CN114614984B - Time-sensitive network secure communication method based on cryptographic algorithm - Google Patents

Abstract

The invention relates to a time-sensitive network security communication method based on a national secret algorithm, belonging to the technical field of communication. Introduce time-sensitive network CNC, use SM2 authentication algorithm and SM3 hash algorithm to perform identity authentication and key negotiation on TSN switches, verify whether TSN switches are credible and distribute session keys. The SM3 hash algorithm is used to generate message authentication codes between TSN switches, and the SM4 encryption/decryption algorithm realizes end-to-end secure communication. While reducing storage space and communication overhead as much as possible, it is necessary to realize a set of independent and controllable secure transmission protocols based on time-sensitive network standards and cryptographic algorithms, and fundamentally ensure the safety, reliability and controllability of industrial communication processes. current problems that need to be resolved.

Description

A Time Sensitive Network Security Communication Method Based on National Secret Algorithm

technical field

The invention belongs to the technical field of communication, and relates to a time-sensitive network security communication method based on a national secret algorithm.

Background technique

While TSN is optimizing the performance of industrial network communication, security has also become a key issue restricting the popularization of time-sensitive network communication applications. As a set of industrial network protocols that are constantly developing and becoming mature, the TSN standard urgently needs to establish an The security mechanism fundamentally guarantees the security issues in the process of industrial communication.

The current research on time-sensitive network security mainly focuses on the configuration and scheduling of TSN key protocols, and has not gone too far in the security field. At the same time, due to the complexity of implementing security functions, the time-sensitive network standards do not specify specific security schemes or cryptographic techniques to ensure secure communications over time-sensitive networks. Therefore, a set of security architecture suitable for time-sensitive networks is required. Identity authentication, key management and secure data stream transmission, and use related encryption algorithms and hash algorithms to realize end-to-end secure data transmission, and define a key management mechanism in the process of data encryption verification to complete key distribution and updates to secure communications over time-sensitive networks.

Cryptographic algorithm is the core technology to ensure information security, and plays a key role in the process of ensuring safe data transmission in industrial networks. The State Cryptography Administration has announced a variety of national secret algorithms, which are suitable for different application scenarios. Among them, the SM2 public key cryptographic algorithm can be used for digital signature and security authentication, and the SM3 hash algorithm can be used to verify the message authentication code and random number. Generated, the SM4 block cipher algorithm can be used to implement data encryption/decryption to ensure data confidentiality. Combining the national secret algorithm SM2 and SM3 can not only effectively perform identity authentication and key negotiation, but also has high security; combining the national secret algorithm SM3 and SM4 can not only generate message authentication codes and data Encryption and decryption, while having a high degree of independence.

In view of the above problems, combined with the security technical requirements for time-sensitive networks in the standards of the Industrial Internet Industry Alliance, a session negotiation and secure communication scheme based on the national secret algorithm is designed to solve the problem of time-sensitive network security threats. While reducing storage space and communication overhead as much as possible, it is necessary to realize a set of independent and controllable secure transmission protocols based on time-sensitive network standards and cryptographic algorithms, and fundamentally ensure the safety, reliability and controllability of industrial communication processes. current problems that need to be resolved.

Contents of the invention

In view of this, the object of the present invention is to provide a time-sensitive network security communication method based on a national secret algorithm.

To achieve the above object, the present invention provides the following technical solutions:

A time-sensitive network security communication method based on a national secret algorithm, the method comprising the following steps:

S1: time-sensitive network initialization;

A time-sensitive network deploys a time-sensitive wired network composed of a time-sensitive network traffic generator and multiple TSN switches through wired connections; at the same time, a time-sensitive network CNC is configured, and the CNC will load the parameters required by the device status control unit; first, the TSN switch needs Use the LLDP protocol to obtain topology-related information of adjacent devices, which will be stored in a management information base MIB in the form of LLDP messages, and then TSN CNC obtains the topology-related information stored in the MIB through the SNMP protocol, including each TSN The object identifier OID information of the switch, including the device system name and the device IP address; use these OID information as the identity ID _i of the TSN switch, and 1≤i≤n is the sum of all TSN switches connected to the network;

SNMPv3 defines a new message format, which includes IP header, UDP header, version, header data, security parameters, Context Engine ID, Context name and SNMP PDU;

The fields in the SNMP message are defined as follows:

Version: Indicates the version of SNMP, and the corresponding field value of SNMPv3 message is 2;

Header data: contains the description content of the maximum message size supported by the message sender and the security mode adopted by the message;

Security parameters: security information including the relevant information of the SNMP entity engine, user name, authentication parameters and encryption parameters;

Context EngineID: SNMP unique identifier, which together with the PDU type determines which application should be sent to;

Context Name: used to determine the MIB view of the managed device by Context EngineID;

SNMPv3 PDU: contains PDU type, request identifier and variable binding list; SNMPv3 PDU includes GetRequest PDU, GetNextRequest PDU, SetRequest PDU, Response PDU, Trap PDU, GetBulkRequest*PDU and InformRequest PDU;

The command names, corresponding codes and functions that identify different PDUs are:

The code of GetRequest is 0, and the function is: from the management station to the agent, query the value of the specified variable;

The code of GetNextRequest is 1, and the function is: from the management station to the agent, query the value of the next variable;

The Response code is 2, and the function is: proxy to the management station, and return the execution result;

The code of SetRequest is 3, and the function is: from the management station to the agent, setting the value of a variable maintained by the agent;

The code of GetBulkRequest is 4, and its function is: transfer bulk information from the management station to the agent;

The code of InformRequest is 5, and its function is: from management station to management station, transfer parameters to process the request;

The Trap code is 6, and the function is: a warning message from the agent to the management station;

The report code is 7, and the function is: SNMPv2 is undefined; snmpv3 is defined as initiating a report when the PDU part of the message cannot be decrypted;

The header includes:

msgID: message identifier, used to identify the PDU; the value range is 0~2 ³¹ -1;

msgMaxSize: indicates the maximum message size supported by the message sender, and the value range is 484～2 ³¹ -1;

msgFlags: An octet string containing several flags, with 3 flags: reportableFlag, privFlag, authFlag;

msgSecurityModel: message security model, used to identify the security model used by the sender to generate the message, the sender and receiver must adopt the same security model;

msgSecurityParamters: Security parameters, security parameters generated by the security subsystem of the sender, user name, message authentication code MAC, encryption parameters, used to protect the security of message transmission, and decrypted and authenticated by the security subsystem of the receiver and other safe handling;

contextEngineID: an identifier that uniquely identifies an SNMP entity; for incoming messages, this field is used to determine which application the PDU is delivered to for processing; for outgoing messages, this value is provided by the upper-layer application and represents that application;

contextName: the name of the context where the managed object is carried;

PDU: PDU with object binding list;

The last three fields contextEngineID, contextName and PDU are collectively called scoped PDU;

The function names and functions that need to be called when the management end and the agent end perform data interaction are:

The function name is snmp_pdu_create, which is used to create SNMP messages;

The function name is snmp_add_var, which is used to fill SNMP messages;

The function name is snmp_send, which is used to send SNMP messages;

The function name is snmp_synch_response, which is used to receive and read SNMP messages;

The function name is snmp_close, which is used to close the session and release the space occupied by the PDU;

S2: identity authentication;

S21: The TSN CNC sends a get-request packet to the TSN switch to obtain MIB information, parses the OID information in the MIB, generates a public-private key pair (KeyD, KeyB) using the SM2 public key algorithm, and sends it to the TSN switch;

S22: The TSN switch calls the snmp_pdu_create function to create an SNMP message, generates a random number N _i through a random number generator, uses the authentication public key Key _D to encrypt the identity ID _i and the random number N _i through the SM2 encryption authentication algorithm, and generates an identity Authentication information C _i =SM2 _KeyD (ID _i ||N _i ), call the snmp_add_var function to fill the encrypted identity authentication information in the PDU;

S23: Use the authentication public key Key _D to process the identity ID _i and the random number N _i through the SM3 hash algorithm, generate a message authentication code TAG=SM3 _KeyD (ID _i ||N _i ), and call the snmp_add_var function to generate the message The authentication code is inserted into the msgAuthenticationParameters field, and the generated identity authentication information C _i and message authentication code TAG are constructed into identity authentication request information Request _i = C _i ||TAG, and the snmp_send function is called to send the SNMP message to TSNCNC;

S24: The TSN CNC side receives and reads the SNMP message through snmp_synch_response, uses the authentication private key Key _B to decrypt the read identity authentication information through the SM2 algorithm to obtain the identity ID _i ' and the random number N _i ', and first determines the ID To verify the legitimacy of _i ', use the authentication public key Key _D to process the identity ID _i ' and the random number N _i ' through the SM3 hash algorithm, and obtain the message authentication code TAG'=SM3 _KeyD (ID _i '||N _i ') , if TAG=TAG', the identity authentication is successful, otherwise, the identity authentication fails, the snmp_colse function is called to close the session, and the subsequent key negotiation process cannot be performed;

The TSN switch completes the identity authentication process, and the TSN switch that has passed the TSN CNC identity authentication will conduct key negotiation with the TSN CNC.

Optionally, the key negotiation is specifically:

S31: The TSN CNC end calls the snmp_pdu_create function to create an SNMP message, generates and stores the session key K _s for the field device, and the random number generator generates a random number R _i ;

S32: TSN CNC splices the obtained random number N _i ', the random number R _i generated by itself, and the generated session key K _s , and uses the authentication private key Key _B to process the spliced data (N _i '| |R _i ||K _s ) is encrypted to generate encrypted information E=SM2 _KeyB (N _i '||R _i ||K _s ), _and the spliced data (N _i ' ||R _i ) to process, generate message authentication code MAC=SM3 _KeyD (N _i '||R _i ), call snmp_add_var function to fill encrypted information E into PDU, and insert generated message authentication code MAC into call snmp_send function Send the PDU to the TSN switch;

S33: The TSN switch side receives and reads the PDU through snmp_synch_response, uses the authentication public key KeyD to process the read message authentication code MAC' through the SM3 hash algorithm, obtains (N _i '||R _i ), and verifies N _i ' = Whether N _i is true, if true, store the random number R _i ', and use the authentication public key KeyD to decrypt the received encrypted information through the SM2 algorithm to obtain the session key K _s , use the session key K _s through SM2 The algorithm encrypts the random number R _i ', and generates key agreement confirmation information Call the snmp_add_var function to fill the key negotiation confirmation information into the PDU, call the snmp_send function to send the SNMP message to the TSN CNC, if not established, discard the message;

S34: TSN CNC receives and reads the SNMP message through snmp_synch_response, uses the session key K _s to decrypt the read key agreement confirmation information through the SM2 algorithm, obtains the random number R _i ', and verifies that R _i '= Whether R _i is established, if established, the key agreement is successful, otherwise, the key agreement fails;

The key negotiation process is completed between the TSN switch of the time-sensitive network and the TSN CNC, and the TSN switch uses the successfully negotiated session key K _s for subsequent secure communication.

Optionally, the secure communication is specifically:

S41: The TSN switch 1 parses the TSN data frame, obtains the data payload, uses the session key K _s to encrypt the plaintext M through the SM4 encryption algorithm, and generates a ciphertext C;

S42: TSN switch 1 uses session key K _s to generate SM3 message authentication code Tag through SM3 hash algorithm, and sends the security control field, ciphertext C and message authentication code Tag to TSN switch 2 as a secure communication message E;

S43: After the TSN switch 2 obtains the message, it first parses the security control field, if the security control field is displayed as 01, it indicates that the message is encrypted, otherwise, directly forwards the message;

S44: The TSN switch 2 uses the session key K _s to generate the SM3 message authentication code Tag' through the SM3 hash algorithm, and verifies whether Tag=Tag' is established, and if established, executes the decryption procedure, otherwise, discards the message;

S45: For the message successfully authenticated by the message authentication code, the TSN switch 2 uses the session key K _s to decrypt the ciphertext C through the SM4 decryption algorithm to obtain the TSN plaintext;

After the time-sensitive network completes the secure communication process, the encrypted message at the port of TSN switch 1 will be decrypted at the port of TSN switch 2, so as to ensure the confidentiality and integrity of data transmission.

The beneficial effects of the present invention are:

Addresses the issue of time-sensitive network security threats. While reducing storage space and communication overhead as much as possible, realize a set of secure transmission protocols that are independently controllable in time-sensitive network standards and cryptographic algorithms, fundamentally guarantee the safety, reliability and controllability of industrial communication processes.

Other advantages, objects and features of the present invention will be set forth in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the investigation and research below, or can be obtained from It is taught in the practice of the present invention. The objects and other advantages of the invention may be realized and attained by the following specification.

Description of drawings

In order to make the purpose of the present invention, technical solutions and advantages clearer, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

Figure 1 is a time-sensitive network security topology diagram;

Figure 2 is the system initialization data interaction process;

Fig. 3 is SNMPv3 message format;

Figure 4 is a time-sensitive network identity authentication process;

FIG. 5 is a flowchart of time-sensitive network key negotiation;

Fig. 6 is time-sensitive network frame format;

Fig. 7 is a message construction format;

Fig. 8 is a flow chart of time-sensitive network security communication.

Detailed ways

Embodiments of the present invention are described below through specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific implementation modes, and various modifications or changes can be made to the details in this specification based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the diagrams provided in the following embodiments are only schematically illustrating the basic concept of the present invention, and the following embodiments and the features in the embodiments can be combined with each other in the case of no conflict.

Wherein, the accompanying drawings are for illustrative purposes only, and represent only schematic diagrams, rather than physical drawings, and should not be construed as limiting the present invention; in order to better illustrate the embodiments of the present invention, some parts of the accompanying drawings may be omitted, Enlargement or reduction does not represent the size of the actual product; for those skilled in the art, it is understandable that certain known structures and their descriptions in the drawings may be omitted.

In the drawings of the embodiments of the present invention, the same or similar symbols correspond to the same or similar components; , "front", "rear" and other indicated orientations or positional relationships are based on the orientations or positional relationships shown in the drawings, which are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the referred devices or elements must It has a specific orientation, is constructed and operated in a specific orientation, so the terms describing the positional relationship in the drawings are for illustrative purposes only, and should not be construed as limiting the present invention. For those of ordinary skill in the art, the understanding of the specific meaning of the above terms.

In a time-sensitive network, most of the functions are implemented by various TSN applications deployed at the application layer. For example, network users can allocate network resources and obtain network information through the APIs opened on the northbound interface of the control layer, and provide users with time on demand. Sensitive network capabilities, so the attacker's attack on the application layer will gradually affect the entire TSN network, which needs to be prevented in advance.

Time-sensitive network application layer security threats include:

Spoofing: The attacker can pretend to be a TSN controller to swindle user data (user key, certificate, etc.), SLA, business logic and other information, so as to prepare for further attacks;

Denial: Users or administrators can deny that they have ever executed malicious network policies, such as configuring specific network policies;

Information leakage: After obtaining the user authentication information, the attacker can pretend to be a legitimate user and inject a fake information flow into the network through the TSN application to obtain more network data;

Vulnerabilities of the application itself: Attackers can obtain corresponding network resources (such as SLA, user data, business logic, etc.) by exploiting the vulnerabilities of the TSN application itself (such as code defects, etc.), so as to prepare for further attacks. In addition, third-party malicious applications can pretend to be legitimate applications to obtain corresponding network resources.

In this paper, we design a time-sensitive network security communication scheme based on the national secret algorithm. After identity authentication and key negotiation between TSNCNC and TSN switches, confidential data transmission is performed between TSN switches to ensure time Integrity and confidentiality of sensitive network data stream transmission.

As shown in Figure 1, the workflow is as follows:

(1) Build a time-sensitive network security communication network model;

(2) Device initialization, TSN CNC loads the parameters required by the device state control unit;

(3) TSN CNC uses SM2/SM3 to perform identity authentication and key negotiation on the TSN switch according to the equipment parameters;

(4) SM3/SM4 is used to realize confidential communication between two TSN switches.

The innovation of the method proposed in this scheme lies in: 1. For the above step (3), introduce the time-sensitive network CNC, use the SM2 authentication algorithm and the SM3 hash algorithm to perform identity authentication and key negotiation on the TSN switch, and verify whether the TSN switch is trustworthy and assign a session key. 2. The SM3 hash algorithm is used to generate message authentication codes between the TSN switches in the above step (4), and the SM4 encryption/decryption algorithm realizes end-to-end secure communication.

(1) Identity authentication

The identity authentication scheme based on the national secret algorithm SM2 and SM3 designed in this paper is mainly divided into time-sensitive network initialization and identity authentication process. Among them, the time-sensitive network initialization includes the parameter process required by the initial device state control unit after the successful construction of the time-sensitive network. The identity authentication mainly authenticates the legitimacy of the TSN switch. Only the TSN switch that has passed the identity authentication can perform subsequent key negotiation and security. communication process.

1. System initialization

The time-sensitive network deploys a time-sensitive wired network composed of time-sensitive network traffic generators and multiple TSN switches through wired connections. At the same time, configure a time-sensitive network CNC, and the CNC will load the parameters required by the equipment status control unit. First, the TSN switch needs to use the LLDP protocol to obtain topology-related information of adjacent devices, which will be stored in a management information base (MIB) in the form of LLDP packets, and then the TSN CNC obtains the topology stored in the MIB through the SNMP protocol Relevant information, including OID (object identifier) information of each TSN switch, such as device system name, device IP address, etc., use these OID information as the identity ID _i (1≤i≤n) of the TSN switch, and n is the access The sum of all TSN switches of the network. The specific interaction process is shown in Figure 2.

SNMPv3 defines a new message format, as shown in Figure 3.

The main fields in the SNMP message are defined as follows:

Version: Indicates the SNMP version, and the corresponding field value of SNMPv3 message is 2.

Header data: mainly includes descriptions such as the maximum message size supported by the message sender and the security mode adopted by the message.

Security parameters: Contains security information such as the relevant information of the SNMP entity engine, user name, authentication parameters, and encryption parameters.

Context EngineID: SNMP unique identifier, which together with the PDU type determines which application should be sent.

Context Name: used to determine the MIB view of the managed device by the Context EngineID.

SNMPv3 PDU: Contains information such as PDU type, request identifier, and variable binding list. Among them, SNMPv3 PDU includes GetRequest PDU, GetNextRequest PDU, SetRequest PDU, Response PDU, Trap PDU, GetBulkRequest*PDU and InformRequest PDU.

The command names, corresponding codes, and function descriptions that identify different PDUs are shown in Table 1.

Table 1 Command names, corresponding codes and function descriptions of different PDUs

The header consists of the following parts:

----msgID: message identifier, used to identify the PDU. The value range is 0～2 ³¹ -1;

----msgMaxSize: indicates the maximum message size supported by the message sender, and the value range is 484～2 ³¹ -1;

----msgFlags: An octet string containing several flags, with 3 feature bits: reportableFlag, privFlag, and authFlag.

----msgSecurityModel: Message security model, used to identify the security model used by the sender to generate the message, the sender and receiver must use the same security model.

----msgSecurityParamters: Security parameters, security parameters generated by the security subsystem of the sender, such as user name, message authentication code (MAC), encryption parameters, etc., are used to protect the security of message transmission, and are determined by the security subsystem of the receiver The system performs security processing such as decryption and authentication on the message.

----contextEngineID: an identifier that uniquely identifies an SNMP entity. For incoming messages, this field is used to determine which application the PDU will be delivered to for processing; for outgoing messages, this value is provided by the upper-layer application and represents that application.

----contextName: The name of the context where the managed object is carried.

----PDU: PDU with object binding list.

The last three fields (contextEngineID, contextName and PDU) are collectively called scopedPDU.

Table 2 shows the function names and functions that need to be called when the management end and the agent end perform data interaction.

Table 2 System initialization function call table

Function name effect snmp_pdu_create Create SNMP message snmp_add_var Fill SNMP message snmp_send Send SNMP message snmp_synch_response Receive and read SNMP messages snmp_close Close the session and release the space occupied by the PDU

2. Identity authentication

The process flow of the time-sensitive network authentication scheme designed in this paper is shown in Figure 4. It is mainly divided into the following steps:

Step 1: TSN CNC sends a get-request packet to the TSN switch to obtain MIB information, parses the OID information in the MIB, uses the SM2 public key algorithm to generate a public-private key pair (KeyD, KeyB), and sends it to the TSN switch;

Step 2: The TSN switch side calls the snmp_pdu_create function to create an SNMP message, generates a random number N _i through a random number generator, uses the authentication public key Key _D to encrypt the identity ID _i and the random number N _i through the SM2 encryption authentication algorithm, and generates Identity authentication information C _i =SM2 _KeyD (ID _i ||N _i ), call the snmp_add_var function to fill the encrypted identity authentication information in the PDU;

Step 3: Use the authentication public key Key _D to process the identity ID _i and the random number N _i through the SM3 hash algorithm, generate a message authentication code TAG=SM3 _KeyD (ID _i ||N _i ), call the snmp_add_var function to generate The message authentication code is inserted into the msgAuthenticationParameters field, and the generated identity authentication information C _i and the message authentication code TAG are constructed into identity authentication request information Request _i =C _i ||TAG, and the snmp_send function is called to send the SNMP message to TSNCNC;

Step 4: The TSN CNC side receives and reads the SNMP message through snmp_synch_response, uses the authentication private key Key _B to decrypt the read identity authentication information through the SM2 algorithm to obtain the identity ID _i ' and the random number N _i ', first judge To verify the validity of ID _i ', use the authentication public key Key _D to process the identity ID _i ' and the random number N _i ' through the SM3 hash algorithm, and obtain the message authentication code TAG'=SM3 _KeyD (ID _i '||N _i ' ), if TAG=TAG', the identity authentication is successful, otherwise, the identity authentication fails, the snmp_colse function is called to close the session, and the subsequent key negotiation process cannot be performed.

That is to say, the TSN switch completes the identity authentication process, and the TSN switch that has passed the TSN CNC identity authentication will perform a key negotiation process with TSNCNC.

(2) Key negotiation

The key agreement scheme based on the national secret algorithm SM2 and SM3 designed in this paper mainly includes the session key generation and confirmation process, as well as the security parameters required for subsequent secure communication in time-sensitive networks.

1. Key negotiation

The process flow of the time-sensitive network key agreement designed in this paper is shown in Figure 5. It is mainly divided into the following steps:

Step 1: The TSN CNC end calls the snmp_pdu_create function to create an SNMP message, generates and stores the session key K _s for the field device, and the random number generator generates a random number R _i ;

Step 2: TSN CNC splices the acquired random number N _i ', the random number R _i generated by itself and the generated session key K _s , and uses the authentication private key Key _B to process the spliced data (N _i ' ||R _i ||K _s ) to encrypt, generate encrypted information E＝SM2 _KeyB (N _i '||R _i ||K _s ), use the authentication public key Key _D to use the SM3 hash algorithm to splice the data (N _i '||R _i ), generate message authentication code MAC=SM3 _KeyD (N _i '||R _i ), call snmp_add_var function to fill encrypted information E into PDU, and insert generated message authentication code MAC into call snmp_send The function sends the PDU to the TSN switch;

Step 3: The TSN switch receives and reads the PDU through snmp_synch_response, uses the authentication public key KeyD to process the read message authentication code MAC' through the SM3 hash algorithm, obtains (N _i '||R _i ), and verifies N _i Whether '=N _i is established, if it is established, store the random number R _i ', and use the authentication public key KeyD to decrypt the received encrypted information through the SM2 algorithm to obtain the session key K _s , use the session key K _s to pass The SM2 algorithm encrypts the random number R _i ', and generates key agreement confirmation information Call the snmp_add_var function to fill the key negotiation confirmation information into the PDU, call the snmp_send function to send the SNMP message to the TSN CNC, if not established, discard the message;

Step 4: TSN CNC receives and reads the SNMP message through snmp_synch_response, uses the session key K _s to decrypt the read key agreement confirmation information through the SM2 algorithm, obtains the random number R _i ', and verifies R _i ' =Whether R _i is established, if established, the key agreement is successful, otherwise, the key agreement fails.

That is to say, the key negotiation process is completed between the TSN switch of the time-sensitive network and the TSN CNC, and the TSN switch uses the successfully negotiated session key K _s for subsequent secure communication.

(3) Secure communication

The secure communication scheme based on SM3 and SM4 algorithms designed in this paper mainly includes the process of time-sensitive network data encryption and data decryption. In the data encryption stage, the TSN switch uses the SM3 algorithm to generate a message authentication code, and uses the SM4 algorithm to encrypt data, so as to ensure the integrity and confidentiality of time-sensitive network transmission data. Among them, the SM4 algorithm adopts the ECB mode for encryption and decryption, and both the encryption algorithm and the key round expansion algorithm adopt a 32-round nonlinear iterative structure.

The time-sensitive network frame format is roughly the same as that of traditional Ethernet. According to the definition of IEEE 802.1Q standard, the time-sensitive network frame format is to add a 4-byte 802.1Q tag on the basis of the traditional Ethernet frame format. Tag protocol identification (TPID), priority (PCP), canonical format indicator (CFI) and virtual local area network serial number (VLAN-ID) are defined in the tag, and its frame format is shown in Figure 6.

In the process of time-sensitive network security communication, it is necessary to construct the MAC layer message format in advance, and the specific message construction format is shown in Figure 7.

When parsing the TSN data frame, you can first get the TSN data payload, encrypt the data payload to generate ciphertext, and fill in 1 byte of data before the data payload as the security control field. The security control field is all 0 by default. Yes, after the encryption of the data payload is completed, set the last bit to 1, indicating that the message has been encrypted, and at the same time fill in the generated message authentication code after the data payload for security verification, and use such a whole as a report of secure communication The text is sent to the recipient. After the other end receives the message, it first checks the security control field, and then verifies the message authentication code. After the authentication is successful, it executes the decryption program.

The entire time-sensitive network security communication process is shown in Figure 8.

Step 1: The TSN switch 1 parses the TSN data frame, obtains the data payload, encrypts the plaintext M with the SM4 encryption algorithm using the session key K _s , and generates the ciphertext C;

Step 2: TSN switch 1 uses session key K _s to generate SM3 message authentication code Tag through SM3 hash algorithm, and sends the security control field, ciphertext C and message authentication code Tag to TSN switch 2 as a secure communication message E;

Step 3: After the TSN switch 2 obtains the message, it first parses the security control field. If the security control field is displayed as 01, it indicates that the message has been encrypted; otherwise, it forwards the message directly;

Step 4: The TSN switch 2 uses the session key K _s to generate the SM3 message authentication code Tag' through the SM3 hash algorithm, and verifies whether Tag=Tag' is established, and if established, then executes the decryption program, otherwise, discards the message;

Step 5: For the message successfully authenticated by the message authentication code, the TSN switch 2 uses the session key K _s to decrypt the ciphertext C through the SM4 decryption algorithm to obtain the TSN plaintext.

That is to say, after the time-sensitive network completes the secure communication process, the encrypted message at the port of TSN switch 1 will be decrypted at the port of TSN switch 2, so as to ensure the confidentiality and integrity of data transmission.

Finally, it is noted that the above embodiments are only used to illustrate the technical solutions of the present invention without limitation. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be carried out Modifications or equivalent replacements, without departing from the spirit and scope of the technical solution, should be included in the scope of the claims of the present invention.

Claims (3)

1. A time sensitive network safety communication method based on a national cryptographic algorithm is characterized in that: the method comprises the following steps:

s1: initializing a time sensitive network;

the time sensitive network deploys a time sensitive wired network formed by a time sensitive network flow generator and a plurality of TSN switches through wired connection; simultaneously configuring a time-sensitive network CNC, wherein the CNC can load parameters required by a device state control unit; firstly, a TSN exchanger needs to acquire topology related information of adjacent equipment by using an LLDP protocol, the information is stored in a management information base MIB in the form of LLDP messages, and then a TSNCNC acquires the topology related information stored in the MIB through the SNMP protocol, wherein the topology related information comprises object identifier OID information of each TSN exchanger, and the object identifier includes equipment system names and equipment IP addresses; using these OID information as the ID of TSN switch _i I is more than or equal to 1 and n is the sum of all TSN switches connected to the network;

SNMPv3 defines a new message format including an IP header, UDP header, version, header data, security parameters, contextEngineID, contextname, and SNMPPDU;

the fields in SNMP messages are defined as follows:

version: representing the version of SNMP, and the SNMPv3 message corresponds to a field value of 2;

header data: the description content of the security mode adopted by the message comprises the maximum message size which can be supported by the message sender;

safety parameters: security information including related information of the SNMP entity engine, a user name, authentication parameters, and encryption parameters;

ContextEngineID: an SNMP unique identifier that, along with the PDU type, determines to which application should be sent;

ContextName: a MIB view for determining a ContextEngineID pair managed device;

SNMPv3PDU: contains PDU type, request identifier and variable binding list; wherein SNMPv3PDU includes GetRequestPDU, getNextRequestPDU, setRequestPDU, responsePDU, trapPDU, getBulkRequest x PDU and infrmrequestpdu;

the command names, corresponding codes and functions for identifying different PDUs are as follows:

GetRequest is coded as 0 and functions as: the management station sends the agent to inquire the value of the appointed variable;

GetNextRequest encodes a 1, functions as: the management station sends the agent to inquire the value of the next variable;

response code 2, functions: the agent sends back an execution result to the management station;

SetRequest codes 3, functions: the management station sends the agent to set the value of a certain variable maintained by the agent;

GetBulkRequest encodes 4, functions: the management station transmits batch information to the agent;

InformaRequest is coded as 5, and functions as: the management station transmits a parameter processing request to the management station;

trap code is 6, and functions are: a warning message proxied to the management station;

report code 7, functions: snmpv2 is undefined; snmpv3 is defined to initiate a report when the PDU portion of the message cannot be decrypted;

the header includes:

msgID: a message identifier for identifying the PDU; the value range is 0 to 2 ³¹ -1；

msgMaxSize: representing the maximum message size supported by the message sender, the range of values is 484-2 ³¹ -1；

msgfrags: an 8-bit group string containing several flags, with 3 characteristic bits: reportableFlag, privFlag, authFlag;

msgSecurityModel: a message security model for identifying a security model used by a sender to generate the message, the sender and the receiver having to employ the same security model;

msgSecurityParamters: the security parameters, the user name, the message authentication code MAC and the encryption parameters generated by the security subsystem of the sender are used for protecting the security of message transmission and the security subsystem of the receiver is used for decrypting and authenticating the message;

contextEngineid: an identifier uniquely identifying the SNMP entity; for an incoming message, this field is used to determine to which application to submit the PDU for processing; for outgoing messages, this value is provided by the upper layer application and represents that application;

contextName: the name of the context in which the carried management object is located;

PDU: a PDU with an object binding list;

wherein the last three fields contextEngineID, contextName and the PDU are collectively referred to as a scopedPDU;

the function name to be called when the management end and the proxy end perform data interaction is as follows:

the function name is snmp_pdu_create, which is used for creating an SNMP message;

the function name is snmp_add_var, which is used for filling SNMP message;

the function name is snmp_send, which is used for sending SNMP message;

the function name is snmp_synch_response, which is used for receiving and reading SNMP messages;

the function name is snmp_close, which is used for closing the session and releasing the space occupied by the PDU;

s2: identity authentication;

s21: the TSNCNC sends a get-request data packet to the TSN switch to acquire MIB information, analyzes OID information in the MIB, generates a public-private key pair (KeyD, keyB) by using an SM2 public key algorithm, and sends the public-private key pair (KeyD, keyB) to the TSN switch;

s22: the TSN exchanger end calls the snmp_pdu_create function to create an SNMP message, and generates a random number N through a random number generator _i Using an authenticated public Key _D Identification ID through SM2 encryption authentication algorithm _i Random number N _i Encryption is carried out to generate identity authentication information C _i ＝SM2 _KeyD (ID _i ||N _i ) Calling a snmp_add_var function to fill encrypted identity authentication information into the PDU;

s23: using authenticated public Key Key _D Identification ID through SM3 hash algorithm _i And random number N _i Processing to generate a message authentication code tag=sm3 _KeyD (ID _i ||N _i ) Calling the snmp_add_var function inserts the generated message authentication code into the msg authentication parameters field and generates identity authentication information C _i The message authentication code TAG is constructed into identity authentication Request information Request _i ＝C _i The TAG is called, and the snmp_send function is called to send an SNMP message to the TSNCNC;

s24: the TSNCNC side receives and reads the SNMP message through the snmp_sync_response, and uses an authentication private Key _B Decrypting the read identity authentication information through SM2 algorithm to obtain an identity ID _i ' and random number N _i ' first judge ID _i ' legitimacy, using authentication public Key Key _D Identification ID through SM3 hash algorithm _i ' random number N _i 'processing, obtaining a message authentication code TAG' =sm3 _KeyD (ID _i '||N _i ') if tag=tag', the identity authentication is successful, otherwise, the identity authentication fails, the snmp_colse function is called to close the session, and the subsequent key negotiation flow cannot be performed;

the TSN switch completes the identity authentication process, and the TSN switch which passes through the TSNCNC identity authentication carries out key negotiation with the TSNCNC.

2. The time-sensitive network security communication method based on the cryptographic algorithm as in claim 1, wherein: the key agreement is specifically:

s31: the TSNCNC end calls a snmp_pdu_create function to create an SNMP message, and generates a session key K for the field device _s And stores, the random number generator generates a random number R _i ；

S32: TSNCNC pairs the acquired random number N _i ' self-generated random number R _i Generated session key K _s Splicing, and using an authentication private Key Key _B Spliced data (N) is subjected to SM2 algorithm _i '||R _i ||K _s ) Encryption is performed to generate encryption information e=sm2 _KeyB (N _i '||R _i ||K _s ) Using an authenticated public Key _D Spliced data (N) is subjected to SM3 hash algorithm _i '||R _i ) Processing is performed to generate a message authentication code mac=sm3 _KeyD (N _i '||R _i ) Calling a snmp_add_var function to fill encryption information E into the PDU, and inserting a generated message authentication code MAC into the call snmp_send function to send the PDU to the TSN switch;

s33: the TSN exchanger receives and reads PDU through snmp_sync_response, uses authentication public key Key D to process the read message authentication code MAC' through SM3 hash algorithm to obtain (N) _i '||R _i ) Verify N _i '＝N _i Whether or not it is true, if so, storing the random number R _i ' and decrypting the received encrypted information by SM2 algorithm by using authentication public key KeyD to obtain session key K _s Using session key K _s For random number R by SM2 algorithm _i ' encryption, generation of key agreement confirm information ack=sm2 _KS (R _i '), call the snmp_add_var function to fill the key negotiation confirmation information into PDU, call the snmp_send function to send SNMP message to TSNCNC, if not, discard the message;

s34: the TSNCNC receives and reads the SNMP message through the snmp_sync_response and uses the session key K _s Decrypting the read key negotiation confirmation information through SM2 algorithm to obtain a random number R _i ' and checkingSyndrome R of _i '＝R _i If so, the key negotiation is successful, otherwise, the key negotiation fails;

the key negotiation process is completed between the TSN switch and the TSNCNC of the time sensitive network, and the TSN switch utilizes the successfully negotiated session key K _s Subsequent secure communications are conducted.

3. The time-sensitive network security communication method based on the cryptographic algorithm as in claim 2, wherein: the secure communication is specifically:

s41: TSN exchanger 1 analyzes TSN data frame, obtains data load, uses session key K _s Encrypting a plaintext M through an SM4 encryption algorithm to generate a ciphertext C;

s42: TSN switch 1 uses session key K _s Generating an SM3 message authentication code Tag through an SM3 hash algorithm, and sending a security control field, a ciphertext C and the message authentication code Tag as a security communication message E to the TSN switch 2;

s43: after the TSN switch 2 obtains the message, firstly, the security control field is analyzed, if the security control field is displayed as 01, the message is indicated to be encrypted, otherwise, the message is directly forwarded;

s44: TSN switch 2 uses session key K _s Generating an SM3 message authentication code Tag 'through an SM3 hash algorithm, verifying whether tag=tag' is satisfied, executing a decryption program if so, otherwise, discarding the message;

s45: the TSN switch 2 uses the session key K to authenticate a successful message via the message authentication code _s Decrypting the ciphertext C through an SM4 decryption algorithm to obtain a TSN plaintext;

the time sensitive network completes the safety communication process, and the message after the encryption processing of the port of the TSN switch 1 is decrypted at the port of the TSN switch 2, so that the confidentiality and the integrity of data transmission are ensured.