CN101741823B - Cross-validation safety communication method and system - Google Patents

Abstract

The present invention relates to a cross-verification secure communication method and system. In the method, during the communication process after the two communication parties establish a communication connection, the communication party puts the generated and saved verification code and the data to be sent in the data section of the communication packet. Put the last received verification code in the identification section of the communication package or encrypt the communication package and use the last received verification code as the key of the encrypted communication package, and send the communication package to the other party. After the other party receives it, use the last saved verification code to verify the received communication packet. If the verification is correct, then accept the data and send the communication packet to the other party in the same way as the other party sends the communication packet; otherwise, refuse to process. The communication parties repeat the above interaction process until the communication ends. Considering the integrity of the communication dialogue, the present invention generates a verification code with random characteristics, and through cross-validation, the dialogues of the two communication parties are chained to ensure that the communication between the two parties forms a closed dialogue chain, so that the data communication is safe and convenient .

Description

A cross-verified secure communication method and system

technical field

The invention belongs to the field of information security, and in particular relates to a cross-validation security communication method and system.

Background technique

Communication security is a widely used technology, and most of them use two methods at present. One way is a way of encrypting data transmission through a secure tunnel. Due to the increase in the complexity of data encryption, this method will cause a sharp increase in the amount of encrypted data, so the encryption method is limited, and once the encryption key is deciphered, it is easy for intruders to forge the response data, thereby bringing security holes to the communication. Another way is to ensure the security of data exchange between the two parties by establishing a reliable communication connection. The US Patent No. US7,424,736 "Method for establishing directed circuits between parties with limited mutual trust" uses this method. The second method cannot detect in time the phenomenon of illegal intrusion, interception of communication information, and modification of communication data by the third party during the communication period of the communication parties, so it is difficult to ensure the communication security of the communication parties during the communication period.

Contents of the invention

The object of the present invention is to provide a safe and convenient cross-verification secure communication method and system for data communication, so as to overcome the deficiencies of the prior art.

In order to achieve the purpose of the above invention, the technical solution adopted by the present invention is a cross-verified secure communication method, which includes the following steps:

(1) Establish a communication connection between the communication parties, and the communication party generates a verification code and communication offer and saves them locally and then sends them to the other communication party;

(2) The other party of the communication generates a new verification code and saves it according to the format requirements of the communication offer it received, puts the new verification code and the data to be sent in the data segment of the communication packet, and puts the last received Put the verification code in the identification section of the communication package or encrypt the communication package and use the verification code received last time as the key of the encrypted communication package, and then send the entire communication package to the other party;

(3) The communication parties repeat the following operations until the communication ends:

After receiving the communication packet sent by the other party, use the verification code saved last time to verify the received communication packet. If the verification is not correct, end the processing; otherwise follow the method of the communication party in step (2) to generate A new verification code and save it, then form a communication package and send it to the other party.

Further, the verification code is character encoding of random features, and its specific form is one of all combinations of object identification code, random character string, sequence number and time stamp, but it at least contains random character string or time stamp , where the object identification code is a character string used by both communication parties to identify themselves, the random character string is a fixed-length character string randomly generated according to the provisions of the communication offer, the sequence number is a continuous number recorded during the communication process, and the time stamp is the current time Converted to a string in the specified format according to the communication offer.

Furthermore, the two communicating parties generate different verification codes each time they communicate.

Further, the format of the verification code can only be recognized and processed locally, and does not need to be consistent between the two communicating parties.

Furthermore, the communication offer includes the composition format requirements of the verification code and the format requirements of the entire communication package, specifically including the start tag of the data segment, data length, data verification method and data encryption method.

Further, the communication packet containing the identification segment is encrypted according to the encryption method agreed by the communication parties and then sent to the other party, and the other party needs to decrypt the communication package after receiving it.

Furthermore, if there is an identification segment in the received communication packet, the verification described in step (3) refers to judging whether the verification code in the identification segment of the received communication packet is consistent with the verification code saved last time by the verifier ; Otherwise, the verification described in step (3) refers to whether the verifier can decrypt the received communication packet with the verification code saved last time.

Further, in step (3), the communication party sorts and processes the received out-of-order data packets according to the verification code through the data buffer device.

The present invention also provides a cross-verified secure communication system, which includes the following devices:

Communication connection establishment device: used to establish a communication connection between the communication parties;

Communication offer generation device: used to generate and save communication offers;

Verification code generating device: used to generate and save the verification code, and trigger the communication packet generation device;

Communication packet generation device: used to put the new verification code generated by the verification code generation device according to the format requirements of the received communication offer and the data to be sent in the communication packet data segment and place the verification code of the other party received last time in the The identification segment of the communication packet forms a communication packet containing the identification segment or puts the new verification code generated by the verification code generating device according to the format requirements of the received communication offer and the data to be sent in the data segment of the communication packet to form a communication packet with only the data segment, And trigger the communication sending and receiving device;

Communication receiving and sending device: used for both communication parties to receive and send communication packets, and trigger the verification device after receiving the communication packets;

Verification device: used by the communication party to verify the received communication packet with the verification code it saved last time after receiving the communication packet sent by the other party. If the verification is incorrect, the processing ends; otherwise, the verification code generation device is triggered ;

Communication end judging device: used to judge whether the communication is over, if so, then end the processing, otherwise continue the communication between the communication parties;

Encryption device: used to encrypt the communication package, use the last received verification code of the other party as the key of the encrypted communication package, and then send the entire communication package to the other party.

Further, the system also includes a data buffering device, which is used to sort and process the received out-of-order data packets according to the verification code.

The effect of the present invention is: because the technical solution considers the integrity of the communication dialogue, according to the generated verification code with random characteristics, through cross-validation, the dialogues of the two communication parties are chained to ensure that the two parties communicate to form a closed dialogue chain , so as to ensure that the data communication is both safe and convenient, so as to realize the object of the present invention.

Description of drawings

Fig. 1 is a flow chart of a cross-verified secure communication method according to the present invention;

Fig. 2 is a schematic structural diagram of a communication packet in an embodiment of the present invention;

Fig. 3 is a schematic structural diagram of another communication packet in the embodiment of the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

A cross-verified secure communication system, the system includes the following devices:

(1) Communication connection establishment device: used to establish a communication connection between the communication parties;

(2) Communication offer generation device: used to generate and save communication offers;

(3) Verification code generation device: used to generate and save the verification code, and trigger the communication packet generation device;

(4) Communication packet generation device: used to put the new verification code and the data to be sent in the data segment of the communication packet and place the verification code of the other party received last time in the identification segment of the communication packet to form a communication packet containing the identification segment or Put the new verification code and the data to be sent in the data segment of the communication packet to form a communication packet with only the data segment, and trigger the communication sending and receiving device;

(5) Communication receiving and sending device: used for both parties to receive and send communication packets, and trigger the verification device after receiving the communication packets;

(6) Verification device: It is used by the communication party to verify the received communication packet with the verification code saved last time after receiving the communication packet sent by the other party. If the verification is incorrect, the processing ends; otherwise, the verification code is triggered generating device;

(7) Communication end judging device: used to judge whether the communication is over, if so, end the processing, otherwise continue the communication between the two parties;

If the communication packet has no identification segment, the above system also includes an encryption device, which is used to encrypt the communication packet. At the same time, the above system may also include a data buffering device, which is used to sort and process the received out-of-order data packets according to the verification code.

As shown in Figure 1, a cross-verification secure communication method includes the following steps:

Step S11: Establish a communication connection between the communication parties.

In this step, a communication connection is established between the communication parties based on data transmission protocols such as FTP, HTTP, and POP3.

Step S12: pass. The messaging party generates verification codes and newsletter offers, saves them and sends them.

After the communication connection between the communication parties is established, the communication party generates a verification code and communication offer, saves the generated verification code and communication offer, and sends them to the other party. In this embodiment, the communication parties are the receiver and the sender respectively, and the receiver first generates a verification code and communication offer, saves the generated verification code and communication offer, and sends them to the sender. There may be only one receiver, or there may be multiple receivers. In this embodiment, there is only one receiver. The verification code here is a character encoding of random features, and its specific form is one of all combinations of object identification code, random character string, sequence number and time stamp, but it contains at least random character string or time stamp, where the object The identification code is a character string used by both communication parties to identify themselves, the random character string is a fixed-length character string randomly generated according to the provisions in the communication offer, the sequence number is a continuous number recorded during the communication process, and the timestamp is the current time converted to the specified time according to the communication offer format string. The communication offer mainly includes the composition format requirements of the verification code, and the format requirements of the entire communication package, including the start tag of the data segment, data length, data verification method, and data encryption method. The communication offer generated by the receiver in this implementation looks like this:

The above offer indicates that the recipient’s identification code is 7973AE9B81E74632B38F677A8DFB6C83, and the communication packet only has data segments. The communication packet should be encrypted with the verification code received last time. The verification code consists of three parts: GUID identification code, random string, and time stamp.此步骤接收方生成的验证码为D167FB39F53849f7ADB1522339D73E4DAUmo82390810221625231，其中D167FB39F53849f7ADB1522339D73E4D为GUID标识码，表明与其通讯的对方为D167FB39F53849f7ADB1522339D73E4D；AUmo8239为随机字符串；0810221625231为时间戳。

Step S13: The other party in the communication generates a verification code and a communication packet, and sends the communication packet.

This step is for the other party to generate a new verification code and save it according to the format requirements of the communication offer it received, put the new verification code and the data to be sent in the data segment of the communication packet, and put the last received The verification code is placed in the identification section of the communication package or the communication package is encrypted, and the verification code received last time from the other party is used as the key of the encrypted communication package, and the entire communication package is sent to the other party. There are two types of communication packets here. One type of communication packet is composed of identification segment and data segment, and the data segment is composed of verification code and data. Its specific structure is shown in Figure 2; the other type of communication packet has no identification segment. There is only a data segment, and its data segment is composed of a verification code and data, and its specific structure is shown in FIG. 3 . Because the communication offer in this embodiment requires that the communication packet has only data segments, the communication packet should be encrypted with the verification code received last time, so we use the communication packet shown in FIG. 3 in this embodiment. In this embodiment, the other communication party in this step is the sender, that is, this step can be expressed as: the sender generates a verification code and a communication packet, and sends the communication packet. That is, the sender needs to generate and save the new verification code (7973AE9B81E74632B38F677A8DFB6C83BUmo02120810221628221) according to the format requirements of the communication offer sent by the receiver, and send the new verification code and the required data "Wang ××, your first task is completed No?" in the data section of the communication package, encrypt the communication package and use the verification code (D167FB39F53849f7ADB1522339D73E4DAUmo82390810221625231) received last time as the key of the encrypted communication package, and send the entire communication package to the other party, that is The decryption code of the encrypted communication packet in this step is D167FB39F53849f7ADB1522339D73E4DAUmo82390810221625231.

Step S14: Verify.

In this step, one of the communication parties uses the verification code saved last time to verify the received communication packet after receiving the other party's communication packet. If the verification is correct, execute step S15, otherwise end the communication. The verification performed by one of the communication parties here is different according to the requirements of the communication offer. That is, if the communication offer does not need to be encrypted, the verification performed when the communication packet received by the verification party has an identification segment is to judge the received communication. Whether the verification code in the identification section of the package is consistent with the verification code saved last time by the authenticator; if the communication offer needs to be encrypted, the verification performed when the communication packet received by the authenticator does not have an identification section is the last saved verification code by the authenticator Whether the verification code can decrypt the received communication packet. In this example, this step can be described as the receiver verifying the received communication packet. Since the communication offer needs to be encrypted in this embodiment, the communication packet received by the verifier does not have an identification segment, so in this step the receiver applies the verification code 167FB39F53849f7ADB1522339D73E4DAUmo82390810221625231 saved last time to decrypt the received communication packet. If it is decrypted, step S15 is executed; otherwise, it means that the content in the received communication packet has been illegally altered by a third party, the receiver refuses to process the communication packet, and the communication ends. In this embodiment, the communication packet received in this step has not been illegally altered by a third party, so it can be decrypted, so after this step is executed, step S15 is executed.

Step S15: Determine whether the communication is over

In this step, if the communication needs to end, the entire communication between the two communicating parties ends; otherwise, step 17 is executed. In this embodiment, it is the receiving party who performs this step at this time, because the data received by the receiving party is "Wang ××, have you completed your first task?" The receiving party should respond to this, so here Step S16 is executed after the steps are executed.

Step S16: After the data is processed, a verification code and a communication packet are generated, and the communication packet is sent.

In this step, the operations to be performed by one of the communicating parties after processing the data in the received communication packet are the same as the operations performed by the communicating party in step S13. After this step is executed, turn to step S14, and the communication parties repeatedly execute step S14 to step S16 according to specific conditions until the communication ends. In this embodiment, the operations that the receiver needs to perform after processing the data in the received communication packet are the same as those performed by the sender in step S13, and the receiver generates a new verification code according to the format requirements of the communication offer And save it, the generated verification code is D167FB39F53849f7ADB1522339D73E4DAUmo82400840681629082, put the data to be sent "I have completed the first task, what should I do next?" and the new verification code in the communication package and encrypt the communication according to the encryption method in the communication offer After the packet is encrypted, it is sent to the sender. The decryption code of the communication packet sent in this step is the received verification code—7973AE9B81E74632B38F677A8DFB6C83BUmo02120810221628221. In this implementation, after the receiver executes this step, it enters step S14, that is, the sender needs to execute step S14.

When the sender executes step S14, the sender first decrypts the received communication packet with the verification code 7973AE9B81E74632B38F677A8DFB6C83BUmo02120810221628221 saved last time. In this implementation, it is assumed that the data received by the sender in this step has not been illegally altered by a third party, so the sender can decrypt the received communication packet with the verification code saved last time, and step S15 needs to be performed .

When the sender executes step S15, because the data received this time is "I have completed the first task, what should I do next?", so it needs to respond to this, so the sender needs to proceed to step S16 .

When executing step S16, the sender generates and saves a new verification code 7973AE9B81E74632B38F677A8DFB6C83BUmo02130246521623628 according to the format requirements of the communication offer, and puts the new verification code and the data to be sent "Please proceed to the second task, I am fine." in the communication package According to the requirements of the communication offer, the communication package is encrypted and sent to the receiver. The decryption code of the communication package sent this time is the verification code received by the sender: D167FB39F53849f7ADB1522339D73E4DAUmo82400840681629082. After the sender executes step S16, the receiver needs to execute step S14 again.

When the receiver executes step S14, the receiver uses the verification code D167FB39F53849f7ADB1522339D73E4DAUmo82400840681629082 saved last time to decrypt and verify the received communication packet. Assuming that the communication packet received by the sender has not been illegally modified by a third party, the receiver If it can be decrypted and the verification is correct, step S15 needs to be performed.

When the receiving party executes step S15, because the received data is "please continue to perform the second task, I have nothing else to do." So there is no need to respond to this, and the communication ends, that is, the entire call ends.

The method described in the present invention is not limited to the examples described in the specific implementation manners, and those skilled in the art can obtain other implementation manners according to the technical solutions of the present invention, which also belong to the technical innovation scope of the present invention.

Claims (10)

1. the safe communication method of a cross validation, the method comprises following steps:

(1) set up communication between communication two party and connect, communication one side sends to communication the opposing party after generating an identifying code and communication offer and the two being kept at this locality;

(2) communication the opposing party is according to the call format of its communication offer that receives, generate a new identifying code and preservation, new identifying code and the data that need to send are placed on the data segment of communication bag, the other side's that the last time is received identifying code is placed on the identification section of communication bag or to communication packet encryption and the other side's that the last time is the received identifying code key as the communication bag after encrypting, more whole communication bag is sent to the other side;

(3) communication two party repeats following operation until communication finishes:

After receiving the communication bag that the other side sends, go to verify received communication bag with the own the last identifying code of preserving, if verify incorrect, end process then; Otherwise according to the method for communication side in the step (2), generate a new identifying code and preservation, then form the communication bag and send it to the other side.

2. the safe communication method of a kind of cross validation as claimed in claim 1, it is characterized in that: described identifying code is the character code of random character, its concrete form is the object identity code, random string, a kind of in all combinations that serial number and timestamp form, but it comprises random string or timestamp at least, wherein said object identity code is the character string of communication two party sign self, random string is according to the random CHAR that generates of regulation in the communication offer, serial number is the continuous number that records in the communication process, and timestamp is the character string that the current time is converted to prescribed form according to the communication offer.

3. the safe communication method of a kind of cross validation as claimed in claim 1 is characterized in that: all generate different identifying codes during the each communication of described communication two party.

4. the safe communication method of a kind of cross validation as claimed in claim 1 is characterized in that: but the form of described identifying code this locality identifying processing only is need not communication two party consistent.

5. the safe communication method of a kind of cross validation as claimed in claim 1, it is characterized in that: described communication offer comprises the composition call format of identifying code and the call format of whole communication bag, specifically comprises beginning label, data length, data verification method and the data ciphering method of data segment.

6. the safe communication method of a kind of cross validation as claimed in claim 1 is characterized in that: send to the other side after the communication bag that comprises identification section is encrypted by the encryption method of communication two party agreement again, need after the other side receives the communication bag is decrypted.

7. such as the safe communication method of the described a kind of cross validation of one of claim 1 to 6, it is characterized in that: if in the communication bag that receives identification section is arranged, the checking described in the step (3) refers to judge whether the identifying code that identifying code and the authentication the last time in the received communication bag identification section preserve is consistent; Otherwise the checking described in the step (3) refers to that can authentication to received communication bag deciphering with the last identifying code of preserving.

8. the safe communication method of a kind of cross validation as claimed in claim 7, it is characterized in that: in the step (3), communication one square tube is crossed data buffering equipment, and the non-ordered data bag that receives is processed according to the identifying code ordering.

9. the safety communication system of a cross validation, this system comprises such as lower device:

Communication connects apparatus for establishing: be used for setting up communication and connect between communication two party;

Communication offer generating apparatus: be used for generating and preserving the communication offer;

Identifying code generating apparatus: be used for generating and preserving identifying code, trigger communication bag generating apparatus;

Communication bag generating apparatus: be used for the new identifying code that the identifying code generating apparatus is generated according to the call format of the communication offer that receives and identifying code that the data that need to send are placed on communication bag data segment and the other side that the last time is received is placed on that communication bag identification section forms the communication bag that comprises identification section or new identifying code that the identifying code generating apparatus is generated according to the call format of the communication offer that receives and needing sends data are placed on communication bag data segment and form the communication bag that only has data segment, and trigger the communication sending and receiving device;

Communication reception and dispensing device: be used for communication two party and receive and send the communication bag, trigger demo plant after receiving the communication bag;

Demo plant: be used for communication one side after receiving the communication bag that the other side sends, go to verify received communication bag with the own the last identifying code of preserving, if verify incorrect, end process then; Otherwise trigger the identifying code generating apparatus;

Communication finishes judgment means: be used for judging whether communication finishes, if so, end process then, otherwise the communication between the continuation communication two party;

Encryption device: be used for the communication bag is encrypted, the other side's that the last time is received identifying code sends to the other side with whole communication bag again as the key of the communication bag after encrypting.

10. the safety communication system of a kind of cross validation as claimed in claim 9, it is characterized in that: described system also comprises a data buffer device, the non-ordered data bag that this equipment is used for receiving is processed according to the identifying code ordering.

Images