TW202110127A - Secure communication key negotiation method - Google Patents

Abstract

The disclosure provides a secure communication key negotiation method suitable for a first mobile device. The method includes: generating a first random value; generating a first reference value based on the first random value and a given base point parameter of an elliptic curve; obtaining a first system time, and creating a first signature of the first reference value and the first system time by using a first private key; transmitting the first signature, the first reference value, the first system time, and a first certificate to a second mobile device; receiving a second signature, a second reference value, a second system time, and accordingly verifying the second mobile device; in response to the second mobile device being valid, generating a reference key, and accordingly obtaining a session key; and establishing a secret peer-to-peer communication session with the second mobile device based on the session key.

Description

Security communication key negotiation method

The present invention relates to a network communication security technology, and particularly relates to a method for negotiating a secure communication key.

With the rapid development of information technology, information and communication operations need to be transmitted securely on an open network, which makes the exchange and transmission of keys an important security issue. In addition, in order to prevent communication products from being implanted with malicious chips or malicious backdoor programs and protect user data from being stolen, how to construct a secure and secret communication system on a zero-trust network is an urgent problem.

In view of this, the present invention provides a secure communication key negotiation method, which can be used to solve the above technical problems.

The present invention provides a secure communication key negotiation method, including: generating a first random value by a first mobile device, wherein the first mobile device is configured with a first secure chip element, and the first secure chip element stores a first private key And a first call request identity certificate; a first reference value is generated by the first mobile device based on a first random value and a selected base point parameter of an elliptic curve; a first system time is obtained by the first mobile device, and a first system time is obtained by the first mobile device. A private key creates a first signature of the first reference value and the first system time; the first mobile device sends the first signature, the first reference value, the first system time, and the first call request identity certificate to a first Two mobile devices; the first mobile device receives a second signature, a second reference value, a second system time, and a second call request identity certificate of the second mobile device from the second mobile device, and verifies them accordingly The second mobile device; in response to the verification of the second mobile device, a reference key is generated by the first mobile device based on the first random value and the second reference value, and the session key is generated accordingly; and the first mobile device is based on The session key establishes an end-to-end voice secret transmission communication with the second mobile device.

Based on the above, the method of the present invention enables the first mobile device and the second mobile device to establish an end-to-end secret voice transmission communication after exchanging the session key. In this way, the purpose of secret and secure communication can be achieved without the intervention of an intermediate communication server.

In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.

In summary, the present invention proposes a process and architecture method for secure communication key negotiation in an Internet system. It uses an IP-Private Branch eXchange (IP-PBX) server and uses a Session Initiation Protocol (Session Initiation Protocol). , SIP) communication transmission technology, providing Internet system with secure communication key call transmission service and secure voice encryption call function, through a reliable Internet certificate verification system, reliable certificate management and certificate real-time status information query, built-in Hardware security components improve the security of mobile communication devices, strengthen the use of end-to-end secure session key negotiation generation mechanism, ensure that the content of the call will not be eavesdropped by a third party, and make encrypted calls between mobile communication devices safer and more reliable . The specific description is as follows.

Please refer to FIG. 1, which is a schematic diagram of a secure communication key agreement system according to an embodiment of the present invention. As shown in FIG. 1, the system 100 includes communication operators 11a, 11b, a first mobile device 12a, a second mobile device 12b, a certificate authentication (CA) server 13, and an online certificate status protocol (Online Certificate Status Protocol, OCSP) server 14 and IP-PBX server 15.

In one embodiment, the first mobile device 12a (for example, a smart phone, a tablet computer, or any other communication device that can secure VoIP communication software) may have a first security chip, which can be stored. For example, the first security chip can be implemented in a patch form and can be attached to a subscriber identification module (SIM) card of the first mobile device 12a. Without replacing the SIM card, the first secure chip can provide related functions of public key infrastructure (PKI), and can be used as an identity verification device for establishing secure communication between the two parties.

In one embodiment, if the user of the first mobile device 12a wants to use the service proposed by the present invention, he can use the first mobile device 12a to apply for the above-mentioned first secure chip component and the first SIP account from the communication operator 11a. After that, the communication operator 11a can apply to the CA server 13 for the first call request identity certificate corresponding to the user identity based on the user identity corresponding to the first mobile device 12a, and write the first call request identity certificate into the first call request identity certificate. Security chip component.

In one embodiment, the above-mentioned first call request identity certificate is a digital file containing the first public key and the identity authentication information of the owner, which is used to prove the ownership of the first public key. In addition, the certificate authority can verify that the content of the certificate has been authenticated by the certificate authority through the signature of the certificate. In addition, when verifying the certificate, it will also verify the validity of the certificate.

After that, the communication operator 11a can register the first SIP account with the IP-PBX server 15. In an embodiment, the OCSP server 14 may also establish the validity of the status of the identity certificate of the first call request. Roughly speaking, OCSP is a PKI standard protocol, which can perform online real-time certificate status query and confirm the validity of the certificate through OCSP.

In addition, for the user of the second mobile device 12b, if he wants to use the service provided by the present invention, he can also cooperate with the communication operator 11b to perform the above operations to obtain the second security chip component corresponding to the second mobile device 12b ( Including the second private key), the second SIP account, and the second call request identity certificate (which can be written to the second secure chip element and includes the second public key), but the present invention may not be limited to this.

For ease of description, it is assumed below that the first mobile device 12a and the second mobile device 12b intend to perform end-to-end secret communication through the method of the present invention. In this case, the first mobile device 12a and the second mobile device 12b can be installed with a specific VoIP application corresponding to the service of the present invention, and can separately use the first SIP account and the second SIP account previously applied for through the above VoIP application The program logs in to the IP-PBX server 15.

After that, the first mobile device 12a and the second mobile device 12b can separately perform a certain mechanism to generate a session key for establishing end-to-end secret communication, and communicate based on the session key. The following will be supplemented with Figure 2 for a detailed description of the above machine.

Please refer to FIG. 2, which is a method for negotiating a secure communication key according to an embodiment of the present invention. First, in step 201, the first mobile device 12a may randomly generate a first random value (hereinafter referred to as Rb). In step 202, the first mobile device 12a may generate a first reference value (hereinafter referred to as Pb(x, y)) based on the first random value (Rb) and the selected base point parameter of the elliptic curve (hereinafter referred to as Q(x, y)) ). In one embodiment, the above-mentioned elliptic curve may be selected from the elliptic curve Diffie-Hellman exchange (Ephemeral Elliptic Curve Diffie-Hellman Exchange, ECDHE) algorithm. Specifically, the ECDHE algorithm can be defined to have multiple candidate elliptic curves, and the elliptic curve in step 202 can be selected from one of the above-mentioned candidate elliptic curves. Moreover, the elliptic curve and its selected base point parameters are known to both the first mobile device 12a and the second mobile device 12b, but the present invention is not limited to this. Correspondingly, the first reference value can be characterized as: Pb(x, y) = Rb * Q(x, y), where * is the elliptic curve point multiplication operator, and the relevant details can refer to the relevant documents of the ECDHE algorithm. I will not repeat them here.

After that, in step 203, the first mobile device 12a can obtain the first time (denoted by Tb), and use the first private key (stored in the first secure chip) to create a first reference value (ie, Pb( x, y)) and the first signature of the first system time (Tb). In one embodiment, the above-mentioned first signature may be characterized as "signature (Pb(x, y) + Tb)".

Then, in step 204, the first mobile device 12a may send the first signature (ie, "signature (Pb(x, y) + Tb)"), the first reference value (Pb(x, y)), The first system time (Tb) and the first call request identity certificate (hereinafter referred to as the B certificate) are sent to the second mobile device 12b.

In step 205, the second mobile device 12b receives the first signature (ie, "signature (Pb(x, y) + Tb)"), the first reference value (Pb(x, y)), and the first signature. After the system time (Tb) and the B certificate, the first mobile device 12b can be verified accordingly. Specifically, the second mobile device 12b may verify the first signature based on the first public key in the B certificate and generate the first verification result. After that, the second mobile device 12b can obtain its second system time, and determine whether the time difference between the second system time (hereinafter referred to as Ta) and the first system time (Tb) is less than a preset threshold, and generate a first 2. Verification results. In one embodiment, the second mobile device 12b may determine that the first mobile device 12a has passed the verification, reflecting that both the first verification result and the second verification result are passed. On the other hand, if the first verification result or the second verification result is not passed, the second mobile device 12b can determine that the first mobile device 12a fails the verification.

In one embodiment, after determining that the first mobile device 12a passes the verification, in step 206, the second mobile device 12b may randomly generate a second random value (hereinafter referred to as Ra). Moreover, in step 207, the second mobile device 12b may generate a second reference value (hereinafter referred to as Pa(x, y)) based on the second random value (Rb) and the selected base point parameter (Q(x, y)) of the elliptic curve. ). For details of step 207, reference may be made to the description in the previous embodiment, which will not be repeated here.

Then, in step 208, the second mobile device 12b can create a second reference value (ie, Pa(x, y)) and a second system time (Ta) with the second private key (stored in the second secure chip) The second signature of. In one embodiment, the above-mentioned second signature may be characterized as "signature (Pa(x, y) +Ta)".

Then, in step 209, the second mobile device 12b may send a second signature (ie, "signature (Pa(x, y) +Ta)"), a second reference value (Pa(x, y)), The second system time (Ta) and the second call request identity certificate (hereinafter referred to as A certificate) are sent to the first mobile device 12a.

In step 210, the first mobile device 12b receives a second signature (ie, "signature (Pa(x, y) +Ta)"), a second reference value (Pa(x, y)), and a second signature. After the system time (Ta) and the A certificate, the second mobile device 12b can be verified accordingly. Specifically, the first mobile device 12a can verify the second signature based on the second public key in the A certificate and generate the first verification result. After that, the first mobile device 12a determines whether the time difference between the first system time (Tb) and the second system time (Ta) is less than a preset threshold, and generates a second verification result. In one embodiment, the first mobile device 12a can determine that the second mobile device 12b has passed the verification in response to the first verification result and the second verification result being passed. On the other hand, if the first verification result or the second verification result is not passed, the first mobile device 12a can determine that the second mobile device 12b fails the verification.

In one embodiment, after determining that the second mobile device 12b passes the verification, in step 211, the first mobile device may generate a reference based on the first random value (Rb) and the second reference value (Pa(x, y)) Golden key (hereinafter referred to as Sb). In one embodiment, the reference key (Sb) can be characterized as Sb(x, y) = Rb * Pa(x, y), but it is not limited to this.

In addition, the second mobile device 12b sends a second signature (ie, "signature (Pa(x, y) +Ta)"), a second reference value (Pa(x, y)), and a second system time ( After Ta) and A certificates are sent to the first mobile device 12a, in step 212, the second mobile device 12b can generate a reference key (Pb(x, y)) based on the second random value (Ra) and the first reference value (Pb(x, y)). Hereinafter referred to as Sa). In one embodiment, the reference key (Sa) can be characterized as Sa(x, y) = Ra * Pb(x, y), but it may not be limited thereto.

In one embodiment, the elliptic curve algorithm guarantees that Sa is equal to Sb. That is, the reference keys generated in steps 211 and 212 are the same key (hereinafter collectively referred to as S). Therefore, in one embodiment, the first mobile device 12a and the second mobile device 12b can separately extract the x vector of S as the session key.

After both the first mobile device 12a and the second mobile device 12b obtain the above-mentioned session key, the end-to-end secret voice transmission communication between the two can be established accordingly.

Please refer to FIG. 3, which is a schematic diagram of establishing end-to-end secret voice transmission communication according to an embodiment of the present invention. In this embodiment, the present invention provides a way for both parties to make a call by installing VoIP communication application software on mobile devices in the same network that are jointly accessed. The data of the voice call is protected by end-to-end encryption, using secure chip components. The private key and the public key recorded in the certificate are exchanged asymmetrically to obtain the session key for the voice call encryption of the two parties. The voice packets transmitted by the two parties use the session key as the symmetric advanced encryption standard (Advanced Encryption). Standard, AES) voice call encryption eliminates the intervention of intermediate communication servers, so as to achieve the purpose of end-to-end direct encryption of communication for users. The specific method is as follows.

Step 301: Both the first mobile communication device 12a and the second mobile device 12b install VoIP communication application software, and connect to the IP-PBX server 15 via the network to log in by SIP. Step 302: When the IP-PBX server 15 submits the A certificate and the B certificate to the OCSP server 14 for verification, the OCSP server 14 will return the verification result. If the verification is successful, the return message will include the certificate subject name (including SIP account number).

Step 303: The first mobile communication device 12a uses SIP to call the second mobile communication device 12b to conduct a secret conversation. Step 304: The first mobile communication device 12a waits for the second mobile communication device 12b to respond. Step 305: After the second mobile communication device 12b responds, the communication application software of the two parties will automatically exchange the session key for secure communication (ie, the mechanism shown in Figure 2). Step 306: After the session key exchange is successful, the two parties in the conversation establish an end-to-end voice secret transmission communication using the session key.

In one embodiment, the above-mentioned session key is a one-time symmetrical session key used for encryption in this conversation. All members use the same key to encrypt the plaintext and decrypt the ciphertext. At the end of this connection Then the key is invalid. If you need to re-communication, perform the key generation and exchange steps again. The session key must be generated using a secure protocol so that the key value cannot be predicted by an attacker. In any encryption system, the failure to securely generate the conference key (or any key) would be a major design flaw.

In summary, the present invention uses the certificate to verify the identity of the calling party, and adds the system time information of both parties as a signature parameter, so that the user's communication identity cannot be copied and reused, so as to prevent the data from being altered after being logged. Impersonating the user's identity and re-sending the fake message. Compared with Transport Layer Security (TLS), it increases the protection against retransmission attacks, ensures the dominance of end-to-end communication security, and eliminates intermediate communication servers. The mechanism of distributing the key intervention to achieve the purpose of protecting the content of the communication by the end user. In addition, because the present invention uses a one-time session key to encrypt the content of the call, it can be applied to a multi-terminal communication group. The same session key becomes invalid after the connection is ended. If you need to re-communication, you need to perform the conversation again. Steps such as the next key exchange will prevent the attacker from copying the same key value and have forward-secure secret communication protection capabilities.

Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the relevant technical field can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be determined by the scope of the attached patent application.

100: System 11a, 11b: communication operators 12a: The first mobile device 12b: Second mobile device 13: CA server 14: OCSP server 15: IP-PBX server 201~212, 301~306: steps

FIG. 1 is a schematic diagram of a secure communication key agreement system according to an embodiment of the present invention. FIG. 2 shows a method for negotiating a secure communication key according to an embodiment of the present invention. Fig. 3 is a schematic diagram of establishing end-to-end secret voice transmission communication according to an embodiment of the present invention.

201~212: Steps

Claims (11)

A method for negotiating a secure communication key, including: A first random value is randomly generated by a first mobile device, wherein the first mobile device is configured with a first secure chip element, and the first secure chip element stores a first private key and a first call request identity certificate; Generating a first reference value by the first mobile device based on the first random value and a selected base point parameter of an elliptic curve; Obtaining a first system time from the first mobile device, and using the first private key to create the first reference value and a first signature of the first system time; Sending the first signature, the first reference value, the first system time, and the first call request identity certificate to a second mobile device by the first mobile device; The first mobile device receives a second signature, a second reference value, a second system time, and a second call request identity certificate of the second mobile device from the second mobile device, and verifies the identity certificate accordingly Second mobile device In response to the verification of the second mobile device, the first mobile device generates a reference key based on the first random value and the second reference value, and obtains a session key accordingly; and The first mobile device establishes an end-to-end secret voice transmission communication with the second mobile device based on the session key. According to the method described in claim 1, wherein the first security chip element is attached to the user identity module of the first mobile device. As the method described in item 1 of the scope of patent application, it also includes: The first mobile device applies to a communication operator for the first secure chip element and a first session initiation protocol account; The communication operator applies to a certificate verification server for the first call request identity certificate corresponding to the user identity based on a user identity corresponding to the first mobile device, and writes the first call request identity certificate Into the first security chip element; The communication operator registers the first session initiation protocol account with a VoIP switchboard server. The method described in item 3 of the scope of patent application further includes: An online certificate status agreement server establishes the validity of the status of the first call request identity certificate. The method according to claim 4, wherein before the step of generating the first random value by the first mobile device, the method further includes: Log in to the VoIP switchboard server by the first mobile device with the first session initiation protocol account; The VoIP switchboard server requests the online certificate status protocol server to verify the certificate status of the identity certificate of the first call request; In response to the certificate status of the first call request identity certificate being valid, the VoIP switchboard server allows the first mobile device to generate the first random value. As the method described in item 1 of the scope of patent application, it also includes: A second random value is randomly generated by the second mobile device, wherein the second mobile device is configured with a second secure chip element, and the second secure chip element stores a second private key and a second call request identity certificate; Generating a second reference value by the second mobile device based on the second random value and the selected base point parameter of the elliptic curve; Obtain a second system time from the second mobile device, and use the second private key to create the second reference value and a second signature of the second system time; Sending the second signature, the second reference value, the second system time, and the second call request identity certificate to the first mobile device by the second mobile device; The second mobile device receives the first signature of the first mobile device, the first reference value, the first system time, and the first call request identity certificate from the first mobile device, and verifies the identity certificate accordingly First mobile device In response to the first mobile device being verified, the second mobile device generates the reference key based on the second random value and the first reference value, and obtains the session key accordingly; and The second mobile device establishes the end-to-end secret voice transmission communication with the first mobile device based on the session key. According to the method described in claim 1, wherein the elliptic curve is selected from an elliptic curve Diffie-Hellmann transient key exchange algorithm. For the method described in item 1 of the scope of patent application, the first reference value is characterized as: Pb(x, y) = Rb * Q(x, y), Where Rb is the first random value, Q(x, y) is the selected base point parameter of the elliptic curve, and * is an elliptic curve point multiplication operator. Such as the method described in item 1 of the scope of patent application, wherein the first signature is characterized as: Signature (Pb(x, y) +Tb), Where Pb(x, y) is the first reference value, and Tb is the first system time. Such as the method described in item 1 of the scope of patent application, wherein the reference key is characterized as: Sb(x, y) = Rb * Pa(x, y) , Where Rb is the first random value, Pa(x, y) is the second reference value, and * is an elliptic curve point multiplication operator. The method according to claim 1, wherein the second call request identity certificate includes a second public key corresponding to the second mobile device, and the step of verifying the second mobile device includes: Verify the second signature based on the second public key, and generate a first verification result; Determine whether a time difference between the second system time and the first system time is less than a preset threshold, and generate a second verification result; Reflecting that both the first verification result and the second verification result are passed, it is determined that the second mobile device is verified; In response to the failure of the first verification result or the second verification result, it is determined that the second mobile device fails the verification.

Images