TWI760240B - Authentication and authorization plug-in system - Google Patents

Abstract

An authentication and authorization plug-in system is configured between a first device and a second device that can transmit packets, and there is a packet forwarding device between the first device and the second device. The authentication and authorization plug-in system comprises a first encryption/decryption device and a second encryption/decryption device, wherein the first encryption/decryption device or the second encryption/decryption device can intercept the packet information transmitted by the first device, the second device or the packet forwarding device. After decrypting with the shared key, hash comparison and timestamp verification will be performed. If the verification is not completed, the packet information is encrypted and transmitted after adding the timestamp and finishing the hash process. The information received by the first device and the second device is determined as abnormal packet and filtered if it is not identified and should be decrypted using the share key.

Description

Authentication and authorization plug-in system

The present invention relates to an authentication and authorization plug-in system, in particular to a system capable of plug-in configuration of a one-to-one encryption/decryptor, in which the pair shares and shares the same group of keys, and transmits packets sent from both ends through the encryption/decryptor and the same set of keys for encryption, and when sent to the encryption/decryptor at the other end, it will be decrypted by the same set of keys, and the timestamp will be verified to confirm the integrity and security of the packet.

At present, due to the advancement of science and technology, the layout of the Internet of Things is becoming more and more dense, the communication technology of many industrial control equipment is also becoming more and more mature, and the need for machines to connect to the Internet has gradually become popular. Many respondents indicated that the focus of IoT environmental investment is in the complex introduction, and "improving security" is the most critical indicator for evaluating the success of the project. The protection concept of traditional information security technology is based on general computer equipment. It is believed that only computers and servers need to consider various protection measures for information security, especially in the network environment, from the traditional Client-Server architecture to everything. The complex environment of networking has accelerated the entry of equipment into the era of the Internet of Things; in the era of the Internet of Things, as long as devices that involve data computing and storage, including tool machines and manufacturing equipment, should have information security solutions deployed. The environment is becoming more complex, hacker attack methods are changing, and IoT information security issues are becoming more serious. Traditionally, in the industrial safety environment, only the local end of the industrial safety issues needs to be considered, but in the future industrial manufacturing environment, it is even more necessary to face the threat of networking and new types of information security.

In response to the emerging information security problems, in the Internet of Things environment, with the technological innovation, they continue to emerge; therefore, the American National Standards Institute has formulated the IEC62443 standard, in order to provide a framework for information security of smart manufacturing, and to formulate solutions that meet the needs of local enterprises. industrial control security environment. In order to steal useful information or extort large sums of money, hackers gradually shift their targets to B2B industrial applications such as manufacturing and medical industries that lack information security protection awareness and measures, resulting in increased information security threats.

The traditional industrial control system (ICS) is only deployed at the local end, and the authorization and authentication mechanism is established in the regional network; in the closed network, the external communication channels are limited, and the management and control are better controlled. With the development of the network, from single-point data transmission to multi-point device information transmission, and even to any device that can broadcast its own data, the traditional data authentication mechanism will become more and more communication channels. With the increase of pipelines, industrial control systems (ICS) have instead become the key targets of hackers. In the environment of the Industrial Internet of Things, due to the lack of experience in defending against cyber attacks, hackers can easily destroy tools and equipment or steal important data. The most common attack vector is to exploit the security gap between the internal and external network connections to damage the industrial environment.

In the smart manufacturing environment, production equipment is generally based on production flexibility and production planning, and thus ignores the control of the production management mechanism of the machine. Under the needs of industrial safety requirements, the industrial control equipment only targets the abnormal behavior of the machine. For detection, the central control equipment performs authority control and tracking, and the operator only has the authority to control the manufacturing machine. However, when the manufacturing machine is in an abnormal state, it is difficult to track the data of the abnormal behavior, and because of the need to provide immediate availability to solve the problem of industrial safety, once serious property damage is caused, even in the event of an industrial safety accident , unable to fundamentally understand the root cause of the incident.

Therefore, in this case, a robust authentication mechanism for remote access control is designed in the M2M environment, which will strengthen the traditional authentication mechanism and combine with the IEC 62443 standard, so that the device can have good information in the network environment. Safe design to achieve safe production and machine protection. In the smart manufacturing environment, in order to improve the production flexibility, the authentication mechanism is often ignored among the manufacturing machines, which greatly improves the production flexibility and production speed. Do protection encryption mechanism.

In terms of information security design, this case helps manufacturers and related supply chain operators to clearly define the attributes and sources of information security threats, help improve the industrial security environment, and at the same time strengthen the design of the Internet of Things environment, providing a good information security design mechanism. In addition, the enterprise should also strengthen the management and control of the use of networked equipment by personnel, and improve the supporting measures on the technical and management aspects, so as to effectively reduce the industrial safety accidents caused by the information security threat of the Industrial Internet of Things. Therefore, the present invention should for the best solution.

The authentication and authorization plug-in system of the present invention is arranged between a first device capable of transmitting packets and a second device, and a packet transfer device is further provided between the first device and the second device, wherein the first device and the second device All devices can transmit a packet of information toward the packet forwarding device, wherein the authentication and authorization plug-in system includes: a first encryption/decryption device, which is connected to the first device and the packet forwarding device by means of a network connection between, and the first encryption/decryption device stores at least one set of common keys, and the first encryption/decryption device is used to intercept the first device or the packet transmission device. packet information; and a second encryption/decryption device connected between the second device and the packet transfer device in a network connection mode, and the second encryption/decryption device is also connected to the first encryption/decryption device The shared key is shared and stored, and the second encryption/decryption device is used to intercept the packet information sent by the second device or the packet forwarding device; wherein the first encryption/decryption device and the first encryption/decryption device are The second encryption/decryption device can decrypt the intercepted packet information with the shared key. Regardless of whether the decryption is successful or not, hash comparison and timestamp verification will be performed. If the authentication is successful, the decrypted information will be sent out directly. After completion, a set of time stamps are extracted and hashed, and then encrypted with the common key and sent out. If the information received by the first device and the second device cannot be identified and needs to be decrypted with the common key, then It will be judged as an abnormal packet and filtered.

More specifically, the first encryption/decryption device can be connected to or synchronize data processing with the second encryption/decryption device, so that the first encryption/decryption device and the second encryption/decryption device can Get the same shared key.

More specifically, the original information sent by the first device or the second device can be encrypted by AES hardware encryption and decryption, and then converted into SSHV2 packet information for transmission, and the second device or the second device can be encrypted. The decrypted information received by the first device that is successfully authenticated and directly transmitted can be decrypted by AES hardware encryption and decryption, so as to obtain the original information correctly transmitted from the other end.

More specifically, after the decryption is successful, if the decrypted information includes an original information, a hashed information of the original information, and a timestamp, the original information can be hashed, and then combined with the original information. Check whether the hash information is the same, and then verify the timestamp to verify whether the timestamp has expired. If the hash comparison is the same and the timestamp has not expired, it is judged that the authentication is successful, and then the decrypted information can be directly outgoing.

More specifically, the authentication and authorization plug-in system is applied in an open platform communication unified architecture.

More specifically, both the first encryption/decryption device and the second encryption/decryption device include at least one processor and at least one computer-readable recording medium, and the computer-readable recording medium stores the At least one encryption/decryption application program, wherein the computer-readable recording medium further stores computer-readable instructions, which, when executed by the processors, enable the encryption/decryption application program to operate , intercept the packet information sent by the first device or the packet forwarding device, and use the shared key to decrypt and perform hash comparison and timestamp verification. If the authentication is successful, the decrypted information will be transmitted directly. If the verification is not completed, a set of time stamps are extracted and hashed, and then encrypted with the shared key and sent out.

More specifically, the encryption/decryption application program includes at least: a packet interception unit for intercepting the packet information sent by the first device or the packet forwarding device; a common key storage unit for to receive and store the shared key; a decryption unit is connected to the packet interception unit and the shared key storage unit for decrypting the intercepted packet information according to the shared key, regardless of whether the decryption is successful or not , will transmit the decrypted information; a verification and comparison unit is connected to the decryption unit, and is used for hash comparison and timestamp verification of the information decrypted by the decryption unit, which can verify the decrypted information. After hash processing, compare whether the hash results are the same, and also verify the timestamp to verify whether the timestamp has expired. If the hash comparison is the same and the timestamp has not expired, it is judged that the authentication is successful; a packet transmission unit , which is connected with the verification and comparison unit to receive the decrypted information that has completed hash comparison and timestamp verification, and transmits the decrypted information directly; and an encryption unit, which is stored with the shared key The unit, the verification and comparison unit and the packet transmission unit are connected to receive the decrypted information without hash comparison or timestamp verification, take out a set of timestamps and perform hash processing, and then use the shared key It is decrypted, and finally sent out by the packet transmission unit.

Other technical contents, features and effects of the present invention will be clearly presented in the following detailed description of the preferred embodiments with reference to the drawings.

Please refer to Figures 1, 2A, 2B, 3A, and 3B, which are the overall architecture diagram of the authentication and authorization plug-in system, the architecture diagram of the first encryption/decryption device, and the architecture diagram of the encryption/decryption application program of the first encryption/decryption device of the present invention. , the schematic diagram of the architecture of the second encryption/decryption device and the architecture diagram of the encryption/decryption application program of the second encryption/decryption device. As can be seen from the figures, the system is set between the first device 1 and the second device 2 that can transmit packets , and there is a packet transfer device 3 between the first device 1 and the second device 2 , wherein both the first device 1 and the second device 2 can transmit a packet of information toward the packet transfer device 3 .

The first device 1 and the second device 2 can be machine devices or computer devices (computers, smart phones, tablet computers), and the packet forwarding device 3 can be a switch or a router, wherein the first device The encryption/decryption device 4 and the second encryption/decryption device 5 are connected to the packet forwarding device 3 via a network line, and the first device 1 (the second device 2) and the first encryption/decryption device 4 (the second encryption/decryption device 4) The decryption device 5) can also be connected through a network line (the first encryption/decryption device 4 (the second encryption/decryption device 5) will be set adjacent to the first device 1 (the second device 2) to avoid the first encryption/decryption. The device 4 (the second encryption/decryption device 5) is maliciously damaged or cracked).

The authentication and authorization plug-in system includes a first encryption/decryption device 4 and a second encryption/decryption device 5, and the first encryption/decryption device 4 can be connected with the second encryption/decryption device 5 or Synchronizing data processing so that the first encryption/decryption device 4 and the second encryption/decryption device 5 can obtain the same common key;

The first encryption/decryption device 4 is connected between the first device 1 and the packet forwarding device 3 by a network connection, and at least one set of common funds is stored in the first encryption/decryption device 4 key, and the first encryption/decryption device 4 is used to intercept the packet information transmitted by the first device 1 or the packet forwarding device 3;

The second encryption/decryption device 5 is connected between the second device 2 and the packet forwarding device 3 by means of a network connection, and the second encryption/decryption device 5 is also connected to the first encryption/decryption device 4 share and store the shared key, and the second encryption/decryption device 5 is used to intercept the packet information transmitted by the second device 2 or the packet forwarding device 3;

The packet transmission mechanisms in this case are as follows: (1) The first device 1 sends out a normal packet, first enters the first encryption/decryption device 4 to try to decrypt it, and then performs hash comparison and timestamp verification. Since the normal packet does not add timestamp and hash processing, the verification must not be If successful, the timestamp and hash processing are added, and then encrypted with the shared key and sent to the packet forwarding device 3. After that, there are two situations, which are described as follows: (a) When the packet transfer device 3 sends the second encryption/decryption device 5 to the normal packet for adding time stamps and hashing and encrypting it, the second encryption/decryption device 5 will first decrypt it with the shared key, and then encrypt the packet. Hash comparison and timestamp verification are performed, and if the verification is successful, the normal packet is directly sent to the second device 2 from the second encryption/decryption device 5 . (b) When the packet transfer device 3 sends an abnormal packet to the second encryption/decryption device 5, and the second encryption/decryption device 5 attempts to decrypt the abnormal packet, adds a timestamp and hash processing, and then re-encrypts the abnormal packet. It is encrypted with the common key and sent to the second device 2. Since the second device 2 does not have the common key and can decrypt it, it judges that this is an abnormal packet and filters it. (2) The second device 2 sends out a normal packet, first enters the second encryption/decryption device 5 to try to decrypt it, and then performs hash comparison and timestamp verification. Since the normal packet does not add a timestamp and hash processing, the verification must not be If successful, the timestamp and hash processing are added, and then encrypted with the shared key and sent to the packet forwarding device 3. After that, there are two situations, which are described as follows: (a) When the packet transfer device 3 sends the first encryption/decryption device 4 to the normal packet for adding time stamps and hashing and encrypting, the first encryption/decryption device 4 will first decrypt it with the shared key, and then encrypt the packet. Hash comparison and timestamp verification are performed, and if the verification is successful, the normal packet is directly sent into the first device 1 from the first encryption/decryption device 4 . (b) When the packet transfer device 3 sends an abnormal packet to the first encryption/decryption device 4, and the first encryption/decryption device 4 attempts to decrypt the abnormal packet, adds a timestamp and hash processing, and then re-encrypts the abnormal packet. It is encrypted with the common key and sent to the first device 1. Since the first device 1 does not have the common key and can decrypt it, it determines that this is an abnormal packet and filters it.

The original information transmitted by the first device 1 or the second device 2 can be encrypted by AES hardware encryption and decryption (or directly sent without encryption by AES hardware encryption and decryption), and then converted into SSHV2 packets The information is sent out (this case can also be implemented in other packet methods), and the decrypted information directly transmitted by the second device 2 or the first device 1 can be decrypted by AES hardware encryption and decryption. , in order to obtain the original information sent correctly by the other end.

The case has the following implementation applications, which are described as follows: (1) The first operation mode, this plug-in system can be directly used as a router to perform packet forwarding function for industrial machines. (2) The second operation method, this plug-in system can be used for industrial machines, and can be forwarded in sealed packages, and can easily achieve confidentiality in information security. (3) The third operation method, this plug-in system can clarify the responsibility of the machine operator and the authentication mechanism of the source of the machine user for industrial machines. (4) The implementation of this case can put the external hanging system into different machine tool systems (CNC, NC) in the intelligent manufacturing environment, so that the machine can truly carry out lightweight authentication and authorization design in different environments , and can perform packet forwarding, filtering, and encryption for different production machines, so that sensitive information between machines can be authenticated during the retransmission process, and data protection can be easily achieved.

In this case, the Raspberry Pi is used as an example for implementation. The Raspberry Pi itself has router-related applications. Through hostapd, you can easily implement the function of a wireless router, or use OpenWrt to make a Linux version suitable for embedded devices. Filter routing , and can easily filter packets on the Raspberry Pi, and this example is applied to the OPCUA network architecture, configured with a one-to-one encryption/decryptor, and shared with the same group of keys SK (session key), which is used to encrypt the packets sent from both ends by the encryptor and the same set of keys, and when sent to the encryptor/decryptor at the other end, it will be decrypted by the same set of keys, and the timestamp will be verified. , to confirm the integrity and security of the packet.

The Raspberry Pi architecture and the OPCUA (Open Platform Communication Unified Architecture) network architecture mentioned above are only an implementation pattern, but the implementation possibilities of this case are not limited to this.

To further explain the encryption mechanism, where m represents the original information or the information after the AES hardware encryption and decryption method, h(m) represents the hash of m, and t represents the timestamp. In this case, the shared key encryption can be used. There are two styles: (1) Esk[m,h(m),t], first hash m, then add a timestamp, encrypt the whole packet with the shared key, and finally split it into a defined length according to the network protocol and send it out. (2) Esk[m,t,h(m,t)] , first add a timestamp, then hash m and t, encrypt the whole package with the shared key, and finally split it into a defined length according to the network protocol sent later.

To further explain the post-decryption verification mechanism, there are the following two modes: (1) Dsk(Esk[m,h(m),t]), first decrypt with the shared key, then hash m to check whether it is correct with h(m), and then confirm whether the timestamp has Expired, if the comparison is correct and the timestamp has not expired, it is judged that the verification is successful, and then m is split into a defined length according to the network protocol and sent. (2) Dsk(Esk[m,t,h(m,t]), first decrypt with the shared key, then hash m,t to check whether it is correct with h(m,t), and then Confirm whether the timestamp has expired. If the comparison is correct and the timestamp has not expired, it is judged that the verification is successful, and then m is split into a defined length according to the network protocol and sent.

The first encryption/decryption device 4, as shown in FIGS. 2A and 2B, includes at least one processor 41 and at least one computer-readable recording medium 42, and the computer-readable recording medium 42 stores at least one computer-readable recording medium 42. An encryption/decryption application 421, wherein the computer-readable recording medium 42 further stores computer-readable instructions, which, when executed by the processors 41, enable the encryption/decryption application 421 operates, intercepting the packet information sent by the first device 1 or the packet forwarding device 3, and decrypting using the shared key and performing hash comparison and timestamp verification. If the authentication is successful, the decrypted The information is sent out directly. If the verification is not completed, a set of time stamps will be extracted and hashed, and then encrypted with the shared key and sent out;

And the encryption/decryption application 421 contains at least: (1) A packet intercepting unit 4211, used to intercept the packet information transmitted by the first device 1 or the packet forwarding device 3; (2) a common key storage unit 4212 for receiving and storing the common key; (3) A decryption unit 4213, which is connected to the packet interception unit 4211 and the shared key storage unit 4212, and is used to decrypt the intercepted packet information according to the shared key, regardless of whether the decryption is successful or not. transmit the decrypted information; (4) A verification and comparison unit 4214, which is connected to the decryption unit 4213, is used to perform hash comparison and timestamp verification on the information decrypted by the decryption unit 4213, wherein the decrypted information can be hashed, Then compare whether the hash results are the same, and also verify the timestamp to verify whether the timestamp has expired. If the hash comparison is the same and the timestamp has not expired, it is judged that the authentication is successful; (5) a packet transmission unit 4215, connected to the verification and comparison unit 4214, for receiving the decrypted information after hash comparison and timestamp verification, and directly transmitting the decrypted information; and (6) an encryption unit 4216, which is connected with the shared key storage unit 4212, the verification and comparison unit 4214 and the packet transmission unit 4215, for receiving the decrypted information without hash comparison or timestamp verification, A set of time stamps are extracted and hashed, and then decrypted according to the shared key, and finally sent out by the packet transmission unit 4215 .

The second encryption/decryption device 5, as shown in FIGS. 3A and 3B, includes at least one processor 51 and at least one computer-readable recording medium 52, and the computer-readable recording medium 52 stores at least one computer-readable recording medium 52. An encryption/decryption application 521, wherein the computer-readable recording medium 52 further stores computer-readable instructions, which, when executed by the processors 51, enable the encryption/decryption application 521 operates, intercepting the packet information sent by the first device 1 or the packet forwarding device 3, and using the shared key to decrypt and perform hash comparison and timestamp verification. If the authentication is successful, the decrypted The information is sent out directly. If the verification is not completed, a set of time stamps will be extracted and hashed, and then encrypted with the shared key and sent out;

The encryption/decryption application 521 contains at least: (1) A packet intercepting unit 5211, used to intercept the packet information transmitted by the first device 1 or the packet forwarding device 3; (2) a common key storage unit 5212 for receiving and storing the common key; (3) A decryption unit 5213 is connected to the packet interception unit 5211 and the shared key storage unit 5212, and is used to decrypt the intercepted packet information according to the shared key, regardless of whether the decryption is successful or not, all transmit the decrypted information; (4) A verification and comparison unit 5214, which is connected to the decryption unit 5213, is used to perform hash comparison and timestamp verification on the information decrypted by the decryption unit 5213, wherein the decrypted information can be hashed, Then compare whether the hash results are the same, and also verify the timestamp to verify whether the timestamp has expired. If the hash comparison is the same and the timestamp has not expired, it is judged that the authentication is successful; (5) a packet transmission unit 5215, connected to the verification and comparison unit 5214, for receiving the decrypted information after hash comparison and timestamp verification, and directly transmitting the decrypted information; and (6) an encryption unit 5216, which is connected with the shared key storage unit 5212, the verification and comparison unit 5214 and the packet transmission unit 5215, for receiving the decrypted information without hash comparison or timestamp verification, A set of time stamps are extracted and hashed, and then decrypted according to the shared key, and finally sent out by the packet transmission unit 5215 .

When compared with other conventional technologies, the authentication and authorization plug-in system provided by the present invention has the following advantages: (1) In this case, a one-to-one encryption/decryptor is configured in the network architecture, and shared with the same set of keys to pass the packets sent from both ends through the encryption/decryptor and the same set of keys. The key is encrypted, and when sent to the encryption/decryptor at the other end, it will be decrypted by the same set of keys, and the timestamp will be verified to confirm the integrity and security of the packet. (2) In this case, the plug-in is connected to the industrial machine in series, and for different production machines, packet transfer, filtering, and encryption are performed, so that the sensitive information between the machines can be authenticated during the retransmission process, and can be easily done to data protection. (3) This case can be applied to any old machine that can connect to the network line, even if the old machine does not have an encryption mechanism due to the old machine, and the outgoing packets cannot be encrypted, so through the plug-in of this case The system can effectively solve such problems, so that old machines and old systems can also be authenticated, and data protection can be easily achieved. (4) When this case is applied to the OPCUA network architecture, the original machine manufacturer or the agent understands the machine design principle and packet transmission mechanism, so if the encryption is performed through the software mechanism provided by the original machine manufacturer or the agent , it will inevitably be uploaded or cracked by the original machine manufacturer or the agent and the information will be stolen, but if it is through the plug-in mechanism of this system, it will be encrypted by the encryption/decryptor and the same set of keys, and the original machine or The agent does not have the key, so it must not be able to decrypt and further obtain the packet information. (5) The plug-in system in this case, if the packet forwarding device encounters a middle attack, if the packet forwarding device throws out an abnormal packet prepared by a hacker, since the encryption/decryptor in this case receives the packet and decrypts it, Even if the abnormal packet cannot be decrypted, hash comparison and timestamp verification will be performed. Obviously, the abnormal packet cannot be successfully verified. After that, the abnormal packet will be encrypted with a timestamp and hash processing. When a device 1 or the second device 2 is used, the first device 1 or the second device 2 must not be able to understand the transmitted packet information, so the abnormal packet must be excluded.

The present invention has been disclosed above through the above-mentioned embodiments, but it is not intended to limit the present invention. Anyone familiar with this technical field with ordinary knowledge can understand the aforementioned technical features and embodiments of the present invention without departing from the present invention. Within the spirit and scope, some changes and modifications can be made, so the scope of patent protection of the present invention shall be determined by the claims attached to this specification.

1: The first device 2: Second device 3: Packet forwarding equipment 4: The first encryption/decryption device 41: Processor 42: Computer-readable recording medium 421: Encryption and decryption application 4211: Packet interception unit 4212: Shared key storage unit 4213: Decryption unit 4214: Verify Alignment Unit 4215: Packet transfer unit 4216: encryption unit 5: Second encryption/decryption device 51: Processor 52: Computer-readable recording medium 521: Encryption and decryption application 5211: Packet interception unit 5212: Shared key storage unit 5213: Decryption unit 5214: Verify alignment unit 5215: Packet transfer unit 5216: encryption unit

[Fig. 1] is a schematic diagram of the overall structure of the authentication and authorization plug-in system of the present invention. [Fig. 2A] is a schematic diagram of the structure of the first encryption/decryption device of the authentication and authorization plug-in system of the present invention. [Fig. 2B] is a schematic diagram of the structure of the encryption/decryption application program of the first encryption/decryption device of the authentication and authorization plug-in system of the present invention. [Fig. 3A] is a schematic diagram of the structure of the second encryption/decryption device of the authentication and authorization plug-in system of the present invention. [Fig. 3B] is a schematic diagram of the structure of the encryption/decryption application program of the second encryption/decryption device of the authentication and authorization plug-in system of the present invention.

1: The first device

2: Second device

3: Packet forwarding equipment

4: The first encryption/decryption device

5: Second encryption/decryption device

Claims (7)

An authentication and authorization plug-in system is arranged between a first device capable of transmitting packets and a second device, and a packet transfer device is further provided between the first device and the second device, wherein the first device and the second device All can transmit a packet of information towards the packet forwarding device, wherein the authentication and authorization plug-in system includes: a first encryption/decryption device, which is connected to the first device and the packet forwarding device through a network connection. while the first encryption/decryption device stores at least one set of common keys, and the first encryption/decryption device is used to intercept the packets sent by the first device or the packet forwarding device information; and a second encryption/decryption device connected between the second device and the packet forwarding device in a network connection mode, and the second encryption/decryption device is also shared with the first encryption/decryption device and stores the shared key, and the second encryption/decryption device is used to intercept the packet information sent by the second device or the packet forwarding device; wherein the first encryption/decryption device and the second The encryption/decryption device can decrypt the intercepted packet information with the shared key. Regardless of whether the decryption is successful, hash comparison and timestamp verification will be performed. If the authentication is successful, the decrypted information will be directly transmitted. If the verification is not completed Then a set of timestamps are extracted and hashed, and then encrypted with the shared key and sent out. If the information received by the first device and the second device cannot be identified and needs to be decrypted with the shared key, the It is judged as an abnormal packet and filtered. The authentication and authorization plug-in system as claimed in claim 1, wherein the first encryption/decryption device is capable of connecting or synchronizing data processing with the second encryption/decryption device, so that the first encryption/decryption device can communicate with the second encryption/decryption device. The second encryption/decryption device can obtain the same common key. The authentication and authorization plug-in system according to claim 1, wherein the original information transmitted by the first device or the second device can be encrypted by AES hardware encryption and decryption, and then converted into The packet information of SSHV2 is sent out, and the decrypted information directly transmitted by the second device or the first device can be decrypted by the AES hardware encryption and decryption method to obtain the correct outgoing information from the other end. original information. According to the authentication and authorization plug-in system described in claim 1, after the decryption is successful, if the decrypted information contains an original information, a hash information of the original information, and a time stamp, the original information can be hashed. , and then compare it with the hash information of the original information to see if it is the same, and then verify the timestamp to verify whether the timestamp has expired. Send the decrypted information directly. The authentication and authorization plug-in system as described in claim 1 is applied in an open platform communication unified architecture. The authentication and authorization plug-in system according to claim 1, wherein both the first encryption/decryption device and the second encryption/decryption device include at least one processor and at least one computer-readable recording medium, and the computer The readable recording medium stores at least one encryption/decryption application program, wherein the computer readable recording medium further stores computer readable instructions, which, when executed by the processors, can make the computer readable instructions. The encryption and decryption application program operates, intercepts the packet information sent by the first device or the packet forwarding device, decrypts using the shared key, performs hash comparison and timestamp verification, and decrypts if the authentication is successful. After the information is sent out directly, if the verification is not completed, a set of time stamps are extracted and hashed, and then encrypted with the shared key and sent out. The authentication and authorization plug-in system according to claim 6, wherein the encryption and decryption application program comprises at least: a packet intercepting unit for intercepting the packet information sent by the first device or the packet forwarding device; a common key storage unit for receiving and storing the common key; a decryption unit connected to the packet intercepting unit and the common key storage unit for intercepting packet information according to the common key pair Decryption is performed, and the decrypted information will be sent out regardless of whether the decryption is successful or not; a verification and comparison unit is connected to the decryption unit for hash comparison and timestamp verification of the information decrypted by the decryption unit , which can hash the decrypted information, and then compare whether the hash results are the same, and also verify the timestamp to verify whether the timestamp has expired. If the hash comparison is the same and the timestamp has not expired, then judge Indicates that the authentication is successful; a packet transmission unit is connected to the verification and comparison unit for receiving the decrypted information that has completed hash comparison and timestamp verification, and directly transmits the decrypted information; and an encryption unit , which is connected with the shared key storage unit, the verification and comparison unit and the packet transmission unit to receive the decrypted information without hash comparison or timestamp verification, and extract a set of timestamps and perform hash processing. Afterwards, it is decrypted according to the shared key, and finally sent out by the packet transmission unit.

Images