Remote data rapid transmission system and method based on Internet

Abstract

The invention discloses a remote data rapid transmission system and method based on the Internet, a client initiates a session establishment request containing a session type identifier and a transmission protocol identifier to a server, receives a session response message after transmitting an initial data packet, obtains a temporary session key through verification of a key distribution center, and transmits the session response message to the server; an authorization identifier and a protocol verification symbol are generated through hierarchical decryption, a security enhancement data packet is constructed and sent, an end-to-end encryption transmission channel is further established, and meanwhile, a session maintenance mechanism is provided. And the server verifies a session type identifier and a transmission protocol identifier of the client, generates a session response message containing a dynamic confusion strategy and a trap identifier, submits the session response message to a key distribution center for signature, returns the session response message to the client, activates a secure transmission service instance after verifying a security enhancement data packet, and implements a series of security control strategies. According to the invention, the problems of low transmission efficiency and poor security of the existing remote data transmission system are effectively solved, and efficient and secure data transmission is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of Internet data processing, and in particular relates to a system and method for rapid remote data transmission based on the Internet. Background Art

[0002] In today's era of rapid internet development, remote data transmission has become an indispensable and critical component in many fields. Whether it's data exchange between enterprises, data calls in cloud computing services, or massive data transmission between IoT devices and servers, these operations place extremely high demands on the performance and security of data transmission systems.

[0003] Existing internet-based remote data transmission systems face numerous bottlenecks in transmission efficiency. For one thing, the traditional session establishment process often requires multiple round-trip communications, resulting in a significant connection overhead and severely impacting the timeliness of data transmission. For example, in applications requiring real-time responses, such as online financial transactions and remote medical diagnosis, excessive connection establishment times can lead to transaction failures or delayed diagnosis. Furthermore, due to the lack of effective optimization strategies, data packet transmission can be disrupted by factors such as network congestion and packet loss, further reducing transmission speeds.

[0004] Existing transmission systems also face significant security challenges. With the increasing diversity and sophistication of cyberattacks, data transmission is highly vulnerable to threats such as theft and tampering. For example, common man-in-the-middle attacks can intercept data packets during transmission and maliciously tamper with their contents or steal sensitive information. Furthermore, the security of traditional encryption methods has been questioned in the face of increasingly powerful computing power. Furthermore, inadequate session management and verification mechanisms can easily lead to security issues such as illegal session establishment and session hijacking, posing significant risks to user data security.

[0005] In summary, the existing Internet-based remote data transmission system has obvious deficiencies in transmission efficiency and security, and cannot meet the needs of the current rapidly developing Internet applications. A new remote data fast transmission system is urgently needed to solve these problems. Summary of the Invention

[0006] To this end, the present invention provides an Internet-based remote data rapid transmission system and method.

[0007] A first aspect of the present invention provides a method for rapid remote data transmission based on the Internet, which is applied to the client stage and includes the following steps:

[0008] Initiate a session establishment request containing a session type identifier and a transport protocol identifier to the server node, and transmit an initial data packet containing a service payload and a protocol control block;

[0009] Receive a session response message from the server node, which includes an operation status code, a protocol status code, and a dynamic session token;

[0010] Submit the dynamic session token to a key distribution center for verification to obtain a temporary session key;

[0011] Using the temporary session key to perform hierarchical decryption on the operation status code and the protocol status code to generate an authorization identifier and a protocol verifier;

[0012] Embedding the authorization identifier and protocol verifier into the protocol header of the reconstructed data packet to form a security-enhanced data packet;

[0013] Attaching the security enhancement data packet to a session control frame and sending it to the server node;

[0014] An end-to-end encrypted transmission channel corresponding to the session type identifier is established.

[0015] As a preferred embodiment, the protocol header reconstruction process specifically includes:

[0016] Parsing the timestamp identifier of the session response message;

[0017] Hash-binding the timestamp identifier with the authorization identifier and writing the result into the verification field of the protocol control block;

[0018] Add a metadata verification chain containing a timestamp identifier to the extended header of the business payload.

[0019] As a preferred embodiment, the dynamic session token includes:

[0020] Client authentication factors, including the session establishment request initiation timestamp and device fingerprint hash value;

[0021] Server authentication factors, including the session response message reception timestamp and the server digital certificate digest;

[0022] The key dynamic generation area consists of a fixed-length basic key segment and a variable-length extended key segment.

[0023] The basic key segment includes an initial vector generated by a pseudo-random number generator.

[0024] The extended key segment is dynamically extended according to the number of historical sessions, and each session adds an additional verification bit containing the hash value of the previous session.

[0025] As a preferred method, a session maintenance mechanism is also included:

[0026] After the encrypted transmission channel is established, the session heartbeat packet is periodically submitted to the key distribution center;

[0027] When a network topology change is detected, a key rotation protocol based on elliptic curve cryptography is triggered;

[0028] Rebuild the security enhancement data package based on the update token issued by the key distribution center.

[0029] A second aspect of the present invention provides an Internet-based remote data rapid transmission system, using a server node, comprising the following steps:

[0030] Verify whether the session type identifier sent by the client node complies with the preset whitelist policy;

[0031] Check whether the transport protocol identifier matches the current security protocol stack;

[0032] Generates a session response message containing the dynamic obfuscation policy, including:

[0033] When the session type is abnormal, a first-class trap identifier is embedded in the operation status code;

[0034] When the protocol type is abnormal, a second type of trap identifier is embedded in the protocol status code;

[0035] Submit the session response message containing the trap identifier to the key distribution center for token signing;

[0036] Returns a digitally signed dynamic session token and security challenge response to the client node;

[0037] Verify the metadata check chain in the security enhancement data packet returned by the client node;

[0038] Activate the secure transmission service instance corresponding to the session type identifier.

[0039] As a preferred method, after generating a combination of a session verification request and a trap identifier, the legitimacy of the trap identifier is verified through a trusted execution environment;

[0040] Generate multi-layer nested temporary session keys based on a preset key derivation tree;

[0041] Injecting a hidden verification code containing a transmission path fingerprint into the extended key segment of the dynamic session token;

[0042] Distribute key activation instructions containing two-way authentication requirements to client nodes;

[0043] Distribute key activation instructions containing two-way authentication requirements to client nodes;

[0044] Monitor the usage of dynamic session tokens in real time. When abnormal access patterns are detected:

[0045] Triggering geofence-based access control policies;

[0046] Generate a surrogate key pair with forward-secure properties;

[0047] Send a key revocation list update notification. If the two-way authentication requirement is passed, the replacement key pair will be updated and issued to the client.

[0048] As a preferred embodiment, the key derivation tree construction process includes:

[0049] Generate an initial root key based on the communication history of the client-server node pair;

[0050] Generate branch keys through a key stretching function based on transmission delay;

[0051] In each session cycle, a key mutation algorithm based on chaotic sequence is used to update the leaf node key.

[0052] A third aspect of the present invention provides a system for executing the methods of the first and second aspects of the present invention, comprising:

[0053] The client module deployed on the edge computing node has a dynamic token processing unit and a protocol adaptation engine;

[0054] The server module deployed on the cloud platform has a security policy decision point and a transmission channel controller;

[0055] A key management module deployed on a trusted third party, with a hardware security unit and key lifecycle management components;

[0056] The modules interact with each other through quantum secure channels for control signaling, and use a data encapsulation mechanism based on national secret algorithms to achieve end-to-end protection.

[0057] The above technical solution of the present invention has the following advantages over the prior art:

[0058] By initiating a session establishment request containing a session type identifier and a transport protocol identifier to a server node and rapidly transmitting an initial data packet containing the service payload and protocol control block, this method significantly reduces the number of round trips required during session establishment and significantly shortens connection establishment time. Compared to traditional systems, this method can complete session establishment in a shorter time, paving the way for rapid data transmission. This method is particularly suitable for applications requiring extremely high real-time performance, such as online gaming and video conferencing, and can effectively enhance the user experience.

[0059] By submitting the dynamic session token to the key distribution center for verification, a temporary session key is obtained. This key is then used to perform layered decryption of the operation status code and protocol status code to generate an authorization identifier and protocol authenticator. These are then embedded in the protocol header of the reconstructed data packet to form a security-enhanced data packet, effectively preventing theft and tampering of data during transmission. Furthermore, the timestamp identifier of the session response message is parsed and hashed with the authorization identifier, and a metadata check chain containing the timestamp identifier is added to the extended header of the service payload, further enhancing data integrity verification and ensuring its authenticity and reliability.

[0060] Dynamic session tokens contain a client-side authentication factor, a server-side authentication factor, and a dynamically generated key area consisting of a base key segment and an extended key segment. The extended key segment dynamically expands based on the number of historical sessions, and each session adds an additional authentication bit containing the hash value of the previous session. This complex and dynamically changing token structure greatly increases the difficulty of cracking by attackers, effectively ensuring session security.

[0061] The server node verifies whether the session type identifier sent by the client node complies with the preset whitelist policy, checks whether the transmission protocol identifier matches the current security protocol stack, and implants a trap identifier when the session type or protocol type is abnormal. This can timely detect and prevent the establishment of illegal sessions, effectively resist various network attacks, and protect the security of data transmission.

[0062] After the encrypted transmission channel is established, session heartbeat packets are periodically submitted to the key distribution center to ensure the continued validity of the session. When network topology changes are detected, a key rotation protocol based on elliptic curve cryptography is triggered, and the security-enhanced data packet is rebuilt based on the update token issued by the key distribution center, ensuring the stability and security of data transmission in complex network environments.

[0063] The server node monitors the usage status of dynamic session tokens in real time. When an abnormal access pattern is detected, it can quickly trigger the geo-fence-based access control policy, generate an alternative key pair with forward security features, and send a key revocation list update notification to the client node to respond to potential security threats in a timely manner and ensure the security and integrity of data transmission.

[0064] The system provided by this invention includes a client module deployed on edge computing nodes, a server module deployed on a cloud platform, and a key management module deployed by a trusted third party. These modules interact with each other through a quantum secure channel for control signaling, and employ a data encapsulation mechanism based on a national secret algorithm to achieve end-to-end protection. This architecture not only leverages the low latency of edge computing and the powerful computing power of cloud computing, but also ensures the security and reliability of data transmission through quantum secure channels and advanced encryption algorithms, providing a comprehensive, efficient, and secure solution for rapid remote data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 is a structural block diagram of a system provided by an embodiment of the present invention; DETAILED DESCRIPTION

[0066] In order to be able to understand the features and technical content of the embodiments of the present disclosure in more detail, the implementation of the embodiments of the present disclosure is described in detail below in conjunction with the accompanying drawings. The accompanying drawings are for reference only and are not used to limit the embodiments of the present disclosure. In the following technical description, for the sake of convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0067] In a first aspect of the embodiments of the present disclosure, a method for rapid remote data transmission based on the Internet is provided, which is applied to a client stage and includes the following steps:

[0068] Initiate a session establishment request containing a session type identifier and a transport protocol identifier to the server node, and transmit an initial data packet containing a service payload and a protocol control block;

[0069] Receive a session response message from the server node, which includes an operation status code, a protocol status code, and a dynamic session token;

[0070] Submit the dynamic session token to a key distribution center for verification to obtain a temporary session key;

[0071] Using the temporary session key to perform hierarchical decryption on the operation status code and the protocol status code to generate an authorization identifier and a protocol verifier;

[0072] Embedding the authorization identifier and protocol verifier into the protocol header of the reconstructed data packet to form a security-enhanced data packet;

[0073] Attaching the security enhancement data packet to a session control frame and sending it to the server node;

[0074] An end-to-end encrypted transmission channel corresponding to the session type identifier is established.

[0075] As a preferred embodiment, the protocol header reconstruction process specifically includes:

[0076] Parsing the timestamp identifier of the session response message;

[0077] Hash-binding the timestamp identifier with the authorization identifier and writing the result into the verification field of the protocol control block;

[0078] Add a metadata verification chain containing a timestamp identifier to the extended header of the business payload.

[0079] As a preferred embodiment, the dynamic session token includes:

[0080] Client authentication factors, including the session establishment request initiation timestamp and device fingerprint hash value;

[0081] Server authentication factors, including the session response message reception timestamp and the server digital certificate digest;

[0082] The key dynamic generation area consists of a fixed-length basic key segment and a variable-length extended key segment.

[0083] The basic key segment includes an initial vector generated by a pseudo-random number generator.

[0084] The extended key segment is dynamically extended according to the number of historical sessions, and each session adds an additional verification bit containing the hash value of the previous session.

[0085] As a preferred method, a session maintenance mechanism is also included:

[0086] After the encrypted transmission channel is established, the session heartbeat packet is periodically submitted to the key distribution center;

[0087] When a network topology change is detected, a key rotation protocol based on elliptic curve cryptography is triggered;

[0088] Rebuild the security enhancement data package based on the update token issued by the key distribution center.

[0089] A second aspect of the present disclosure provides an Internet-based remote data rapid transmission system, using a server node, comprising the following steps:

[0090] Verify whether the session type identifier sent by the client node complies with the preset whitelist policy;

[0091] Check whether the transport protocol identifier matches the current security protocol stack;

[0092] Generates a session response message containing the dynamic obfuscation policy, including:

[0093] When the session type is abnormal, a first-class trap identifier is embedded in the operation status code;

[0094] When the protocol type is abnormal, a second type of trap identifier is embedded in the protocol status code;

[0095] Submit the session response message containing the trap identifier to the key distribution center for token signing;

[0096] Returns a digitally signed dynamic session token and security challenge response to the client node;

[0097] Verify the metadata check chain in the security enhancement data packet returned by the client node;

[0098] Activate the secure transmission service instance corresponding to the session type identifier.

[0099] As a preferred method, after generating a combination of a session verification request and a trap identifier, the legitimacy of the trap identifier is verified through a trusted execution environment;

[0100] Generate multi-layer nested temporary session keys based on a preset key derivation tree;

[0101] Injecting a hidden verification code containing a transmission path fingerprint into the extended key segment of the dynamic session token;

[0102] Distribute key activation instructions containing two-way authentication requirements to client nodes;

[0103] Monitor the usage of dynamic session tokens in real time. When abnormal access patterns are detected:

[0104] Triggering geofence-based access control policies;

[0105] Generate a surrogate key pair with forward-secure properties;

[0106] Send key revocation list update notification to the client node.

[0107] As a preferred embodiment, the key derivation tree construction process includes:

[0108] Generate an initial root key based on the communication history of the client-server node pair;

[0109] Generate branch keys through a key stretching function based on transmission delay;

[0110] In each session cycle, a key mutation algorithm based on chaotic sequence is used to update the leaf node key.

[0111] A third aspect of the present disclosure provides a system for executing the methods of the first and second aspects of the present disclosure, including:

[0112] The client module deployed on the edge computing node has a dynamic token processing unit and a protocol adaptation engine;

[0113] The server module deployed on the cloud platform has a security policy decision point and a transmission channel controller;

[0114] A key management module deployed on a trusted third party, with a hardware security unit and key lifecycle management components;

[0115] The modules interact with each other through quantum secure channels for control signaling, and use a data encapsulation mechanism based on national secret algorithms to achieve end-to-end protection.

[0116] The above technical solutions of the embodiments of the present disclosure have the following advantages over the prior art:

[0117] By initiating a session establishment request containing a session type identifier and a transport protocol identifier to a server node and rapidly transmitting an initial data packet containing a service payload and a protocol control block, the disclosed embodiment significantly reduces the number of round trips during session establishment and significantly shortens connection establishment time. Compared to traditional systems, session establishment can be completed in a shorter time, laying the foundation for rapid data transmission. This approach is particularly suitable for applications with extremely high real-time requirements, such as online gaming and video conferencing, and can effectively enhance the user experience.

[0118] By submitting the dynamic session token to the key distribution center for verification, a temporary session key is obtained. This key is then used to perform layered decryption of the operation status code and protocol status code to generate an authorization identifier and protocol authenticator. These are then embedded in the protocol header of the reconstructed data packet to form a security-enhanced data packet, effectively preventing theft and tampering of data during transmission. Furthermore, the timestamp identifier of the session response message is parsed and hashed with the authorization identifier, and a metadata check chain containing the timestamp identifier is added to the extended header of the service payload, further enhancing data integrity verification and ensuring its authenticity and reliability.

[0119] Dynamic session tokens contain a client-side authentication factor, a server-side authentication factor, and a dynamically generated key area consisting of a base key segment and an extended key segment. The extended key segment dynamically expands based on the number of historical sessions, and each session adds an additional authentication bit containing the hash value of the previous session. This complex and dynamically changing token structure greatly increases the difficulty of cracking by attackers, effectively ensuring session security.

[0120] The server node verifies whether the session type identifier sent by the client node complies with the preset whitelist policy, checks whether the transmission protocol identifier matches the current security protocol stack, and implants a trap identifier when the session type or protocol type is abnormal. This can timely detect and prevent the establishment of illegal sessions, effectively resist various network attacks, and protect the security of data transmission.

[0121] After the encrypted transmission channel is established, session heartbeat packets are periodically submitted to the key distribution center to ensure the continued validity of the session. When network topology changes are detected, a key rotation protocol based on elliptic curve cryptography is triggered, and the security-enhanced data packet is rebuilt based on the update token issued by the key distribution center, ensuring the stability and security of data transmission in complex network environments.

[0122] The server node monitors the usage status of dynamic session tokens in real time. When an abnormal access pattern is detected, it can quickly trigger the geo-fence-based access control policy, generate an alternative key pair with forward security features, and send a key revocation list update notification to the client node to respond to potential security threats in a timely manner and ensure the security and integrity of data transmission.

[0123] The system provided by the disclosed embodiments includes a client module deployed on edge computing nodes, a server module deployed on a cloud platform, and a key management module deployed by a trusted third party. These modules interact with each other through a quantum secure channel for control signaling, and employ a data encapsulation mechanism based on a national cryptographic algorithm to achieve end-to-end protection. This architecture not only fully leverages the low latency advantages of edge computing and the powerful computing power of cloud computing, but also ensures the security and reliability of data transmission through quantum secure channels and advanced encryption algorithms, providing a comprehensive, efficient, and secure solution for rapid remote data transmission.

[0124] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible variations. Unless explicitly required, individual components and functions are optional, and the order of operations may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to also include plural forms. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of one or more associated listings. In addition, when used in this application, the term "comprise" and its variations "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or modules, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, modules and / or groups thereof. In the absence of further restrictions, an element defined by the statement "comprises a..." does not exclude the presence of other identical elements in the process, method or device that includes the element. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments can be referenced to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can be found in the description of the method part.

Claims

1. A remote data rapid transmission method based on the Internet, applied to a client node, characterized in that: include: Initiate a session establishment request containing a session type identifier and a transport protocol identifier to the server node, and transmit an initial data packet containing a service payload and a protocol control block; Receive a session response message from the server node, which includes an operation status code, a protocol status code, and a dynamic session token; Submit the dynamic session token to a key distribution center for verification to obtain a temporary session key; Using the temporary session key to perform hierarchical decryption on the operation status code and the protocol status code to generate an authorization identifier and a protocol verifier; Embedding the authorization identifier and protocol verifier into the protocol header of the reconstructed data packet to form a security-enhanced data packet; Attaching the security enhancement data packet to a session control frame and sending it to the server node; An end-to-end encrypted transmission channel corresponding to the session type identifier is established.

2. The method according to claim 1, characterized in that The protocol header reconstruction process specifically includes: Parsing the timestamp identifier of the session response message; Hash-binding the timestamp identifier with the authorization identifier and writing the result into the verification field of the protocol control block; Add a metadata verification chain containing a timestamp identifier to the extended header of the business payload.

3. The transmission method according to claim 1, wherein: The dynamic session token contains: Client authentication factors, including the session establishment request initiation timestamp and device fingerprint hash value; Server authentication factors, including the session response message reception timestamp and the server digital certificate digest; The key dynamic generation area consists of a fixed-length basic key segment and a variable-length extended key segment. The basic key segment includes an initial vector generated by a pseudo-random number generator. The extended key segment is dynamically extended according to the number of historical sessions, and each session adds an additional verification bit containing the hash value of the previous session.

4. The method according to claim 1, wherein Also includes session maintenance mechanism: After the encrypted transmission channel is established, the session heartbeat packet is periodically submitted to the key distribution center; When a network topology change is detected, a key rotation protocol based on elliptic curve cryptography is triggered; Rebuild the security enhancement data package based on the update token issued by the key distribution center.

5. A method for rapid remote data transmission based on the Internet, applied to a server node, comprising the following steps: Verify whether the session type identifier sent by the client node complies with the preset whitelist policy; Check whether the transport protocol identifier matches the current security protocol stack; Generates a session response message containing the dynamic obfuscation policy, including: When the session type is abnormal, a first-class trap identifier is embedded in the operation status code; When the protocol type is abnormal, a second type of trap identifier is embedded in the protocol status code; Submit the session response message containing the trap identifier to the key distribution center for token signing; Returns a digitally signed dynamic session token and security challenge response to the client node; Verify the metadata check chain in the security enhancement data packet returned by the client node; Activate the secure transmission service instance corresponding to the session type identifier.

6. The method according to claim 5, further comprising the steps of: Based on the combination of the session authentication request and the trap identifier, the legitimacy of the trap identifier is verified through the trusted execution environment; Generate multi-layer nested temporary session keys based on a preset key derivation tree; Injecting a hidden verification code containing a transmission path fingerprint into the extended key segment of the dynamic session token; Distribute key activation instructions containing two-way authentication requirements to client nodes; Monitor the usage of dynamic session tokens in real time. When abnormal access patterns are detected: Triggering geofence-based access control policies; Generate a surrogate key pair with forward-secure properties; Send a key revocation list update notification. If the two-way authentication requirement is passed, the replacement key pair will be updated and issued to the client.

7. The method according to claim 6, characterized in that The key derivation tree construction process includes: Generate an initial root key based on the communication history of the client-server node pair; Generate branch keys through a key stretching function based on transmission delay; In each session cycle, a key mutation algorithm based on chaotic sequence is used to update the leaf node key.

8. An Internet data security transmission system, characterized in that: include: The client module deployed on the edge computing node has a dynamic token processing unit and a protocol adaptation engine; The server module deployed on the cloud platform has a security policy decision point and a transmission channel controller; A key management module deployed on a trusted third party, with a hardware security unit and key lifecycle management components; The modules interact with each other through quantum secure channels for control signaling, and use a data encapsulation mechanism based on national secret algorithms to achieve end-to-end protection.

Images