Encryption method based on DH and RSA encryption algorithms

An encryption method technology field based on DH and RSA encryption algorithms

[0001] The present invention belongs to the technical field of secure communication, and relates to an encryption method based on DH and RSA encryption algorithms.

Background technique

[0002] Nowadays, with the increasing importance of industrial field communication, various communication security based on fieldbus communication methods are also becoming more and more important. In order to avoid various communication threats that may be received, a design that can guarantee communication is designed. Safe methods are extremely important. For the Modbus/TCP communication method, there are defects such as that the corresponding instructions and addresses are used for data transmission in plain text, so the attacker can easily intercept and tamper with the data information, thereby causing communication failures and endangering communication security. Therefore, in order to ensure the transmission security of data information during communication, it is necessary to perform encryption and decryption processing on the communication data information.

[0003] The AES encryption algorithm is a commonly used symmetric encryption algorithm. Its encryption and decryption uses the same key. It is an encryption method based on data blocks. It can resist all known cryptographic attacks. It has practical performance in hardware and software in a computer environment. All are very good, its key establishment time is short and flexible, suitable for various complex environments. However, since the encryption and decryption of symmetric encryption use the same key, the security of symmetric encryption depends not only on the strength of the encryption algorithm itself, but also on whether the key is safely stored and transmitted. If the key is attacked and leaked during the transmission, the transmission content will be leaked.

Summary of the invention

[0004] In order to solve the problem that the AES symmetric key is attacked and leaked during the transmission process, which will cause the transmission content to be leaked, the present invention provides an encryption method based on DH and RSA encryption algorithms, which can guarantee the symmetric encryption. The secure transmission of the key ensures the security of communication.

[0005] The purpose of the present invention is achieved through the following technical solutions: An encryption method based on DH and RSA encryption algorithms, including the following steps: Step 1. The sender negotiates with the receiver to establish security based on a preset key exchange algorithm Key; Step 2: The sender obtains the data to be transmitted, and counts the data volume of the data to be transmitted; Step 3: When the data volume of the data to be transmitted is greater than the preset value, the sender determines the symmetric key based on the security key; 4. Based on the symmetric key, apply the AES encryption algorithm to encrypt the data to be transmitted; Step 5. The sender broadcasts the encrypted data to be transmitted to the receiver.

[0006] In the present invention, the preset key exchange algorithm is the DH key exchange algorithm.

[0007] In the present invention, the method for the sender to negotiate with the receiver to establish a security key based on a preset key exchange algorithm is as follows: (1) The sender randomly selects a prime number and an integer, and generates a first random less than the prime number. The first result is calculated based on the first preset algorithm, and the prime number, integer, and the first result are broadcast to multiple receivers, where the first preset algorithm is YAjEjXAjmodPjYAi is the first result, P: is a prime number, Ei Is an integer, X_AiIs the first random number; (2) After each receiver receives the prime number, integer, and the first result, each receiver generates a random number smaller than the prime number.

The second result is calculated based on the first result and the respective random number, and the second result obtained by each calculation is sent to the sender; (3) After the sender receives the second result sent by each receiver, Calculate the first key corresponding to each receiver, perform normalization processing based on the first key corresponding to each receiver to obtain the security key, and determine the key calculation factor corresponding to each receiver based on the second result. The key calculation factors are respectively sent to the corresponding recipients; (4) Each recipient calculates its own second key based on its own random number and the first result, and calculates the factor between its own second key and the received key After performing the exclusive OR operation, the security key is obtained.

[0008] In the present invention, after the sender obtains the data to be transmitted and counts the data amount of the data to be transmitted, the method further includes the following steps: (1) When the data amount of the data to be transmitted is less than or equal to the preset value, the sender Determine its own RSA key pair, where the RSA key pair includes a public key and a private key; (2) The sender uses the security key as the symmetric key and applies a preset symmetric encryption algorithm to encrypt the public key, Broadcast the encrypted public key to the receiver; (3) The sender uses the private key to encrypt the data to be transmitted by RSA and then broadcasts it to the receiver.

[0009] In the present invention, the preset symmetric encryption algorithm is the AES encryption algorithm.

[0010] In the present invention, the method for the sender to determine the symmetric key based on the security key is as follows: the sender uses the security key as the symmetric key.

[0011] In the present invention, the method for the sender to determine the symmetric key based on the security key is as follows: (1) The sender determines its own RSA key pair, where the RSA key pair includes a public key and a private key; (2) ) The sender uses the security key as the symmetric key, uses the preset symmetric encryption algorithm to encrypt the public key, and broadcasts the encrypted public key to the receiver; (3) The receiver uses the public key to transfer the symmetric key to be transmitted After the key is encrypted, it is sent to the sender.

[0012] In the present invention, the preset symmetric encryption algorithm is the AES encryption algorithm.

[0013] Compared with the prior art, the present invention has the following advantages: After the sender and the receiver establish a communication connection, the present invention first negotiates the establishment of a security key, so as to achieve the pass without any pre-information from the other party. The insecure channel creates a secure key for subsequent encrypted transmission of data or keys to ensure secure communication. In addition, the AES encryption algorithm is used to ensure certain communication efficiency.

Description of the drawings

[0014] FIG. 1 is a schematic diagram of an embodiment of a secure communication method based on combined encryption of the present invention; FIG. 2 is an example of a unicast communication key agreement establishment process; FIG. 3 is an example of a broadcast communication key agreement establishment process; Fig. 4 is another example of the establishment process of a broadcast communication key agreement; Fig. 5 is a schematic diagram of an embodiment of the step S40 of the secure communication method based on combined encryption of the present invention; Fig. 6 is a secure communication method based on the combined encryption of the present invention A schematic diagram of another embodiment after step S40 is refined; FIG. 7 is a schematic diagram of another embodiment of a secure communication method based on combined encryption according to the present invention.

Detailed ways

[0015] The technical solution of the present invention will be further described below in conjunction with the drawings, but it is not limited to this. Any modification or equivalent replacement of the technical solution of the present invention without departing from the spirit and scope of the technical solution of the present invention shall cover In the protection scope of the present invention.

[0016] Modbus/TCP is a Modbus message transmission protocol running on TCP/IP. Through this protocol, industrial equipment can communicate with other devices through a network such as Ethernet. The protocol follows the master-slave communication mode of a single master station. There can only be one master on a Modbus network, and there may be one or more slaves (as shown in Figure 2). Among them, the master is a TCP client and the slave is a TCP server. The master sends a request to the slave to obtain data or modify Slave data, the slave responds to the host request and returns response data. The host sends request messages to the slaves in two ways, namely unicast mode and broadcast mode. In unicast mode, the master device only addresses a single slave device, and in broadcast mode, the master device sends request commands to all slave devices. The sender in the embodiment of the present invention refers to the host as the main body of data transmission, and the receiver refers to the slave as the main body of data receiving.

[0017] As shown in FIG. 1, the secure communication method based on combined encryption provided by the present invention includes the following steps: Step S10: The sender negotiates with the receiver to establish a security key based on a preset key exchange algorithm.

[0018] For the sender and receiver that do not have any information (including key information) of each other, if you want to ensure the security of data transmission, you need to ensure the security of the data encryption key. Therefore, the sender establishes with the receiver. After connection, first negotiate with the receiver through a preset key exchange algorithm to establish a security key to provide security for subsequent data transmission or key transmission.

[0019] Optionally, the preset key exchange algorithm is a DH key exchange algorithm. Based on the DH key exchange algorithm, the sender and receiver can create a secure key through an insecure channel without any pre-information from the other party or when the key pair is missing. The key encrypts the key or data to be transmitted.

[0020] In the unicast mode, the sender communicates with one receiver, and therefore negotiates with the one receiver to establish a security key. In the broadcast mode, the sender negotiates with multiple receivers to establish a security key. Optionally, in the unicast mode, step S10 includes: the sender randomly selects a prime number P and an integer E, and generates a first random number X smaller than the prime number P_A, The first result Y is calculated based on the first preset algorithm_A, The prime number P, the integer E, and the first result Y_ASent to the server, where the first preset algorithm is Y_A=E"X_AmodP, P is a large prime number; the receiver receives the prime number P, the integer E, and the first result Y_AAfter that, generate a second random number X smaller than the prime number_B, Based on the first result Y_AAnd the second random number X_BCalculate and obtain the security key K, optionally, calculate and obtain the security key K based on the third preset algorithm, and the third preset algorithm is K=YJX_B modP; and obtain the second result Y based on the second preset algorithm_B, The second result Y_BSent to the sender, where the second preset algorithm is Y_b=EX_b modP; After receiving the second result, the sender calculates and obtains the security key based on the first random number and the second result; optionally, calculates and obtains the security key K based on the fourth preset algorithm, and the fourth preset algorithm is K= Y_BX_A modP.

[0021] The receiver saves its calculated security key K=YJX_B modP, the sender saves its calculated security key K=Y_BX_A modP, where Y_BX_A modP=YjX_B modP.

[0022] In the broadcast mode, the specific steps of step S10 are as follows: Step 1. The sender randomly selects a prime number Pi and an integer Ei, and generates a third random number X smaller than the prime number._Ai, And calculate the third result Y based on the fifth preset algorithm_Ai, Where the fifth preset algorithm is Y_Ai=EjX_AimodPi, the prime number Pr integer Ei and the third result Y_AiSend to multiple recipients; Step 2. Each recipient receives the prime number P "integer Ei and the third result Y_AiThen, each generates a random number Xj smaller than the prime number d, and based on the third result Y_AiAnd the respective random number 4 to calculate the respective fourth result Yj will be counted separately

The fourth result Yi obtained by the calculation is sent to the sender, where the fourth result Yi=Ei-XimodPi; Step 3. The sender receives the fourth result ya sent by each receiver: Afterwards, calculate the first result corresponding to each receiver A key, and normalization is performed based on the first key corresponding to each receiver, so that the sender and the receiver determine the security key (symmetric key) required for broadcast communication. Specifically, the sender passes where = Y "Y 2 2." Y (Y is the fourth result i 1 2 i, i sent by each receiver) calculates the security key, and determines the key calculation factor corresponding to each receiver based on the fourth result Yi, The key calculation factors are sent to the corresponding receivers respectively; among them, the calculation method of the first key corresponding to each receiver is: Where = YjX_AimodPi; ^{1 1}Step 4. Each receiver based on its own random number Xj and the third result Y_AiCalculate its own second key, and perform an XOR between its own second key and the received key calculation factor to obtain the security key.

[0023] For ease of understanding, as shown in FIG. 3, four receivers B, C, D, and E are taken as examples to explain the foregoing process, but in different implementation manners, the number of receivers is not limited to four.

[0024] Step 1. The sender randomly selects a prime number Pj and an integer Ei, and generates a random number X smaller than the prime number._AiAnd based on Y_Ai=E"X_Aim0 dp_iCalculate Y_Ai, The prime number Pr integer Ei and the third result Y_AiSent to recipients B, C, D, E; Step 2. Recipients B, C, D, and E receive the P "Εί and Y from sender A"_AiThen, each select a random number smaller than Pj, namely the random number XBiVPi'XciVPi'XDiVPj'XEiVPi, and calculate YBjEjXBimodPj'YcjEj X respectively_CimodPi ,Y_Di=Ei ~X_DimodPi .Y_Ei=E_i~X_EimodPi, the receivers B, C, D, and E will each get Y_Bi, Y_Ci, Y_Di, Y_EiSend to sender A; Step 3. Sender A receives Y sent by receivers B, C, D, and E_Bi, Y_Ci, Y_Di, Y_EThen, calculate the keys separately:^KiB=^YBi~^XAi^modPi'^KiC=^YCi~^XAi^modPi'^KiD=^YDi~^XAi^modPi'^KiE=^YEi~^XAi^modPi; Step 4. Recipient B calculates the key: K_iB=Y_Ai~X_BimodP_i ; The receiver C calculates the key: K_iC=Y_Ai~X_CimodP_i ; The receiver D calculates the key: K_iD=Y_Ai~X_DimodP_i ; The receiver E calculates the key: K_iE=Y_A"X_Eim0dp_i (I=1,2,...N, ensure that the length of% is 128 bits).

[0025] Step 5. The sender A performs the normalization process: Min Xiaozheng Fei Zhizheng Zhizheng, and at the same time, sends all 0 Fei Rong Fei back to B;

K_iB-K_iD"K_iESend to C; send Ki^KiJKiE to D; send K_iB-KiJK_iDSend to E.

[0026] Step 6. Each receiver assigns its own key (K_iBK_iCK_iD, K_iE) Perform an XOR with the key sent by A to get the final key, namely: This=%^^^^^^;^KC=^KiB ^KiC ^KiD ^KiE;^KD=^KiB ^KiC ^KiD ^KiE;^KE=^KiB ^KiC ^KiD ^K[0027] At this point, the sender A and the receivers B, C, D, and E negotiate to establish a security key.

[0028] For ease of understanding, FIG. 4 is a schematic diagram of a session including a client and two servers. The client A negotiates with the servers B and C to establish a security key K. First, the client A sends the prime number Pr, the integer Ei, and the client A based on the prime number Pj, the integer Ei, and the random number X._AiCalculated Y_AiSent to servers B and C respectively, where X_AiSaved by client A, and only known to client A; then, Y is calculated by server B/C respectively_Bi/Y_Ci, And Y_Bi/Y_CiSent to client A, where server B/C calculates Y_Bi/Y_Ci, Can be based on Y_Bi=E"X_BimodP_i/Y_Ci=E_i -X_CimodPi calculation; then, client A based on Y sent by server B/C_Bi/Y_Ci, Based on K_iB=Y_AJX_BimodPi/K_iC=Y_Ai -X_Cim0 dp_iCalculate K separately_Bi/K_Ci, Then based on K_BiWith K_CiPerform normalization, that is, based on K_BiWith K_CiCalculate the security key K, K=K_iB -K_iC, Client A keeps K and keeps K_CiSend to server B, send K_BiSent to server C, server B based on K_CiCalculate K, based on K by server C_BiCalculate K, the K calculated by the server B and C, and the K calculated by the client A are the same keys, both are K=K_iB -K_iC。

[0029] Step S20: The sender obtains the data to be transmitted, and counts the data volume of the data to be transmitted.

[0030] In the broadcast mode, if the RSA algorithm is used for encryption, the private key is used to encrypt the public key for decryption, and the RSA private key is used to encrypt the public key.

The amount of calculation for decryption is relatively large. If the amount of data to be transmitted is relatively large, the use of this method will result in an excessive amount of calculation, which affects the transmission efficiency and also causes a large resource consumption.

[0031] Therefore, in the broadcast mode, first determine the data volume of the data to be transmitted, and perform step S30: determine whether the data volume of the data to be transmitted is greater than the preset value, and if so, perform step S40: apply the AES encryption algorithm to encrypt the transmission to be transmitted For data transmission, the encryption and decryption speed of the AES encryption algorithm is relatively fast, which is suitable for use when the amount of data is large, and ensures the efficiency of data transmission in the communication process.

[0032] In step S40, the sender determines the symmetric key based on the security key.

[0033] The embodiment of the present invention uses the AES symmetric encryption algorithm to encrypt the data to be transmitted. Therefore, the symmetric key for AES symmetric encryption needs to be determined first.

[0034] Optionally, as shown in FIG. 5, the specific steps of step S40 are as follows: Step S400: the sender uses the security key as a symmetric key. That is, the security key is used as the symmetric key, and the subsequent AES symmetric encryption is performed. Because the AES encryption algorithm is simple and the encryption speed is fast, and the symmetric key is encrypted and transmitted through the security key, the secure transmission of the symmetric key is ensured. Therefore, the embodiment of the present invention guarantees a certain amount of communication while ensuring secure communication. Transmission efficiency.

[0035] Optionally, first, based on the security key, the senders RSA public key is symmetrically encrypted and transmitted to the receiver, and then the receiver transmits the preset symmetric key based on the RSA public key encryption, and the symmetric key is used as the subsequent The symmetric key for AES encryption of the data to be transmitted.

[0036] Specifically, as shown in FIG. 6, the specific steps of step S40 are as follows: Step S410: the sender determines its own RSA key pair, where the RSA key pair includes a public key and a private key; The RSA key pair can be previously generated and stored in the sender, or currently generated, that is, the current RSA key pair is generated based on the RSA algorithm, and the public key and private key are generated based on the RSA algorithm. The sender chooses two random keys. Prime numbers p and q, first, calculate n and L, where n=pXq, L=lcm (pT, qT), lcm is the least common multiple, and then randomly select an integer e, where e satisfies 1<e<L and gcd(e,L)=1, gcd is to find the greatest common divisor, and finally calculate d, where d satisfies 1<d<L and eXd mod L =1. The sender uses (e, n) as the public key and (d, n) as the private key, sends the public key to the receiver, and keeps the private key.

[0037] Step S411: The sender uses the security key as a symmetric key, applies a preset symmetric encryption algorithm to encrypt the public key, and broadcasts the encrypted public key to the receiver; the sender determines its own RSA secret After the key pair, use the security key as the symmetric key, apply the preset symmetric encryption algorithm to encrypt its own public key, and broadcast the encrypted public key to the receiver, because the senders public key is encrypted before broadcasting to the receiver Party, can guarantee the security of the public key.

[0038] After the sender sends its own public key to the receiver, the receiver can use the senders public key to encrypt its own public key and send it to the sender, or the receiver can also use the security key as a symmetric key. The key is used to encrypt its own public key using a preset symmetric encryption algorithm and then sent to the sender to realize the exchange of asymmetric keys. The data to be encrypted can be encrypted before transmission to ensure communication security.

[0039] Optionally, the preset symmetric encryption algorithm is an AES encryption algorithm.

[0040] Step S412: The receiver uses the public key to encrypt the symmetric key to be transmitted, and then sends it to the sender.

[0041] After receiving the public key encrypted by the sender, the receiver uses the security key to decrypt it to obtain the public key plaintext, and then uses the public key plaintext to encrypt the symmetric key to be transmitted and send it to the sender .

[0042] Wherein, the symmetric key to be transmitted is a symmetric key pre-stored by the receiver.

[0043] Through the security key, a secure RSA key pair is established, and then through the RSA key pair, the preset symmetry to be transmitted

The key is encrypted and then transmitted, combining the advantages of the strong confidentiality of the RSA encryption algorithm and the fast encryption and decryption speed of the AES encryption algorithm, giving consideration to communication security and communication efficiency.

[0044] Step S50: Based on the symmetric key, the AES encryption algorithm is applied to encrypt the data to be transmitted; the symmetric key is used as the encryption and decryption key of the AES encryption algorithm, and the data to be transmitted is encrypted and decrypted.

[0045] Step S60: The sender broadcasts the encrypted data to be transmitted to the receiver.

[0046] After the sender and the receiver establish a communication connection, they first negotiate the establishment of a security key, so that a security key is created through an insecure channel without any prior information from the other party for subsequent data or The encrypted transmission of the key ensures safe communication. In addition, the AES encryption algorithm is used to ensure certain communication efficiency.

[0047] Optionally, as shown in FIG. 7, after step S30, the following steps are further included: Step S70: When the amount of data to be transmitted is less than or equal to a preset value, the sender determines its own RSA key pair, where all The RSA key pair includes a public key and a private key; if the amount of data to be transmitted is small, to enhance confidentiality, RSA encryption can be performed on the data to be transmitted.

[0048] The sender's own RSA key pair may be previously generated and stored in the sender, or may be currently generated, that is, the RSA key pair is currently generated based on the RSA algorithm, and the public key and the private key are generated based on the RSA algorithm, The sender selects two random large prime numbers p and q. First, calculate n and L, where n=pXq, L=lcm (pT, qT), lcm is the least common multiple, and then randomly select an integer e, where e Satisfy 1<e<L and gcd(e,L)=1, gcd is to find the greatest common divisor, and finally calculate d, where d meets 1<d<L and eXd mod L =1. The sender uses (e, n) as the public key and (d, n) as the private key, sends the public key to the receiver, and keeps the private key.

[0049] Step S80: The sender uses the security key as a symmetric key, applies a preset symmetric encryption algorithm to encrypt the public key, and broadcasts the encrypted public key to the receiver; the preset symmetric encryption algorithm can be It is the AES encryption algorithm.

[0050] Step S90: The sender applies the private key to RSA encryption of the data to be transmitted, and then broadcasts it to the receiver.

[0051] Since the private key is kept by the sender itself, and the senders public key is sent to the communicating party (ie, the receiver), the private key is used to encrypt the data to be transmitted to obtain the encrypted data to be transmitted and broadcast to multiple receivers , The receiver uses the senders public key to decrypt the encrypted data to be transmitted.

[0052] After the sender and the receiver establish a communication connection, they first negotiate the establishment of a security key, so that a security key can be created through an insecure channel without any pre-information from the other party for subsequent data/ Encrypted transmission of the key, the sender uses the security key as the symmetric key, applies a preset symmetric encryption algorithm, encrypts its own public key and broadcasts it to the receiver, realizing the confidential transmission of the public key and performing secure key exchange. This ensures that the verification of the senders signature is not leaked, and when the RSA algorithm is applied to the broadcast mode, the application of private key encryption and public key decryption can also ensure the safe transmission of data and ensure the safety of data information in the subsequent communication process.

[0053] In addition, the specific encryption method is determined according to the amount of data to be transmitted. When the amount of data to be transmitted is small, the data to be transmitted is encrypted and transmitted by the RSA algorithm. This method uses different key pairs and the encryption method More secure; when the amount of data is large, the time-consuming encryption method will increase rapidly. At this time, the RSA algorithm is not applicable. Because the AES symmetric encryption algorithm has a faster encryption speed, the AES symmetric encryption algorithm is used to realize the encrypted transmission of data. . In this way, both communication speed and confidentiality can be taken into account.

[0054] In an embodiment of the present invention, the communication subject (sender/receiver) obtains the same symmetric key through the DH key exchange protocol, this key is regarded as an AES symmetric key, and the AES encryption algorithm is used to treat The transmitted data is encrypted for transmission. Because the DH key exchange protocol allows the sender and the receiver to create a secure key through an insecure channel without any pre-information from the other party or when the key pair is missing, etc., to ensure the AES encryption algorithm

While the key is safe, it can take full advantage of the fast encryption speed of the AES encryption algorithm.

[0055] In another embodiment of the present invention, the communication subject (sender/receiver) obtains the same symmetric key through the DH key exchange protocol, and the symmetric key is used to symmetrically encrypt the public key of the communication subject Transmission enables the communication subject to have the public key of the other party, and then uses RSA to encrypt and transmit the preset symmetric key based on the public key, and uses the preset symmetric key to encrypt and transmit the data to be transmitted.

[0056] In another embodiment of the present invention, the encryption method of the data to be transmitted is determined according to the data volume of the data to be transmitted. Specifically, the sender needs to broadcast the data to be transmitted to multiple receivers. The sender can first negotiate with multiple receivers to establish a security key. If the amount of data to be transmitted is large, the security key is used to symmetrical the data to be transmitted. After encryption, broadcast to multiple receivers. If the amount of data to be transmitted is small, RSA encryption is performed on the data to be transmitted. Specifically, the RSA public key is encrypted with a secure key and then broadcast to multiple receivers. The sender uses its own The RSA private key performs RSA encryption on the data to be transmitted, and then broadcasts it to the receiver, so that the receiver can use the sender's RSA public key to decrypt the data it sends.