CN110011786B

CN110011786B - High-safety IP secret communication method

Info

Publication number: CN110011786B
Application number: CN201910211626.XA
Authority: CN
Inventors: 李大双; 徐兵杰; 何远杭; 樊矾
Original assignee: CETC 30 Research Institute
Current assignee: CETC 30 Research Institute
Priority date: 2019-03-20
Filing date: 2019-03-20
Publication date: 2022-03-18
Anticipated expiration: 2039-03-20
Also published as: CN110011786A

Abstract

The invention discloses a high-security IP secret communication method, comprising an IP encryption processing device and an IP decryption processing device. The IP encryption processing device includes a full IP packet encryption module, a true randomization segmentation module, and two XOR operation modules. and two block encryption and tunnel encapsulation modules; the IP decryption processing device includes two tunnel decapsulation and packet decryption modules, two XOR operation modules, a de-true randomization combination module and a full IP packet decryption module. The present invention adopts three encryption protection mechanisms: full IP packet encryption, true randomization segmentation and IP tunnel group encryption, so that it is difficult for an adversary to obtain IP plaintext content by monitoring the content of communication data, analyzing and deciphering. The method of the invention can establish a high-security confidential communication IP network with low investment cost on the public Internet, can resist the attack threat of various existing cryptanalysis and deciphering means, and can resist the deciphering and analysis attack of quantum computer.

Description

High-safety IP secret communication method

Technical Field

The invention relates to a high-safety IP secret communication method.

Background

At present, quantum computers are actively developed in developed countries, and the era of quantum computing is no longer far away. Due to the dual characteristics of superposition and entanglement among the quantum bits, the computing capacity of a quantum computer can show exponential growth along with the increase of the number of the quantum bits, and quantum computing can form a huge security threat to secret communication based on cryptographic algorithm security. The rapid development of artificial intelligence based on neural network learning provides a new exponential acceleration operation way for the cryptanalysis and decryption technology. The quantum chip based neural network computing model will pose a serious security challenge to existing secure communication systems.

In the existing public internet, various network devices always have some security holes, are easy to be implanted into monitoring trojans by enemies through a network attack means, and are easy to acquire communication data between IP subnets. And even if the IP subnetworks are directly connected based on the special optical cable, optical signals transmitted in the optical fiber are easy to monitor, and IP message data is recovered through signal decoding.

In the new high-security IP secret communication method, an IP encryption device encrypts the whole message including an IP head by adopting a block algorithm aiming at each plaintext IP block to be transmitted, encrypts and masks the whole plaintext IP message in a data format, randomly divides the whole plaintext IP message byte by byte based on a quantum true random number to form two random divided data blocks with the same length as the original IP message, performs byte-by-byte XOR operation and masking on the random data blocks negotiated by a preset or key distribution protocol, re-encapsulates the obtained random XOR data blocks into two new IP secret state messages after being encrypted by the block encryption algorithm, and then transmits the two new IP secret state messages from an Internet access link of the IP encryption device. Because the true randomization segmentation mechanism not only "destroys" the integrity of the ciphertext information, but also completely eliminates any recognizable features in the input data of the block cipher algorithm, all existing cryptanalysis attack methods cannot work. Because the output of the derandomized combiner is the block encryption random data without the plaintext characteristic, an adversary cannot judge which combination of the pair of block keys is correct even if the adversary adopts a quantum computer to carry out exhaustive decoding operation, and therefore the secret communication system cannot be cracked even if the adversary finishes the exhaustive operation. Therefore, the novel IP secret communication method can greatly improve the safety of the existing secret communication system and can effectively resist the decoding analysis attack of a quantum computer with strong calculation power and neural network calculation.

Disclosure of Invention

In order to overcome the defects in the prior art, the invention provides a novel high-security secret communication method which jointly adopts three protection mechanisms of full IP packet encryption, true randomization segmentation and tunnel transmission packet encryption. Firstly, carrying out full IP block encryption on the whole plaintext IP message (including an IP header) to be transmitted by using a block encryption algorithm to form a full IP block encryption data block; secondly, randomly dividing the full IP block encrypted data into two random divided data blocks based on a quantum true random number, and performing true random XOR operation on the two random divided data blocks; then, based on two different keys negotiated independently, the two keys are encrypted in groups by adopting a group encryption algorithm to form two groups of encrypted data blocks as loads transmitted by the IP encrypted tunnel; and finally, respectively packaging the two block encrypted data blocks into standard IPSec messages, and transmitting the standard IPSec messages to the destination IP password equipment through the public Internet.

By adopting the novel high-safety IP secret communication method provided by the invention, even if an adversary obtains the IP secret messages transmitted between the IP encryption machines, the adversary cannot perform analysis and decryption by adopting a cryptographic analysis method. Even if the cryptographic system applies public cryptographic algorithms, it can force the adversary to have to do exhaustive operations that traverse three key spaces. Because the combined output of the two paths of block decryption is also random data, the adversary cannot decrypt the plaintext IP message only through the exhaustive operation of the block cipher algorithm traversing the two key spaces, the adversary is forced to perform the serial block algorithm decryption operation in the triple key space, and the operation amount of decryption at least exceeds the upper limit of the block key space adopting the single encryption algorithm. Therefore, the method of the invention has the capability of resisting the attack of decoding and analyzing implemented by strong calculation power of network monitoring, quantum computation and the like by the enemy. By adopting the technology provided by the invention, a high-safety secret communication network can be established based on the public Internet.

The technical scheme adopted by the invention for solving the technical problems is as follows: a high-security IP secret communication method comprises an IP encryption processing device and an IP decryption processing device, wherein the IP encryption processing device comprises an all-IP message packet encryption module, a quantum random number generator, a true randomization partition module, two XOR operation modules and two packet encryption and tunnel encapsulation modules; the IP decryption processing device comprises two tunnel decapsulation and packet decryption modules, two XOR operation modules, a true-removal random combination module and an all-IP packet decryption module, wherein the tunnel decapsulation and packet decryption modules are respectively connected with one XOR operation module, the XOR operation module is connected with the true-removal random combination module, and the true-removal random combination module is connected with the all-IP packet decryption module.

Compared with the prior art, the invention has the following positive effects:

in the existing public internet, various network devices always have some security holes, are easy to be implanted into monitoring trojans by enemies through a network attack means, and are easy to acquire confidential communication data between IP subnets.

The novel high-safety IP secret communication method designed by the invention adopts three protection mechanisms of full IP message packet encryption, randomized segmentation and tunnel transmission packet encryption, so that an adversary can hardly obtain IP plain text data contents by monitoring communication data content analysis and deciphering.

The novel high-safety IP secret communication method designed by the invention can establish a high-safety secret communication IP network on the public Internet at lower investment cost, can resist the attack threat of various existing cryptoanalysis deciphering means, can very effectively resist the deciphering analysis attack of a quantum computer with strong computing capacity, and can be used for both party and government secret communication with extremely high safety requirements and commercial secret communication with higher safety requirements.

Drawings

The invention will now be described, by way of example, with reference to the accompanying drawings, in which:

FIG. 1 is a schematic diagram of a novel high-security IP secure communication method;

FIG. 2 is a schematic diagram illustrating a true randomization partitioning and combining recovery principle of a data block;

fig. 3 is a schematic diagram of an IP encryption packet encapsulation structure.

Detailed Description

Technical architecture of novel IP secret communication method

The core idea of the novel high-security IP secret communication method provided by the invention is around the IP message content true randomization segmentation transmission technology, and three encryption mechanisms for providing transmission protection are adopted. For each plaintext IP message, three transmission protection mechanisms of full IP message packet encryption, true randomization segmentation and randomization exclusive OR, and packet encryption of data blocks are respectively implemented among IP encryptors.

The invention does not relate to the specific implementation of dynamic key negotiation between IP encryption machines and IPSec message encapsulation between IP encryption machines.

1. Implementation architecture design of novel high-security IP secret communication method

In the new high-security IP secure communication method proposed by the present invention, the secure communication architecture design is shown in fig. 1. The IP encryption processing function mainly comprises 7 modules, namely a full IP message packet encryption module, a quantum random number generator module, a true random segmentation module, two exclusive or operation modules and two packet encryption and tunnel encapsulation modules. The IP decryption processing function mainly comprises 6 modules including two tunnel decapsulation and packet decryption modules, two exclusive-or operation modules, a true-removal random combination module and a full IP message packet decryption module.

The length of the block encryption keys k1, k2 and k3 is assumed to be 256 or 512 bits, the length of the randomized exclusive-or operation keys k4 and k5 is 1500 bytes, and the keys are quantum true random data which are preset or generated by negotiation of a dynamic key distribution protocol, and the keys are generated independently of each other and are not required to be obtained by derivation inference.

2. Combination of randomized segmentation and block encryption to improve resistance to cryptanalysis cracking

The core idea of the novel high-security IP secret communication method provided by the invention is to randomize and cut the input content of the block encryption algorithm aiming at the IP message, so that the IP secret state message transmitted by the link does not contain the complete information of IP plaintext encryption mapping, the integrity of ciphertext information is damaged, various cryptanalysis decoding methods are prevented, and the message data block randomizing, cutting and recovering method is shown in figure 2. The method comprises the steps that the randomization segmentation mechanism carries out randomization segmentation operation byte by byte on the basis of quantum true random numbers which are dynamically generated in real time and have the same length as the message content (a randomization segmentation data block 1 is formed by AND operation, and a randomization segmentation data block 2 is formed by non-AND operation) on the IP message content to be transmitted through the public Internet, two data blocks with completely randomized content are obtained, the two data blocks are encrypted through a grouping algorithm and then packaged into a new IP message, the ID serial numbers of the two encrypted IP messages are generated in an increasing mode, and the difference value is 1. Because the input of the block encryption algorithm is data which is subjected to true randomization segmentation and randomization exclusive-or processing, the encrypted input data does not have any characteristics available for cryptanalysis any more, and therefore all existing cryptanalysis deciphering methods adopting plain-ciphertext comparative analysis and neural network deep learning characteristic analysis can be resisted. The true random XOR operation enables the number of the '0' bit and the '1' bit contained in the packet encryption input data to be basically consistent, and the characteristic that the '0' bit and the '1' bit are distributed unevenly, which is possibly caused by the random division, is eliminated.

3. The security mechanism of the hidden plaintext format forces the adversary to perform exhaustive operations in the triple key space

In the existing secure communication system, if a public block encryption algorithm is adopted, if the key length of the block algorithm is 256 bits, when an adversary performs a deciphering operation of traversing the whole key space, the deciphering analysis operation frequency is at least one time and reaches at most 2²⁵⁶Second, average is 2²⁵⁵Next, the process is carried out. Thus, existing secure communication systems present certain security risks.

In the novel high-security secret communication method provided by the invention, the encapsulation structure of the IP encryption message is shown in figure 3. Before executing true randomization to cut IP message, it adopts the randomization protection of block encryption to the whole IP message (including IP head), so that when the enemy carries out exhaustion decryption combination operation to two coupled IP block encrypted messages, it can not find any plaintext feature in its output data, and compels the enemy to reach the upper limit of operation of traversing the whole key space, and even if exhaustion operation is completed, it can also use the methodThe plaintext IP message cannot be decoded. If the time required for the packet decryption operation is 1ns, the adversary needs to operate at least 2 aiming at the 256-bit key space²⁵⁶≈3.6717×10⁵⁵For trillion years. Furthermore, even in the case of an open algorithm, in order for an adversary to break the entire cryptographic system, it is necessary to first perform a packet decryption operation for each packet key combination (k1, k2) and then perform an exhaustive operation for all-IP packet decryption. The amount of storage space required for such combined decryption operations is also not at all engineering realizable. Finally, even if the adversary performs the exhaustive operation of the packet algorithm once, because the combined output of the "decryption" operation results for each pair of packet key combinations is "random" data, it is necessary to perform the cryptanalysis deciphering operation serially for the all-IP packet encryption data block. Even if the inputs of the IP encryption processing devices are the same, the loads of the tunnel transmission packet encryption are dynamically changed due to a true random segmentation mechanism, so that even if an enemy successfully decodes one IP secret message transmitted by a tunnel, the load of the next IP secret message is changed, and analysis and decoding need to be carried out again. Under the condition that the cryptographic algorithm is not disclosed, as the encrypted input is randomized data obtained by true randomized segmentation and randomized exclusive-or operation, an adversary can not adopt any analysis method of a plaintext-ciphertext pair to implement decoding attack, and can not adopt exhaustive operation to perform decoding analysis.

(II) working process

1. IP encryption processing workflow

When the IP encryption processing device needs to execute IP encryption on a plaintext IP message, the following processing steps are adopted:

the first step is as follows: based on the block encryption key k3, performing block encryption operation on the whole plaintext IP message to form an all-IP message block encryption data block;

the second step is that: and (2) performing true random segmentation on the full IP packet encrypted data block respectively based on true random data blocks which are generated by a quantum random number generator and have the same length as the full IP packet encrypted data block to form two random segmented data blocks.

The third step: the randomized segmented data blocks are subjected to byte-by-byte exclusive-OR encryption operations based on preset or 1500-byte long random data keys k4 and k5, respectively, negotiated by a key distribution protocol, to form two randomized exclusive-OR data blocks.

The fourth step: and respectively based on the block encryption keys k1 and k2, carrying out block encryption operation on the randomized exclusive-or data block, and re-encapsulating a standard IP protocol header to form two new standard IP secret state messages. The IP secret state message sequence number field encrypted by k1 is set as an increasing odd sequence number value, the IP secret state message sequence number field encrypted by k2 is set as an increasing even sequence number value, and the difference value of the two new IP message sequence numbers is 1. And then, sending the new standard IP secret message to the public Internet, and forwarding and transmitting the new standard IP secret message to a target IP cipher machine through a routing relay.

Thus, the IP cipher encryption device completes the encryption processing flow of the plaintext IP message.

2. IP decryption processing workflow

When the local IP decryption processing device receives the IP secret message, the following steps are adopted:

firstly, stripping off an IP head packaged in tunnel transmission;

secondly, for the IP secret state message corresponding to the odd sequence number, carrying out grouping decryption operation on the load of the IP secret state message based on a key k1, and for the IP secret state message corresponding to the even sequence number, carrying out grouping decryption operation on the load of the IP secret state message based on a key k2 to obtain two random exclusive-or data blocks;

and thirdly, carrying out XOR decryption operation on the load of the IP secret state message corresponding to the odd sequence number based on the key k4, and carrying out XOR decryption operation on the load of the IP secret state message corresponding to the even sequence number based on the key k5 to obtain two randomized and segmented data blocks.

Fourthly, performing byte-by-byte logic OR combination operation on the two randomized and partitioned data blocks with the collected odd and even serial numbers to recover the all-IP block encrypted data:

the method for determining whether the OR operation can be carried out or not according to the sequence number value contained in the received IP secret message header comprises the following steps: firstly, decrypting the IP secret message load with unaligned parity serial numbers, then carrying out XOR operation to obtain a randomized segmentation data block, caching and queuing, and executing combination operation after the messages are aligned. And if the true randomized segmented data blocks decrypted by the IP dense-state message loads which are associated with the parity and have the difference of a plurality of interval sequence numbers are collected and meet the condition of 'or' combining operation, discarding the true randomized segmented data blocks decrypted by the unaligned IP dense-state message loads which are queued and waited in front of the cache.

And fifthly, carrying out packet decryption operation on the all-IP packet encrypted data block obtained by the path combination operation based on the key k3 to recover the plaintext IP message.

Therefore, the IP decryption processing device completes the decryption processing flow of the IP secret message.

Claims

1. a high-security IP secrecy communication method is characterized in that: comprise IP encryption processing device and IP decryption processing device, wherein said IP encryption processing device comprises full IP packet encryption module, true randomization segmentation module, quantum A random number generator, two XOR operation modules, and two block encryption and tunnel encapsulation modules, the full IP packet encryption module is connected to a true randomization segmentation module, and the true randomization segmentation module is connected to a quantum random number generator , the true randomization segmentation module is respectively connected with two XOR operation modules, and the XOR operation modules are respectively connected with a packet encryption and tunnel encapsulation module; the IP decryption processing device includes two tunnel decapsulation and packet decryption modules, Two XOR operation modules, a de-realization randomization combination module and a full IP packet decryption module, the tunnel decapsulation and packet decryption modules are respectively connected with an XOR operation module, and the two XOR operation modules are both connected with the XOR operation module. The de-randomization combining module is connected, and the de-randomizing combining module is connected with the full IP packet decryption module; wherein:

When the IP encryption processing device performs IP encryption on a plaintext IP message, the following processing steps are taken:

The first step is to perform a block encryption operation on the entire plaintext IP message based on the block encryption key k3 to form a block encrypted data block of the full IP message;

In the second step, based on the true random data block generated by the quantum random number generator, which has the same length as the block encrypted data block of the full IP packet, perform an "AND" or "non+AND" on the encrypted data block of the full IP packet. True randomized segmentation, forming two randomized segmentation data blocks;

The third step is to perform a byte-by-byte XOR encryption operation on the randomized divided data blocks based on the 1500-byte long random data keys k4 and k5 that are preset or negotiated by the key distribution protocol, forming two randomized data blocks. XOR data blocks;

In the fourth step, based on the group encryption keys k1 and k2, respectively, perform a group encryption operation on the randomized XOR data block, and re-encapsulate the standard IP protocol header to form two new standard IP encrypted state messages; Set the serial number value field of the IP encrypted state packet encrypted by k1 to the incremental odd serial number value, set the serial number value field of the IP encrypted state packet encrypted using k2 to the incremental even serial number value, and the two new IP packets The difference between the serial numbers is 1; then, the new standard IP encryption message is sent to the public Internet, and forwarded and transmitted to the destination IP encryption machine through the routing relay.

2. a kind of high-security IP security communication method according to claim 1, is characterized in that: described all-IP message group encryption module implements group encryption operation to the whole plaintext IP message that needs to transmit with group encryption algorithm, Encrypting and masking the data format of the entire plaintext IP packet is performed to form a block encrypted data block for the entire IP packet.

3. a kind of high-security IP security communication method according to claim 2, is characterized in that: described true randomization segmentation module is based on quantum random number generator real-time dynamic generation and full IP packet encryption data block length The same quantum true random number is randomized and divided byte by byte, and the full IP packet encrypted data block is randomized and divided into two randomized divided data blocks; one of the randomized divided data blocks is composed of quantum true random data. The block and the full-IP packet encrypted data block are obtained by byte-by-byte logical "AND" operation, and another randomized divided data block is obtained by inverting the quantum true random data block byte-by-byte, and then grouping the encrypted data block with the full IP packet. Obtained by byte-by-byte logical AND operation.

4. a kind of high-security IP secret communication method according to claim 3, is characterized in that: described two XOR operation modules are respectively based on two different 1500-byte long random data keys negotiated independently, Perform a byte-by-byte logical XOR operation on the randomized divided data block to form a randomized XOR data block.

5. a kind of high-security IP secret communication method according to claim 4, is characterized in that: described two group encryption modules are respectively based on two different keys negotiated independently, adopt group encryption algorithm to randomize two The XOR data block is packet-encrypted to form two packet-encrypted data blocks, which are respectively re-encapsulated into new IP packets transmitted by two IP encryption tunnels.

6. a kind of high-security IP secret communication method according to claim 1, is characterized in that: when described IP decryption processing device receives IP secret state message, takes following steps:

The first step is to strip off the IP header of the tunneling encapsulation;

The second step is to perform a packet decryption operation on the payload of the IP encrypted message corresponding to the odd sequence number based on the key k1. For the IP encrypted state packet corresponding to the even sequence number, perform the packet decryption operation on the payload based on the key k2. Get two randomized XOR data blocks;

The third step is to perform XOR decryption operation on the payload of the IP encrypted message corresponding to the odd sequence number based on the key k4, and perform XOR decryption on the payload based on the key k5 for the encrypted IP message corresponding to the even sequence number. operation to obtain two randomized partitioned data blocks;

The fourth step is to perform a byte-by-byte logical "OR" combination operation on the two randomized partitioned data blocks whose parity numbers have been collected to recover the full IP packet encryption data block;

The fifth step, based on the key k3, perform a packet decryption operation on the full IP packet encryption data block obtained by the combining operation, and recover the plaintext IP message.

7. a kind of high-security IP security communication method according to claim 6, is characterized in that: the method that determines whether to carry out "or" combining operation is: at first the IP secret state that the associated parity sequence number is not collected The packet payload is decrypted and then the randomized divided data blocks obtained after the XOR operation are buffered and queued, and the "OR" combination operation is performed after waiting for all of them to be collected. If the true randomization split data blocks of the decryption of the payload are all collected and reach the condition of the "OR" combination operation, the uncollected IP encrypted state packet payload decrypted true randomized data blocks that are queued in front of the cache are discarded. piece.