CN102111411A - Method for switching encryption safety data among peer-to-peer user nodes in P2P network - Google Patents

Abstract

The invention provides a method for encrypted secure data exchange between peer user nodes in a P2P network. Any two peer user nodes A and B in the network respectively log in to the network through an authentication server to obtain a public key certificate. Through the exchange operation, the user Node A has its own random number N _A and the random number N _B sent by user node B, and user node B has its own random number N _B and the random number N A sent by user node _A ; then apply encryption The algorithm enables user node A and user node B to form an encrypted channel for encrypted data transmission. The invention has simple process of establishing secure communication and few times of interaction, except that the certificate sent for the first time is in plain text, and the rest of the information is exchanged in cipher text, which has better security.

Description

An Encrypted Secure Data Exchange Method Between Peer User Nodes in P2P Network

technical field

The present invention relates to an Internet data exchange method, in particular to a secure encrypted communication method between peer user nodes in a P2P network.

Background technique

P2P (Peer to Peer, peer-to-peer) network is also called a peer-to-peer network. Compared with the current S/C (server/client) mode common on the Internet, each node in the network can freely join or exit the network. The relationship between nodes is equal, and resources can be better shared between nodes. P2P network has broad application prospects in direct communication between users, file exchange and distributed computing.

However, the P2P network is a decentralized network, data exchange between nodes is convenient, resource sharing is frequent, each node can join or exit freely, viruses and Trojan horses are easy to spread through the network, so user data encounters eavesdropping, Tampering, replay, man-in-the-middle and other attacks. In order to avoid the above problems, a secure information communication mechanism is needed to protect the security of P2P communication.

In the prior art, P2P communication is often data transmission in plain text, which lacks data security protection. Existing encrypted communication methods such as SSL/TLS and IKE are too large and complex for P2P network transmission, and SSL/TLS and IKE themselves have security flaws and are vulnerable to man-in-the-middle attacks. Specifically, SSL/TLS protocol certificates are completely transmitted in plain text, and the identity of each household node is easily eavesdropped. The nonce random number of IKE is also sent in plain text, which is easy to be intercepted by an intermediary. Therefore, a solution is urgently needed to protect end-to-end data transmission.

At present, practical methods have been proposed for the authentication of P2P network user nodes. The authentication server issues digital certificates to users, and exchanges certificates to achieve authentication during authentication. However, the secure transmission of authenticated data has not been considered. In the final analysis, the authentication of network users is to realize the secure exchange of data, so a method that can guarantee the secure communication between peer user nodes in the P2P network from authentication to data transmission is very much needed.

Contents of the invention

The technical problem to be solved by the present invention is to design a safe communication method from authentication to data transmission in order to overcome the security problem in peer-to-peer user node communication in the P2P network.

In order to solve the problems of the technologies described above, the present invention adopts the following technical solutions:

A method for exchanging encrypted and secure data between peer user nodes in a P2P network, comprising the following steps:

Step 1: Any two peer user nodes A and B in the network log in to the network through the authentication server to obtain a public key certificate, and the certificate is generated by the digital signature of the user node public key with the private key of the authentication server;

Step 2: User node A sends the public key certificate of user node A to user node B, and node B verifies the public key certificate of node A to obtain the public key of node A;

Step 3: User node B sends node B's public key certificate and random number N to user node A. _B encrypts with node A's public key, and user node A decrypts the public key sent by user node B with its own private key. Key certificate and random number N _B , verify the certificate of node B to obtain the public key of node B;

Step 4: User node A sends its own random number _NA to user node B, encrypts it with B's public key, and user node B decrypts the random number _NA sent by user node A with its own private key.

Step 5: Node A has its own random number N _A and the random number N _B sent by node B, and node B has its own random number N _B and the random number N A sent by node _A , and the encryption algorithm is applied User node A and user node B form an encrypted channel for encrypted data transmission.

In the described step 1, the generation of the public key certificate between peer user nodes in the P2P network includes the following steps:

Step 1-1: For any user node in the trust domain, first download the public key of the authentication server, and then the user node generates its own public and private key pair when logging in, and compares the public key with the input The user name and password are encrypted with the public key of the authentication server and sent to the authentication server; 

Step 1-2: After the authentication server decrypts the received encrypted user name and password information with its own private key, it checks the user name and password of the login user node, and if the verification is successful, the user node login is successful;

Step 1-3: The authentication server digitally signs the public key of the user node with its own private key, and obtains the public key certificate of the user node;

Steps 1-4: The public key certificate of the user node is encrypted with the public key of the user node and sent to the user node, and the user node decrypts with the private key and saves the obtained public key certificate.

In the step 1-1, the user node generates its own public and private key pairs at each login, which are different from each other.

The encryption security data exchange method between peer user nodes in the P2P network is characterized in that: the encryption algorithm in the step 5 is a DH encryption algorithm.

The present invention has realized following beneficial effect

1. The present invention proposes a method for peer-to-peer users to establish secure communication, which not only establishes mutual authentication, but also considers encrypted transmission during communication.

2. The establishment of authentication and encrypted communication is closely combined, and the other party's public key obtained through authentication is immediately used to establish an encrypted channel.

3. Every time the user logs in, a new public-private key pair is generated, a new certificate is applied, and each time the random number is exchanged, it is encrypted with a different public key, which greatly reduces the possibility of the DH key being cracked and implementing man-in-the-middle attacks sex.

4. Every time an encrypted channel is established, the random numbers exchanged are different, and the encrypted channel is not easy to be cracked.

5. The establishment process of secure communication is simple, and the number of interactions is small. Except for the certificate sent for the first time in plain text, the rest of the information is exchanged in cipher text, which has better security.

the

Description of drawings

Fig. 1 is the schematic diagram that the present invention establishes secure communication between two nodes;

Fig. 2 is the flowchart of obtaining certificate by authentication server of the present invention;

Fig. 3 is a flow chart of establishing secure communication using certificates in the present invention.

the

Detailed ways

Below in conjunction with accompanying drawing, the present invention will be further described.

For the convenience of understanding, a simple P2P network is taken as an example to illustrate the implementation method of the present invention. As shown in Figure 1, in this P2P network, there are two user nodes, user node A and user node B respectively, and an authentication server connected through the network. User nodes in the network will get their own certificates during the login process. Using this certificate, the public key algorithm can be used to realize the exchange of random numbers in an encrypted environment and establish encrypted and secure communication. Referring to FIG. 2 , firstly, the process of obtaining the user node certificate is described.

A user node, assuming user node A, first downloads the public key of the authentication server from the authentication server, and then enters the user name and password to log in to the network. During the login process, a pair of public-private key pairs will be automatically generated according to the asymmetric encryption algorithm of the user node A terminal. , and the key are encrypted with the public key of the authentication server, and then the encrypted result is sent to the authentication server through the network. It should be noted that the public-private key pair generated by each login of the user node is different, and the public-private key pair generated by this login cannot be used in the next login process.

When the authentication server receives the encrypted result sent by user node A, it uses its own key to decrypt the encrypted result, and checks the decrypted user name and password. If the user name and password are correct, it means that user node A login successful. After user node A successfully logs in,

The authentication server digitally signs the public key of user node A sent by user node A with its own private key to form a certificate for identity authentication. The authentication server encrypts the certificate with the public key of user node A, and returns it to user node A. User node A decrypts it with its own private key after receiving it, and saves the obtained certificate.

In the above login process, user node A obtains a certificate for identity authentication after interacting with the authentication server, and the certificate includes the public key of user node A signed by the private key of the authentication server. The above process is also the same for user node B. After successfully logging in to the network, user node B can also obtain a certificate for identity authentication from the authentication server, but the certificate includes the public key of user node B signed by the private key of the authentication server.

When a user node logs into the network, according to the needs of practical applications, a user node needs to establish a connection and secure communication with other user nodes in the network to realize encrypted data exchange. The first thing to do is to exchange certificates, exchange random numbers under the protection of the public key, and establish a DH encrypted channel. Still taking user nodes A and B as examples below, referring to FIG. 3 , the establishment of an encrypted channel between two user nodes will be explained.

Assuming that the establishment process of the data connection is initiated by user node A, then user node A needs to send its own certificate to user node B, and user node B will decrypt the certificate A with the public key of the authentication server after receiving it, and obtain the user's certificate. A's public key. User node B sends node B's certificate and random number N _B to user node A to encrypt with node A's public key, user node A decrypts the certificate and random number N _B sent by user node B with its own private key , verify the certificate of node B to obtain the public key of node B. User node A sends its own random number _NA to user node B, and encrypts it with B's public key, and user node B uses its own private key to decrypt the random number NA sent by user node _A. Node A has its own random number N _A and the random number N _B sent by node B, and node B has its own random number N _B and the random number N _A sent by node A. Point A and user node B form an encrypted channel.

In the process of establishing encrypted communication above, if a user node C intercepts the message returned by user node B during the authentication process, since it does not have the private key of user node A, it cannot decrypt the interception result. It is also impossible to pretend to be user node B to establish a connection with user node A, thereby causing the failure of secure communication establishment. Similarly, if the node intercepts the random number sent by A, it cannot decrypt the intercepted result because it does not have the private key of user node A. The DH encrypted channel thus established is safe and can prevent man-in-the-middle attacks.

In the establishment process of the above-mentioned encrypted communication; the identity authentication process between the user nodes A and B does not involve the authentication server. The authentication server only grants the user node the identity authentication certificate for this login during the user login process. In the future, no matter how many user nodes the user node establishes connections with during this login, it has nothing to do with the authentication server. The load of the authentication server is greatly reduced, and the data connection process between two user nodes will not be delayed due to the overload of the authentication server.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than limit them. Although the present invention has been described in detail with reference to the embodiments, those skilled in the art should understand that modifications or equivalent replacements to the technical solutions of the present invention do not depart from the spirit and scope of the technical solutions of the present invention, and all of them should be included in the scope of the present invention. within the scope of the claims.

Claims (4)

1. in a kind of P2P network, the encrypted security data exchange method between peer user node is characterized in that, comprises the following steps: Step 1: Any two peer user nodes A and B in the network respectively log in to the network through the authentication server to obtain a public key certificate, which is generated by the digital signature of the public key of the user node with the private key of the authentication server; Step 2: User node A sends the public key certificate of user node A to user node B, and user node B verifies the public key certificate of user node A to obtain the public key of user node A; Step 3: User node B encrypts its own public key certificate and random number N _B with the public key of user node A and sends it to user node A, and user node A decrypts the public key sent by user node B with its own private key. Key certificate and random number N _B , verify the certificate of user node B, and obtain the public key of user node B; Step 4: User node A encrypts its own random number N _A with the public key of user node B, and sends it to user node B; user node B uses its own private key to decrypt the random number sent by user node A N _A ; Step 5: User node A has its own random number N _A and the random number N _B sent by user node B, and user node B has its own random number N _B and the random number N A sent by user node _A ; Encryption algorithm is applied to make user node A and user node B form an encrypted channel for encrypted data transmission. 2. according to claim 1 in the P2P network, the encryption security data exchange method between peer user nodes, in the described step 1, the public key certificate generation between peer user nodes in the P2P network comprises the following steps: Step 1-1: For any user node in the trust domain, first download the public key of the authentication server, and then the user node generates its own public and private key pair when logging in, and compares the public key with the input The user name and password are encrypted with the public key of the authentication server and sent to the authentication server;  Step 1-2: After the authentication server decrypts the received encrypted user name and password information with its own private key, it checks the user name and password of the login user node, and if the verification is successful, the user node login is successful; Step 1-3: The authentication server digitally signs the public key of the user node with its own private key, and obtains the public key certificate of the user node; Steps 1-4: The public key certificate of the user node is encrypted with the public key of the user node and sent to the user node, and the user node decrypts with the private key and saves the obtained public key certificate. 3. The encryption security data exchange method between the peer user nodes in the P2P network according to claim 2, characterized in that: in the step 1-1, the user node generates its own public address when logging in each time. , private key pairs are different from each other. 4. The encrypted secure data exchange method between peer user nodes in the P2P network according to claim 1, characterized in that: the encryption algorithm in the step 5 is a DH encryption algorithm.

Images