DPU-based multi-user key management method, network data transmission method and device

Abstract

The invention provides a multi-user key management method and a network data transmission method and device based on a DPU (Data Processing Unit), a hardware trust root is configured based on the DPU, a storage root key is generated, a multi-layer key management architecture of the root key, a user master key and a working key is adopted, secure storage and hierarchical calling of keys are realized, and the security of the keys is improved. The encryption and decryption operation follows a strict key hierarchy process; a unique identifier is allocated to each user, a logic partition is divided for each user in a storage medium, and an access control strategy is set, so that physical and logic isolation of a key of each user is realized, and independence and security of user data are ensured. Furthermore, in combination with the LSTM network, the key use mode is analyzed, the optimal key rotation time is predicted, the updating period is automatically adjusted, and the intelligence and automation level of key management is improved.

Description

Technical Field

[0001] The present invention relates to the field of data communication technology, and in particular to a DPU-based multi-user key management method, a network data transmission method and a device. Background Art

[0002] In the modern information technology environment, data security and privacy protection have become critical issues. With the explosive growth of data volume and the increasing sophistication of network attacks, traditional key management systems face many challenges. Especially in a multi-user environment, how to ensure the data isolation and key security of each user has become an urgent problem to be solved.

[0003] Traditional key management systems usually rely on software implementation, which has the following limitations: 1) Insufficient security. Key management at the software level is vulnerable to attacks from malware and system vulnerabilities, and the security of keys is difficult to guarantee. 2) Inefficiency. In large-scale multi-user environments, the performance bottleneck of software key management systems is obvious, and it is difficult to meet the needs of efficient data encryption and decryption. 3) Imperfect key isolation. In traditional systems, the key storage and management of multiple users often do not have strict physical isolation, which can easily lead to key leakage and data confusion.

[0004] Therefore, there is an urgent need for a key management and data transmission solution for multiple users. Summary of the invention

[0005] In view of this, the embodiments of the present invention provide a multi-user key management method, a network data transmission method and a device based on DPU to eliminate or improve one or more defects existing in the prior art, and solve the problem that the prior art is prone to leakage and insufficient security due to imperfect key isolation in the process of large-scale user key management.

[0006] One aspect of the present invention provides a multi-user key management method based on a data processing unit, the method is executed on the data processing unit, the data processing unit is provided with a hardware trust root and a storage medium, the method comprises the following steps:

[0007] Initialize the hardware root of trust, generate and store at least one root key in the hardware root of trust; receive registration requests from multiple users, generate a unique user identifier and a user master key for each user, the user master key is encrypted using the specified root key; generate a corresponding working key for each user, the working key is encrypted using the corresponding user master key;

[0008] Divide an independent logical partition for each user on the storage medium for storing the user master key and the working key, and call each logical partition according to a preset access control policy to extract the multi-layer encrypted working key for data transmission;

[0009] Update and transform the root key, the user master key and the working key according to a set time interval or according to a set trigger event;

[0010] And / or, taking the key usage data of the current time period as input, predicting the key usage data of the future target time period based on the pre-trained long short-term memory network, analyzing the key usage data of the future target time period to identify the peak and trough periods of user use of each key, and dynamically adjusting the key rotation period and rotation frequency according to preset rules.

[0011] In some embodiments, dividing an independent logical partition for each user on the storage medium includes:

[0012] For the preset storage medium, the parted disk partition tool is used to divide the logical partitions, and the partitions are formatted using the ext4, NTFS or FAT32 file management system;

[0013] Create a mount point for each user and mount the corresponding logical partition to the mount point; set access permissions to ensure that each logical partition can only be accessed by the corresponding user;

[0014] Regularly and automatically monitor the usage and health status of partitions and generate logs.

[0015] In some embodiments, the root key, the user master key and the working key are updated and transformed according to a set time interval or according to a set trigger event, and the set time interval is based on industry standard specifications or according to user customized settings; the set trigger event includes a security vulnerability discovery event, a user authority change event and / or a user abnormal risk operation activity event.

[0016] In some embodiments, the step of training the long short-term memory network includes:

[0017] Obtaining historical data related to key usage, including the time, number of times, frequency, number of successful uses, and number of failed uses of each key, marking security events, and reading various events in the system log; the historical data is recorded in a time series format;

[0018] The time window length is defined according to the key call frequency in the usage scenario, and the input data and target data are extracted by sliding in the historical data using the time window length; the target data is the next moment data corresponding to the input data;

[0019] An initial neural network model is obtained, wherein the initial neural network model includes multiple LSTM layers and fully connected layers; the initial neural network model inputs the input data and fits and outputs the predicted value of the target data; a loss function is calculated according to the predicted value and the true value of the target data, and the loss function is used to update the initial neural network model to obtain the long short-term memory network.

[0020] In some embodiments, the loss function is mean square error or root mean square error.

[0021] In some embodiments, analyzing the key usage data of the future target period to identify the peak and trough periods of user usage of each key, and dynamically adjusting the key rotation period and rotation frequency according to preset rules, includes:

[0022] Analyze the key usage data in the future target period, and count the number of times each key is used, the frequency of use, the number of successful uses, and the number of failed uses;

[0023] For each key, a peak period and a valley period are defined based on a combination of parameters including the number of uses, the frequency of use, the number of successful uses, and the number of failed uses;

[0024] When it is identified that the future target time period is a peak period, the rotation frequency of each key is increased according to a first set ratio before the future target time period; when it is identified that the future target time period is a trough period, the rotation frequency of each key is reduced according to a second set ratio before the future target time period.

[0025] In some embodiments, the method further includes: during a key update or rotation process, using a dual key mechanism to achieve smooth key conversion.

[0026] On the other hand, the present invention also provides a network data transmission method, comprising the following steps:

[0027] Creating a root key, a user master key, and a working key for a sender and a receiver based on the above-mentioned multi-user key management method based on a data processing unit;

[0028] The sender or receiver accesses the corresponding logical partition and uses the root key to decrypt and extract the user master key;

[0029] Decrypt and extract the working key using the user master key;

[0030] The sender uses the corresponding working key to encrypt and transmit the first target data to be sent, and the receiver uses the corresponding working key to decrypt the received second target data.

[0031] On the other hand, the present invention also provides a computer-readable storage medium having a computer program / instruction stored thereon, which implements the steps of the above method when the computer program / instruction is executed by a processor.

[0032] On the other hand, the present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0033] The beneficial effects of the present invention are at least:

[0034] The DPU-based multi-user key management method, network data transmission method and device of the present invention configure the hardware trust root based on the data processing unit DPU and generate the storage root key, adopt the multi-level key management architecture of the root key, the user master key and the working key, realize the secure storage and hierarchical call of the key, and the encryption and decryption operations follow the strict key hierarchy process; assign a unique identifier to each user and divide the logical partition for each user in the storage medium and set the access control policy to realize the physical and logical isolation of each user's key, and ensure the independence and security of user data. Furthermore, the key usage mode is analyzed in combination with the LSTM network, the optimal key rotation time is predicted and the update cycle is automatically adjusted, so as to improve the intelligence and automation level of key management.

[0035] Additional advantages, purposes, and features of the present invention will be described in part in the following description, and will become apparent to those skilled in the art after studying the following, or may be learned from the practice of the present invention. The purposes and other advantages of the present invention may be achieved and obtained by the structures specifically indicated in the specification and the accompanying drawings.

[0036] Those skilled in the art will appreciate that the objectives and advantages that can be achieved with the present invention are not limited to the above specific description, and the above and other objectives that can be achieved by the present invention will be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of the present application, and do not constitute a limitation of the present invention. In the drawings:

[0038] Figure 1 This is a system framework diagram adopted by the multi-user key management method based on the data processing unit described in one embodiment of the present invention.

[0039] Figure 2 The figure is a flowchart of a multi-user key management method based on a data processing unit according to an embodiment of the present invention. Figure 3 This is a flowchart of initializing a system used by a multi-user key management method based on a data processing unit according to an embodiment of the present invention.

[0040] Figure 4 The present invention is a flowchart for implementing user key isolation in a multi-user key management method based on a data processing unit according to an embodiment of the present invention.

[0041] Figure 5 This is a key rotation flow chart of a multi-user key management method based on a data processing unit according to an embodiment of the present invention.

[0042] Figure 6 The present invention is a flowchart of the encryption and decryption operations of the network data transmission method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0044] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, only structures and / or processing steps closely related to the solutions according to the present invention are shown in the accompanying drawings, while other details that are not closely related to the present invention are omitted.

[0045] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0046] In the prior art, multi-user key management systems usually rely on software implementation and are enhanced in combination with certain hardware security modules. For example, some systems use software-based key management servers to generate, store, and distribute keys through cryptographic algorithms. Such systems may use a combination of TPM (Trusted Platform Module) or HSM (Hardware Security Module) to improve the security of key storage and processing. At the same time, in some high-security environments, hardware devices such as smart cards are also used to provide additional security guarantees.

[0047] Although hardware modules such as TPM or HSM are used in the existing technology to enhance the security of key storage and processing, the overall system still relies mainly on software-level implementation. The key management system at the software level is vulnerable to attacks by malware and system vulnerabilities, resulting in the inability to fully guarantee the security of the key. In addition, the security mechanism at the software level shows great limitations in dealing with advanced persistent threats (APTs) and is difficult to effectively defend against complex network attacks.

[0048] The existing multi-user key management system has significant performance bottlenecks when facing large-scale multi-user environments. The key management system implemented by traditional software often fails to meet the performance requirements when handling a large number of concurrent key generation, encryption and decryption operations. At the same time, the key update and rotation process relies on fixed cycles or manual triggers, lacks intelligent and automated support, resulting in low overall system operation efficiency and inability to quickly respond to key security incidents.

[0049] Traditional systems rely on software implementation and are vulnerable to attacks from malware and system vulnerabilities, making it difficult to ensure the security of keys. In addition, traditional systems have obvious performance bottlenecks in large-scale multi-user environments, making it difficult to meet the needs of efficient data encryption and decryption. Especially in a multi-user environment, the key storage and management of multiple users often do not have strict physical isolation, which can easily lead to key leakage and data confusion. To this end, the present invention provides a hardware-level security environment by introducing a hardware root of trust (HRoT) and a data processing unit (DPU), ensuring the security of the key generation, storage, and management process, and significantly improving the performance of the key management system.

[0050] The key update mechanism in traditional systems is often not smart enough and cannot be dynamically adjusted according to actual usage, which easily leads to the complexity of key management and security risks. At the same time, the audit and monitoring mechanism of traditional systems is not comprehensive enough, and it is difficult to detect and respond to abnormal situations in a timely manner. To this end, the present invention combines long short-term memory network (LSTM) technology to analyze key usage patterns, predict the optimal key rotation time, and automatically adjust the update cycle to achieve a smooth transition through a dual-key mechanism. In addition, the system also includes operation log recording and real-time anomaly detection mechanisms to ensure the comprehensive audit and monitoring capabilities of the system, and to be able to detect and respond to potential security threats in a timely manner.

[0051] Specifically, one aspect of the present invention provides a multi-user key management method based on a data processing unit, such as Figure 1 As shown, the method is executed on a data processing unit, and the data processing unit is provided with a hardware trust root and a storage medium, such as Figure 2 As shown, the method includes the following steps S101 to S104:

[0052] Step S101: Initialize the hardware root of trust, generate and store at least one root key in the hardware root of trust; receive registration requests from multiple users, generate a unique user identifier and user master key for each user, and encrypt the user master key with the specified root key; generate a corresponding working key for each user, and encrypt the working key with the corresponding user master key.

[0053] Step S102: Divide an independent logical partition for each user on the storage medium to store the user master key and the working key, and call each logical partition according to the preset access control policy to extract the multi-layer encrypted working key for data transmission.

[0054] Step S103: updating and transforming the root key, the user master key and the working key at a set time interval or according to a set triggering event.

[0055] Step S104: Taking the key usage data of the current time period as input, predict the key usage data of the future target time period based on the pre-trained long short-term memory network, analyze the key usage data of the future target time period to identify the peak and trough periods of user use of each key, and dynamically adjust the key rotation period and rotation frequency according to preset rules.

[0056] In step S101, the hardware root of trust (HRoT) is a secure hardware module (such as TPM, HSM or security chip) responsible for generating and storing encryption keys. In this application, the hardware root of trust is loaded and run based on the data processing unit DPU. The data processing unit (DPU) is a dedicated hardware designed to accelerate data-intensive tasks and complex calculations. The DPU is designed to process and optimize data flows and computing tasks while reducing the burden on the central processing unit (CPU).

[0057] Each user needs to register to use the system, which includes generating a unique user ID and user master key. The user master key is encrypted with the specified root key in the hardware root of trust to ensure its security. Each user can set one or more working keys for different sessions or operations. The working key needs to be encrypted with the corresponding user master key to ensure that only the corresponding user can decrypt and use it.

[0058] In step S102, an independent logical partition is divided for each user on the storage medium, including steps S1021 to S1023:

[0059] Step S1021: for the preset storage medium, the parted disk partition tool is used to divide the logical partition, and the partition is formatted using the ext4, NTFS or FAT32 file management system.

[0060] Step S1022: Create a mount point for each user, and mount the corresponding logical partition to the mount point; set access permissions to ensure that each logical partition can only be accessed by the corresponding user.

[0061] Step S1023: Regularly and automatically monitor the usage and health status of the partitions and generate logs.

[0062] To create an independent logical partition on the storage medium for each user to store the user master key and work key, you first need to select a suitable storage medium, such as a hard disk, solid-state drive (SSD), or network storage (NAS), and determine the partition size based on the number of users and storage requirements. Next, use a partition management tool (such as fdisk or parted under Linux) to create an independent logical partition for each user, and format each partition with an appropriate file system (such as ext4, NTFS, etc.). Then, create independent mount points for each user and mount the corresponding partitions to these mount points. By setting file system permissions, ensure that each user can only access their corresponding partitions. In actual operation, the specific steps include: 1) determine the storage medium and partition scheme; 2) create logical partitions, such as entering the partition tool through fdisk and using the n command to create a new partition, specifying the partition size and type; 3) format the partition, such as using mkfs.ext4 / dev / sda1 to format the partition; 4) mount the partition, create a mount point for each user and use the mount command to mount the partition to the corresponding mount point; 5) set permissions, use commands such as chmod and chown to ensure that each user can only access their own partition. In this way, each user has an independent storage space to safely store their master key and work key, while preventing unauthorized access by other users. This method provides good isolation and security, helping to protect the privacy and integrity of user data.

[0063] In order to ensure the safe use and management of keys, strict access control policies need to be formulated. First, a strong authentication mechanism is adopted to ensure that only authorized users can access the system, and multi-factor authentication (such as smart password key USBKey and password) and security protocols (such as OAuth 2.0) are used to manage session tokens. Secondly, through role definition and permission allocation, a role-based access control (RBAC) mechanism is used to manage user permissions to ensure that only specific roles can access the corresponding key partitions. For each key, specific operation permissions (such as encryption and decryption, signature verification, key acquisition) and access time windows are set to achieve fine-grained permission control. The generation, storage, use and destruction of keys must be performed in a hardware security module (HSM) or a trusted environment to ensure security during the key life cycle. All key operation logs are recorded, stored in a secure location and encrypted for protection, and logs are audited and monitored in real time to identify and respond to security risks. At the same time, fine-grained control policies are configured, such as access time, operation frequency and geographical location restrictions, to further improve security and flexibility. Through these measures, the safe use and management of keys are guaranteed, unauthorized access and abuse are prevented, and the overall security and reliability of the system are ensured.

[0064] In step S103, the root key, the user master key and the working key are updated and transformed according to a set time interval or according to a set trigger event. The set time interval is based on industry standard specifications or according to user customized settings, and can be one week, one month or three months, etc.; the set trigger event can include a security vulnerability discovery event, a user authority change event and / or a user abnormal risk operation activity event.

[0065] In step S104, the time for executing key rotation can be further refined by predicting the key usage data of the future target time period, analyzing and predicting the key usage frequency or the time period with high number of times or handover, and configuring the corresponding key rotation cycle and frequency during the peak or trough period to achieve dynamic adjustment and pre-adjustment.

[0066] Specifically, in the present application, a pre-trained long short-term memory network is used to take the key usage data of the current period as input and predict the key usage data of the future target period, and then an analysis is performed based on the predicted data.

[0067] In some embodiments, the training step of the long short-term memory network includes steps S201 to S203:

[0068] Step S201: Obtain historical data related to key usage, including the usage time, number of times used, frequency of use, number of successful uses and number of failed uses of each key, mark security events and read various events in the system log; historical data is recorded in a time series format.

[0069] Step S202: define the time window length according to the key call frequency in the usage scenario, and use the time window length to slide and extract input data and target data in the historical data; the target data is the next moment data corresponding to the input data.

[0070] Step S203: obtaining an initial neural network model, the initial neural network model including multiple LSTM layers and fully connected layers; inputting input data into the initial neural network model and fitting the predicted value of the output target data; calculating the loss function according to the predicted value and the true value of the target data, and using the loss function to update the initial neural network model to obtain a long short-term memory network.

[0071] In some embodiments, the loss function is mean square error or root mean square error.

[0072] In some embodiments, analyzing the key usage data of the future target period to identify the peak and trough periods of the user's use of each key, and dynamically adjusting the key rotation period and rotation frequency according to the preset rules, including steps S301 to S303:

[0073] Step S301: Analyze the key usage data in the future target period, and count the number of times each key is used, the frequency of use, the number of successful uses, and the number of failed uses.

[0074] Step S302: For each key, a peak period and a valley period are defined based on a combination of parameters including the number of uses, the frequency of use, the number of successful uses, and the number of failed uses.

[0075] Step S303: When the future target period is identified as a peak period, the rotation frequency of each key is increased according to the first set ratio before the future target period; when the future target period is identified as a trough period, the rotation frequency of each key is reduced according to the second set ratio before the future target period.

[0076] In some embodiments, the method further includes: during a key update or rotation process, using a dual key mechanism to achieve smooth key conversion.

[0077] Exemplarily, the operation may be in the form of: generating a new working key (WK2) and keeping the old working key (WK1) valid. At this point, there are two working keys in the system: the old key WK1 and the new key WK2. Modify the encryption policy of the system so that the new data encryption operation is encrypted using the new key WK2, while the old data can still be decrypted using the old key WK1. This can be achieved by introducing key selection logic in the encryption and decryption modules. Start a data re-encryption process in the background to re-encrypt all data encrypted using the old key WK1 to be encrypted using the new key WK2. This can be done gradually to avoid a significant impact on system performance. In this process, a flag or metadata can be set to indicate the key version currently used by the data. During the data re-encryption process, the metadata associated with the data is updated to mark that the data has been encrypted using the new key WK2. This can be achieved by adding a key version number field in the database or storage system. Once all data has been re-encrypted using the new key WK2 and it is confirmed that no data still requires the old key WK1 for decryption, the old key WK1 can be safely deleted.

[0078] On the other hand, the present invention also provides a network data transmission method, referring to Figure 6 , including the following steps S401 to S404:

[0079] Step S401: creating a root key, a user master key and a working key for the sender and the receiver based on the multi-user key management method based on the data processing unit described in the above steps S101 to S104.

[0080] Step S402: The sender or receiver accesses the corresponding logical partition and uses the root key to decrypt and obtain the user master key.

[0081] Step S403: Use the user master key to decrypt and extract the working key.

[0082] Step S404: the sender uses the corresponding working key to encrypt and transmit the first target data to be sent, and the receiver uses the corresponding working key to decrypt the received second target data.

[0083] On the other hand, the present invention further provides a computer-readable storage medium having a computer program / instruction stored thereon, which implements the steps of the above method when the computer program / instruction is executed by a processor.

[0084] On the other hand, the present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0085] The present invention is described below in conjunction with a specific embodiment:

[0086] The present embodiment provides a multi-user key management method, system and device based on a data processing unit DPU, aiming to improve the security and efficiency of key management. During the system initialization process, the hardware root of trust is first configured to ensure the security of system startup, and then the root key is generated and stored. Next, a unique user master key is generated for each user and stored encrypted using the root key. The initial working key is also encrypted with the user master key. User key isolation is achieved by assigning unique identifiers, logical partition storage, and strict access control policies. Encryption and decryption operations follow the process of hierarchical key invocation to ensure key security. Key updates can be triggered on a regular or specific event basis, and the key usage pattern is analyzed in combination with the LSTM network to predict the optimal rotation time and automatically adjust the cycle. A smooth transition is achieved through a dual key mechanism. The system also includes operation log recording and real-time anomaly detection mechanisms to ensure the comprehensiveness of auditing and monitoring. This embodiment includes the following steps:

[0087] 1. System initialization

[0088] 1.1 Initialize the hardware root of trust

[0089] Reference Figure 1 and Figure 3 , ensuring secure boot and configuration of the hardware root of trust, including loading and verification of firmware and operating systems. The hardware root of trust ensures that the system boots from trusted firmware and operating systems, ensuring the integrity and authenticity of the generated root keys.

[0090] 1.2 Generate root key

[0091] Generate and store root keys in the hardware root of trust. The hardware root of trust is tamper-resistant and highly secure, which can effectively prevent the key from being stolen or tampered with.

[0092] 1.3 Generate a User Master Key

[0093] Register users and generate unique user master keys for each user. These master keys are used to encrypt user-specific working keys. The user master keys are encrypted with the root key and stored in secure storage.

[0094] 1.4 Generate working key

[0095] Generates the initial working key and encrypts it with the user master key. These working keys are used for specific operations such as data encryption, decryption, digital signature, and signature verification.

[0096] 2. User key isolation implementation

[0097] 2.1 User ID and Key Association

[0098] Reference Figure 4 , assign a unique identifier to each user and closely associate it with the corresponding user master key and work key.

[0099] 2.2 Logical Partition Storage

[0100] Reference Figure 4 On the storage medium, an independent logical partition is created for each user's key to ensure physical storage isolation.

[0101] 2.3 Access Control Policy Settings

[0102] Reference Figure 4 , formulate strict access control policies, and only authorized users can access the key partition to which they belong. Set control policies such as encryption and decryption, signature verification, and key acquisition for keys, and configure fine-grained control such as key access time to ensure the safe use and security management of keys through access control policies.

[0103] 3. Encryption and decryption operations

[0104] 3.1 Key Calling Process

[0105] Reference Figure 6 ,When performing encryption and decryption operations, the keys are called strictly according to the hierarchy to ensure the correct key usage order.

[0106] 3.1.1 Accept the encryption request from the sender user.

[0107] 3.1.2 Extract the sender's user master key and decrypt it with the root key to obtain the sender's user master key.

[0108] 3.1.3 Use the sender’s user master key to decrypt the working key.

[0109] 3.1.4 Use the decrypted working key to perform data encryption operations.

[0110] 3.1.5 Complete the encryption operation on the data and obtain the ciphertext.

[0111] 3.1.6 Receive the decryption request from the recipient user.

[0112] 3.1.7 Extract the recipient's user master key and decrypt it with the root key to obtain the sender's user master key.

[0113] 3.1.8 Use the recipient’s user master key to decrypt the working key.

[0114] 3.1.9 Use the decrypted working key to decrypt the ciphertext.

[0115] 3.1.10 Complete the decryption operation of the data and obtain the plain text. 3.2 Real-time decryption control

[0116] Decryption is performed only when necessary to minimize the exposure time of the key in plaintext.

[0117] 4. Key Update and Rotation

[0118] 4.1 Key Update

[0119] Key updates are triggered periodically or based on specific events to ensure the security of keys at all levels.

[0120] Regular update means updating the key at a predetermined time interval, such as every month or every three months. This ensures that the key will not be left unchanged for a long time, thereby reducing the risk of being cracked.

[0121] A specific event can be anything that affects the security of the key, for example:

[0122] Security vulnerability discovery: If a security vulnerability is found in the key or encryption algorithm, the key needs to be updated immediately.

[0123] User rights changes: When user rights change, the associated keys need to be updated.

[0124] Unusual activity detection: If unusual activity is detected in the system, such as suspicious logins or data access, key updates can be triggered to enhance security.

[0125] 4.2 Key Rotation

[0126] Reference Figure 5 , use LSTM network to analyze key usage patterns, predict the best rotation time, and automatically adjust the key rotation cycle. The specific steps are as follows:

[0127] Step S1: Data preparation

[0128] Collect data: Collect data related to key usage, such as the number of times the key is used, how often it is used, the number of successful and failed uses, security events, and system logs. Make sure the data is in a time series format and includes timestamps.

[0129] Data preprocessing: Clean the data and handle missing values ​​and outliers. Standardize or normalize the data to ensure that the data is suitable for the LSTM model. Convert the timestamps to the appropriate time series format.

[0130] Step S2: Create a time series dataset

[0131] Define the time window: According to the characteristics of key usage, determine the appropriate time window length (such as the past 7 days, 30 days, etc.) to create a time series dataset.

[0132] Create a data set: Use the sliding window technique to create input features and target variables. The input features are past key usage data, and the target variables are future key usage data.

[0133] Step S3: Build and train LSTM model

[0134] Build an LSTM model: Build a neural network model that includes an LSTM layer. You can include multiple LSTM layers and fully connected layers to improve the expressiveness of the model.

[0135] Compile model: Compile the model using a suitable loss function (such as mean squared error) and optimizer (such as Adam).

[0136] Training model: Use the preprocessed time series dataset to train the model, and adjust the batch size and number of training rounds to optimize model performance.

[0137] Step S4: Predict and evaluate the model

[0138] Create a test dataset: Divide the dataset into a training set and a test set, making sure that the data in the test set is not used for model training.

[0139] Make predictions: Use the trained LSTM model to make predictions on the test set to obtain the predicted values ​​of future key usage.

[0140] Evaluate model performance: Evaluate the accuracy of the prediction results. Commonly used evaluation indicators include mean square error (MSE), root mean square error (RMSE), etc.

[0141] Step S5: Determine the optimal rotation time

[0142] Analyze forecast results: Analyze forecasted key usage patterns, identify peaks and valleys, and determine the best time to rotate keys based on these patterns.

[0143] Dynamically adjust the rotation cycle: Dynamically adjust the key rotation cycle based on the prediction and analysis results. For example, increase the rotation frequency before the peak period and reduce the rotation frequency during the trough period.

[0144] Step S6: Automated Process

[0145] Build an automated script: Run the LSTM model regularly to update the prediction results. You can set it to run daily, weekly, or monthly to ensure the timeliness of the prediction results.

[0146] Automatically adjust key rotation settings: Automatically adjust key rotation periods and policies based on the latest forecast results. This process can be implemented using scripts or configuration management tools.

[0147] Step S7: Monitoring and Optimization

[0148] Continuous monitoring: Continuously monitor key usage and prediction results to detect and handle abnormal situations in a timely manner.

[0149] Model optimization: Based on the monitoring results, the LSTM model and data preprocessing methods are continuously optimized to improve prediction accuracy and stability.

[0150] 4.3 Smooth Transition Mechanism

[0151] During the key update process, data continuity and availability are ensured, and a dual-key mechanism is used to achieve smooth key rotation.

[0152] 4.3.1 Generate New Key: Generate a new key and start using it for new encryption operations.

[0153] 4.3.2 Double decryption: During a transition period, the old key and the new key are used to decrypt the data. This ensures that the data that has been encrypted with the old key can still be decrypted normally.

[0154] 4.3.3 Update stored data: gradually re-encrypt the data encrypted by the old key with the new key. This process can be done in the background to avoid interfering with the foreground operation.

[0155] 4.3.4 Discarding old keys: Once all data has been encrypted with the new key, the old key can be safely discarded.

[0156] 5. Audit and monitoring

[0157] 5.1 Operation log records all key-related operations, including generation, access, and update, for auditing and tracking purposes.

[0158] 5.2 Anomaly detection and alarm, set up a real-time monitoring mechanism to promptly detect abnormal key access behavior and issue an alarm.

[0159] The technical effects of this embodiment include the following:

[0160] 1) Hardware Root of Trust (HRoT) configuration and key generation: Configure the hardware root of trust during system initialization, generate and store the root key, and ensure the security of system startup and the integrity of the key.

[0161] 2) Multi-level key management architecture: A hierarchical management method of root key, user master key and working key is adopted to achieve secure storage and hierarchical calling of keys. Encryption and decryption operations follow a strict key hierarchy process.

[0162] 3) User key isolation technology: By assigning unique identifiers, logical partition storage and strict access control policies, physical and logical isolation of each user's key is achieved to ensure the independence and security of user data.

[0163] 4) Intelligent key update mechanism: Combined with the LSTM network to analyze the key usage pattern, predict the optimal key rotation time and automatically adjust the update cycle to improve the intelligence and automation level of key management.

[0164] 5) Real-time auditing and anomaly detection: The system includes operation log recording and real-time anomaly detection mechanisms to ensure the comprehensiveness of auditing and monitoring, and to promptly detect and handle abnormal key access behaviors.

[0165] Corresponding to the above method, the present invention also provides an apparatus / system, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, the processor is used to execute the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the apparatus / system implements the steps of the method described above.

[0166] The embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned edge computing server deployment method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0167] In summary, the DPU-based multi-user key management method, network data transmission method and device configure the hardware trust root based on the data processing unit DPU and generate the storage root key, adopt the multi-level key management architecture of root key, user master key and working key, realize the secure storage and hierarchical call of keys, and the encryption and decryption operations follow the strict key hierarchy process; assign a unique identifier to each user and divide the logical partition for each user in the storage medium and set the access control policy to realize the physical and logical isolation of each user's key, and ensure the independence and security of user data. Furthermore, the key usage mode is analyzed in combination with the LSTM network, the optimal key rotation time is predicted and the update cycle is automatically adjusted to improve the intelligence and automation level of key management.

[0168] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0169] It should be clear that the present invention is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present invention.

[0170] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0171] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the embodiments of the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A multi-user key management method based on a data processing unit, It is characterized in that The method is executed on a data processing unit, the data processing unit is provided with a hardware trust root and a storage medium, and the method comprises the following steps: Initialize the hardware root of trust, generate and store at least one root key in the hardware root of trust; receive registration requests from multiple users, generate a unique user identifier and a user master key for each user, the user master key is encrypted using the specified root key; generate a corresponding working key for each user, the working key is encrypted using the corresponding user master key; Divide an independent logical partition for each user on the storage medium for storing the user master key and the working key, and call each logical partition according to a preset access control policy to extract the multi-layer encrypted working key for data transmission; Update and transform the root key, the user master key and the working key according to a set time interval or according to a set trigger event; And / or, taking the key usage data of the current time period as input, predicting the key usage data of the future target time period based on the pre-trained long short-term memory network, analyzing the key usage data of the future target time period to identify the peak and trough periods of user use of each key, and dynamically adjusting the key rotation period and rotation frequency according to preset rules.

2. The multi-user key management method based on a data processing unit according to claim 1, It is characterized in that Dividing an independent logical partition for each user on the storage medium includes: For the preset storage medium, the parted disk partition tool is used to divide the logical partitions, and the partitions are formatted using the ext4, NTFS or FAT32 file management system; Create a mount point for each user and mount the corresponding logical partition to the mount point; set access permissions to ensure that each logical partition can only be accessed by the corresponding user; Regularly and automatically monitor the usage and health status of partitions and generate logs.

3. The multi-user key management method based on a data processing unit according to claim 1, It is characterized in that The root key, the user master key and the working key are updated and transformed according to a set time interval or according to a set trigger event, wherein the set time interval is based on industry standard specifications or is based on user-defined settings; the set trigger event includes a security vulnerability discovery event, a user authority change event and / or a user abnormal risk operation activity event.

4. The multi-user key management method based on a data processing unit according to claim 1, It is characterized in that The training steps of the long short-term memory network include: Obtaining historical data related to key usage, including the time, number of times, frequency, number of successful uses, and number of failed uses of each key, marking security events, and reading various events in the system log; the historical data is recorded in a time series format; The time window length is defined according to the key call frequency in the usage scenario, and the input data and target data are extracted by sliding in the historical data using the time window length; the target data is the next moment data corresponding to the input data; An initial neural network model is obtained, wherein the initial neural network model includes multiple LSTM layers and fully connected layers; the initial neural network model inputs the input data and fits and outputs the predicted value of the target data; a loss function is calculated according to the predicted value and the true value of the target data, and the loss function is used to update the initial neural network model to obtain the long short-term memory network.

5. The multi-user key management method based on a data processing unit according to claim 4, It is characterized in that The loss function is mean square error or root mean square error.

6. The multi-user key management method based on a data processing unit according to claim 1, It is characterized in that Analyze the key usage data of the future target period to identify the peak and trough periods of user usage of each key, and dynamically adjust the key rotation period and rotation frequency according to preset rules, including: Analyze the key usage data in the future target period, and count the number of times each key is used, the frequency of use, the number of successful uses, and the number of failed uses; For each key, a peak period and a valley period are defined based on a combination of parameters including the number of uses, the frequency of use, the number of successful uses, and the number of failed uses; When it is identified that the future target time period is a peak period, the rotation frequency of each key is increased according to a first set ratio before the future target time period; when it is identified that the future target time period is a trough period, the rotation frequency of each key is reduced according to a second set ratio before the future target time period.

7. The multi-user key management method based on a data processing unit according to claim 1, It is characterized in that The method further comprises: in the key updating or rotation process, adopting a dual key mechanism to realize smooth key conversion.

8. A network data transmission method, It is characterized in that The steps include: Creating a root key, a user master key and a working key for a sender and a receiver based on the multi-user key management method based on a data processing unit according to any one of claims 1 to 7; The sender or receiver accesses the corresponding logical partition and uses the root key to decrypt and extract the user master key; Decrypt and extract the working key using the user master key; The sender uses the corresponding working key to encrypt and transmit the first target data to be sent, and the receiver uses the corresponding working key to decrypt the received second target data.

9. A computer-readable storage medium having a computer program / instructions stored thereon, It is characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

10. A computer program product comprising a computer program / instructions, It is characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images