Method and device for secure communication

A secure communication method comprising obtaining a secret code generated in response to a first communication device being paired with a second communication device, obtaining a prestored product key, generating a module key based on the secret code and the product key, randomly generating a session key, obtaining a key sequence number, auto-incrementing the key sequence number, setting a sending sequence number with an initial value of zero, generating a key frame by performing a computation on the session key and a verification authentication code of the session key using the module key, sending a data packet including the key frame, the key sequence number, the sending sequence number, and a data type to the second communication device. The data type indicates that the data packet is a key data packet.

TECHNICAL FIELD

The present disclosure relates to secure authentication and secure communication technology for wireless communication and, more particularly, to a secure communication system and method for preventing replay attacks.

BACKGROUND

In secure communications, there are generally the following basic requirements.

1. Confidentiality: To ensure that communication data can only be interpreted by two communication devices.

2. Authentication: To ensure that the communication data is sent out by an authenticated party.

3. Preventing replay/playback attacks: To prevent attackers from recording previously sent data to fool a receiver. An attacker uses previous data or current data running in the system to deceive the receiver. Therefore, these two types of attacks need to be prevented during the system design.

Wireless communication systems are vulnerable to man-in-the-middle attacks (MITMs). For example, instructions are injected into the wireless system to control and hijack the receiver, wireless system data is modified to deceive the receiver, and the receiver is hijacked by the replay attacks, thereby (1) capturing an object being attacked to cause property loss of system owners; (2) manipulating the hijacked object to complete some malicious attacks to cause the loss of life and property of others.

Currently, the wireless communication systems are prone to be attacked due to lack of data protection and effective authentication of both communication devices. Even if the encryption and authentication are added in the system, the system is hijacked due to lack of effective prevention of replay attacks.

In one-way communication systems, the above problems are particularly prominent. In two-way communication systems, the above problems also exist.

SUMMARY

In accordance with the disclosure, there is provided a secure communication method. A secret code generated in response to a first communication device being paired with a second communication device and a prestored product key are obtained. A module key is generated based on the secret code and the product key. A session key is randomly generated. A key sequence number is obtained and auto-incremented. A sending sequence number with an initial value of zero is set. A key frame is generated by performing a computation on the session key and a verification authentication code of the session key using the module key. A data packet including the key frame, the key sequence number, the sending sequence number, and a data type is sent to the second communication device. The data type indicates that the first data packet is a key data packet.

Also in accordance with the disclosure, there is provided a secure communication method. A sending sequence number is obtained by a first communication device. The sending sequence number is auto-incremented. Instruction data to be sent is obtained. An instruction data frame is generated by encrypting the instruction data and a verification authentication code of the instruction data using a session key that is randomly generated. A data packet including the instruction data frame, the sending sequence number, and a data type is sent to a second communication device. The data type indicates that the data packet is an instruction data packet.

Also in accordance with the disclosure, there is provided a communication device including an authentication sending circuit configured to encrypt a randomly generated session key using a module key to generate an encrypted session key, and send the encrypted session key to another communication device.

DESCRIPTION OF MAIN COMPONENTS AND REFERENCE NUMERALS

DETAILED DESCRIPTION OF THE EMBODIMENTS

Exemplary embodiments will be described with reference to the accompanying drawings.

FIG. 1is a schematic diagram of a hardware architecture of a secure communication system1000consistent with the disclosure.

As shown inFIG. 1, the secure communication system1000includes communication apparatuses that communicate via a wireless network, such as a first communication device1and a second communication device2. The first communication device1and the second communication device2can be a message sender and a message receiver, respectively, of a one-way communication system, or a master and a slave, respectively, of an asymmetric two-way communication system. For example, the first communication device1can be a flight controller, such as a remote controller, or the like, and the second communication device2can be an unmanned aerial vehicle (UAV), or a camera, a gimbal, or the like, provided on the UAV.

In some embodiments, each of the first communication device1and the second communication device2can be both a message sender and a message receiver. For example, the first communication device1and the second communication device2can be two UAVs, two cameras of the UAV, or the like.

The first communication device1includes one or more secure storages10and one or more volatile memories11. The one or more secure storages10can include a read-only memory (ROM) of the first communication device1or another type of non-volatile memory, such as an erasable programmable read only memory (EPROM), a Flash Memory, a floppy disk, a hard disk, a magnetic disk, a compact disc, a SmartMedia Card (SM) card, a CompactFlash (CF) card, an eXtreme Digital (XD) card, a Secure Digital (SD) card, a MultiMediaCard (MMC), a SONY memory stick, an embedded MultiMediaCard (eMMC), a NAND, or the like. The one or more volatile memories11can include a Random-Access Memory (RAM) including a static RAM (SRAM), a dynamic RAM (DRAM), or the like.

In some embodiments, when the first communication device1is in production, a product key100can be assigned, which can be burned or cured in the one or more secure storages10of the first communication device1, such as the ROM.

Similarly, the second communication device2also includes one or more secure storages20and one or more volatile memories21. Accordingly, a product key200is also stored in the one or more secure storages20of the second communication device2. The product key200is the same as the product key100.

Furthermore, the first communication device1also includes an authentication sending circuit12and an instruction sending circuit13.

The authentication sending circuit12can be configured to send a multi-layered encrypted key data packet to the second communication device2to perform security authentication between the first communication device1and the second communication device2. The instruction sending circuit13can be configured to send a multi-layered encrypted instruction data packet to the second communication device2, so as to send the instruction data to the second communication device2.

The authentication sending circuit12and the instruction sending circuit13can prevent replay attacks during communication. Details will be described below with reference toFIG. 2.

Furthermore, the second communication device2also includes an authentication receiving circuit22and an instruction execution circuit23.

The authentication receiving circuit22can be configured to receive the key data packet sent by the first communication device1and authenticate the first communication device1. The instruction execution circuit23can be configured to receive the instruction data packet sent by the first communication device1to execute an instruction sent by the first communication device1.

FIG. 2is a flowchart of a data processing method of a sender of a one-way communication system consistent with a secure communication method of the disclosure.

In some embodiments, the sender can be the first communication device1. According to different needs, the execution sequence of the processes in the data processing method shown inFIG. 2can be changed, and some processes can be omitted. It is not intended to limit the processes and sequence to those shown inFIG. 2.

At S10, when the first communication device1is booted or is powered up and restarted, the authentication sending circuit12of the first communication device1obtains a secret code101that is generated and written to the one or more secure storages10when the first communication device1is paired with the second communication device2, and a prestored product key100from the one or more secure storages10.

In some embodiments, the pairing process between the first communication device1and the second communication device2can be generally performed in a safe environment to ensure the security of the secret code101. The pairing process can be a frequency matching process between the UAV and the remote controller.

At S11, the authentication sending circuit12obtains a module key110based on the secret code101and the product key100.

In some embodiments, the authentication sending circuit12can perform, for example, a derivation algorithm, on the secret code101and the product key100to generate the module key110. The derivation algorithm can include an encryption, a hashing, a Message Authentication Code (MAC), or any combination thereof. In some embodiments, the module key110can be generated only once at power-up. Therefore, the authentication sending circuit12can store the module key110in the one or more volatile memories11to improve security.

At S12, the authentication sending circuit12randomly generates a session key111. The session key111can be dynamically generated by using a random number generator or another method of generating a random number. The session key111can also be generated only once at power-up. Therefore, the authentication sending circuit12can store the session key111in the one or more volatile memories11.

At S13, the authentication sending circuit12obtains a key sequence number N102from the one or more secure storages10, auto-increments the key sequence number N102, and sets a sending sequence number Q112with an initial value of zero.

In some embodiments, an initial value of the key sequence number N102can be set to zero or another value, and can be auto-incremented each time the session key111is generated, for example, incremented by one. Therefore, the authentication sending circuit12can store the key sequence number N102in the one or more secure storages10, such that the key sequence number N102can be retrieved after a power failure. When the session key111is changed, the sending sequence number Q112can be reset to zero. When the session key111is not changed, the sending sequence number Q112can be monotonically increased. Therefore, the authentication sending circuit12can store the sending sequence number Q112in the one or more volatile memories11. The method of increasing the sending sequence number Q112can include that a value of Q is incremented by one each time a message is sent to the second communication device2or the value of Q is incremented by one every period of time, such as every 50 milliseconds or every 1 second. In some embodiments, the key sequence number N102can also be stored in the one or more volatile memories11, such that the authentication sending circuit12can obtain the key sequence number N102from the one or more volatile memories11.

At S14, the authentication sending circuit12generates a verification authentication code for the session key111, the key sequence number N102, the sending sequence number Q112, and a data type using a verification method. The verification method can include a message digest algorithm, such as various hashes, including the message digest 5 (MD5), the Secure Hash Algorithm (SHA), or the like, a check code, such as a cyclic redundancy check (CRC) or the like, or a message authentication code. The data type can be a character representing a type of authentication data.

At S15, the authentication sending circuit12computes the session key111and the verification authentication code of the session key111using the module key110to generate a key frame.

In some embodiments, the computation can include: (1) computing the verification code (or a digest) of an original message and encrypting the session key111and the verification code (or the digest) by using the module key110, (2) computing the MAC of the original message and encrypting the session key111by using the module key110.

At S16, the authentication sending circuit12sends the key frame, the key sequence number N102, the sending sequence number Q112, and the data type to the second communication device2.

In some embodiments, for the one-way communication system, the authentication sending circuit12can send the key frame, the key sequence number N102, the sending sequence number Q112and the data type to the second communication device2once every period of time, for example, every 1 second, to ensure that the second communication device2can receive the key frame.

At S17, the authentication sending circuit12writes the auto-incremented key sequence number N102into the one or more secure storages10and writes the sending sequence number Q112into the one or more volatile memories11.

In some embodiments, the sending sequence number Q112can be written into the volatile storage, which can ensure timely erasing the sending sequence number Q112and the security of information. If the sending sequence number Q112is stored in the one or more secure storage10, encryption or another mean may be needed to ensure adequate security of information.

At S18, the authentication sending circuit12determines whether the first communication device1is repowered up. If the first communication device1is repowered up, the above processes at S10to S17are repeatedly performed. If the first communication device1is not repowered up, the process at S19described below will be executed.

At S19, the instruction sending circuit13of the first communication device1obtains the sending sequence number Q112from the one or more volatile memories11and auto-increments the sequence number Q112.

In some embodiments, the method of increasing the sending sequence number Q112can include that the value of Q is incremented by one each time a message is sent to the second communication device2or the value of Q is incremented by one every period of time, such as every 50 milliseconds or every 1 second.

At S20, the instruction sending circuit13obtains instruction data to be sent, and generates a verification authentication code for the instruction data, the sending sequence number Q112, and a data type. The instruction data can include, for example, controlling a rotation direction, a rotation angle, or the like, of a camera of the UAV. The verification method can include the message digest algorithm, such as various hashes including the MD5, the SHA, or the like, a check code, such as CRC or the like, or a message authentication code. The data type can be a character representing a type of authentication data.

At S21, the instruction sending circuit13computes the instruction data and the verification authentication code of the instruction data using the session key111stored in the one or more volatile memories11to generate an instruction data frame. The computation can include an encryption algorithm, a message authentication code, or the like.

At S22, the instruction sending circuit13sends the instruction data frame, the sending sequence number Q112, and the data type to the second communication device2.

At S23, the instruction sending circuit13writes the sending sequence number Q112to the one or more volatile memories11.

In some embodiments, the product key110, the session key111, the key sequence number N102and the sending sequence number Q112can also be stored in the secure storage of the remote controller or the UAV.

In some embodiments, circuits performing the above-described processes can be combined or split, as long as the key exchange and the communication function can be realized.

FIG. 3is a flowchart of a data processing method of a receiver of the one-way communication system consistent with the secure communication method of the disclosure.

In some embodiments, the receiver can be the second communication device2. According to different needs, the execution sequence of the processes in the data processing method shown inFIG. 3can be changed, and some processes can be omitted. It is not intended to limit the processes and sequence to those shown inFIG. 3.

At S30, the second communication device2receives the data packet sent by the first communication device1.

At S31, the second communication device2determines whether the data packet is the key data packet.

In some embodiments, the authentication receiving circuit22determines whether the data packet is the key data packet according to the data type included in the data packet. If the data packet is the key data packet, the processes at S32to S40described below will be executed. If the data packet is determined to be the instruction data packet according to the data type included in the data packet, the processes at S42to S46described below will be executed.

At S32, the authentication receiving circuit22of the second communication device2obtains a key sequence number n202from the one or more secure storages20of the second communication device2.

At S33, the authentication receiving circuit22obtains the key sequence number N102included in the received data packet and determines whether N<=n. If N<=n, it indicates that the data packet may be the same as a data packet previously sent by the first communication device1or the packet may be sent by the attacker through the replay attack. The process at S34will be executed. At S34, the authentication receiving circuit22discards the data packet. Otherwise, if N>n, the process at S35described below will be executed.

In some embodiments, because the key sequence number N102can be generated each time the session key111is generated, the key sequence number N102can remain unchanged in a same session. Therefore, if N<=n, it indicates that the attacker may have used data running in a previous session to perform the replay attack. As such, the replay attack by the attacker using the data of the previous session can be prevented by comparing the key sequence number N102with the key sequence number n202.

At S35, the authentication receiving circuit22obtains a secret code201that is generated and written into the one or more secure storages20when the second communication device2is paired with the first communication device1. The secret code201is the same as the secret code101of the first communication device1described above.

At S36, the authentication receiving circuit22obtains a prestored product key200from the one or more secure storages20. The product key200is the same as the product key100of the first communication device1described above.

At S37, the authentication receiving circuit22generates a module key210based on the secret code201and the product key200.

In some embodiments, the authentication receiving circuit22can perform, for example, a derivation algorithm, on the secret code201and the product key200to generate the module key210. The derivation algorithm can include an encryption or a MAC. The authentication receiving circuit22can store the module key210in the one or more volatile memories21.

At S38, the authentication receiving circuit22decrypts the key frame in the data packet using the module key210to obtain the session key111and the verification authentication code including in the data packet.

At S39, the authentication receiving circuit22verifies whether the session key111is correct by using the verification authentication code. If the session key111is not correct, the above process at S34will be executed and the data packet will be discarded. Otherwise, if the session key111is correct, the process at S40described below is executed.

At S40, the authentication receiving circuit22stores the session key111and the sending sequence number Q112included in the data packet in the one or more volatile memories21, sets a sending sequence number q=Q, stores the key sequence number N102including in the storing data packet in the one or more security storages20, and sets the key sequence number n=N. As such, the second communication device2obtains the session key111sent by the first communication device1and completes the key exchange process.

In some embodiments, the process of determining the data type of the data packet at S31can be omitted. At power-up or reboot, the key data packet can be sent after the session key is generated. After receiving the key data packet, if the receiver succeeds in receiving the key data packet, the receiver returns success information, and if unsuccessful, the sender may need to resend the data packet until the receiver succeeds. All of follow-up data packets may be considered to be the instruction data packets.

If the received data packet is the instruction data packet, the process at S41described below will be executed.

At S41, the instruction execution circuit23of the second communication device2obtains the sending sequence number q212from the one or more volatile memories21.

At S42, the instruction execution circuit23obtains the sending sequence number Q112in the received data packet and determines whether Q<=q. If Q<=q, it indicates that the data packet may be the same as a data packet previously sent by the first communication device1or the packet may be sent by the attacker through the replay attack. The process at S34will be executed and the instruction execution circuit22will discard the data packet. Otherwise, if Q>q, the process at S43described below will be executed.

At S43, the instruction execution circuit23obtains the stored session key211from the one or more volatile memories21.

At S44, the instruction execution circuit23decrypts the instruction data frame in the data packet using the session key211to obtain the instruction data and the verification authentication code.

At S45, the instruction execution circuit23verifies whether the instruction data is correct using the verification authentication code. If the instruction data is incorrect, the above process at S34will be executed and the instruction execution circuit23will discard the data packet. If the instruction data is correct, the process at S46described below will be executed.

At S46, the instruction executing circuit23stores the sending sequence number Q112in the one or more volatile memories21, sets the sending sequence number q=Q, and executes the instruction, for example, controlling the rotation direction, the rotation angle, or the like, of the camera of the UAV.

When the processes shown inFIG. 3are being executed, if an abnormality occurs on the second communication device2, for example, restart after a power failure, a key re-exchange with the first communication device1may be needed. The implementation method for the key re-exchange can include that the first communication device1can be also repowered up or, in a case of two-way communication, the second communication device2can actively request the first communication device1to perform the key re-exchange.

In some embodiments, if there is a power failure or restart abnormality of the second communication device2, one of two solutions can be selected. The first communication device can be restarted, such that the first communication device1and the second communication device2can resume the key exchange. If there is a return link from the second communication device2to the first communication device1, then after restarting, the second communication device2can send a request to request the first communication device1to resend the session key or the key data packet.

FIG. 4is a schematic diagram of a data stream transmission process of the one-way communication system consistent with the secure communication method of the disclosure.

When the first communication device1is booted or is powered up and restarted, the module key110is generated according to the prestored product key100and the secret code101that is generated during the pairing process, and the key sequence number N102is obtained from the one or more secure storages10. During the process of key exchange with the second communication device2, the first communication device1auto-increments the obtained key sequence number N102. For example, the key sequence number N102is increased by one every time data is sent, the auto-incremented key sequence number N102is written to the one or more secure storages10, and the original value of N is replaced by the auto-incremented value of N. At the same time, the first communication device1randomly generates the session key111and sets the sending sequence number Q112with an initial value of zero. Furthermore, the first communication device1uses the module key110to encrypt or perform another computation on the session key111and the verification authentication code of the session key111to generate a key frame, generates the key data packet including the key frame, the key sequence number N102, and the sending sequence number Q112, and periodically sends the key data packet to the second communication device2.

When the second communication device2is booted or is powered up and restarted, the module key210is generated according to the prestored product key200and the secret code201that is generated during the pairing process, and the key sequence number n202is obtained from the one or more secure storages20. Upon receipt of the key data packet sent by the first communication device1, the second communication device2determines whether N<=n. If N<=n, the packet is discarded. If N>n, the session key is decrypted and verified. The session key111and the sending sequence number Q112are stored in the one or more volatile memories21of the second communication device2, and sets q=Q. The key sequence number N102is stored in the one or more secure storages20of the second communication device2, such as the non-volatile memory, and sets n=N, thereby completing the key exchange process.

After the authentication, if the first communication device1and the second communication device2are not powered up and restarted, a sending process of the instruction data can be executed. The first communication device1obtains the sending sequence number Q112and auto-increments the sequence number Q112, for example, increments the value of Q by one each time a message is sent or increments the value of Q by one every period of time. The first communication device1also uses the session key111to encrypt or perform another computation on the instruction data to be sent and the verification authentication code of the instruction data to generate the instruction data frame, generates the instruction data packet including the instruction data frame and the sending sequence number Q112, and periodically sends the instruction data packet to the second communication device2.

After receiving the instruction data packet, the second communication device2obtains the receiving sequence number q212from the one or more volatile memories21and determines whether Q<=q. If Q<=q, the instruction data packet is discarded. Otherwise, if Q>q, the instruction data is decrypted and verified, the sending sequence number Q112is stored in the one or more volatile memories21, q=Q is set, and the instruction data is executed.

The key data packet includes the data type, the key sequence number N, the sending sequence number Q, the session key, and the verification authentication code. The session key and verification authentication code are encrypted using the module key, and the MAC code itself is not encrypted. Similarly, the instruction data packet includes the data type, the sequence number Q, the instruction data, and the verification authentication code. The instruction data and the verification authentication code are encrypted using the session key.

In some embodiments, the product key can be prestored in the one or more secure storages of the first communication device and the second communication device, such as a ROM, to prevent the attacker from reading the product key. The pairing of the first communication device and the second communication device can generally take place in a safe environment to ensure the security of the secret code. Therefore, the confidentiality and security of the module key that is generated based on the product key and the secret code can be guaranteed. When the second communication device receives the data packet sent by the first communication device, and if N<=n and/or Q<=q, it indicates that the data packet may be repeatedly sent by the first communication device or sent by the attacker through the replay attack, such that the packet is discarded. When N>n and Q>q, the data packet can be processed, thereby ensuring the prevention of replay attacks during data transmission.

The key sequence number can be auto-incremented once each time the first communication device is powered up to regenerate the session key. Therefore, in order to ensure security, the key sequence number can be stored in the one or more non-volatile memories of the first communication device and the second communication device. The sending sequence number can be cleared when the session key is newly generated. Therefore, the sending sequence number can be stored in the one or more volatile memories of the first communication device and the second communication device.

In some embodiments, the key data packet can also include the data type, the key sequence number N, the sending sequence number Q, the session key, and the MAC code. In such a situation, the module key can be used to encrypt or preform a MAC computation on the session key, and the MAC code itself can be not encrypted. Similarly, the instruction data packet can include the data type, the sequence number Q, the instruction data, and the MAC code, and the session key can be used to encrypt or preform a MAC computation on the instruction data.

In the above embodiments, the authentication and instruction transmission systems in the one-way communication system are described. That is, the first communication device is the message sender and the second communication device is the message receiver. It can be appreciated by those skilled in the art that the technical solutions described in the above embodiments are also applicable to an asymmetric two-way communication system. For example, the first communication device can be the master and the second communication device can be the slave. In the asymmetric two-way communication system, the reliability of a communication from the master to the slave needs to be relatively high, while the reliability of a communication from the slave to the master can be relatively low. The communication processes described above with reference toFIGS. 2-4can be referred to for, the communication from the master to the slave in the asymmetrical two-way communication system. The communication from the slave to the master is described below with reference toFIG. 5andFIG. 6.

FIG. 5is a flowchart of a method for sending feedback data from a slave to a master of an asymmetric two-way communication system consistent with the secure communication method of the disclosure.

In some embodiments, the slave can be the second communication device2. According to different needs, the execution sequence of the processes in the data processing method shown inFIG. 5can be changed, and some processes can be omitted. It is not intended to limit the processes and sequence to those shown inFIG. 5.

At S50, the feedback data sending circuit24of the second communication device2obtains the stored session key211from the one or more volatile memories21. The session key211can be received from the first communication device1using the method shown inFIG. 2.

At S51, the feedback data sending circuit24obtains a sending sequence number M from the one or more volatile memories21, and auto-increments the sending sequence number M. The auto-incrementing method can be that the sending sequence number M is incremented by one every time data is sent, or increased by one every preset time period, such as every 50 millisecond or every 1 second.

At S52, the feedback data sending circuit24obtains feedback data to be sent, generates a verification authentication code for the feedback data and the sending sequence number M using a verification method. The verification method can include a message digest algorithm, such as various hashes, including the MD5, the SHA, or the like, a check code, such as CRC or the like, or a message authentication code.

At S53, the feedback data sending circuit24uses the session key212to encrypt or perform another computation on the feedback data and the verification authentication code of the feedback data to generate a feedback data frame.

At S54, the feedback data sending circuit24sends the feedback data frame and the sending sequence number M to the first communication device1.

FIG. 6is a flowchart of a method for receiving feedback data by the master from the slave of the asymmetric two-way communication system consistent with the secure communication method of the disclosure.

In some embodiments, the master can be the first communication device1. According to different needs, the execution sequence of the processes in the data processing method shown inFIG. 6can be changed, and some processes can be omitted. It is not intended to limit the processes and sequence to those shown inFIG. 6.

At S60, the feedback data receiving circuit14of the first communication device1receives the data packet sent by the second communication device2.

At S61, the feedback data receiving circuit14obtains a sending sequence number m from the one or more volatile memories11.

At S62, the feedback data receiving circuit14obtains the sending sequence number M in the data packet and determines whether M<=m.

If M<=m, at S63, the feedback data receiving circuit14discards the data packet.

If M>m, at S64, the feedback data receiving circuit14decrypts the feedback data frame using the session key111to obtain the feedback data and the verification authentication code.

At S65, the feedback data receiving circuit14uses the verification authentication code to determine whether the feedback data is accurate. If the feedback data is not accurate, the above process at S63is performed, at which the feedback data receiving circuit14discards the data packet.

If the feedback data is accurate, at S66, the feedback data receiving circuit14receives the feedback data and stores the sending sequence number M in the one or more volatile memories21, and sets the sending sequence number as m=M.

It is intended that the specification and examples be considered as exemplary only and not to limit the scope of the disclosure. Those skilled in the art will be appreciated that any modification or equivalents to the disclosed embodiments are intended to be encompassed within the scope of the present disclosure.