RU2644523C1 - Method of protected communication system organization - Google Patents

Abstract

FIELD: radio engineering, communication.

SUBSTANCE: in the method, signals-beacons are exchanged between the communication control center and N≥1 radio stations. From the communications control center at the selected radio frequency, tuning beacons (TB) with open communications control center keys for each of the radio stations of the network are emitted. Radio stations detect TB by scanning the frequency range and after confirmation of its authenticity, a response beacon (RB) with a session key encrypted with the public key of the communications control center is radiated at the radio frequency of receiving the TB at specified non-overlapping instants of time. The communications control center receives the RB from each radio station and, after confirming its authenticity, transmits for each radio station a tuned data beacon (TDB) containing pre-calculated tuning data encrypted with the received session key. The radio stations receive the TDB from the communications control center and, upon confirmation of their authenticity, decrypt using the session keys the tuning data contained in them, which they then use to configure their parameters.

EFFECT: shortening the time of establishing a communication network while ensuring guaranteed protection against unauthorized access of tuned data transmitted via radio.

3 dwg

Description

The invention relates to the field of telecommunications, and in particular to methods for automatically building and configuring communication networks to ensure the protection of transmitted information and is intended for automatic secure configuration of a communication network in the absence of pre-arranged communication channels.

A known method of organizing a secure communication network is described in the SSL and TLS protocols (IETF RFC 5256 standard) [2], in which a message is sent from the server containing the server’s public key, a response message from the network node between the server and other network nodes , which contains a symmetric session key encrypted with the server’s public key, as a result of which the session key becomes known to both parties, and the subsequent exchange of information messages encrypted by the session between the server and the network node ovym key.

Also known is a method of organizing a secure communication network described in the IPSec protocol (IETF RFC 2401-2412 standards). In this method, a secure communication network is organized at the network level, in which mutated IP packets are exchanged sequentially for mutual authentication between network nodes, and then encrypted packets are exchanged, including an insert for checking message integrity.

The disadvantages of these analogues is that they can only work if the communication network is already organized at the channel and physical levels.

The closest analogue in technical essence to the claimed method is the method of organizing a communication system described in the invention RU 2549120 - "Means of transmitting telecommunications network data and telecommunications network". The indicated method consists in the fact that in a network containing several radio stations and a head radio station acting as a communication control center (CSC), radio stations begin sending out tuning beacon signals or messages at a predetermined frequency each, which are detected by the head radio station using a scanning receiver and other devices included in the unit for detecting and determining the type of signal of the head radio station, after which the head radio station determines the tuning data corresponding to the detected nym beacons configured such data and sends signals on the detected frequency response radio beacons, which after receiving stations moving at the headend network tuning via their constituent channel control unit in accordance with the received beacon.

The disadvantage of this method is the long duration of the network setup, associated with the need to create and send configuration data for each detected beacon of the radio station, as well as the lack of guaranteed encryption of configuration data that is sent on the air in the clear and therefore can be intercepted and used, for example, for intentional network disruption.

The technical problem to which the invention is directed is to develop a method for organizing a communication network, which reduces the time it takes to create and send configuration data to the network while ensuring their encryption.

Achievable technical result - reducing the time of the organization of the communication network while ensuring guaranteed protection against unauthorized access transmitted over the air configuration data.

To achieve a technical result in the known method, including the exchange of beacon signals between the communication control center (CSC) and N≥1 radio stations, according to the invention, from the CSC at the selected radio frequency, radiation of the tuning beacons containing the public key of the CSC for each of the radio stations of the network is emitted; radio stations detect the tuning beacon by scanning the frequency range, verifying its authenticity and, if the tuning of the beacon is confirmed, the tuning emits a response beacon with the session key encrypted by the central control center key on the receiving frequency of the tuning beacon at a given time; The NCC receives a response beacon from each radio station, verifies its authenticity and, if the response beacon is authenticated, transmits a configuration data beacon for each radio station containing the configuration data pre-calculated for it, encrypted with the received session key; radio stations receive beacons for configuration data from the central control center, verify their authenticity, and if authentication of beacons for verification data is confirmed, they decrypt using the session keys the configuration data contained in them, which they then use to configure their parameters.

The technical problem is solved by the proposed new algorithm for the exchange of beacon signals between the DSS and N (N≥1) radio stations in the process of organizing a communication network, which can be represented by the diagram shown in FIG. 1, where indicated:

1 - communication control center;

2.1 ... 2.N - N radio stations;

MN - tuning beacon transmitted from the central control center to N radio stations;

MO1 ... MON - response beacons transmitted from N radio stations to the central control center;

MND1 ... MNDN - beacons for configuration data transmitted from the central control center to N radio stations.

The inventive method of organizing a secure communication system includes the following steps.

BUT). Stage transmission beacon settings (MN) from the central control center to the radio stations

At this stage, the NCC:

1) using special software, for example, a program for the automated calculation of radio data (certificate of state registration of a computer program No. 20111613837), calculates the tuning data ND _i for each of the N radio stations of the network;

для излучения МН, например, по критерию минимального уровня шума;2) among the available set of radio frequencies for the organization of the network, selects the nominal

for MN radiation, for example, by the criterion of the minimum noise level;

3) forms an MN, which includes a “public key” generated on the basis of a previously entered "private key", and the identification number of the CSC id _C ;

.4) provides continuous radiation of the formed MN at a frequency

.

At the same time, radio stations scan the set of frequencies available for organizing a communication network, with a delay at each scan frequency for a time Δτ = 2τ _mn , sufficient for guaranteed reception of MN (where τ _mn is the duration of MN).

B) The stage of transmission of response beacons (MO) from radio stations to the central control center

At this stage, the radio station after receiving MN:

1) verify the authenticity of the MN by analyzing the identification number of the CSC id _C contained therein;

2) if the identification number of the CSC id _{C is} unknown, then the received MN is discarded;

3) if the identification number of the CSC id _C is known, then they make a conclusion about the authenticity of the MN and form the MO, which includes the “session key” crypto _i encrypted with the “public key” contained in the MN and the identification number of the radio station id _i ;

4) emit MO at a frequency f ₀ with a unique, pre-set, for example, by the unique identification number of the radio station id _i delay delay _i to prevent collision MO when receiving DSS;

At the same time, the central control center receives the MO from radio stations at a frequency f ₀ at predetermined time points determined for each radio station id _i by delay _i .

AT). The stage of transmitting the beacon of configuration data (MND) from the central control center to the radio station

At this stage, the GCC after taking MO:

1) verify the authenticity of the MO by analyzing the identification number of the radio station id _i contained therein;

2) if the identification number of the radio station id _{i is} unknown, then discards the received MO;

3) if the identification number of the radio station id _i is known, it decrypts it using the "private key" and extracts the "session key" crypto _{i of the} radio station from the MO;

4) generates a beacon of tuning data (MND) for a radio station, which includes NDi encrypted with a "session key", and id _{i is the} identification number of the radio station;

5) emits MND at a frequency f ₀ .

At the same time, radio stations:

1) receive MND from the central control center at a frequency f ₀ ;

2) verify the authenticity of the MND by analyzing the identification number id _i contained therein;

3) if the identification number id _i does not belong to the radio station, then the received MND is discarded;

4) if the identification number id _i belongs to the radio station, then it is decrypted using the “session key” and the ND configuration data is extracted from the MND;

5) set their parameters according to the ND tuning data accepted in the MND.

The network setup is considered complete when the DCC has transmitted the MND to all the radio stations to be tuned.

In the presented algorithm for encryption of configuration data, known asymmetric encryption schemes with a symmetric session key are used, such as SSL, TLS, RSA-KEM, GOST R 34.10-2012, etc. [2].

According to these schemes, a “private (secret) key” is generated in the central control center, which must be kept secret. On the basis of the "private key", a "public key" is generated, according to which it is impossible to restore the "private key" (in fact, the "public key" is a specially encrypted "private key"). The NCC as part of the MN sends its “public key” to all radio stations on an open channel. Radio stations generate symmetric "session keys" (which are valid only during the given connection), encrypt them with the "public key" received from the central control center (and they themselves are not able to decrypt it back), and then send it to the central control center as part of the MO. The central control center decrypts the “session keys” of the radio stations with its “private key”, encrypts the configuration data received from the “session keys” radio stations and sends them as part of the MND to the address of the radio stations. Radio stations decrypt the configuration data using their "session keys." As a result, guaranteed protection against unauthorized access to configuration data transmitted over the air over the network is ensured.

Reducing the time of organizing a communication network using the proposed algorithm in comparison with the prototype can be estimated as follows.

Assume that the central control center and all the radio stations are turned on simultaneously. We denote by τ _MN , τ _MO , and τ _{MND the} durations of the beacons for tuning, response, and tuning data, respectively.

We also denote by F the number of frequencies (channels) allocated to configure the network.

The time of the organization of the communication network when using the prototype.

The temporal parameters of the organization of the communication network when using the prototype are determined by the beacon exchange diagram shown in FIG. 2, where indicated:

1 - communication control center;

2.1 ... 2.N - N radio stations;

МН1 ... MHN - tuning beacons transmitted from N radio stations to the central control center;

MO1 + PND1 - a response beacon with a training data packet transmitted from the central control center to the first radio station;

MON + PNDN is a response beacon with a training data packet transmitted from the central control center to the N-th radio station.

In the prototype, each radio station transmits an MN, which is detected by the CSC using a scanning receiver. It takes time to scan the entire set of DCC channels

.If no more than one radio station is located on each channel, then the MN from all radio stations will be detected by the _DCC during T _PI . However, there is a possibility that the same frequency channel will be simultaneously selected by 2≤M≤N radio stations. Taking into account the choice by the radio stations for the MN emission of the same frequencies, the MN from all the radio stations will be received by the DCC in time

.

Then the central control center sequentially transmits, at the frequency of the received MN for each radio station, a response beacon, which actually includes the MO and MND. The total transmission time of the response center beacon will be

The total networking time using the prototype can be estimated

The time of the organization of the communication network when applying the proposed method.

The time parameters of the organization of the communication network when applying the proposed method are determined by the diagram of the exchange of signals-beacons, presented in Fig. one.

МН, который обнаруживается всеми радиостанциями. Коллизии при приеме МН радиостанциями исключены, так как все радиостанции работают на прием. Для приема МН всеми радиостанциями требуется времяAccording to the claimed method, the CSC transmits at a preselected frequency

MN, which is detected by all radio stations. Collisions when receiving MN radio stations are excluded, since all radio stations are working on reception. It takes time for all radio stations to receive MN

в заданные непересекающиеся моменты времени. Продолжительность передачи МО может быть оцененаThen all the radio stations transmit MO on the frequency

at given disjoint times. MO transmission duration can be estimated

передает МНД для каждой радиостанции за времяFurther, the central control center at a frequency

transmits MND for each radio station in time

The total network time of the claimed method can be estimated

The final gain in time of the organization of the communication network of the proposed method in comparison with the prototype will be

The analysis of expression (9) shows that the gain (γ> 0) of the proposed method compared to the prototype in the time of the organization of the communication network will be ensured when the condition

In practice, when organizing a communication network, condition (10), as a rule, will always be fulfilled. Indeed, due to the fact that the tunable radio stations are located in a limited area (within the "radio visibility") when using the prototype, it is highly likely that these radio stations select the same frequencies for primary MN broadcasting (M> 1). This coincidence is due to the fact that the radio stations, being in approximately the same jamming and signaling environment, tend to select the “best” frequencies for themselves (with a minimum level of “noise”) for the MN transmission, which are very likely to be the same.

Calculated according to (9), the quantitative value of the gain of the proposed method in comparison with the prototype in time of organizing a communication network for various values of M = 2, 4 and 6, as well as τ _MN = τ _MO = τ _MND and F = 100 is shown in FIG. 3.

Thus, the claimed method in comparison with the prototype due to the proposed new algorithm for the exchange of beacon signals between the central control center and the radio stations provides a reduction in the time of the organization of the communication network with simultaneous guaranteed protection against unauthorized access of the broadcast data transmitted over the air.

Information sources

1. Kuznetsov A.V., Bessonov V.V. The technology of creating a self-organizing radio network with the functions of cognitive radio based on the principles of software-defined radio // XV international scientific and technical conference "Cybernetics and high technologies of the XXI century." - Voronezh, 2014 .-- T. 1. - S. 176-187.

2. Schneier B. Applied cryptography. Protocols, algorithms, C source code = Applied Cryptography. Protocols, Algorithms and Source Code in S. - M .: Triumph, 2002. - 816 c.

Claims (1)

A method of organizing a secure communication system, including the exchange of beacon signals between the communication control center (CSC) and N≥1 radio stations, characterized in that from the CSC at the selected radio frequency, the radiation of the tuning beacons containing the public key of the CSC for each of the radio stations of the network is emitted; radio stations detect the settings beacon by scanning the frequency range, verify their authenticity and, if the beacon is authenticated, the settings emit the settings beacon at the receiving frequency of the reception beacon at specified non-overlapping time moments of the response beacon with the session key encrypted by the public control center key; The NCC receives a response beacon from each radio station, verifies its authenticity and, if the response beacon is authenticated, transmits a configuration data beacon for each radio station containing the configuration data pre-calculated for it, encrypted with the received session key; radio stations receive beacons for configuration data from the central control center, verify their authenticity, and if authentication of beacons for verification data is confirmed, they decrypt using the session keys the configuration data contained in them, which they then use to configure their parameters.

Images