CN108306868A - Data security communication device and method - Google Patents

Abstract

A data security communication device and method, the device includes: a mixing and unmixing module, which is used to perform mixed processing on M channels of first original data and N-M channels of random signals according to a first key, to determine N channels of mixed signals; The decryption module encrypts the mixed signals of the N channels respectively according to the first key, and determines the encrypted signals of the N channels; the binding and unbinding module performs binding processing on the encrypted signals of the N channels, and determines the first confidentiality of the bound N channels signal; and/or unbundle the second confidential signal of N paths, determine and output the aligned N path unbundling signals to the encryption and decryption module for decryption processing, and the encryption and decryption module determines and outputs N paths of decrypted signals according to the second key The signal is sent to the mixing and unmixing module for unmixing processing, and the mixing and unmixing module determines and outputs L channels of second original data according to the second key. The invention can carry out confidential processing on N channels of data, and it is difficult to decipher; the data is sent by N channels at the same time, which improves the security of the physical link of the communication system.

Description

Data security communication device and method

technical field

The invention relates to the field of secure communication, in particular to a data secure communication device and method.

Background technique

With the advent of the information age, the network has unknowingly become an indispensable part of our lives, profoundly affecting the construction of politics, economy, culture and many other aspects, ensuring network information security no matter for individuals, enterprises or Countries are important. Most of the current secure communication methods and devices are based on an encryption algorithm, and the key length is limited. With the rapid increase of computer computing power, it is no longer safe; in addition, most of the current secure communication methods and devices only protect One channel of information, multiple devices are required when multiple channels of information need to be protected.

Contents of the invention

(1) Technical problems to be solved

The object of the present invention is to provide a data security communication device and method, which have solved at least one of the above technical problems.

(2) Technical solutions

One aspect of the present invention provides a data security communication device, including:

A key storage module, configured to store the first key and the second key input by the outside world;

The mixing and unmixing module is used to perform mixed processing on M channels of first raw data and N-M channels of random signals input from the outside according to the first key, and determine N channels of mixed signals, wherein N is a positive integer greater than 1, and N ≥ M;

An encryption and decryption module, including N encryption and decryption units, each encryption and decryption unit is used to respectively encrypt the N-way mixed signals according to the first key, and determine the N-way encrypted signals; and

A binding and unbinding module, configured to perform binding processing on the N channels of encrypted signals, determine the bound N channels of first confidential signals; and/or perform unbinding processing on N channels of second confidential signals input from the outside, Determine and output the aligned N-way unbundling signals to the encryption and decryption module for decryption processing, the encryption and decryption module determines and output the N-way decrypted signals to the mixing and unmixing module for unmixing processing according to the second key, and the mixing and unmixing module Determine and output L channels of second original data according to the second key, where L is a positive integer greater than 1, and L≤N.

In some embodiments of the present invention, the hybrid unmixing module includes a random signal generator, and the random signal generator is used to generate N-M random signals with a bit width of A, where A is the number of bits of the first original data .

In some embodiments of the present invention, the mixing and unmixing module further includes: a mixing and unmixing controller, and the mixing and unmixing controller is used to control M paths of first raw data and N-M and/or according to the clock cycle and the second key, control the correspondence between the N decrypted signals and the L second original data output terminals.

In some embodiments of the present invention, the encryption and decryption unit is an AEES algorithm unit and/or a DES algorithm unit.

In some embodiments of the present invention, the encryption and decryption module also includes:

The encryption and decryption controller is used to ensure that the mixed signal/unbundling signal entering the encryption and decryption module at the same time is output at the same time after being processed by the encryption and decryption module.

In some embodiments of the present invention, the data secure communication device communicates with a second data secure communication device that outputs N channels of second secret signals, and the first key of the data secure communication device and the second data secure The second key of the communication device is the same.

In some embodiments of the present invention, it further includes: a transmitting and receiving module, configured to transmit the first secure signal to the second data secure communication device, and receive the second secure signal output by the second data secure communication device.

Another aspect of the present invention also provides a data security communication method, including:

According to the first key input from the outside world, the first raw data of M paths input from the outside world and the random signal of N-M paths are mixed to determine N paths of mixed signals, wherein M is a positive integer greater than 1, and N≥M;

Encrypt the N channels of mixed signals respectively according to the first key to determine N channels of encrypted signals; and

performing binding processing on the N encrypted signals, determining the bound N encrypted first confidential signals; and/or performing unbinding processing on the N encrypted second encrypted signals input from the outside, determining and outputting the aligned N encrypted signals. Bind the signal to the encryption and decryption module for decryption processing, the encryption and decryption module determines and outputs N-way decrypted signals to the mixing and unmixing module for unmixing processing according to the second key, and the mixing and unmixing module determines according to the second key And output L channels of second original data, L is a positive integer greater than 1, L≤N.

In some embodiments of the present invention, the encryption/decryption processing is implemented by AES algorithm and/or DES algorithm.

In some embodiments of the present invention, the binding process is realized by adding a flag sequence before the frame header of the N-channel encrypted signals.

(3) Beneficial effects

Compared with the prior art, the data security communication device and method of the present invention has at least the following advantages:

1. It is difficult to crack the first original data of M channels at the same time by performing confidential processing. The first original data is also sent by N channels at the same time. It is necessary to steal N channels of signals at the same time to restore the data, and it is impossible to steal one channel of signals alone. Data recovery improves the security of the physical link of the communication system.

2. Different encryption algorithms can also be used to perform mixed encryption processing on the first original data, which enriches the types of algorithms, increases the difficulty of deciphering, and improves the security of information.

Description of drawings

FIG. 1 is a schematic structural diagram of a data secure communication device according to an embodiment of the present invention.

FIG. 2 is a schematic diagram of steps of a data secure communication method according to an embodiment of the present invention.

Detailed ways

At present, the security communication methods and devices in the prior art are generally based on an encryption algorithm, and only one channel of information is protected. In view of this, the present invention provides a data security communication device, which can simultaneously send M channels of first raw data Perform confidentiality processing, and can use a variety of encryption algorithms, the key is extremely long, breaking the key length limit of many encryption algorithms, and it is difficult to decipher; in addition, data is sent by N channels at the same time, and all channels need to be tapped to recover data. The security of the physical link of the communication system is greatly improved.

In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the present disclosure will be further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

An aspect of the embodiment of the present invention provides a data secure communication device. FIG. 1 is a schematic structural diagram of the data secure communication device according to the embodiment of the present invention. As shown in FIG. 1 , the device includes a key storage module 1, a hybrid solution Mixing module 2, encryption and decryption module 3 and binding and unbinding module 4.

These modules are described in detail below.

The key storage module 1 is used to store the first key and the second key input from the outside, and output them to the mixing and unmixing module 2 and the encryption and decryption module 3 . In some embodiments of the present invention, it includes a matrix keyboard and its driver as an input device, an I2C serial EEPROM (electrically erasable programmable read-only memory) and its driver as a storage device, wherein the drivers of the keyboard and EEPROM can be Realized by FPGA (Field Programmable Gate Array) or other chips.

The key storage module has two working modes, which can be selected through the matrix keyboard after power-on. When the first working mode is selected, all keys are keyed in sequence through the matrix keyboard, and the keys are stored in EEPROM and provided to the hybrid solution in sequence. Mixing module 2 and encryption and decryption module 3; when selecting working mode two, no need to key in the key, mixing and unmixing module 2 and each encryption and decryption module 5 read the last input key from EEPROM in order, and complete the preparation work.

The mixing and unmixing module 2 is used to perform mixed processing on the M-way first original signal and the N-M-way random signal input from the outside according to the first key to determine the M-way mixed signal; The decrypted information is demixed to determine L channels of second original signals, where L is a positive integer greater than 1, and L≤N.

More specifically, the hybrid unmixing module 2 may include a random signal generator and a hybrid unmixing controller.

In some embodiments, the random signal generator may be composed of N×A m-sequence generators for generating N-M random signals with a bit width of A, and the feedback structure or initial state of each m-sequence generator is different , can generate different pseudo-random signals. Wherein, the minimum scale when the random signal is mixed with the first original signal is lbit.

The hybrid unmixing controller, in some embodiments, the hybrid unmixing controller can be composed of A non-collision frequency hopping sequence set generators whose alphabet set is N, and is used to control M channels according to the clock cycle and the first key The corresponding relationship between the first original data and the N-M random signals to the N output terminals; and/or according to the clock cycle and the second key, control the corresponding relationship between the N decrypted signals and the N second original data output terminals, wherein each The feedback structures or initial states of the generators of the collision-free frequency hopping sequence sets can be different, and different frequency hopping sequence sets can be generated, and A is the number of bits of the first original data.

The initial state of the non-collision frequency hopping sequence set generator is determined by the input key, which is used to control which port each input signal and random signal of the mixing and unmixing module are output from, so as to realize the mixing of N-way first original data and random signals, for example , the frequency hopping sequence set is [7, 8, 36, 26...; 14, 16, 23, 45...; 21, 24, 10, 15...;...], the first clock cycle , the data input by input port 1 is output by output port 7, the data input by input port 2 is output by output port 14, the data input by input port 3 is output by output port 21..., the second clock cycle, input port 1 input The data of input port 8 is output by output port 8, the data input by input port 2 is output by output port 16, the data input by input port 3 is output by output port 24..., and so on.

Encryption and decryption module 3, including N encryption and decryption units, each encryption and decryption unit is used to encrypt the N-channel mixed signals according to the first key, and determine N-channel encrypted signals, N≥M; and/or Deciphering the N-channel unbundling signals output by the binding-unbinding module according to the second key to determine the N-channel decrypted signals.

The encryption and decryption unit may be algorithm units such as AES (Advanced Encryption Standard) and DES (Data Encryption Standard). The encryption algorithm or key used by each algorithm unit may be the same or different.

It should also be noted that, the secure data communication device communicates with the second secure data communication device outputting N channels of second secret signals, and the first key of the secure data communication device and the first key of the secure data communication device of the second The two keys are consistent, and the encryption and decryption unit of the data security communication device should be the same as the encryption and decryption unit of the second data security communication device, so as to ensure normal communication. In addition, the first key and the second key of the same data secure communication device may be the same or different.

In order to realize that the mixed signal/unbundling signal entering the encryption and decryption module at the same time can be output at the same time after being processed by the encryption and decryption module, an encryption and decryption controller is also needed. In some embodiments, the encryption and decryption module controller can pass through the encryption and decryption module. It is implemented by adding buffers before and after the unit, and the buffer reads and writes the input and output signals of the encryption and decryption module according to the instruction signal of the encryption and decryption unit.

Since the time for each channel of data to arrive at the receiving end after being transmitted through the channel is different, there is a certain relative delay, and the received N-channel second confidential information must be aligned before subsequent processing can be performed. Therefore, the present invention also includes a channel binding The module, when sending, uses a special flag sequence (which can be selected according to actual needs) to bind the input N-way encrypted information, that is, add a special flag sequence before the frame header of the N-way encrypted signal, and receive At the same time, according to the special flag sequence added by the sending end, the second confidential information of the N channels is aligned; at the same time, the channel binding module can further align the data by aligning the frame headers, and improve the accuracy of the alignment of the N-channel signals at the receiving end.

In addition, in order to realize the transmission and reception of data and signals, the device of the present invention may also include a transmitting and receiving module, which is used to transmit the first confidential signal to the second data secure communication device, and receive the output of the second data secure communication device. The second secret signal of .

In some embodiments, the transmitting and receiving module includes but is not limited to an optical transmitting receiver, an electrical transmitting receiver, an infrared transmitting receiver, and a radio transmitting receiver, etc., and the specific selection is related to the communication network it is connected to. The secure data communication device of the present invention can communicate with the second secure data communication device through a public network, a military network, an infrared network, an optical fiber communication network or a radio communication network.

It can be understood that the data security communication device may be based on other microprocessors such as FPGA, DSP (digital signal processing chip), single-chip microcomputer, ARM (Advanced RISC Machines), ASIC (application-specific integrated circuit design).

Next, the working process of the data secure communication device will be described in conjunction with FIG. 1 .

When the data security communication device is used as an encryption terminal device, the mixing and unmixing module receives M channels of first original data, and performs M channels of first original data and N-M channels of random signals according to the first key in the key storage module 1. Mixing processing to obtain N channels of mixed signals, and output them to the encryption and decryption module 3 . The encryption and decryption module 3 receives the N channels of mixed signals, and encrypts the N channels of mixed signals according to the first key, and obtains and outputs N channels of encrypted signals. The binding and unbinding module 4 receives N channels of encrypted signals, and performs binding processing to obtain the bound N channels of first secret signals. So far, the processing at the encryption end is completed.

When the data secure communication device is used as the decryption end device, the binding and unbinding module 4 receives N second secret signals from the second data secure communication device communicating with it, and performs unbinding processing on them, and determines and outputs the aligned The N-way unbundling signals are sent to the encryption and decryption module 3 . The encryption and decryption module 3 receives the N-channel unbundling signals, decrypts them according to the second key, determines and outputs the N-channel decrypted signals to the mixing and unmixing module 2 for unmixing processing. According to the second key, the mixing and unmixing module 2 controls the manner in which the decrypted signal of N paths is output to the second original signal output terminal of L paths in each clock cycle, and obtains and outputs the second original data of L paths, so far, the decryption is completed end processing.

In another aspect of the embodiment of the present invention, a data secure communication method is also provided. FIG. 2 is a schematic diagram of the steps of the data secure communication method according to the embodiment of the present invention. As shown in FIG. 2 , the method includes the following steps:

S1. Perform mixed processing on M channels of first raw data and N-M channels of random signals input from the outside according to the first key input from the outside, and determine N channels of mixed signals, where M is a positive integer greater than 1, and N≥M.

S2. Encrypt the N channels of mixed signals respectively according to the first key, and determine N channels of encrypted signals. Encryption and decryption processing can be realized through AES algorithm, DES algorithm or other algorithms, which is not limited in the present invention.

S3. Perform binding processing on the N channels of encrypted signals, determine the bound N channels of first confidential signals; and/or perform unbinding processing on the N channels of second confidential signals input from the outside, determine and output aligned N channels The unbundled signals of the channels are sent to the encryption and decryption module for decryption processing, and the encryption and decryption module determines and outputs the decrypted signals of N channels to the mixing and unmixing module for unmixing processing according to the second key. The key determines and outputs L channels of second original data, where L is a positive integer greater than 1, and L≤N.

The first original data and the second secret signal may be serial signals or parallel signals (considered as multiple individual serial signals). When it is a parallel signal, the output terminals corresponding to each individual serial signal may be the same or different, which is specifically determined by the mixing and unmixing controller and the corresponding key.

Since the time for each channel of data to reach the receiving end after transmission through the channel is different, there is a certain relative delay, and the received N channels of second confidential information must be aligned before subsequent processing can be performed. Therefore, when sending, you can also use a special The flag sequence (which can be selected according to actual needs) binds the input N-way encrypted information. When receiving, according to the special flag sequence added by the sender, align the N-way second secret information; at the same time, it can also align the frame header , to further align the data and improve the accuracy of the alignment of N-way data at the receiving end.

Unless known to the contrary, the numerical parameters set forth in the specification and attached claims are approximations that can vary depending upon the desired properties obtained from the teachings of the present disclosure. Specifically, all numbers used in the specification and claims to represent the content of the composition, reaction conditions, etc., should be understood to be modified by the term "about" in all cases. In general, the expressed meaning is meant to include a variation of ±10% in some embodiments, a variation of ±5% in some embodiments, a variation of ±1% in some embodiments, a variation of ±1% in some embodiments, and a variation of ±1% in some embodiments ±0.5% variation in the example.

Furthermore, "comprising" does not exclude the presence of elements or steps not listed in a claim. "a" or "an" preceding an element does not exclude the presence of a plurality of such elements.

The specific embodiments described above have further described the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above descriptions are only specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. a kind of data security communication device, including：

Cipher key storage block, for storing extraneous input first key and the second key；

Mixing solution mixes module, for being believed at random the first initial data of the roads M of external world's input and the roads N-M according to the first key Number mixed processing is carried out, determines the roads N mixed signal, wherein N is positive integer more than 1, N >=M；

Encryption/decryption module, including N number of encryption/decryption element, each encryption/decryption element are used for according to the first key respectively to the N Road mixed signal is encrypted, and determines the roads N coded signal；And

Binding unbundlings module, for coded signal to carry out binding processing, the secrecy letter of the roads N first of determining binding to the roads N Number；And/or unbundlings processing is carried out to the second secret signal of the roads N of external world's input, determine and exports the roads the N unbundlings signal of alignment extremely Encryption/decryption module is decrypted, and encryption/decryption module is determining according to second key and exports the roads N and has decrypted signal to mixed Conjunction solution mixes module and carries out solving mixed processing, and the mixed module of mixing solution is determining according to second key and exports the second initial data of the roads L, L is the positive integer more than 1, L≤N.

2. the apparatus according to claim 1, wherein it includes random signal generator that mixing solution, which mixes module, it is described with Machine signal generator is used to generate the random signal that the roads N-M bit wide is A, wherein A is the digit of the first initial data.

3. the apparatus according to claim 1, wherein the mixing solution mixes module and further includes：Mixing solution mixes controller, described Mixing solution mixes controller and is used to, according to clock cycle and first key, control M the first initial data of road and the roads N-M random signal extremely The correspondence of N number of output end；And/or according to clock cycle and the second key, control N has decrypted on road signal to L second original The correspondence of beginning data output end.

4. the apparatus according to claim 1, wherein the encryption/decryption element is aes algorithm unit and/or DES algorithm lists Member.

5. the apparatus according to claim 1, wherein encryption/decryption module further includes：

Encryption and decryption controller, for ensuring that the same time enters mixed signal/unbundlings signal of encryption/decryption module by adding solution It is exported simultaneously after close resume module.

6. the apparatus according to claim 1, wherein the data security communication device and the second secret signal of the roads output N The communication of the second data security communication device, the first key of the data security communication device and second data confidentiality are logical The second key agreement of T unit.

7. the apparatus according to claim 1, wherein further include：Transmitting and receiving module, for emitting the first secrecy letter Number to the second data security communication device, and receive the second secret signal of the second data security communication device output.

8. a kind of data security communication method, including：

The first initial data of the roads M and the roads N-M random signal of external world's input are mixed according to the first key of external world's input Processing, determines the roads N mixed signal, wherein M is the positive integer more than 1, N >=M；

The roads N mixed signal is encrypted respectively according to the first key, determines the roads N coded signal；And

To the roads N, coded signal carries out binding processing, determines the first secret signal of the roads N of binding；And/or the external world is inputted The second secret signal of the roads N carry out unbundlings processing, determine and the roads N unbundlings signal to the encryption/decryption module for exporting alignment be decrypted Processing, encryption/decryption module is determining according to second key and exports the roads N and has decrypted signal to mixing solution and mixes module to carry out solution mixed Processing, mixing solution mix module according to second key determination and export the second initial data of the roads L, and L is the positive integer more than 1, L ≤N。

9. according to the method described in claim 8, wherein, the encryption/decryption process is by aes algorithm and/or DES algorithms It realizes.

10. according to the method described in claim 8, wherein, the binding processing is by before the roads the N frame head of coded signal Flag sequence is added to realize.