File data secure transmission method based on bidirectional encryption algorithm

Abstract

The invention belongs to the field of archive data secure transmission, and discloses an archive data secure transmission method based on a bidirectional encryption algorithm. Comprising the following steps: collecting historical comprehensive data and real-time data information, designing a security policy according to the historical comprehensive data, deploying the security policy to all archive data, and dynamically updating the sensitivity level of the real-time data information; constructing an input packet according to the real-time data information, designing a secret key and secret key generation model, importing the input packet into the model, and obtaining a secret key and a secret key which are generated in real time; segmenting the real-time data information through a slicing strategy, and encrypting the real-time data information by using a secret key and a secret key; a multi-element encryption group is designed according to the ciphertext fragment, multi-path transmission is used, and a receiving end carries out data decryption and restoration through a dynamic key; and displaying the transmission report on a computer end page, and performing interface interaction with a user to realize safe transmission of the archive data based on a bidirectional encryption algorithm.

Description

Technical Field

[0001] The present invention relates to the field of secure transmission of archive data, and more specifically, to a method for secure transmission of archive data based on a bidirectional encryption algorithm. Background Art

[0002] The two-way encryption algorithm includes symmetric encryption and asymmetric encryption. The present invention mainly aims at the secure transmission of archive data in the process based on symmetric encryption. In the specific transmission process, the following problems and difficulties may be encountered:

[0003] The transmission of archival data may involve the collaboration of multiple institutions or departments. Key distribution is one of the most critical links in the encryption system. Especially in the collaboration of multiple institutions or departments, each institution may have a different key management mechanism. How to ensure the security and compatibility of key distribution between different institutions is a major problem. If the key is accidentally lost (such as hardware failure or misoperation), the encrypted data will not be able to be decrypted, making the data unrecoverable.

[0004] When a key is used for a long time, attackers may try to brute force the key by continuously analyzing the data stream encrypted by the key. The key needs to be replaced (rotated) regularly to avoid the risks caused by long-term use. However, how to efficiently manage the generation, update, and destruction of keys is a complex issue.

[0005] Archival data usually involves a large number of data files, and archival data may contain multiple formats (text, pictures, videos, etc.). The overall transmission and encryption time costs are high. Therefore, how to slice and transmit data is a difficult problem. In particular, the security of the encryption algorithm may decrease with the storage and management time of the key. Therefore, it is necessary to comprehensively consider the adaptability of the data itself and the encryption algorithm to data in different forms.

[0006] In view of this, the present invention proposes a method for securely transmitting archive data based on a two-way encryption algorithm to solve the above problem. Summary of the invention

[0007] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solutions: A method for secure transmission of archival data based on a two-way encryption algorithm, comprising: Step S1: collecting historical comprehensive data and real-time data information, designing a security strategy based on the historical comprehensive data, and deploying it to all archival data, thereby dynamically updating the sensitivity level of the real-time data information;

[0008] Step S2: construct an input package according to real-time data information, design a key and secret key generation model, import the input package into the model, and obtain the key and secret key generated in real time;

[0009] Step S3: Slice the real-time data information through the slicing strategy and encrypt it using the key and encryption key;

[0010] Step S4: Design a multi-encryption group based on the ciphertext fragments and use multi-path transmission. The receiving end uses a dynamic key to decrypt and restore the data.

[0011] Step S5: Display the transmission report on the computer end page and interact with the user interface.

[0012] Preferably, the method of designing a security strategy based on historical comprehensive data and deploying it to all archival data, thereby dynamically updating the sensitivity level of real-time data information includes:

[0013] Historical comprehensive data includes data on the archival data retrieved and transmitted at historical time, and real-time data information refers to the archival data transmitted at the current time;

[0014] Conduct preliminary classification of the sensitivity of historical comprehensive data and archival data through manual labeling;

[0015] Use dynamic classification to update the sensitivity level of the data after preliminary classification within the cycle time. Set the dynamic classification method as ,in, Indicates the sensitivity level of the data after update. Indicates the sensitivity level of the data after preliminary classification. Indicates the frequency of data access, Indicates the life cycle of data. Indicates the maximum value of the data life cycle. and represents the weight coefficient, and represents the adjustment factor, Indicates adjustment item;

[0016] Set the time period D_G, and use the cycle time as the window size, and extract the real sensitivity level of the historical comprehensive data at the start time and the end time in each window, and use the real sensitivity level at the start time as the sensitivity level after preliminary classification, and the real sensitivity level at the end time as the updated sensitivity level. Take the sensitivity levels after preliminary classification and the updated sensitivity level as a group of samples, slide the window over the time period D_G, collect all the output samples and train the dynamic classification method in batches until the sensitivity level output by the dynamic classification method converges with the real sensitivity level at the end time, and then use the weight coefficient at this time and , adjustment factor and , Adjustment items Arrange it on the dynamic grading method to obtain the final dynamic grading method expression;

[0017] The final dynamic classification expression is deployed on all archival data, and the sensitivity level of the dynamically updated real-time data information is extracted to obtain the sensitivity level of the data information at the current time.

[0018] Preferably, the method of constructing an input package according to real-time data information, designing a key and a secret key generation model, importing the input package into the model, and obtaining the key and secret key generated in real time includes:

[0019] The timestamp, sensitivity level, data characteristics and user ID of the real-time data information are extracted and designed into a one-dimensional matrix. The obtained one-dimensional matrix is ​​used as an attribute label to mark the real-time data information to form an input package;

[0020] By designing key and secret key generation model, obtain key and secret key, master key Used for data encryption, dynamic key Used to control the distribution and access of subkey fragments;

[0021] Dynamic Key Stored on distributed nodes On, used to control the sub-key fragment access rights, and each dynamic key Can only access its stored subkey fragments .

[0022] Preferably, the design method of the key and key generation model includes:

[0023] The key and secret key generation model is constructed based on the master key generation formula and secret key generation formula;

[0024] Set the master key generation formula to ,in, Represents the random seed generated by the hardware random number generator. Indicates the timestamp, Indicates the characteristics of indicator data, including the file size of real-time data information , File Type and sensitivity level , Indicates the user identity characteristics. Represents the data concatenation operation, represents a secure hash function;

[0025] Generated master key The secret sharing algorithm is used to split subkey fragments and set the reconstruction threshold ;

[0026] Based on master key The dynamic key is generated by the subkey fragment and the dynamic key generation formula is set as ,in, Indicates the sub-key fragment used to distribute and control the corresponding sub-key fragment The dynamic key of Indicates that the master key is numbered The subkey fragment of Represents dynamic data characteristics, including the file size of each data block , File Type , Sensitivity Level , User identity characteristics and dynamic environmental characteristics ,and ;

[0027] A dynamic update adjustment mechanism is set for the generated master key and dynamic key. The dynamic update adjustment mechanism stipulates that the dynamic key is dynamically adjusted as the master key is updated. The master key is updated by collecting a timestamp once at the update cycle. , Sensitivity Level and dynamic environmental characteristics , regenerate through the master key generation formula;

[0028] The update cycle , represents the basic period, Indicates the data transmission frequency, Indicates the frequency of data access.

[0029] Preferably, the master key The secret sharing algorithm is used to split subkeys of fragments and set reconstruction threshold The methods include:

[0030] Extract the value range of the sensitivity level, use the clustering algorithm to dynamically divide the value range, discretize the value range into continuous value segments, take the current time as the base point, collect the number of key slices and reconstruction thresholds of each data in each value segment in the previous S_o ​​time, and take the average value as the number of key slices and reconstruction threshold at the current time, denoted as and ;

[0031] Suppose the polynomial expression of the secret sharing algorithm is ,in, is a constant term, equal to the master key , , …, , …, represents the coefficient, Represents a variable, by calculating the storage node i value Get the master key numbered Fragment .

[0032] Preferably, the method of using a clustering algorithm to dynamically divide the value range and discretize the value range into continuous value segments includes:

[0033] Step Q1: Taking the current time as the base point, collect the sensitivity levels of the data at the previous S_o ​​times, and collect the values ​​of all sensitivity levels to form a data set;

[0034] Step Q2: Randomly select LN values ​​as the initial cluster centers, calculate the distances between the remaining values ​​and the initial cluster centers, and assign them to the cluster corresponding to the nearest initial cluster center;

[0035] Step Q3: Use the average value of all values ​​in the cluster as the new cluster center, repeat step Q2 until the cluster centers of all two adjacent iterations are the same, and obtain the values ​​divided into LN clusters;

[0036] Step Q4: Calculate the density of values ​​in each cluster , calculate the number of divisions based on density , extract the maximum and minimum values ​​in each cluster to form a preliminary range, and divide the preliminary range into value range;

[0037] Step Q5: Collect the value segments in all clusters and arrange them in order of size (ascending or descending), and record them as the value segments after the value range is discretized;

[0038] in, Indicates the density of values ​​in the cluster, Indicates The maximum value in the cluster. Indicates The minimum value of the cluster. Indicates the number of values ​​in the cluster, Indicates the standard split value.

[0039] Preferably, the method of segmenting the real-time data information by a slicing strategy and encrypting it by using a key and a secret key comprises:

[0040] Design a slice strategy, which is based on the slice size strategy formula and the slice quantity strategy formula, and obtain the slice size according to the slice strategy and number of slices ;

[0041] The slice size output using the slice strategy and number of slices Segment the real-time data information to form data blocks;

[0042] Allocate a subkey fragment to each data block, encrypt the data block using the allocated subkey fragment, and generate a ciphertext fragment;

[0043] The slice size strategy formula is: , the slice quantity strategy formula is , Indicates the file size of real-time data information, Indicates the maximum number of slices, Indicates the network bandwidth. Indicates the transmission delay, Indicates the number of standard slices, Indicates the standard file size, Indicates the adjustment step size.

[0044] Preferably, the method of designing a multi-encryption group according to the ciphertext fragments and using multi-path transmission, and the receiving end performing data decryption and recovery by using a dynamic key includes:

[0045] A checksum is introduced for each ciphertext segment. The checksum is generated by HMAC. The ciphertext segment with the checksum added and the dynamic key are combined into a multi-element encryption group.

[0046] The multiple encryption group is transmitted from the sender to the receiver through multi-path transmission. After receiving it, the receiver first recalculates the check value of each ciphertext fragment and compares it with the one provided by the sender: if they are inconsistent, a retransmission request is sent to the sender. If they are consistent, the receiver reconstructs the master key from the dynamic key, uses the master key to decrypt the data block, and reassembles the decrypted data blocks in sequence into complete real-time data information.

[0047] Preferably, the method of transmitting the multi-element encryption group from the sending end to the receiving end through multi-path transmission includes: the ciphertext fragment and the dynamic key are transmitted through independent transmission paths respectively.

[0048] Preferably, the transmission report includes transmission status and identification information, and the transmission status includes normal and abnormal. If the check values ​​are inconsistent, the transmission status is displayed as abnormal, and the identification information sent is a retransmission request. If the check values ​​are consistent, the transmission status is displayed as normal, and the identification information sent is successful transmission.

[0049] The technical effects and advantages of the archival data secure transmission method based on a two-way encryption algorithm of the present invention are as follows:

[0050] 1. Data security is significantly improved

[0051] A dual encryption mechanism of master key and dynamic key is designed, which not only encrypts the data block, but also controls the distribution of dynamic keys for its ciphertext fragments. The generation and update mechanism of dynamic keys is based on multiple dynamic characteristics such as sensitivity level, timestamp, user ID, etc., to ensure the security and real-time performance of the key.

[0052] The master key is divided into multiple sub-key fragments through a secret sharing algorithm, and a reconstruction threshold is set. Only sub-key fragments that meet the reconstruction conditions can reconstruct the master key, thereby preventing key leakage. The ciphertext fragments and dynamic keys are transmitted through independent transmission paths. Even if one path is attacked, the attacker cannot obtain the key and ciphertext at the same time, greatly reducing the risk of data leakage.

[0053] 2. Accurate assessment of dynamic sensitivity level

[0054] Dynamic security strategies are designed based on historical comprehensive data and real-time data information. Dynamic classification methods are optimized through periodic updates and training to make sensitivity levels more accurate. Dynamic classification formulas are used to comprehensively consider multiple factors such as data access frequency, life cycle, and weight coefficients to dynamically adjust sensitivity levels to ensure that data security levels can be updated in a timely manner in line with actual conditions. Clustering algorithms are used to dynamically divide the range of sensitivity levels and discretize sensitivity levels to ensure flexibility and accuracy of classification.

[0055] 3. Efficient key management and encryption mechanism

[0056] Through the key and secret key generation model, the master key and dynamic key are dynamically generated based on real-time data information to ensure the timeliness and uniqueness of the key. The key and secret key are adjusted in real time with dynamic characteristics such as data transmission frequency and access frequency, avoiding the security risks of fixed keys. By designing the slice strategy formula, optimizing the slice size and number of slices, and combining the allocation of sub-key fragments, efficient encryption is achieved to speed up data transmission.

[0057] 4. Robustness and reliability of the transmission process

[0058] A checksum is introduced for each ciphertext fragment. The receiving end verifies the integrity of the data through the checksum to prevent data tampering or loss during transmission. The transmission status and identification information are displayed in real time on the computer end, providing users with intuitive transmission progress and abnormal feedback, facilitating timely problem handling.

[0059] 5. Performance advantages

[0060] The efficient sharding strategy optimizes transmission performance. Multi-path transmission not only improves transmission security, but also disperses network load, improving the efficiency and reliability of data transmission. Distributed key storage avoids single point failure and improves the system's fault tolerance and scalability. It is highly adaptable and can be adapted to different application scenarios.

[0061] Each module (such as sensitivity level assessment, key generation, slice encryption, transmission and decryption) is relatively independent, which facilitates flexible expansion and functional upgrades.

[0062] 6. Intelligent sensitivity level assessment and training

[0063] The dynamic classification method uses a sliding window to perform a periodic training mechanism on historical comprehensive data, and continuously optimizes weight coefficients, adjustment factors and adjustment items to make the sensitivity level assessment more accurate. By combining manual labeling and dynamic classification, intelligent sensitivity level assessment of data can be achieved, reducing manual intervention and improving efficiency.

[0064] 7. User experience optimization

[0065] The real-time interactive interface transmits reports and interacts with users, allowing users to intuitively understand the dynamic changes in transmission status, abnormal information, and sensitivity levels. The system can promptly feedback abnormal information and automatically initiate retransmission requests, reducing user intervention and improving the operating experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 It is a structural schematic diagram of a method for securely transmitting archive data based on a two-way encryption algorithm of the present invention;

[0067] Figure 2 The figure is a schematic diagram of the steps of a method for securely transmitting archive data based on a two-way encryption algorithm of the present invention. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] Example 1

[0070] See also Figure 1 and Figure 2 As shown, the method for securely transmitting archive data based on a two-way encryption algorithm described in this embodiment includes:

[0071] The two-way encryption algorithm includes symmetric encryption and asymmetric encryption. The present invention mainly aims at the secure transmission of archive data in the process based on symmetric encryption. In the specific transmission process, the following problems and difficulties may be encountered:

[0072] 1. Key management issues

[0073] The transmission of archival data may involve the collaboration of multiple institutions or departments. Key distribution is one of the most critical links in the encryption system. Especially in the collaboration of multiple institutions or departments, each institution may have a different key management mechanism. How to ensure the security and compatibility of key distribution between different institutions is a major problem. If the key is accidentally lost (such as hardware failure or misoperation), the encrypted data will not be able to be decrypted, making the data unrecoverable.

[0074] When a key is used for a long time, attackers may try to brute force the key by continuously analyzing the data stream encrypted by the key. The key needs to be replaced (rotated) regularly to avoid the risks caused by long-term use. However, how to efficiently manage the generation, update, and destruction of keys is a complex issue.

[0075] 2. Characteristics of the archival data itself

[0076] Archival data usually involves a large number of data files, and archival data may contain multiple formats (text, pictures, videos, etc.). The overall transmission and encryption time costs are high. Therefore, how to slice and transmit data is a difficult problem. In particular, the security of the encryption algorithm may decrease with the storage and management time of the key. Therefore, it is necessary to comprehensively consider the adaptability of the data itself and the encryption algorithm to data in different forms.

[0077] The process of archival data transmission involves issues such as multi-institutional collaboration, complex data formats, and high transmission security requirements. In order to cope with the complexity of key management and the multi-faceted challenges of data security, this technical solution proposes the following design process:

[0078] Security policy formulation: Design a dynamic security policy based on data characteristics and transmission security requirements.

[0079] Key and secret key generation model: Based on security policies, design dynamic key generation and slicing models.

[0080] Data slicing and adaptive key allocation: Adaptively slice and allocate keys based on the characteristics of data slices (file type, importance, size, etc.).

[0081] Transmission and decryption: Combines the multi-path transmission and reassembly mechanism of data and key slices to ensure the integrity and security of data during transmission.

[0082] This solution aims to achieve dynamic key management, targeted data encryption protection and efficient secure transmission.

[0083] Step S1: Collect historical comprehensive data and real-time data information, design security strategies based on historical comprehensive data, and deploy them to all archival data, and then dynamically update the sensitivity level of real-time data information;

[0084] Data dynamic update module: used to collect historical comprehensive data and real-time data information, design security strategies based on historical comprehensive data, and dynamically update the sensitivity level of real-time data information;

[0085] The security strategy is the basis of the entire technical solution and is used to guide key generation, data encryption and transmission methods. The main contents include:

[0086] Methods for designing security policies based on historical comprehensive data and deploying them to all archival data, and then dynamically updating the sensitivity level of real-time data information include:

[0087] Historical comprehensive data includes data on the archival data retrieved and transmitted at historical time, and real-time data information refers to the archival data transmitted at the current time;

[0088] Conduct preliminary classification of the sensitivity of historical comprehensive data and archival data through manual labeling;

[0089] For example, the classification levels are set to 5, from high to low, namely S_1, S_2, S_3, S_4 and S_5, then S_1 represents extremely highly sensitive data (personal privacy, biometric data); S_2 represents highly sensitive data (such as enterprise core technical documents, financial data); S_3 represents moderately sensitive data (such as department-level internal information); S_4 represents low-sensitivity data (such as ordinary internal documents); S_5 represents public data (such as press releases, promotional materials), where the sensitivity level can be the importance level or confidentiality level of the data or file.

[0090] Use dynamic classification to update the sensitivity level of the data after preliminary classification within the cycle time. Set the dynamic classification method as ,in, Indicates the sensitivity level of the data after update. Indicates the sensitivity level of the data after preliminary classification. The frequency of data access is the frequency with which the data is accessed. Frequently accessed data may contain more sensitive information or be critical to business operations, and therefore may require a higher security level. Represents the life cycle of data, that is, the time span from data creation to deletion. Data that has not been accessed for a long time may no longer require a high level of protection, so its security level can be lowered. Indicates the maximum value of the data life cycle, which is used to normalize the impact of the life cycle. and Indicates the weight coefficient; used to adjust the impact of access frequency and life cycle on security level. Used to adjust the impact of data access frequency and data life cycle on security level. and represents the adjustment factor, Indicates adjustment item;

[0091] Set the time period D_G, and use the cycle time as the window size, and extract the real sensitivity level of the historical comprehensive data at the start time and the end time in each window, and use the real sensitivity level at the start time as the sensitivity level after preliminary classification, and the real sensitivity level at the end time as the updated sensitivity level. Use the sensitivity levels after preliminary classification and the updated sensitivity level as a set of samples, slide the window over the time period D_G, collect all the output samples and train the dynamic classification method in batches until the sensitivity level output by the dynamic classification method converges (is the same) with the real sensitivity level at the end time, and then set the weight coefficient at this time and , adjustment factor and , Adjustment items Arrange it on the dynamic grading method to obtain the final dynamic grading method expression;

[0092] The final dynamic grading expression is deployed on all archival data to dynamically update all archival data stored in the database, extract the sensitivity level of the dynamically updated real-time data information, and obtain the sensitivity level of the data information at the current time.

[0093] Step S2: construct an input package according to real-time data information, design a key and secret key generation model, import the input package into the model, and obtain the key and secret key generated in real time;

[0094] Step S3: Slice the real-time data information through the slicing strategy and encrypt it using the key and encryption key;

[0095] Methods for segmenting real-time data information through slicing strategies and encrypting them using keys and cryptographic keys include:

[0096] Design a slice strategy, which is based on the slice size strategy formula and the slice quantity strategy formula, and obtain the slice size according to the slice strategy and number of slices ;

[0097] The slice size output using the slice strategy and number of slices Segment the real-time data information to form data blocks;

[0098] A subkey fragment is assigned to each data block, and the data block is encrypted using the assigned subkey fragment to generate a ciphertext fragment; wherein, one or more subkey fragments may also be assigned, with more subkey fragments assigned to high-sensitivity data blocks and fewer subkey fragments assigned to low-sensitivity data blocks, and the assigned subkey fragments are greater than the number of key slices and less than or equal to the reconstruction threshold.

[0099] The slice size strategy formula is: , the slice quantity strategy formula is , Indicates the file size of real-time data information, Indicates the maximum number of slices, based on file complexity and format settings. For files with complex formats, more slices may be required to reduce processing difficulty. Indicates network bandwidth, which affects data transmission rate. Indicates transmission delay, which affects the time efficiency of data transmission. Indicates the number of standard slices, which can be set by averaging the number of slices after normal data transmission. Indicates the standard file size, which can be set by taking the average file size after normal data transmission. Indicates the adjustment step size; that is, the unit change when the slice is dynamically adjusted.

[0100] Model design module: used to design key and secret key generation models and build input packages, obtain keys and secret keys generated in real time, segment real-time data information through slicing strategies, and encrypt using keys and secret keys;

[0101] Build an input package based on real-time data information, design a key and secret key generation model, import the input package into the model, and obtain the key and secret key generated in real time. The specific method includes:

[0102] The timestamp, sensitivity level, data characteristics and user ID of the real-time data information are extracted and designed into a one-dimensional matrix. The obtained one-dimensional matrix is ​​used as an attribute label to mark the real-time data information to form an input package;

[0103] By designing key and secret key generation model, obtain key and secret key, master key Used for data encryption, dynamic key Used to control the distribution and access of subkey fragments;

[0104] Dynamic Key Stored on distributed nodes On, used to control the sub-key fragment Access rights, any node needs to verify To access , and each dynamic key Can only access its stored subkey fragments ;

[0105] The design methods of keys and key generation models include:

[0106] The key and secret key generation model is constructed based on the master key generation formula and secret key generation formula;

[0107] The master key generation depends on the random number generator, device characteristics, user characteristics and dynamic environment characteristics. The master key generation formula is set as ,in, Represents the random seed generated by the hardware random number generator, which is used to provide initial randomness. Indicates the timestamp, Indicates the characteristics of indicator data, including the file size of real-time data information , File Type and sensitivity level , Represents a user identity feature, such as a user ID or login credentials, Represents the data concatenation operation, which is used to combine data from multiple sources. Represents a secure hash function, such as SHA-256, used to generate a fixed-length key from concatenated data.

[0108] Generated master key Divided into sub-key fragments, and set the reconstruction threshold A_1;

[0109] Subkey generation combines the master key fragments and dynamic data features. The dynamic key is generated by the subkey fragment and the dynamic key generation formula is set as ,in, Indicates the sub-key fragment used to distribute and control the corresponding sub-key fragment The dynamic key of Indicates that the master key is numbered The subkey fragment of Represents dynamic data characteristics, including the file size of each data block , File Type , Sensitivity Level , User identity characteristics and dynamic environmental characteristics ,and ;

[0110] A dynamic update adjustment mechanism is set for the generated master key and dynamic key. The dynamic update adjustment mechanism stipulates that the dynamic key is dynamically adjusted as the master key is updated. The master key is updated by collecting a timestamp once at the update cycle. , Sensitivity Level and dynamic environmental characteristics , regenerate through the master key generation formula;

[0111] The update cycle , Indicates the basic period, which is a preset period based on the sensitivity level of the data. For example, for data with a lower sensitivity level, it may be set to 2 days. Indicates the frequency of data transmission, for example, the number of times it is transmitted per day. Indicates the frequency of data access. For example, it can be the number of times the data is accessed per day.

[0112] By implementing this comprehensive key generation strategy, we can improve the flexibility and adaptability of the system while ensuring data security and meet the key management requirements in different scenarios.

[0113] Among them, the file size can be obtained through the file system API or the library function provided by the programming language. For example, in the Linux system, the file size can be obtained by using the stat command or the corresponding system call; the file type can be determined by the file extension or file header information. In programming, the file type can be judged based on the file extension, or a more complex file analysis tool can be used to determine the file type; the user ID can be obtained through the system user management tool, such as the id command in Linux, which can display the user's UID and GID; the login credentials are usually obtained during the user login process and can be managed through a secure authentication framework, such as OAuth2.0 or JWT (JSON Web Tokens).

[0114] A hardware random number generator (HRNG) is a device that uses physical phenomena to generate random numbers. A hardware random number generator can generate random seeds, which can then be used as input to a faster cryptographically secure pseudo-random number generator to generate a pseudo-random number output sequence. For example, the STM32 hardware random number generator, for STM32 models without a hardware random number generator, can generate pseudo-random numbers through software simulation. For example, a time parameter can be generated by the system's timer, or a dynamically changing random seed can be provided by measuring the AD (analog-to-digital conversion) value. Through these methods, the hardware random number generator can provide high-quality random numbers for applications that require high security, ensuring the reliability of encryption and secure communications.

[0115] Dynamic environment features include geographic location, source IP address, device information, etc. These features can provide additional randomness and environmental context to enhance the security of the key. The geographic location can be obtained through IP address resolution services. Many services provide APIs to return geographic location information based on the user's IP address. The source IP address can be obtained directly from the network request, such as in the web server log or using the library function provided by the programming language to obtain the client IP address. Device information can be provided by the client. For example, on a mobile device, the device model, operating system version, and other information can be obtained through the operating system API.

[0116] The master key The secret sharing algorithm is used to split subkeys of fragments and set reconstruction threshold The methods include:

[0117] Extract the value range of the sensitivity level. For example, the sensitivity level of the data is as low as 0.7 and as high as 11.4. The value range of the sensitivity level is , use the clustering algorithm to dynamically divide the value range, discretize the value range into continuous value segments, take the current time as the base point, collect the number of key slices and reconstruction thresholds of each data in each value segment in the previous S_o ​​time, and take the average value as the number of key slices and reconstruction threshold at the current time, recorded as and ; Realize dynamic adjustment of the number of key slices and reconstruction threshold according to the sensitivity level range.

[0118] A secret sharing algorithm is a method of splitting a master key into multiple fragments and ensuring that the original secret can only be recovered when a certain number of fragments are combined. The polynomial expression of the secret sharing algorithm is assumed to be ,in, is a constant term, equal to the master key , , …, , …, denotes coefficients, which are randomly selected, Represents a variable, and for each slice fragment, Takes a different value, usually from 1 to , by calculating the storage node i value Get the master key numbered Fragment .

[0119] The specific process of generating slices includes:

[0120] Selection coefficient: random selection coefficient , …, , …, ;

[0121] Calculate the slice: For each The value of (usually corresponding to each storage node), calculate Value, which is the corresponding key slice ;

[0122] Distribute slices: Distribute each calculated Distribute to the corresponding nodes stored superior;

[0123] Recovery Key: When you need to recover the master key When collecting at least slices and use an interpolation algorithm (such as Lagrange interpolation) to calculate the original polynomial , thus obtaining = .

[0124] In this way, even if some slices are lost or obtained by attackers, as long as no more than slices leaked, master key Still secure. This strategy improves the flexibility and security of key management, especially in environments that require high security and reliability.

[0125] Use a clustering algorithm to dynamically divide the value range and discretize the value range into continuous value segments. The specific methods include:

[0126] Step Q1: Taking the current time as the base point, collect the sensitivity levels of the data at the previous S_o ​​times, and collect the values ​​of all sensitivity levels to form a data set;

[0127] Step Q2: Randomly select LN values ​​as the initial cluster centers, calculate the distances between the remaining values ​​and the initial cluster centers, and assign them to the cluster corresponding to the nearest initial cluster center;

[0128] The value of LN can be set according to work requirements. For example, if you want to divide the data more finely, assign a larger value to LN, for example, set the value of LN to 11. Otherwise, take a smaller value.

[0129] Step Q3: Use the average value of all values ​​in the cluster as the new cluster center, repeat step Q2 until the cluster centers of all two adjacent iterations are the same, and obtain the values ​​divided into LN clusters;

[0130] Step Q4: Calculate the density of values ​​in each cluster , calculate the number of divisions based on density , extract the maximum and minimum values ​​in each cluster to form a preliminary range, and divide the preliminary range into value range;

[0131] Step Q5: Collect the value segments in all clusters and arrange them in order of size (ascending or descending), and record them as the value segments after the value range is discretized;

[0132] in, Indicates the density of values ​​in the cluster, Indicates The maximum value in the cluster. Indicates The minimum value of the cluster. Indicates the number of values ​​in the cluster, Represents the standard separation value; the standard separation value can be set by data analysis. For example, if the number of values ​​in each cluster is too large, The value of is given a larger value, such as 3 or 4, and The minimum value of is 1 and all are positive integers.

[0133] Step S4: Design a multi-encryption group based on the ciphertext fragments and use multi-path transmission. The receiving end uses a dynamic key to decrypt and restore the data.

[0134] Designing multiple encryption groups based on ciphertext fragments and using multi-path transmission, the receiving end uses dynamic keys to decrypt and restore data, including:

[0135] A checksum is introduced for each ciphertext segment. The checksum is generated by HMAC (key-based hash message authentication code). The ciphertext segment with the checksum added and the dynamic key are combined into a multi-encryption group.

[0136] The multiple encryption group is transmitted from the sender to the receiver through multi-path transmission. After receiving it, the receiver first recalculates the check value of each ciphertext fragment and compares it with the one provided by the sender: if they are inconsistent, it means that the file has been tampered with or the transmission is wrong, and a retransmission request is sent to the sender. If they are consistent, it means that the transmission is secure. The receiver reconstructs the master key from the dynamic key, uses the master key to decrypt the data block, and reassembles the decrypted data block in sequence into complete real-time data information, completing the data transmission from the sender to the receiver.

[0137] The method of transmitting a multi-encryption group from a sender to a receiver through multi-path transmission includes: transmitting the ciphertext fragment and the dynamic key through independent transmission paths respectively. Using different transmission protocols and network channels (such as one channel for data and another channel for keys) ensures that even if a single channel is hijacked, the attacker cannot obtain both the complete data and the key at the same time.

[0138] Step S5: Display the transmission report on the computer end page and interact with the user interface;

[0139] Visualization module: used to arrange the transmission report on the computer page and interact with the user interface;

[0140] The transmission report includes transmission status and identification information. The transmission status includes normal and abnormal. If the check values ​​are inconsistent, the transmission status is displayed as abnormal, and the identification information sent is a retransmission request. If the check values ​​are consistent, the transmission status is displayed as normal, and the identification information sent is successful transmission.

[0141] Users can click, query, download and perform other interactive operations on the insurance analysis report through the computer page (computer display screen, where the computer refers to a smart device, which can be a mobile phone or tablet).

[0142] Example 2

[0143] See also Figure 1 As shown, the part not described in detail in this embodiment is described in Example 1, which provides a file data security transmission platform based on a two-way encryption algorithm, including:

[0144] Data dynamic update module: used to collect historical comprehensive data and real-time data information, design security strategies based on historical comprehensive data, and dynamically update the sensitivity level of real-time data information;

[0145] Model design module: used to design key and secret key generation models and build input packages, obtain keys and secret keys generated in real time, segment real-time data information through slicing strategies, and encrypt using keys and secret keys;

[0146] Data transmission module: used to design multiple encryption groups according to ciphertext fragments and use multi-path transmission. The receiving end uses dynamic keys to decrypt and restore data.

[0147] Visualization module: used to arrange the transmission report on the computer page and interact with the user interface.

[0148] Example 3

[0149] This embodiment discloses an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the operation mode of the method for secure transmission of archive data based on a two-way encryption algorithm provided above is implemented.

[0150] Since the electronic device introduced in this embodiment is an electronic device used to implement a method for securely transmitting archival data based on a two-way encryption algorithm in the embodiment of the present application, based on the method for securely transmitting archival data based on a two-way encryption algorithm introduced in the embodiment of the present application, a person skilled in the art can understand the specific implementation of the electronic device of the present embodiment and its various variations, so how the electronic device implements the method in the embodiment of the present application is not described in detail here. As long as a person skilled in the art implements an electronic device used by a method for securely transmitting archival data based on a two-way encryption algorithm in the embodiment of the present application, it belongs to the scope of protection to be provided by the present application.

[0151] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0152] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technical users in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for secure transmission of archive data based on a two-way encryption algorithm, characterized in that: include: Step S1: Collect historical comprehensive data and real-time data information, design security strategies based on historical comprehensive data, and deploy them to all archival data, and then dynamically update the sensitivity level of real-time data information; Step S2: construct an input package according to real-time data information, design a key and secret key generation model, import the input package into the model, and obtain the key and secret key generated in real time; Step S3: Slice the real-time data information through the slicing strategy and encrypt it using the key and encryption key; Step S4: Design a multi-encryption group based on the ciphertext fragments and use multi-path transmission. The receiving end uses a dynamic key to decrypt and restore the data. Step S5: Display the transmission report on the computer end page and interact with the user interface.

2. A method for securely transmitting archive data based on a two-way encryption algorithm according to claim 1, characterized in that: The method of designing a security strategy based on historical comprehensive data and deploying it to all archival data, thereby dynamically updating the sensitivity level of real-time data information includes: Historical comprehensive data includes data on the archival data retrieved and transmitted at historical time, and real-time data information refers to the archival data transmitted at the current time; Conduct preliminary classification of the sensitivity of historical comprehensive data and archival data through manual labeling; Use dynamic classification to update the sensitivity level of the data after preliminary classification within the cycle time. Set the dynamic classification method as ,in, Indicates the sensitivity level of the data after update. Indicates the sensitivity level of the data after preliminary classification. Indicates the frequency of data access, Indicates the life cycle of data. Indicates the maximum value of the data life cycle. and represents the weight coefficient, and represents the adjustment factor, Indicates adjustment item; Set the time period D_G, and use the cycle time as the window size, and extract the real sensitivity level of the historical comprehensive data at the start time and the end time in each window, and use the real sensitivity level at the start time as the sensitivity level after preliminary classification, and the real sensitivity level at the end time as the updated sensitivity level. Take the sensitivity levels after preliminary classification and the updated sensitivity level as a group of samples, slide the window over the time period D_G, collect all the output samples and train the dynamic classification method in batches until the sensitivity level output by the dynamic classification method converges with the real sensitivity level at the end time, and then use the weight coefficient at this time and , adjustment factor and , Adjustment items Arrange it on the dynamic grading method to obtain the final dynamic grading method expression; The final dynamic classification expression is deployed on all archival data, and the sensitivity level of the dynamically updated real-time data information is extracted to obtain the sensitivity level of the data information at the current time.

3. A method for securely transmitting archive data based on a two-way encryption algorithm according to claim 2, characterized in that: The method of constructing an input package according to real-time data information, designing a key and a secret key generation model, importing the input package into the model, and obtaining the key and secret key generated in real time includes: The timestamp, sensitivity level, data characteristics and user ID of the real-time data information are extracted and designed into a one-dimensional matrix. The obtained one-dimensional matrix is ​​used as an attribute label to mark the real-time data information to form an input package. By designing key and secret key generation model, obtain key and secret key, master key Used for data encryption, dynamic key Used to control the distribution and access of subkey fragments; Dynamic Key Stored on distributed nodes On, used to control the sub-key fragment access rights, and each dynamic key Can only access its stored subkey fragments .

4. The method for securely transmitting archive data based on a two-way encryption algorithm according to claim 3 is characterized in that: The design method of the key and key generation model includes: The key and secret key generation model is constructed based on the master key generation formula and secret key generation formula; Set the master key generation formula to ,in, Represents the random seed generated by the hardware random number generator. Indicates the timestamp, Indicates the characteristics of indicator data, including the file size of real-time data information , File Type and sensitivity level , Indicates the user identity characteristics. Represents the data concatenation operation, represents a secure hash function; Generated master key The secret sharing algorithm is used to split subkey fragments and set the reconstruction threshold ; Based on master key Generate a dynamic key with the subkey fragment, and set the dynamic key generation formula to ,in, Indicates the sub-key fragment used to distribute and control the corresponding sub-key fragment The dynamic key of Indicates that the master key is numbered The subkey fragment of Represents dynamic data characteristics, including the file size of each data block , File Type , Sensitivity Level , User identity characteristics and dynamic environmental characteristics ,and ; A dynamic update adjustment mechanism is set for the generated master key and dynamic key. The dynamic update adjustment mechanism stipulates that the dynamic key is dynamically adjusted as the master key is updated. The master key is updated by collecting a timestamp once at the update cycle. , Sensitivity Level and dynamic environmental characteristics , regenerate through the master key generation formula; The update cycle , represents the basic period, Indicates the data transmission frequency, Indicates the frequency of data access.

5. The method for securely transmitting archive data based on a two-way encryption algorithm according to claim 4 is characterized in that: The master key The secret sharing algorithm is used to split subkeys of fragments and set reconstruction threshold The methods include: Extract the value range of the sensitivity level, use the clustering algorithm to dynamically divide the value range, discretize the value range into continuous value segments, take the current time as the base point, collect the number of key slices and reconstruction thresholds of each data in each value segment in the previous S_o ​​time, and take the average value as the number of key slices and reconstruction threshold at the current time, denoted as and ; Suppose the polynomial expression of the secret sharing algorithm is ,in, is a constant term, equal to the master key , , …, , …, represents the coefficient, Represents a variable, by calculating the storage node i value Get the master key numbered Fragment .

6. A method for securely transmitting archive data based on a two-way encryption algorithm according to claim 5, characterized in that: The method of using a clustering algorithm to dynamically divide the value range and discretize the value range into continuous value segments includes: Step Q1: Taking the current time as the base point, collect the sensitivity levels of the data at the previous S_o ​​times, and collect the values ​​of all sensitivity levels to form a data set; Step Q2: Randomly select LN values ​​as the initial cluster centers, calculate the distances between the remaining values ​​and the initial cluster centers, and assign them to the cluster corresponding to the nearest initial cluster center; Step Q3: Use the average value of all values ​​in the cluster as the new cluster center, repeat step Q2 until the cluster centers of all two adjacent iterations are the same, and obtain the values ​​divided into LN clusters; Step Q4: Calculate the density of values ​​in each cluster , calculate the number of divisions based on density , extract the maximum and minimum values ​​in each cluster to form a preliminary range, and divide the preliminary range into value range; Step Q5: Collect the value segments in all clusters and arrange them in order of size (ascending or descending), and record them as the value segments after the value range is discretized; in, Indicates the density of values ​​in the cluster, Indicates The maximum value in the cluster. Indicates The minimum value of the cluster. Indicates the number of values ​​in the cluster, Indicates the standard split value.

7. A method for securely transmitting archive data based on a two-way encryption algorithm according to claim 6, characterized in that: The method of segmenting the real-time data information by a slicing strategy and encrypting it by using a key and a secret key includes: Design a slice strategy, which is based on the slice size strategy formula and the slice quantity strategy formula, and obtain the slice size according to the slice strategy and number of slices ; The slice size output using the slice strategy and number of slices Segment the real-time data information to form data blocks; Allocate a subkey fragment to each data block, encrypt the data block using the allocated subkey fragment, and generate a ciphertext fragment; The slice size strategy formula is: , the slice quantity strategy formula is , Indicates the file size of real-time data information, Indicates the maximum number of slices, Indicates the network bandwidth. Indicates the transmission delay, Indicates the number of standard slices, Indicates the standard file size, Indicates the adjustment step size.

8. A method for securely transmitting archive data based on a two-way encryption algorithm according to claim 7, characterized in that: The method of designing a multi-encryption group according to the ciphertext fragment and using multi-path transmission, and the receiving end decrypting and restoring the data by using a dynamic key includes: A checksum is introduced for each ciphertext segment. The checksum is generated by HMAC. The ciphertext segment with the checksum added and the dynamic key are combined into a multi-element encryption group. The multiple encryption group is transmitted from the sender to the receiver through multi-path transmission. After receiving it, the receiver first recalculates the check value of each ciphertext fragment and compares it with the one provided by the sender: if they are inconsistent, a retransmission request is sent to the sender. If they are consistent, the receiver reconstructs the master key from the dynamic key, uses the master key to decrypt the data block, and reassembles the decrypted data blocks in sequence into complete real-time data information.

9. A method for securely transmitting archive data based on a two-way encryption algorithm according to claim 8, characterized in that: The method for transmitting the multi-encryption group from the sending end to the receiving end through multi-path transmission includes: the ciphertext fragment and the dynamic key are transmitted through independent transmission paths respectively.

10. A method for securely transmitting archive data based on a two-way encryption algorithm according to claim 9, characterized in that: The transmission report includes transmission status and identification information. The transmission status includes normal and abnormal. If the check values ​​are inconsistent, the transmission status is displayed as abnormal, and the identification information sent is a retransmission request. If the check values ​​are consistent, the transmission status is displayed as normal, and the identification information sent is successful transmission.

Images