RU2425455C1 - Method of protecting information in burst transmission radio network - Google Patents

Abstract

FIELD: information technology. ^ SUBSTANCE: in the method, before radio communication on each user station, cryptographic algorithms are prepared for operation by obtaining variables for generating a first pseudorandom number (PRN1) and a second pseudorandom number (PRN2). The cryptographically protected information is transmitted using a combination cipher defined by PRN1 and PRN2, and synchronised sequences making up the packet, wherein each of these two parts of the packet are modulated with different frequencies defined by PRN2. The cryptographic algorithms are then synchronised in the burst transmission radio network (BTRN) through transmission of current values of PRN1 and PRN2. At the receiving side, the BTRN receives the transmitted digital information by splitting the received mixture into two components: service and encoded information in case of synchronisation of cryptographic algorithms in the BTRN, or service and protected information in case of decryption of the transmitted combined cipher. ^ EFFECT: protected mode of operation with self-recovery of a burst transmission radio network during passive attack. ^ 1 dwg

Description

The invention relates to the field of radio engineering and may find application in adaptive systems of special radio communications for transmitting data over a radio channel under the influence of a complex of intentional interference.

A known method of generating a sync sending of a cryptographic algorithm while ensuring confidentiality and / or security of data packets transmitted in a communication system described in [1], in which for communication systems with multiple access, the sync package is formed from unique values assigned to each communication resource within which the transfer of protected data packets, while before starting work or in the process of performing connected functions, synchronize the timelines of communication devices and assign unique values to the communication resources, and the distribution of this information is carried out by organizational methods or through trusted channels, when transmitting or receiving a data packet based on previously distributed information, a unique value is determined that was previously assigned to the communication resource within which the data packet will be transmitted or received, when processing the transmitted or of the received data packet, the data packet is encrypted and / or imitated using the generated sync packet, and in the case of checks imitozaschischennosti produce a message authentication code and collate it with data received in the packet, while in the case of coincidence produced and adopted imitovstavok believe that the received packet is valid, otherwise it is considered that the received packet is false.

The disadvantage of this method is that the synchronization of communication devices occurs once, which limits the ability to dynamically change the number of network elements.

A known method of communication described in [2], in which the transmitted data is encrypted using random numerical data used as a key, and random numerical data is encrypted using a cryptographic key shared with the receiving party, encrypted random numerical data is transmitted together with encrypted the transmitted data from the transmitting side to the receiving side, the encrypted random numeric data is decrypted using a common cryptographic key, and the encrypted transmitted the data is decrypted on the receiving side with the help of decrypted random numerical data used as a key, and the method involves generating secret private keys individual for objects, carried out at the center of the network, by converting identifiers individual for objects, using the center algorithm, which includes an algorithm integral transformation with a weight function, stored only in the center and being common to these objects, distribution of the generated private secret key her and the specified integral conversion algorithm with a weight function from the specified center to each of the specified objects, and generating the specified common cryptographic key for the specified transfer of the transmitted data by applying the integrated conversion algorithm with the weight function and the secret private key stored by each of the objects to the identifier, individual for another object with which communication is provided.

The disadvantage of this method is the high complexity of providing cryptographic protection based on the center of the network, the failure of which will entail a malfunction in the functioning of the entire network.

The closest in technical essence to the claimed method is the method according to the patent [3], adopted as a prototype.

The prototype method is as follows.

In a radio network for packet data transmission (RAPD) comprising at least one station of a network operator and a plurality of user stations (MS), information is exchanged. MS transmit message data to each other, directly or through intermediate stations. When the station is included in the first communication session, it transmits key request messages to the operator station. Other authorized stations will not communicate with the new station, but will transmit a key request message to the network operator's station. The network operator’s station will transfer the necessary keys back to the new station through other stations to give the new station permission to operate on the network. Each MS periodically transmits key sensing signals to other stations through its public key.

Based on the description of the work of the prototype method, we can conclude that it is not adapted to work in conditions of special communication. These conditions imply the functioning of the substation in the conditions of "information war", that is, their ability to withstand unauthorized access to data passing through it. This ability can be ensured by the combined use of [4, 9] means of cryptographic information protection (Cryptographic Protection) and pseudo-random tuning of the operating frequency (MFC), and the CMS and MFC should be used in network operation, which implies the following.

Modern communication networks are a combination of a large number of mobile PS operating synchronously. The word "mobile" implies that any of the substations may temporarily go out of network synchronism (disconnect, move beyond the network coverage area, etc.). In order to return to the network and continue data exchange with other network subscribers, she needs to restore synchronous operation mode with them. The restoration of synchronism is understood primarily as the restoration of synchronism in the cryptographic information protection (generation of the same pseudorandom numbers) and frequency hopping (data exchange at the same frequencies). This can be achieved only by introducing a special algorithm for stopping the overall synchronous operation of the network and exchanging some information with all substations of the RPPD (including the subscriber who wants to enter the network) in order to restart the network based on this information. The absence of such algorithms makes all the other possible ways to improve the network operation meaningless if it does not have the ability to repair itself.

In addition, ensuring the overall synchronous operation of the network should not be provided only by a certain center, since it will be enough for the enemy to disable the center in order to disable the entire network. Therefore, any substation should be able to organize synchronous operation.

Thus, the object of the invention is to protect data from unauthorized access simultaneously with the self-healing of the network.

The technical result achieved in this case is the ability to provide a protected mode of operation for a communication network consisting of mobile subscribers during passive enemy attacks.

The specified technical result is achieved using the proposed method of protecting information in a radio network with packet data transmission, the essence of which is as follows:

- before the start of the radio exchange, at each user station (PS), cryptographic algorithms are prepared for operation, for which digital constants K1 of size x _i bits and K2 of size x ₂ bits are determined individually for each PS, as well as a digital constant K5 of the total radio network size z bits that are loaded into the PS when it is turned on; further, the constants K1 and K2 are converted into two other digital constants K3 and K4 of size y ₁ ≥x ₁ and y ₂ ≥x ₂ bits, respectively;

- on the transmitting side, during the time interval T ₁ , cryptographically protected information is transmitted, for which the incoming digital information is encoded with an error-correcting code common to the whole RRAP, the encoded data in blocks of y ₁ bits are added modulo 2 with the first pseudorandom number (PSCH1) of size y ₁ bit, thereby obtaining encrypted data stream cipher that y in blocks of ₂ bits are summed modulo 2 with the second pseudo-random number (PSCH2) y ₂ bits in size, resulting in a data encrypted Raman codes that y in blocks of ₂ bits are combined with the synchronization sequence, forming the data packet, then each of the above obtained two-part package (synchronization sequence and the encrypted block) modulated by different frequencies determined PSCH2 modulated radio transmitted data packet reception side RPPD; further, they generate PSCH1 and PSCH2 according to the cryptographic algorithms g ₁ and g ₂ , respectively, using K5, and each received PSCH1 serves as the initial state for generating the next PSCH1 using K5, and each received PSCH2 serves as the initial state for generating the next PSCH2 using K5 ;

- on the transmitting side, during the time interval T ₂ , cryptographic algorithms are synchronized, for which x ₁ bit of the current value of the PSCH1 and x ₂ bits of the current value of the PSCH2 are encoded by an error-correcting code common to the entire RPSD, the encoding result is combined with the sync sequence to form a data packet; further, each of the three parts of the packet obtained above (a sync sequence encoded x ₁ bit and encoded x ₂ bits) is modulated with different frequencies determined by the PSCH2, the modulated data packet is transmitted over the radio channel to the receiving side of the RRAP m times, where m is determined experimentally; then x ₁ bit of the current value of PSCh1 and x ₂ bits of the current value of PSCh2 are converted into digital constants K3 and K4, generate PSCh1 and PSCh2 according to the corresponding cryptographic algorithms g ₁ and g ₂ using K5, which is the key of the algorithms g ₁ and g ₂ ;

- at the same time, on the transmitting side of the RIPD, after the cryptographic algorithms are prepared for operation, as the CR arrives during the time interval T ₂ , the cryptographic algorithms are synchronized, and then the cryptographically protected information is transmitted during the time interval T ₁ , and the number of time intervals T ₁ is determined by the volume incoming QI, which must be transmitted;

- cryptographic algorithms are synchronized on the receiving side of the RRAP, for which, during the time interval T ₂ , signals are received, which are a mixture of the above-formed packets and interference simultaneously at all frequencies; divide the received mixture into two components - service (SS), containing a mixture of sync sequences with interference, and coded information (CIS), containing a mixture of encoded x ₁ bits and encoded x ₂ bits with interference; SSs are demodulated and converted into a sequence of decisions, which is compared with the codes of the expected sync sequences, and the result of the comparison is used for phase-locked loop; CIS is demodulated using phase-locked loop, from the demodulated packet, ₁ bit of the current value of the PSN1 and x ₂ bits of the current value of the PSN2 of the transmitting side are encoded with a noise-resistant code, decode them, and the above reception of the RPSD signals is repeated m times, resulting in the final values of x ₁ bit of the current value of PSCH1 and x ₂ bits of the current value of PSCH2 of the transmitting side, which are converted into digital constants K3 and K4;

- further, on the receiving side of the RPDD, during the time interval T ₁ , cryptographically protected information is received, for which PSCH1 and PSCH2 are generated according to the cryptographic algorithms g ₁ and g ₂ , respectively, using K3, K4 and K5, and hereinafter each received PSCH1 is used in as the initial state for the generation of the next PSCH1 using K5, and each obtained PSCH2 is used as the initial state for the generation of the next PSCH2 using K5; further, the mixture of the useful signal and interference is received simultaneously at all frequencies, each of which belongs to a group of frequencies known at the receiving and transmitting sides of the RRAP; further, the received mixture is divided into two components - SS and encrypted information (VMS) containing a mixture of encrypted bits with interference; The SS is demodulated on the basis of the previously developed PSCH2 and converted into a sequence of decisions, which is compared with the codes of the expected sync sequences, the comparison result is used for phase-locked loop; VMS is demodulated based on the previously developed PSCH2 using phase-locked loop; Further, a combination cipher composed of demodulated VMSs with a size of y ₂ bits is summed with PSC2, resulting in a stream cipher, which is summed with blocks of _{1 1} bits from PSC1, resulting in data encoded by a noiseless code that decodes, resulting in What does the transmitted QI receive?

- at the same time, on the receiving side of the RIPD, as the DT arrives during the time interval T ₂ , cryptographic algorithms are synchronized, and then, during the time interval T ₁ , cryptographically protected information is received, and the number of time intervals T ₁ is determined by the amount of received DT to be transmitted .

The inventive method of protecting information in a radio network with packet data is as follows.

Before the start of the radio exchange of each substation, cryptographic algorithms are prepared for operation in accordance with the ALG0 algorithm, which includes the sequence of the following actions.

1. Two digital constants, individual for each user station (PS), are determined: K1 and K2 of size x ₁ and x ₂ bits, respectively, as well as a digital constant K5 of size z bits for the entire radio network, which are loaded into the PS when it is turned on. The values of the constants K1 and K2 can represent, for example, some functions of the network address of the MS, which includes this radio modem.

2. The constants K1 and K2 are converted to two other constants K3 and K4 of size y ₁ ≥x ₁ and y ₂ ≥x ₂ bits, respectively. The conversion may consist, for example, in a simple duplication of certain bits. Thus, y ₁ = f ₁ (x ₁ ) and y ₂ = f ₂ (x ₂ ). The constants K3 and K4 are not yet pseudo-random numbers (PSN), but are only the initial (zero) state for generating the first pseudo-random number (PSN1) and the second pseudo-random number (PSN2).

3. The development of PSCH1 and PSCH2 occurs according to the first cryptographic algorithm (hereinafter referred to as g ₁ ) and the second cryptographic algorithm (hereinafter referred to as g ₂ ), respectively, using the constant K5, which is the key of the algorithms g ₁ and g ₂ , and, g ₁ is different from g ₂ . The corresponding PSCH1 and PSCH2 generated by the g ₁ and g ₂ algorithms can later be used for transmitting a combination cipher by RAPD [9].

The transfer of cryptographically protected information on the transmitting side of the RAPD occurs in accordance with the ALG1 algorithm, including the sequence of the following actions.

1. The incoming digital information is encoded by an error-correcting code common to the entire RAPD.

2. The coded data in blocks of y ₁ bit are summed modulo 2 with the first pseudo-random number (PSN1) of size y ₁ bit. As a result of summing with PSCH1, the encoded data becomes the data encrypted by the stream cipher [9].

3. The resulting stream cipher in blocks of y ₂ bits is added modulo 2 with a second pseudo-random number (ПСЧ2) of size y ₂ bits. As a result of summing with PSCH1 and PSCH2, the encoded data becomes the data encrypted with a combination cipher.

4. The encrypted data on y ₂ bits are combined with the sync sequence, forming a data packet. In this case, the encrypted data is the information component (IP) of the packet, and the sync sequence is its service component (SS).

и определяется экспериментальным путем. Номера этих частот имеют размер не менее x₂ бит каждая.5. Each of the two parts of the packet (SS and IS) is modulated by different frequencies determined by PSCH2. The number of these frequencies is within

and is determined experimentally. The numbers of these frequencies have a size of at least x ₂ bits each.

6. The modulated data packet over the air is transmitted to the receiving side of the RAPD.

7. The generation of PSCh1 and PSCh2 occurs according to the cryptographic algorithms g ₁ and g ₂ , respectively, using the constant K5. Each received PSCh1 serves as an initial (zero) state for generating the next PSCh1 using constant K5. Each received PSCh2 serves as an initial (zero) state to generate the next PSCh2 using constant K5.

Work in accordance with ALG1 is carried out over a period of time T ₁ , sec, determined experimentally. The combination cipher obtained in this case ensures the confidentiality of the information circulating in the RAPD, and the modulation with pseudorandom frequencies ensures its secrecy.

However, to maintain the synchronism of the operation of the radio communication system as a whole, during the exchange of encrypted information between the transmitting and receiving sides after completing the work on ALG1 described above, the transmitting side of the RDPD synchronizes cryptographic algorithms in accordance with the ALG2 algorithm, including the sequence of the following operations.

1. Certain bits of the current value of PSCH1 (in the amount of x ₁ ), called the first current timestamp (TBM1), are encoded by a noise-resistant code common to the entire RPSD.

2. Certain bits of the current value of PSCh2 (in the amount of x ₂ ), called the second current time stamp (TBM2), are encoded by a noise-resistant code common to the entire RPSD.

3. TBM1 and TBM2 are combined with the sync sequence to form a data packet. At the same time, TBM1 and TBM2 constitute the packet IC, and the sync sequence is the packet SS.

4. Each of the three components of the package:

the synchronization sequence, TBM1 and TBM2 are modulated by different frequencies, belonging to a certain frequency group (w ₁ , ..., w _k ), known on the receiving and transmitting sides of the RPPD. As a result of the modulation, a modulated radio frequency signal is obtained, which is transmitted to the receiving side of the RPSD.

5. In order to increase the probability of receiving a packet formed according to claims ₁ to 4, if any frequencies from (w ₁ , ..., w _k ) are corrupted, the operations according to claim 4 are repeated m times, where m is determined experimentally.

6. TBM1 and TBM2 are converted (“multiplied”) into constants K3 and K4 of size y ₁ ≥x ₁ and y ₂ ≥x ₂ bits, respectively, according to the functions f ₁ and f ₂ : y ₁ = f ₁ (x ₁ ) and y ₂ = f ₂ (x ₂ ).

7. The generation of PSCh1 and PSCh2 is performed using cryptographic algorithms g ₁ and g ₂ , respectively, using the constant K5 of size z bits, which is the key of the algorithms g ₁ and g ₂ .

Work in accordance with ALG2 is carried out over a period of time T ₂ , sec, determined experimentally.

After the transmitting side of the RAPD acts according to the ALG0 algorithm, the work of the transmitting side of the RAPD corresponds to ALG2 during T ₂ and, during T ₁ , corresponds to ALG1. The number of ALG1 corresponds to the amount of incoming QI, which must be transmitted.

At the receiving side, the RPSD receives from the radio channel the signals transmitted by the transmitting side of the RPSD, which are a mixture of packets received by ALG1 and ALG2, and interference.

To isolate the QI from this mixture, cryptographic algorithms are synchronized first on the receiving side of the RAPD in accordance with the ALG3 algorithm, including a sequence of the following operations.

1. A mixture of the useful signal and interference is received simultaneously at all frequencies, each of which belongs to a group of frequencies (w ₁ , ..., w _k ), known at the receiving and transmitting sides of the RPSD.

2. The separation of the adopted mixture in the SS and IP.

3. The SS is demodulated and converted into a sequence of decisions.

4. The resulting sequence of solutions is compared with the codes of the expected sync sequences, and the comparison result is used for phase-locked loop.

5. The IC is demodulated using phase locked loop.

6. From the demodulated packet, the TBM1 and TBM2 encoded error-correcting codes are extracted.

7. There is a decoding of TBM1 (size x ₁ bit) and TBM2 (size x ₂ bit).

8. Items 1-7 are repeated m times. Their result is the receiving side of TBM1 and TBM2. The need for m-fold repetition is to increase the probability of receiving a packet generated by ALG2 if any frequencies from (w ₁ , ..., w _k ) are corrupted.

9. TBM1 and TBM2 are converted to constants K3 and K4 of size y ₁ ≥x ₁ and y ₂ ≥x ₂ bits, respectively, according to the functions f ₁ and f _2: y ₁ = f ₁ (x ₁ ), and y ₂ = f ₂ (x ₂ ).

Reception of cryptographically protected information on the receiving side of the RAPD occurs in accordance with the ALG4 algorithm, including the sequence of the following actions.

1. PSCH1 and PSCH2 are generated by cryptographic algorithms g ₁ and g ₂ , respectively, using a constant K5 of size z bits (which is the key of algorithms g ₁ and g ₂ ) and constants K3 and K4 (which are the initial (zero) state of the algorithms ) In the future, each received PSCH1 serves as the initial (zero) state for generating the next PSCH1 using the constant K5, and each received PSCH2 serves as the initial (zero) state for generating the next PSCH1 using the constant K5.

2. A mixture of the useful signal and interference is received simultaneously at all frequencies, each of which belongs to a group of frequencies (w ₁ , ..., w _k ), known at the receiving and transmitting sides of the RPSD.

3. There is a separation of the adopted mixture into SS and IP.

4. SS is demodulated on the basis of ПСЧ2, developed by ALG3, and converted into a sequence of decisions.

5. The resulting sequence of solutions is compared with the codes of the expected sync sequences, and the comparison result is used for phase-locked loop.

6. The IC is demodulated based on the PSCh2 generated by ALG3, using phase-locked loop.

7. The combination code composed of demodulated ICs according to claims 1-6 (size y ₂ bits) is summed with PSCH2 (size y ₂ bits) generated by ALG3. As a result of summing with ПСЧ2, the combination cipher becomes a stream cipher.

8. The resulting stream cipher in blocks of y ₁ bit is summed with PSCH1, (size y ₂ bits). As a result of summing with PSCH1, the encrypted data becomes data encoded by an error-correcting code.

9. Decoding of the decrypted data occurs, as a result of which the transmitted DI is obtained.

In the future, as the mixture of the useful signal and interference arrives, the operation of the receiving side of the RPPD corresponds to work on ALG3 for T ₂ and then for T ₁ to work on ALG4. The number of ALG4 corresponds to the amount of incoming QI, which must be transmitted.

Thus, the claimed method makes it possible to self-repair the network and maintain a synchronous mode of operation between substations during passive attacks of the enemy on the communication network. In addition, since the encryption of encoded data is carried out by a stream cipher, the claimed method allows encrypting large streams of information, since only stream ciphers prevent the effect of error propagation and provide maximum encryption speeds [9].

Functional diagram of a device for implementing the inventive method is shown in figure 1, where the following notation:

1 - analog-to-digital Converter (ADC);

2 - the first interface (I1);

3 - the first control unit (BU1);

4 - second interface (I2);

5 - the first antenna-feeder unit (AFB1);

6 - the first switch (K1);

7 - the second control unit (BU2);

8 - first adder (C1);

9 - the second switch (K2);

10 - second adder (C2);

11 - the third switch (K3);

12 - packer;

13 - transmitting unit (BOP);

14 - third interface (I3);

15 - the first frequency synthesizer (MF1);

16 - the first register (P1);

17 - the second register (P2);

18 - the third register (P3);

19 - the fourth register (P4);

20 - code sequence generator (GKP);

21 - the second frequency synthesizer (MF2);

22 - the fourth interface (I4);

23 - fifth register (P5);

24 - the first block of cryptographic protection (BKZ1);

25 - the second block of cryptographic protection (BKZ2);

26 - clock generator (GTI);

27 - fifth interface (I5);

28 - the first shift register (PC1);

29 - sixth register (P6);

30 - amplifier-conversion unit (UPB);

31 - phase-locked loop (BFA);

32 - receiving unit (PRB);

33 - the fourth switch (K4);

34 - the second antenna-feeder unit (AFB2);

35 - block identification of the signal element (BOES);

36 ₁ ... 36 _k - comparison schemes (SS);

37 - multiplexer;

38 - the third block of cryptographic protection (BKZ3);

39 - the fourth block of cryptographic protection (BKZ4);

40 - seventh register (P7);

41 - third adder (C3);

42 - fourth adder (C4);

43 - the sixth interface (I6);

44 - fifth switch (K5);

45 - digital-to-analog converter (DAC);

46 - seventh interface (I7);

47 - the fourth frequency synthesizer (MF4);

48 - a comparator;

49 - eighth register (P8);

50 - ninth register (P9);

51 - third control unit (BU3);

52 - the fourth control unit (BU4);

53 - fifth control unit (BU5);

54 - sixth control unit (BU6);

55 - seventh control unit (BU7);

56 - the third frequency synthesizer (MF3);

57 - the second shift register (PC2).

A device for implementing the method comprises serially connected I1 2, ADC 1, K1 6, BU2 7, C1 8, K2 9, C2 10, K3 11, packetizer 12, PB 13 and AFB1 5, the output of which is the output of the device; connected in series AFB2 34, the input of which is the input of the device, UPB 30, BFA 31, PRB 32, K4 33, C4 42, C3 41, BU7 55, K5 44, DAC 45 and I7 46; serially connected I4 22, P5 23, P2 17, P1 16 and BKZ1 24, the output of which is connected to the second input P1 16, the second output of which is connected to the second input P2 17; serially connected I5 27, PC1 28, BKZ2 25, P3 18 and P4 19, the first output of which is connected to the second input P3 18, the second output of which is connected to the second input BKZ2 25. The second output I5 27 is connected to serially connected PC2 57, BKZ3 38 and P6 29.

The output of PC1 28 is connected, in addition, with BKZ1 24, and the output of PC2 57 is connected to BKZ4 39 and P7 40 in series. The third output P1 16 is connected to the second input C1 8; the third output P3 18 is connected to the second input C2 10; the second output P2 17 is connected to the first input BU3 51, the output of which is connected to the second input K2 9; the second output P4 19 is connected to the first inputs MF1 15, MF2 21 and BU4 52, the output of which is connected to the second input K3 11. The second output K4 33 is connected to the BU6 54, the output of which is connected to P9 50 connected to the second input P7 40, the first the second output of which is connected to the second input of BKZ4 39. The second output of P7 40 is connected to the second input of C3 41. The third output of K4 33 is connected to the first input of BU5 53, the output of which is connected to the first input of P8 49, the output of which is connected to the first inputs of SCh3 56 , MF4 47 and the second input P6 29, the output of which is connected to the second input BKZ3 38. The second output P6 29 is connected to the second input C4 42.

The second output of AFB2 34 is connected to the first input of BOES 35, the output of which is connected to the signal inputs k of comparison circuits (CC) 36 ₁ -36 _k , the outputs of which are connected to the corresponding k signal inputs of comparator 48 and multiplexer 37. The output of comparator 48 is connected to the address input multiplexer 37, the output of which is connected to the second input of BFA31.

The output I2 4 is connected to the input BU1 3, the first group of outputs of which is connected by a bus to the groups of inputs K1 6, BU2 7, BU3 51, BU4 52 and the third inputs of K2 9, K3 11, and the second group of outputs BU1 3 is connected by a bus to the groups of inputs K4 33 , K5 44, BU5 53, BU6 54 and BU7 55.

The output of the SCH 56 is connected to the second input of the UPB 30, and the output of the SCH 47 to the second input of the BOES 35. The output of I3 14 is connected to the third input of K1 6. The output of the circuit breaker 20 is connected to the second input of the packer 12. The second output of K5 44 is connected to I6 43.

The third output K2 9 is connected to the fourth input K3 11. The second output I4 22 is connected to the second input P4 19. The output of the MF1 15 is connected to the second input of the PB 13, and the output of the MF2 21 to the third input of the PB 13.

The output of the GTI 26 is connected to the clock inputs of the blocks 1,3, 35, 44, 45, 6-13, 15-21, 23-25, 28, 29, 31-33, 35, 37-42, 44, 45, 47- 49, 51-57, and also k CC 36 ₁ -36 _k .

The device operates as follows. On the transmitting side, a stream of analog information flows through I1 2 to ADC 1, where it is digitized. The resulting digital data stream, like the digital data stream coming through I3 14, through K1 6 enters to BU2 7, which encodes this stream based on the control signal from BU1 3. At the same time, K1 6 passes or data stream from I3 14, or a data stream from ADC 1, based on a control signal from BU1 3.

Coded data comes in blocks of y ₁ bit in C1 8, where they are added to the contents of P1 16 (size y ₁ bit), which is a pseudo-random value. The data encrypted in C1 8 is received in blocks of y ₂ bits through K2 9, based on the control signal from BU1 3, in C2 10, where they are added to the contents of P3 18 (size y ₂ bits), which is a pseudo-random value. The data encrypted a second time in C2 10 is transmitted through K3 11, based on the control signal from BU1 3, to the packetizer 12, where they are combined with the sync sequence coming from the HCP 20.

A packet formed in a packetizer 12 and consisting of two parts — encrypted information and a synchronization sequence — arrives at PB 13, where it is converted into a modulated radio frequency signal, which is transmitted to the receiver using AFB1 5. Each of the two parts of the packet is modulated by different frequencies supplied to the packetizer 13 from MF1 15 and MF2 21. The numbers of these frequencies (up to x ₂ bits each) are received in MF1 15 and MF2 21 from P4 19.

Two digital constants of size x ₁ and x ₂ bits, respectively, are transmitted through I4 22 to P5 23 and P4 19. These constants must be individual for each network radio modem and can represent, for example, some functions of the network address of that MS which includes this radio modem. The constant from P5 23 is rewritten in P2 17. Thus, the initial loading of blocks 17 and 19 is carried out, having dimensions, respectively, x ₁ and x ₂ bits.

Blocks 16 and 18 must be sized, respectively, y ₁ ≥x ₁ and y ₂ ≥x ₂ bits. Therefore, the values of blocks 17 and 19 must "multiply" into the values of blocks 16 and 18 according to the functions f ₁ and f ₂ . "Reproduction" may consist, for example, in a simple duplication of certain bits. Thus, y ₁ = f ₁ (x ₁ ) and y ₂ = f ₂ (x ₂ ).

At initial loading, the values of P1 16 and P3 18 are not yet a pseudo-random number, but are only the initial (zero) state of blocks 24 and 25, respectively. Therefore, to generate pseudorandom numbers used to sum with the incoming data in C1 8 and C2 10, the value of P1 16 goes to BKZ1 24, and the value of P3 8 to BKZ2 25. In blocks 24 and 25, the generation of pseudorandom numbers by cryptographic algorithms g ₁ and g ₂ , respectively. The development takes place on the basis of the value of PC1 28, loaded into BKZ1 24 and BKZ2 25 and supplied to PC1 28 through I5 27. This value is a constant of size z bits, which is the key of the cryptographic algorithms g ₁ and g ₂ . If the cryptographic algorithm consists of several cycles, after each cycle in block 28 there is a shift by d bits.

The resulting pseudo-random numbers are loaded from BKZ1 4 to P1 16 and from BKZ2 25 to P3 18, respectively, and the resulting values of P1 16 and P2 18 are used to sum with the incoming data in C 1 8 and C2 10. Thus, the speed of block 24 should be such as to generate a pseudo-random number before entering the next block of data in block 8, and the speed of the block 25 - to generate a pseudo-random number before arriving in block 10 of the next data block.

The presence of encoders in the modem ensures the confidentiality of the information circulating in the network. However, to maintain synchronization of the modem operation on the transmitting and receiving sides, instead of transmitting encrypted data according to the main algorithm (described above), the following procedure is provided every T seconds:

1) certain bits (in the amount of x ₁ ) from the current value of block 16 are loaded into block 17;

2) certain bits (in the amount of x ₂ ) from the current value of block 18 are loaded into block 19;

3) the value of block 17, called TBM1, enters BU3 51, which encodes TBM1 based on the control signal from BU1 3;

4) based on the control signal from BU1 3, the encoded TBM1 through K2 9 enters K3 11;

5) based on the control signal from BU1 3 through K3 11, encoded TBM1 enters the packetizer 12;

6) the value of block 19, called TBM2, enters the BU4 52, which encodes the TBM2 based on the control signal from BU1 3;

7) based on the control signal from BU1 3 through K3 11, the encoded TBM2 enters the packetizer 12;

8) in the packetizer 12 there is a combination of TBM1 and TBM2 with the sync sequence coming from GKP 20;

9) the packet formed in the packetizer 12 and consisting of three parts: the sync sequence, TBM1 and TBM2, enters the PB 13, where it is converted into a modulated radio frequency signal, which is transmitted to the recipient using AFB1 5;

10) each of the three parts of the packet is modulated by different frequencies arriving at the packetizer 13 from MF1 15 and MF2 21, and the numbers of these frequencies (up to x ₂ bits each) arrive at MF1 15 and MF2 21 from P4 19;

11) points 9.10 are repeated m times.

After completion of the procedure, consisting of paragraphs 1-11, the values of blocks 17 and 19 should "multiply" in the values of blocks 16 and 18 according to the functions f ₁ and f ₂ . After that, the work of the transmitting part of the device corresponds to the work of transmitting encrypted data according to the main algorithm.

At the receiving end, the input signal, which is a mixture of the useful signal and interference, is received by AFB2 34, where it is divided into service and information components.

The part of the input signal containing the service component from the second output of AFB2 34 is fed to the first signal input of BOES 35. The sequence of random elements of the mixture is converted into BOES 35 into a random sequence of decisions about the symbols corresponding to the received elements of the signal using the reception frequency obtained at the second output MF4 47 based on the value supplied from the output of P8 49. This sequence of decisions about symbols in the general case due to the action of interference does not coincide with any of the sequences of symbols of the elements which were used on the transmitting side in the formation of the sync sequences in the HCP 20. In BOES 35, the mixture of the signal element and the interference is optimally processed, and at its output a sequence of decisions is made about which element of the sync sequence (logical "0" or logical "1") worked . The obtained sequence of decisions about symbols is compared element by element with the codes of the expected sync sequences in the corresponding CC 36 ₁ -36 _k .

The comparison results from the outputs of the CC 36 ₁ -36 _k are fed to the comparator 48, which sets the maximum of k input values. This maximum determines the control signal for the multiplexer 37.

The comparison results from the outputs of the CC 36 ₁ -36 _k are also provided to the corresponding signal inputs of the multiplexer 37, in which, based on the control signal coming from the comparator 48, one of the k inputs is selected, the signal from which is output to the multiplexer 37 to second signal input BFA 31.

Another part of the input signal containing the information component is fed to the first input of the UPB 30, in which the spectrum of the input signal is shifted to the intermediate frequency at which the main signal processing is performed, followed by amplification of the intermediate frequency signal.

The conversion to the reception frequency occurs in the UPB 30 based on the frequency received from the output of MF3 56 based on the value supplied from the output of P8 49.

The signal from the output of the UPB 30 is fed to the first signal input of the BFA 31, in which the exact phase adjustment of the information component and the clock sequence based on the service component occurs. The signal from the output of the BFA 31 is fed to the signal input of the PRB 32, where it is demodulated.

From the output of block 32, the encrypted data is received in blocks of y ₂ bits through K4 33, based on the control signal from BU1 3, to C4 42, where they are added to the contents of P6 29 (size y ₂ bits), which is a pseudo-random value. After block 42, the encrypted data arrives in blocks of y ₁ bit in C3 41, where they are added to the contents of P7 40 (size y ₁ bit), which is also a pseudo-random value.

To generate pseudo-random numbers used for summing with encrypted data in C4 42 and C3 41, the value of P6 29 goes to BKZ3 38, and the value of P7 40 goes to BKZ4 39. In blocks 38 and 39, pseudorandom numbers are generated by cryptographic algorithms g ₂ and g ₁ , respectively. The development takes place on the basis of the value of PC2 57, loaded into BK3Z 38 and BKZ4 39 and supplied to PC2 57 through I5 27. This value is a constant of size z bits, which is the key of the cryptographic algorithms g ₁ and g ₂ . If the cryptographic algorithm consists of several cycles, after each cycle in block 57, a shift by d bits occurs.

The decrypted data stream from the output C3 41 receives the BU7 55, which decodes this stream on the basis of the control signal from the BU1 3. From the output of the BU7 55, through K5 44, on the basis of the control signal from the BU1 3, the flow goes to external devices either through block 43 or , after conversion to an analog signal in the DAC 45, through block 46.

Based on the described operation algorithm, it follows that error-free decoding of data on the receiving side depends on the state of P6 29 and P7 40. To maintain synchronism of the modem on the transmitting and receiving sides, instead of receiving encrypted data according to the main algorithm (described above), it takes two every T seconds digital constants of size x ₁ and x ₂ bits, respectively. The constants, based on the control signal from BU1 3, come through K4 33 to BU6 54 and BU5 53, respectively. Decoded on the basis of the control signal from BU1 3, in BU6 54 and BU5 53 constants are recorded, respectively, in P9 50 and P8 49.

Thus, the initial loading of blocks 50 and 49 is carried out, having dimensions, respectively, x ₁ and x ₂ bits.

Blocks 40 and 29 are sized, respectively. y ₁ ≥x ₁ and y ₂ ≥x ₂ bits. Therefore, the values of blocks 50 and 49 must be converted to the values of blocks 40 and 29 according to the functions f ₁ and f _2. , identical on the receiving and transmitting sides. That is, y ₁ = f ₁ (x ₁ ), and y ₂ = f ₂ (x ₂ ).

BU1 3 controls the operation of blocks 6, 7, 9, 11, 33, 44, 51-55 based on the control program received via the I2 4 interface.

From the GTI 26 output to blocks 1, 3, 35, 44, 45, 6-13, 15-21, 23-25, 28, 29, 31-33, 37-42, 47-57 and also to k CC 36 ₁ -36 _k clock pulses are supplied, which determine the beginning of each microoperation, as a result of which synchronization of the operation of the device as a whole is ensured.

BPA 31 can be implemented in the form of schemes for linking the clock signal to the bit intervals of the received data [5, Chapter 9]. BOES 35 can be implemented as a decisive device [6, Chapter 7.4]. CC 36-36 _k can be implemented as discrete matched filters [6, chapter 7.4-7.5].

PB 13 and PRB 32 can be implemented as processors of the Motorola DSP56800 family [7, pp. 1-11, chapter 5]. Blocks 24, 25, 38, 39 can be implemented as any of the block or stream ciphers described in [3].

The implementation of other blocks of the device can be carried out using digital devices known from the technical literature.

Thus, the device for implementing the method allows for the entry of subscribers who have left the general synchronous operation mode of the network back into the network, as well as provide communication between different subnets [8] or relay.

Information sources

1. RF patent for the invention No. 2287222 "Method for generating sync sending of a cryptographic algorithm in communication systems with ensuring the security and confidentiality of transmitted messages", A.V. Sharamok, I.E. Grechnev, 2005.

2. RF application for the invention No. 98117712 "Method for communicating using a common cryptographic key (options)." Baba Yoshimi, 2000

3. RF patent for the invention No. 2201036 "Protected radio network for packet data transmission", 1998, Larsen M., Larsen J.

4. Borisov V.I. and others. Interference immunity of radio communication systems with the expansion of the signal spectrum by the method of pseudo-random tuning of the operating frequency. - M .: Radio and communications, 2000.

5. S.N. Sukhman, A.V. Bernov, B.V. Shevkoplyas. Synchronization in telecommunication systems. Analysis of engineering solutions. - M .: Eco-Trends, 2003.

6. Pestryakov VB "Noise-like signals in information transmission systems", M., Soviet Radio, 1973.

7. Technical support of digital signal processing, Reference. Kupriyanov M.S., Matyushkin B.D., Ivanova V.E., Matvienko N.I., Usov D.Yu. - SPb. The Fort, 2000.

8. P. Roshan, J. Lieri. The basics of building wireless LAN standard 802.11. Per. and English. M .: Williams Publishing House, 2004.

9. A.P. Alferov, A.Yu. Zubov, A.S. Kuzmin, A.V. Cheremushkin. The basics of cryptography. Helios ARV, 2005.

Claims (1)

A method of protecting information in a radio network with packet data transmission (RAPD), which consists in the fact that:
- prior to the beginning of the radio exchange, at each user station (PS), cryptographic algorithms are prepared for operation, for which digital constants K1 of size x ₁ bit and K2 of size x ₂ bits are determined individually for each PS, as well as a digital constant K5 of the total radio network size z bits that are loaded into the PS when it is turned on; further, the constants K1 and K2 are converted into two other digital constants K3 and K4 of size ₁ ≥x ₁ and ₂ ≥x ₂ bits, respectively, which are parameters for generating the first pseudo-random number (PSCH1) and the second pseudo-random number (PSCH2), respectively;
- on the transmitting side, during the time interval T ₂ , cryptographic algorithms are synchronized, for which x ₁ bit of the current value of the PSCH1 and x ₂ bits of the current value of the PSCH2 are encoded by an error-correcting code common to the entire RPSD, the encoding result is combined with the sync sequence to form a data packet; further, each of the three parts of the packet obtained above (a sync sequence encoded x ₁ bit and encoded x ₂ bits) is modulated with different frequencies determined by the PSCH2, the modulated data packet is transmitted over the radio channel to the receiving side of the RRAP m times, where m is determined experimentally; then x ₁ bit of the current value of PSCh1 and x ₂ bits of the current value of PSCh2 are converted into digital constants K3 and K4, generate PSCh1 and PSCh2 according to the corresponding cryptographic algorithms g ₁ and g ₂ using the parameters K3, K4 and K5;
- on the transmitting side, during the time interval T ₁ , cryptographically protected information is transmitted, for which the incoming digital information is encoded with an error-correcting code common to the entire RRAP, the encoded data in blocks of ₁ bit total modulo 2 with the first pseudorandom number (PSCH1) of size y ₁ bit, as a result of which data is encrypted by a stream cipher, which, in blocks of ₂ bits each, are summed modulo 2 with a second pseudo-random number (PSCH2) of ₂ bits in size, as a result of which data is encrypted e with a combination cipher, which are combined in blocks of ₂ bits each with a sync sequence to form a data packet, then each of the two parts of the packet obtained above (a sync sequence and an encrypted block) is modulated with different frequencies determined by PSCH2, the modulated data packet is transmitted over the radio channel to the receiving side of the DTCH; further, they generate PSCH1 and PSCH2 according to the cryptographic algorithms g ₁ and g _2, respectively, using K5, and each received PSCH1 serves as the initial state for generating the next PSCH1 using K5, and each received PSCH2 serves as the initial state for generating the next PSCH2 using K5;
- at the same time, the synchronization of cryptographic algorithms with the subsequent transfer of cryptographically protected information on the transmitting side is carried out once digital information (DI) is received once or repeatedly depending on the amount of received DI to be transmitted;
- cryptographic algorithms are synchronized on the receiving side of the RPCA, for which, during the time interval T ₂ , signals are received, which are a mixture of the above-formed packets and interference simultaneously at all frequencies; divide the received mixture into two components - service (SS), containing a mixture of sync sequences with interference, and coded information (CIS), containing a mixture of encoded x ₁ bits and encoded x ₂ bits with interference; SSs are demodulated and converted into a sequence of decisions, which is compared with the codes of the expected sync sequences, and the result of the comparison is used for phase-locked loop; CIS is demodulated using phase-locked loop, from the demodulated packet, ₁ bit of the current value of the PSN1 and x ₂ bits of the current value of the PSN2 of the transmitting side are encoded with a noise-resistant code, decode them, and the above reception of the RPSD signals is repeated m times, resulting in the final values of x ₁ bit of the current value of PSCH1 and x ₂ bits of the current value of PSCH2 of the transmitting side, which are converted into digital constants K3 and K4;
- further, cryptographically protected information is received on the receiving side of the RRTC during the time interval T ₁ , for which PSCH1 and PSCH2 are generated using cryptographic algorithms g ₁ and g _2, respectively, using the parameters K3, K4 and K5, and hereinafter each received PSCH1 is used as the initial state for generating the next PSH2 using K5, and each obtained PSH2 is used as the initial state for generating the next PSH2 using K5; further, the mixture of the useful signal and interference is received simultaneously at all frequencies, each of which belongs to a group of frequencies known at the receiving and transmitting sides of the RRAP; further, the received mixture is divided into two components - SS and encrypted information (VMS) containing a mixture of encrypted bits with interference; The SS is demodulated on the basis of the previously developed PSCH2 and converted into a sequence of decisions, which is compared with the codes of the expected sync sequences, the comparison result is used for phase-locked loop; VMS is demodulated based on the previously developed PSCH2 using phase-locked loop; Further, a combination cipher composed of demodulated VMSs with a size of ₂ bits is summed with PSC2, resulting in a stream cipher, which is summed in blocks of ₁ bit with PSC1, resulting in data encoded by a noiseless code that decodes into resulting in a transmitted QI;
- at the same time, the synchronization of cryptographic algorithms with the subsequent reception of cryptographically protected information on the receiving side is carried out as the QI arrives once or repeatedly depending on the amount of the received QI that needs to be transmitted.