CN117375992A - Time synchronization security enhancement method and device based on random numbers - Google Patents

Abstract

The invention discloses a time synchronization security enhancement method and a device based on random numbers, wherein the method comprises the following steps: hiding the transmission time of the interactive information data between the sending end and the receiving end by adopting a random number distributed by the symmetric key; the transmitting end only transmits the information data in the window at the time determined by the random number, and the receiving end only receives the information data in the time receiving window determined by the random number; the receiving end only decrypts and authenticates the information data in the time receiving window. According to the method, the random number is added to the time synchronization interaction information to randomly process the sending time and the receiving time of the time interaction information data, so that an attacker can hardly conduct DOS attack in a targeted manner, and the safety of a time synchronization system can be remarkably enhanced.

Description

Time synchronization security enhancement method and device based on random numbers

Technical field

The present invention relates to the field of communication technology, in particular to a random number-based time synchronization security enhancement method and device.

Background technique

Time is a quantity that records the duration of individual events and the intervals between them. After obtaining accurate time information through observation, the time information is transmitted to the user through some means. This system is called a timing system, also called a time synchronization system. Existing timing systems include microwave timing, satellite timing, optical fiber timing and other solutions. The optical fiber-based time synchronization solution can take advantage of mature long-distance and large-capacity optical communication technology and the flexible networking characteristics of optical networks, and is an important technical direction in this field.

In the actual optical fiber timing system, there is the transmission of physical signal pulses and the interaction of information data. In the process of information data interaction, in order to prevent time synchronization problems caused by attackers tampering with data, cryptographic technologies such as encryption, decryption and authentication are usually used to protect the interactive information data. Cryptographic protection such as encryption, decryption and authentication requires corresponding hardware resources. After using cryptographic technology, although attackers cannot tamper with data information, they can consume the hardware resources used by the time synchronization system for cryptographic protection by sending a large number of similar data packets, causing the time synchronization system to be unable to achieve effective decryption and authentication. The information data used for time synchronization causes time synchronization to fail.

Contents of the invention

In view of this, the present invention provides a random number-based time synchronization security enhancement method and device.

The invention discloses a time synchronization security enhancement method based on random numbers, which includes:

Step 1: Hide the transmission time of the interactive information data between the sender and the receiver by using random numbers distributed with symmetric keys;

Step 2: The sending end only sends the information data within the window at the time determined by the random number, and the receiving end only receives the information data within the time reception window determined by the random number; the receiving end only receives the information data within the time reception window. Decryption and authentication.

Further, the step 1 includes:

Through symmetric key distribution technology, the sending end and the receiving end obtain the same random number sequence N, and store it in the first random number unit of the sending end and the second random number unit of the receiving end respectively; the first cryptographic unit of the sending end pairs the input Time synchronized interactive information D performs cryptographic operations; among them, symmetric key distribution technology includes public key key agreement and quantum key distribution; cryptographic operations include encryption and authentication.

Further, in step 1:

Perform a Hash operation on the time synchronization interaction information D to obtain the hash value hd;

Use the private key to encrypt hd, and append hd to the time synchronization interaction information D; you can choose to perform symmetric or asymmetric encryption on the time synchronization interaction information D or D+hd.

Further, in step 1:

Use the HAMC method to perform a hash operation on the time synchronization interactive information D to obtain the hash value hd, and append hd to the time synchronization interactive information D for information authentication; perform symmetric or asymmetric encryption on the D or D+hd data. to protect its confidentiality.

Further, the step 2 includes:

The sending end only sends the encrypted and authenticated time synchronization interaction information D within the time transmission window determined by the random number; the receiving unit of the receiving end only receives the encrypted and authenticated time synchronization interaction information D within the time reception window determined by the random number. , and then the encrypted and authenticated time synchronization interactive information D is decrypted and authenticated through the second cryptographic unit of the receiving end, and the time synchronization interactive information D is restored.

Further, in step 2:

According to the random number sequence N shared between the sender and the receiver, the sender randomly determines the sending time of the password-protected time synchronization interactive information D.

Furthermore, if the time period of time synchronization between the sender and the receiver is once per second, the interactive information needs to be sent within one second; assuming a random number sequence N∈[0,N _max ], if the sender and receiver are either If the value of the random number sequence obtained once is n, then the sending end chooses to send the password-protected time synchronization interactive information D at the N/N _max time in the corresponding time.

Furthermore, for a two-way time synchronization system, if the sending end requires time t0 to obtain the time synchronization interaction information sent by the receiving end, the receiving end selects N/N _max * (1-t0) as the time to send the time synchronization interaction information. .

Further, in step 2:

According to the random number sequence N, the receiving end determines the time reception window for receiving information corresponding to the sending end, that is, assuming that the sending time of the sending end determined by the random number sequence N is f(N), the specific form of the f function is determined by the sending end and The receiving end has agreed in advance, that is, the receiving end can obtain f(N) through N; the transmission delay of time interactive information is τ, and the time window of the receiving unit of the receiving end is [f(N)+τ-u, f(N) +τ+u]; where u is determined by the uncertainty of the relevant parameters; the relevant parameters include clock difference and transmission delay; the sending end and the receiving end are only in [f(N)+τ-u, f(N)+ The time synchronization interactive information D is received within the τ+u] time window.

The invention also discloses a random number-based time synchronization security enhancement device, which is used to implement any of the above random number-based time synchronization security enhancement methods. The device includes a sending end and a receiving end; the sending end includes A first encryption unit, a sending unit and a first random number unit; the receiving end includes a second random number unit, a receiving unit and a second encryption unit;

The output terminals of the first encryption unit and the first random number unit are respectively connected to the input terminal of the sending unit; the first random number unit and the second random number unit are connected to each other; the output terminal of the sending unit is connected to the input terminal of the receiving unit; The output end of the two random number units is connected to the input end of the receiving unit; the output end of the receiving unit is connected to the input end of the second encryption unit.

Due to the adoption of the above technical solution, the present invention has the following advantages:

1. By using symmetrically distributed random numbers to hide the transmission time of interactive information data, the sender only sends information data within the time sending window determined by the random number, and the receiver only receives information within the time reception window determined by the random number. information data. Since the attacker does not know this time window, he cannot conduct targeted attacks against this window. Since the receiver only decrypts and authenticates information data within a limited time window, the computational burden can be significantly reduced and the security of time synchronization can be greatly improved.

2. This solution adds random numbers to the time synchronization interaction information to randomly process the sending time and reception time of the time interaction information data, making it difficult for attackers to carry out targeted DOS attacks, and can significantly enhance the security of the time synchronization system.

3. The present invention can also be combined with delay attack protection technology (preventing attackers from delaying time interaction information) and time information hiding technology (preventing attackers from distinguishing time interaction information from various information) to further enhance time Synchronize system security.

Description of the drawings

In order to explain the technical solutions in the embodiments of the present invention more clearly, the drawings needed to be used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only those recorded in the embodiments of the present invention. For some embodiments, those of ordinary skill in the art can also obtain other drawings based on these drawings.

Figure 1 is a schematic diagram of a one-way time synchronization system according to an embodiment of the present invention;

Figure 2 is a schematic diagram of a two-way time synchronization system according to an embodiment of the present invention;

Figure 3 is a schematic diagram of information interaction for securely adding time synchronization based on random numbers according to an embodiment of the present invention.

Detailed ways

The present invention will be further described with reference to the accompanying drawings and embodiments. The described embodiments are only some of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art should fall within the scope of protection of the embodiments of the present invention.

The present invention is applicable to both one-way time synchronization systems and two-way time synchronization systems. Figure 1 is a schematic diagram of a one-way time synchronization system. A typical one-way time synchronization system is divided into two parts: the L end and the R end. The L end and the R end each include a clock, the L end includes a sending unit, and the R end includes a receiving unit and a clock update unit. The one-way time synchronization system works as follows:

The purpose of the time synchronization system is to make the clock difference between the R-side clock and the L-side clock zero. The L end sends a synchronization signal to the R end, based on the L end clock, and the signal sending time is _TL . Based on the clock of the R terminal, the time when the R terminal receives the signal is _TR . The flight time for the synchronization signal to be transmitted from the L end to the R end is τ _LR . Therefore, based on the clock of the L terminal, the time of the synchronization signal received by the R terminal is:

T _R ⁰ =τ _LR +T _L .

Therefore, the clock difference between the R terminal and the L terminal is:

ΔT=T _R -T _R ⁰ =T _R -T _L -τ _LR ,

Among them, _TR is measured from the R end, and τ _LR is estimated from the transmission distance between the R end and the L end and the signal transmission speed. _TL is measured by the L end, but since the correction of the R end's clock requires this data, the L end needs to transmit the data to the R end through the information exchange channel.

Figure 2 is a schematic diagram of a two-way time synchronization system. As shown in the figure, a typical two-way time synchronization system is divided into two parts: the L end and the R end. The L end includes a clock, a sending unit, and a receiving unit. The R end includes a clock, a sending unit, a receiving unit, and a clock update unit.

The purpose of the time synchronization system is to make the clock difference between the R-side clock and the L-side clock zero. On the one hand, when the L end sends a synchronization signal, the time is T _L , the time interval counter of the L end starts counting, and stops counting when it receives the synchronization pulse sent from the R end, and the count value is T _LR ; on the other hand, the R end sends a synchronization When pulse occurs, the time is T _R , the time interval counter on the R end starts counting, and stops counting when it receives the synchronization pulse sent from the L end, and the count value is T _RL . Assume that the time for the pulse from the L terminal to be transmitted to the R terminal is τ _LR , and the time for the pulse from the R terminal to be transmitted to the L terminal is τ _RL , then there is

T _LR =(T _R +τ _RL )-T _L

T _RL =(T _L +τ _LR )-T _R

The time difference between R end and L end is:

Among them, the asymmetry of signal transmission (τ _LR -τ _RL ) can be obtained in advance through equipment calibration and channel estimation. T _RL is measured from the R end. T _LR is measured from the L end. Since the R end needs T _LR data to correct the local clock, the measurement data needs to be transmitted from the L end to the R end through the information exchange channel.

The present invention is applicable to but not limited to the above two types of time synchronization systems, and is also applicable to time synchronization systems such as NTP and PTP.

Through the analysis of the one-way time synchronization system and the two-way time synchronization system, it can be seen that the above solutions need to transmit information through the information interaction channel, and the accuracy of the information is directly related to the time synchronization accuracy. In order to prevent attackers from tampering with information, cryptographic protection measures such as encryption, decryption or authentication are usually implemented for interactive information. However, cryptographic protection methods require corresponding hardware resource support. An attacker can implement a DOS (Denial of Service) attack and consume the hardware resources by sending a large amount of similar information, making the real time synchronization interaction information unable to be decrypted or authenticated, causing legitimate users to be unable to obtain the required time interaction information, resulting in time Synchronization fails and time synchronization performance degrades.

In order to improve the security of time synchronization performance under the above-mentioned DOS attack, the present invention proposes an embodiment of a time synchronization security enhancement method based on random numbers, which includes:

S1. Hide the transmission time of interactive information data between the sender and the receiver by using random numbers distributed with symmetric keys;

S2. The sending end only sends the information data within the window at the time determined by the random number, and the receiving end only receives the information data within the time reception window determined by the random number; the receiving end only decrypts the information data within the time reception window. and certification.

As shown in Figure 3, through symmetric key distribution technology (including but not limited to public key key negotiation, quantum key distribution and other technologies), both ends obtain the same random number sequence N, which is stored in the random number unit. The time synchronization interactive information D at the sender passes through the cryptographic unit to complete cryptographic operations such as encryption and authentication of the information data. Specific solutions include but are not limited to the following example solutions.

Example solution 1: First perform a Hash operation on the data D to obtain the hash value hd, then encrypt hd using the private key, and append hd to the original data D. You can choose to perform symmetric or asymmetric encryption on D or D+hd data.

Example solution 2: Use the HAMC method to perform a Hash operation on the data D, obtain the hash value hd, and append hd to the original data D for information authentication. The D or D+hd data is then symmetrically or asymmetrically encrypted to ensure its confidentiality.

According to the random number sequence N shared by both interacting parties, the sending end randomly determines the sending time of the interactive information after password protection. For example, if the time period of time synchronization is once per second, the interaction information needs to be sent within one second. Assume that the random sequence value is N∈[0,N _max ]. If the random sequence value obtained by the interacting parties at a certain time is n, then the corresponding interactive information can be sent at the N/Nmax time within the second. In the actual implementation process, it may take a certain time t0 for the sending end to obtain the time interaction information, such as the two-way time synchronization system described in Figure 2. Therefore, N/Nmax*(1-t0) can be selected as the time to send interactive information.

According to the random sequence N, the receiving end determines the time window for receiving information corresponding to the sending end. In principle, the time when reception starts can be determined based on the send time plus the transmission time. However, due to the clock difference between the clocks at both ends and the uncertainty in the delay during transmission, there is a certain uncertainty in the reception time. Therefore, the information needs to be received within a certain time window. Assume that the sending time of the sender determined by the random number N is f(N), and the specific form of the f function is agreed upon by the sender and the receiver in advance, that is, the receiver can obtain f(N) through N. The transmission delay of time interactive information is τ, and the time window for the receiving end to open the receiving unit is [f(N)+τ-u, f(N)+τ+u], where u is the clock difference and transmission delay Wait for the uncertainty to decide.

Since the time interaction information is only received within the [f(N)+τ-u, f(N)+τ+u] time window, and the attacker cannot know in advance without obtaining the random number shared by the legitimate communicating parties. this time window. Therefore, the attacker cannot send a large amount of attack data for this time window, thereby greatly reducing the attacker's DOS attack on the hardware resources required for cryptographic protection, thereby improving the decryption of correct time synchronization interaction information under such attack conditions. As well as the completionability of authentication, the time synchronization system's ability to resist DOS attacks is greatly enhanced.

Referring to Figure 3, the present invention also provides an embodiment of a time synchronization security enhancement device based on random numbers that implements the above method embodiment, which includes a sending end and a receiving end; the sending end includes a first cryptographic unit, a sending unit and a third A random number unit; the receiving end includes a second random number unit, a receiving unit and a second cryptographic unit;

The output terminals of the first encryption unit and the first random number unit are respectively connected to the input terminal of the sending unit; the first random number unit and the second random number unit are connected to each other; the output terminal of the sending unit is connected to the input terminal of the receiving unit; The output end of the two random number units is connected to the input end of the receiving unit; the output end of the receiving unit is connected to the input end of the second encryption unit.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that the present invention can still be modified. Modifications or equivalent substitutions may be made to the specific embodiments, and any modifications or equivalent substitutions that do not depart from the spirit and scope of the invention shall be covered by the scope of the claims of the invention.

Claims (10)

1. A random number-based time synchronization security enhancement method, comprising:

step 1: hiding the transmission time of the interactive information data between the sending end and the receiving end by adopting a random number distributed by the symmetric key;

step 2: the transmitting end only transmits the information data in the window at the time determined by the random number, and the receiving end only receives the information data in the time receiving window determined by the random number; the receiving end only decrypts and authenticates the information data in the time receiving window.

2. The method for enhancing time synchronization security based on random numbers according to claim 1, wherein the step 1 comprises:

the method comprises the steps that through a symmetric key distribution technology, a sending end and a receiving end obtain the same random number sequence N and respectively store the same random number sequence N in a first random number unit of the sending end and a second random number unit of the receiving end; the first cipher unit of the transmitting end carries out cipher operation on the input time synchronization interaction information D; the symmetric key distribution technology comprises public key negotiation and quantum key distribution; cryptographic operations include encryption and authentication.

3. The random number based time synchronization security enhancement method according to claim 2, wherein in said step 1:

carrying out Hash operation on the time synchronization interaction information D to obtain a Hash value hd;

encrypting hd by adopting a private key, and attaching hd to the back of the time synchronization interaction information D; the time synchronization interaction information D or D+hd can be selected to be encrypted symmetrically or asymmetrically.

4. The random number based time synchronization security enhancement method according to claim 2, wherein in said step 1:

carrying out Hash operation on the time synchronization interaction information D by adopting a HAMC method to obtain a Hash value hd, and attaching hd to the back of the time synchronization interaction information D to carry out information authentication; and D or D+hd data is symmetrically or asymmetrically encrypted to ensure confidentiality.

5. The method for enhancing time synchronization security based on random numbers according to claim 1, wherein the step 2 comprises:

the transmitting end only transmits the encrypted and authenticated time synchronization interaction information D in a time transmitting window determined by the random number; the receiving unit of the receiving end only receives the encrypted and authenticated time synchronization interaction information D in the time receiving window determined by the random number, and then decrypts and authenticates the encrypted and authenticated time synchronization interaction information D through the second password unit of the receiving end to restore the time synchronization interaction information D.

6. The random number based time synchronization security enhancement method according to claim 1, wherein in said step 2:

and according to the random number sequence N shared between the transmitting end and the receiving end, the transmitting end randomly determines the transmitting time of the time synchronization interaction information D after password protection.

7. The method for enhancing time synchronization security based on random numbers according to claim 6, wherein if the time period of time synchronization of the transmitting end and the receiving end is once per second, the interactive information needs to be transmitted within one second; suppose that the sequence of random numbers N E [0, N _max ]If the random number sequence obtained by the transmitting end and the receiving end at any time takes the value of N, the transmitting end selects N/N in the corresponding time _max And sending the time synchronization interaction information D after password protection at the moment.

8. The method for enhancing time synchronization security based on random numbers as claimed in claim 7, wherein for the bi-directional time synchronization system, if the transmitting end needs time t0 to acquire the time synchronization interaction information transmitted by the receiving end, the receiving end selects N/N _max * (1-t 0) as a time for transmitting the time synchronization interaction information.

9. The random number based time synchronization security enhancement method according to claim 1, wherein in said step 2:

according to the random number sequence N, the receiving end determines a time receiving window of the receiving information corresponding to the transmitting end, namely, the transmitting end is assumed to transmit the time f (N) determined by the random number sequence N, the specific form of the f function is pre-agreed by the transmitting end and the receiving end, namely, the receiving end can obtain f (N) through N; the transmission delay of the time interaction information is tau, and the time window of the receiving unit of the receiving end is [ f (N) +tau-u, f (N) +tau+u ]; wherein u is determined by uncertainty of the relevant parameter; the relevant parameters include clock skew and transmission time delay; the transmitting end and the receiving end only receive the time synchronization interaction information D in the time windows of [ f (N) +tau-u, f (N) +tau+u ].

10. A random number-based time synchronization security enhancement device for implementing the random number-based time synchronization security enhancement method as claimed in any one of claims 1 to 9, characterized in that the device comprises a transmitting end and a receiving end; the transmitting end comprises a first password unit, a transmitting unit and a first random number unit; the receiving end comprises a second random number unit, a receiving unit and a second password unit;

the output ends of the first password unit and the first random number unit are respectively connected with the input end of the sending unit; the first random number unit and the second random number unit are mutually connected; the output end of the sending unit is connected with the input end of the receiving unit; the output end of the second random number unit is connected with the input end of the receiving unit; the output end of the receiving unit is connected with the input end of the second password unit.