and device for automatic driving software platform |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20060190998A1 (en) * | 2005-02-17 | 2006-08-24 | At&T Corp | Determining firewall rules for reverse firewalls |
| CN111277413B (en) * | 2020-03-06 | 2021-08-06 | 电子科技大学 | Reverse password firewall method suitable for proxy re-encryption |
-
2020
- 2020-09-17 CN CN202010978321.4A patent/CN114205073B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN114205073A (en) | 2022-03-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Pachghare | Cryptography and information security | |
| KR101404755B1 (en) | Method for securely communicating information about the location of a compromised computing device | |
| CN110891066B (en) | Proxy anonymous communication method based on homomorphic encryption scheme | |
| EP2361462B1 (en) | Method for generating an encryption/decryption key | |
| US9819486B2 (en) | S-box in cryptographic implementation | |
| KR20100124315A (en) | Method and apparatus for detecting unauthorized access to a computing device and securely communicating information about such unauthorized access | |
| Obert et al. | Recommendations for trust and encryption in DER interoperability standards | |
| Saxena et al. | Efficient signature scheme for delivering authentic control commands in the smart grid | |
| CN114205073B (en) | Password reverse firewall and security defense method thereof | |
| AlJabri et al. | [Retracted] A Comprehensive Review of Lightweight Authenticated Encryption for IoT Devices | |
| CN111049738A (en) | E-mail data security protection method based on hybrid encryption | |
| Justindhas et al. | Secured model for internet of things (IoT) to monitor smart field data with integrated real-time cloud using lightweight cryptography | |
| Alimohammadi et al. | Performance analysis of cryptography methods for secure message exchanging in VANET | |
| Song et al. | Semda: Secure and efficient multidimensional data aggregation in smart grid without a trusted third party | |
| Azaim et al. | Design and implementation of encrypted SMS on Android smartphone combining ECDSA-ECDH and AES | |
| CN113807534A (en) | Model parameter training method and device of federal learning model and electronic equipment | |
| Thapar et al. | A study of data threats and the role of cryptography algorithms | |
| EP2985749A2 (en) | Symmetric encryption device, and method used | |
| CN113595982B (en) | Data transmission method and device, electronic equipment and storage medium | |
| Canard et al. | Towards practical intrusion detection system over encrypted traffic | |
| Abduljabbar et al. | Robust scheme to protect authentication code of message/image documents in cloud computing | |
| Yap et al. | On the security of a lightweight authentication and encryption scheme for mobile ad hoc network | |
| Aissa et al. | An approach using stream cipher algorithm for image encryption and decryption | |
| Momani | Cryptography Approaches in Wireless Sensor Networks a Survey Study | |
| Zhang et al. | On the security of Kim et al. two ID‐based broadcast signcryption schemes |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |