CN112202714B - Lightweight network security encryption device and method suitable for Internet of things - Google Patents

Abstract

The present disclosure discloses a lightweight network security encryption device and method suitable for the Internet of Things, comprising: a first data processing terminal connected to a first network communication terminal, and a second data processing terminal connected to the second network communication terminal The first data processing terminal is connected to the second data processing terminal; the first data processing terminal collects the original data of the first network communication terminal and encrypts it to obtain encrypted data, and the second data processing terminal receives the encrypted data. Encrypt and decrypt the encrypted data to obtain original data, and send the original data to the second network communication terminal. By arranging the first data processing terminal and the second data processing terminal, secure data transmission between network communication terminals or between network communication terminals and a data center is realized.

Description

A lightweight network security encryption device and method suitable for the Internet of Things

technical field

The present disclosure relates to a lightweight network security encryption device and method suitable for the Internet of Things.

Background technique

The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

At present, the commonly used data communication transmission scheme is that the Internet of Things network communication terminal enters the data center equipment or other network communication terminal after data filtering through the firewall, and completes the data transmission between the network communication terminals, or between the network communication terminal and the data center. In this data communication transmission scheme, only a firewall is used for security protection during the data transmission process. However, when the data transmission distance is long, the data is easily intercepted and leaked during the transmission process, resulting in irreparable losses.

With the construction and development of the Internet of Things, the number of network communication terminals has increased, and the deployment of network communication terminals is scattered, the distance is long, and the structure is complex. The structure is difficult to adapt, and a communication encryption strategy is urgently needed, which can securely encrypt data during transmission and improve the security of data transmission.

SUMMARY OF THE INVENTION

In order to solve the above problems, the present disclosure proposes a lightweight network security encryption device and method suitable for the Internet of Things. The second data processing terminal is connected to the second data processing terminal. The first data processing terminal encrypts the data of the first network communication terminal and sends it to the second data processing terminal. The second data processing terminal decrypts the encrypted data and sends it to the data center or the second network. The communication terminal realizes the secure transmission of data between network communication terminals.

To achieve the above object, the present disclosure adopts the following technical solutions:

In one or more examples, a lightweight network security encryption device suitable for the Internet of Things is proposed, including:

a first data processing terminal connected with the first network communication terminal, and a second data processing terminal connected with the second network communication terminal, the first data processing terminal is connected with the second data processing terminal;

The first data processing terminal collects the original data of the first network communication terminal and encrypts it to obtain the encrypted data, and the second data processing terminal receives the encrypted data and decrypts the encrypted data to obtain the original data, and sends the original data to the second data processing terminal. network communication terminal.

In one or more embodiments, a method for using a lightweight network security encryption device suitable for the Internet of Things is provided, including:

Collect the original data of the first network communication terminal through the first data processing terminal and encrypt it to obtain encrypted data;

The first data processing terminal sends the encrypted data to the second data processing terminal;

The second data processing terminal decrypts the received encrypted data to obtain original data;

The second data processing end sends the original data obtained by decryption to the second network communication terminal.

Compared with the prior art, the beneficial effects of the present disclosure are:

1. In the present disclosure, the first data processing terminal is connected at the first network communication terminal, the second data processing terminal is connected at the second network communication terminal or the data center communication host, and the first data processing terminal is connected to the first network communication terminal. After the data is encrypted, it is sent to the second data processing end, and the second data processing end decrypts the encrypted data and sends it to the second network communication terminal or data center communication host. Secure transfer of data between.

2. The present disclosure can prevent illegal network penetration attackers from implementing active attacks and passive information collection on IoT network terminals within the scope of the enterprise network or regional network, so as to realize data security "can't take away, can't understand". Ensure that IoT terminals and data centers can only exchange data with compliant communication objects. Guarantee the security of data transmission.

3. Both the first data processing terminal and the second data processing terminal of the present disclosure are lightweight devices, which are easy to install and use, and the present disclosure realizes data transmission between network communication terminals through the first data processing terminal and the second data processing terminal. It is not affected by the distance between network communication terminals and the network structure in the middle. When the distance between two network communication terminals is long, the security of data transmission can still be guaranteed.

Description of drawings

The accompanying drawings that form a part of the present application are used to provide further understanding of the present application, and the schematic embodiments and descriptions of the present application are used to explain the present application and do not constitute improper limitations on the present application.

1 is a schematic diagram of the connection of a security encryption device of the present disclosure;

2 is a schematic structural diagram of a first data processing terminal A (single-channel encryption device) of the present disclosure;

3 is a schematic structural diagram of a first data processing terminal B (multi-channel encryption device) of the present disclosure;

FIG. 4 is a communication model of the security encryption device of the present disclosure.

Among them: 1. Encrypted patch M, 2. Communication interface, 3. Communication interface, 4. Encrypted patch X, 5. Encrypted patch Y, 6. Encrypted patch Z, 7. Expansion board stacking slot, 8, Encrypted patch slot.

Detailed ways:

The present disclosure will be further described below with reference to the accompanying drawings and embodiments.

It should be noted that the following detailed description is exemplary and intended to provide further explanation of the application. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs.

It should be noted that the terminology used herein is for the purpose of describing specific embodiments only, and is not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly dictates otherwise, the singular is intended to include the plural as well, furthermore, it is to be understood that when the terms "comprising" and/or "including" are used in this specification, it indicates that There are features, steps, operations, devices, components and/or combinations thereof.

In this disclosure, terms such as "upper", "lower", "left", "right", "front", "rear", "vertical", "horizontal", "side", "bottom", etc. The orientation or positional relationship is based on the orientation or positional relationship shown in the drawings, and is only a relational word determined for the convenience of describing the structural relationship of each component or element of the present disclosure, and does not specifically refer to any component or element in the present disclosure, and should not be construed as a reference to the present disclosure. public restrictions.

In the present disclosure, terms such as "fixed connection", "connected", "connected", etc. should be understood in a broad sense, indicating that it may be a fixed connection, an integral connection or a detachable connection; it may be directly connected, or through an intermediate connection. media are indirectly connected. For the relevant scientific research or technical personnel in the field, the specific meanings of the above terms in the present disclosure can be determined according to specific situations, and should not be construed as limitations on the present disclosure.

Example 1

In order to realize the security of data communication between IoT network communication terminals, or between IoT network communication terminals and a data center, in this embodiment, a lightweight network security encryption device suitable for the IoT is proposed, The security encryption device will be described with reference to Figures 1-4, including:

a first data processing terminal connected with the first network communication terminal, and a second data processing terminal connected with the second network communication terminal, the first data processing terminal is connected with the second data processing terminal;

The first data processing terminal collects the original data of the first network communication terminal and encrypts it to obtain the encrypted data, and the second data processing terminal receives the encrypted data and decrypts the encrypted data, obtains the original data, and sends the original data to the first data processing terminal. 2. Network communication terminals.

The bottom layer of the IoT adopts the RAW mode of LWIP and the C language for data processing, and then sends the data to the second-layer network to form the second-layer network data packet. The second-layer network data packet is cached and integrated into the third-layer IP packet. The processing end uses an encryption algorithm to encrypt, extracts the encrypted IP packet at the second data processing end, decrypts to obtain the original data, and sends it to the second network communication terminal.

Among them, the first data processing terminal and the second data processing terminal are transparently deployed, which are applicable to any IP network, and do not change the network topology and IP address planning of the original Internet of Things.

The first network communication terminal and the second network communication terminal may be located in a small-scale local area network or a long-distance wide area network; routing protocols such as OSPF and BGP may be used; and bearer protocols such as PPPoE and MPLS VPN may be used.

Both the first data processing end and the second data processing end include a base, an encryption chip is arranged on the base, and a communication interface is arranged at both ends of the base, and the encryption patches of the first data processing end and the second data processing end are paired for use.

The communication interface on the base can be an RJ45 network cable interface or an SFP optical interface.

The first data processing end and the second data processing end may be single-channel data transmission or multi-channel data transmission. For single-channel data transmission or multi-channel data transmission, the first data processing end and the second data processing end , set up a variety of structures.

The first data processing end A and the second data processing end A refer to a single-channel encryption device, as shown in FIG. 2 .

The second data processing end B and the second data processing end B refer to the multi-channel encryption device, as shown in FIG. 3 .

The first data processing terminal A and the second data processing terminal A have the same structure, as shown in FIG. 2 , both include a base, an encryption patch M1 is set on the base, and a communication interface 2 is set at both ends of the base, and the length of the base is 4±0.5cm, 2±0.5cm wide, and 2±0.5cm high, so that the first data processing end and the second data processing end are lightweight devices.

The first data processing terminal B and the second data processing terminal B have the same structure. As shown in FIG. 3 , they both include a base, at least two encryption patches are arranged on the base, and one or more communication interfaces 3 are arranged at both ends of the base. Multiple communication interfaces 3 at the same end support link aggregation. An expansion board stacking slot 7 is set on the base for expanding the number of encrypted patches, and an encrypted patch slot 8 is set on the base for inserting encrypted patches. The length is 10±0.5cm, the width is 15±0.5cm, and the height is 2±0.5cm. The first data processing terminal B and the second data processing terminal B are also lightweight devices.

When the first network communication terminal only communicates with the second network communication terminal of a single target, the first data processing terminal A is connected to the first network communication terminal, the second data processing terminal A is connected to the second network communication terminal, and the first network communication terminal is connected to the second data processing terminal A. A data processing terminal A is paired with the encryption chip of the second data processing terminal A.

When the first network communication terminal communicates with multiple second network communication terminals, the first network communication terminal is connected to the first data processing terminal B, each second network communication terminal is connected to the second data processing terminal A, and the first data processing terminal A is connected to each second network communication terminal. The processing terminal B is provided with the same number of encryption patches as the second network communication terminals, and multiple encryption patches are paired with multiple encryption patches of the second data processing terminal A respectively, so as to realize the transmission of the same first network communication terminal. The data is securely transmitted to a plurality of second network communication terminals.

When a second network communication terminal communicates with multiple first network communication terminals, each first network communication terminal is connected to the first data processing terminal A, the second network communication terminal is connected to the second data processing terminal B, and the second network communication terminal is connected to the second data processing terminal B. The data processing terminal B is provided with the same number of encrypted patches as the first network communication terminals, and the encrypted patches on the second data processing terminal B are respectively paired with the encrypted patches of the plurality of first data processing terminals A, so as to realize the The data of the multiple first network communication terminals are securely transmitted to the same second network communication terminal.

When multiple second network communication terminals communicate with the same first network communication terminal, and the same second network communication terminal also communicates with multiple first network communication terminals, connect the first network communication terminal at each first network communication terminal. A data processing terminal B, each second network communication terminal is connected to the second data processing terminal B, the same first data processing terminal B is connected to multiple second data processing terminals B, and the multiple first data processing terminals B are connected to the same first data processing terminal B. A second data processing terminal B is connected.

The second network communication terminal in this embodiment may also be a data center communication host, that is, a communication connection between the Internet network communication terminal and the data center communication host is realized.

条逻辑信道，需要

对加密贴片，计算过程如下：Assume that in the IoT network, as shown in Figure 4, there are n network communication terminals E1, E2, E3...E(n), and a certain network communication terminal E(x) actually communicates with another Sum(E(x)) The network communication terminal needs to send and receive data, that is, the network communication terminal E(x) has Sum(E(x)) logical channels, then the whole network has a total of

logical channels, need

For encrypted patches, the calculation process is as follows:

(1) The required number of bases for encryption devices=n, where the number of bases for single-channel encryption devices=∑(Sum(E(i))=1?1:0), and the number of bases for multi-channel encryption devices=n-∑(Sum (E(i))=1?1:0).

(2)

The encryption patch is made of electronic chips with special algorithms, used in pairs, and cannot be modified after being manufactured to ensure uniqueness. After one end is stolen or damaged, it can only be paired to replace the hardware. As an additional security feature, the encryption patch supports automatic binding of IP and MAC addresses for the first communication; the communication interface supports link aggregation for high availability.

The encrypted patches are paired in two groups, with a globally unique channel ID. The two encrypted patches in the group are placed at both ends of the logical channel for encryption and decryption. Two encrypted patches in the same group can encrypt and decrypt each other, but encrypted patches in different groups cannot encrypt and decrypt each other. Assuming that a pair of two encrypted patches are named P1 patch and P2 patch, and the other paired two encrypted patches are S1 patch and S2 patch, the encryption and decryption communication effects are shown in Table 1. .

Communication effect data recipient P1 P2 S1 S2 data sender P1 —— success fail fail P2 success —— fail fail S1 fail fail —— success S2 fail fail success ——

Table 1

The encrypted patch is burned by chip hardware, and adopts anti-reading and anti-tampering measures. It cannot be modified by software after manufacturing to ensure uniqueness. After one end is stolen or damaged, only two encryption patch hardware can be replaced together, which cannot be supplemented or repaired.

As a security additional function, the encryption patch supports the automatic binding of IP and MAC addresses for the first communication; the communication interface supports high-availability link aggregation, and the communication interface includes RJ45 network port and SFP optical port.

When the new encrypted patch is connected to the IoT network for operation, the sender's network terminal MAC address and IP address are automatically intercepted when the power is turned on for the first time, and the sender's network terminal MAC address and IP address are automatically written into the chip itself through a pre-made program and cannot be modified, and the IP and MAC are permanently bound. When the network system changes IP or replaces the MAC address of the network terminal, the original encryption patch cannot be used, and must be replaced with a new encryption patch in pairs. It is suitable for network penetration attacks and hackers to illegally replace and tamper with equipment to enhance security.

Multiple communication interfaces on the same side of the base of the encryption device can support link aggregation, which is suitable for current network multi-link aggregation, server multi-NIC aggregation and binding, etc., and enhances the high availability and robustness of the link.

The encryption and decryption communication logic of the encryption patch is discussed with reference to FIG. 2 and FIG. 3 , as shown in Table 2.

Table 2

Since each pair of encrypted patches forms a "single-wire" logical channel, normally no communication loop is formed. However, it is necessary to pay attention not to artificially add loops during network installation, that is, two or more sets of encryption patches cannot be placed on two network terminals to ensure that the two network terminals with communication needs have one and only one set of encryption patches.

This embodiment is suitable for the lightweight network security encryption device and technology of the Internet of Things, and is suitable for the Internet of Things networks in various industries such as electric power, environment, chemical industry, and logistics. The encrypted patch adopts interconnected chip architecture such as STM32, which is suitable for the Internet of Things environment with general data volume.

Example 2

In this embodiment, a lightweight network security encryption method suitable for the Internet of Things is proposed, including:

Collect and encrypt the data of the first network communication terminal through the first data processing terminal;

The first data processing terminal sends the encrypted data to the second data processing terminal;

The second data processing terminal decrypts the received encrypted data to obtain the original data before encryption;

The second data processing end sends the original data obtained by decryption to the second network communication terminal.

The above are only preferred embodiments of the present application, and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this application shall be included within the protection scope of this application.

Although the specific embodiments of the present disclosure are described above in conjunction with the accompanying drawings, they do not limit the protection scope of the present disclosure. Those skilled in the art should understand that on the basis of the technical solutions of the present disclosure, those skilled in the art do not need to pay creative efforts. Various modifications or variations that can be made are still within the protection scope of the present disclosure.

Claims (8)

1. A lightweight network security encryption device suitable for the Internet of things, comprising:

the system comprises a first data processing end connected with a first network communication terminal and a second data processing end connected with a second network communication terminal, wherein the first data processing end is connected with the second data processing end;

the first data processing terminal acquires original data of the first network communication terminal and encrypts the original data to obtain encrypted data, the second data processing terminal receives the encrypted data, decrypts the encrypted data to obtain the original data, and sends the original data to the second network communication terminal;

the first data processing end and the second data processing end respectively comprise a base, encryption patches are arranged on the bases, communication interfaces are arranged at two ends of each base, and the first data processing end and the encryption patches of the second data processing end are used in a matched mode;

the encryption patch automatically binds the IP and the MAC address for the first communication, and the bound IP and MAC address cannot be modified after binding.

2. A lightweight network security encryption apparatus suitable for internet of things as claimed in claim 1, wherein the first data processing terminal is connected with the first network communication terminal in series in a transparent manner, and the second data processing terminal is connected with the second network communication terminal in series in a transparent manner.

3. A lightweight network security encryption device adapted for the internet of things as recited in claim 1, wherein said encryption patch is plugged into said base.

4. A lightweight network security encryption device adapted for the internet of things as recited in claim 1, wherein said encryption patch provides both encryption and decryption functions.

5. A lightweight network security encryption device suitable for internet of things as claimed in claim 1, wherein the first data processing end and the second data processing end are in single-channel data transmission, the first data processing end and the second data processing end have the same structure, the base is provided with an encryption patch, two ends of the base are respectively provided with a communication interface, and the encryption patch of the first data processing end and the encryption patch of the second data processing end are used in pair.

6. A lightweight network security encryption device suitable for internet of things as claimed in claim 1, wherein the first data processing terminal and the second data processing terminal are for multi-channel data transmission, the first data processing terminal and the second data processing terminal have the same structure, the base is provided with at least two encryption patches, encryption algorithms of the encryption patches on the same base are different from each other, the second data processing terminal is provided with an encryption patch paired with the first data processing terminal, and two ends of the base are provided with one or more communication interfaces.

7. A lightweight network security encryption device adapted for internet of things as recited in claim 1, wherein said base has communication interfaces at the same end supporting link aggregation, and wherein said base has expansion board stacking slots for expanding the number of encryption patches.

8. A method for using a lightweight network security encryption device for internet of things, which utilizes the lightweight network security encryption device for internet of things as claimed in any one of claims 1 to 7, comprising:

acquiring original data of a first network communication terminal through a first data processing terminal and encrypting the original data to obtain encrypted data;

the first data processing terminal sends the encrypted data to the second data processing terminal;

the second data processing end decrypts the received encrypted data to obtain original data;

and the second data processing terminal sends the original data obtained by decryption to a second network communication terminal.

Images