Data transmission encryption method and system

Abstract

The application belongs to the technical field of data security, and provides a data transmission encryption method and system. The method comprises the following steps: obtaining a transmission identifier by analyzing a hard disk data transmission request, calculating a time sensitivity coefficient and determining a transmission priority; determining a key fusion tree and a hybrid encryption key based on the coefficient and the priority; performing block processing on a data transmission object; matching and encrypting data blocks with encryption keys, and calculating an integrity check value; adjusting the key according to the change of the time sensitivity coefficient and regenerating the check value to form a transmission log. The application improves the data transmission security and efficiency, and enhances the data integrity verification capability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, in particular to a data transmission encryption method and system. BACKGROUND

[0002] With the rapid development of information technology, data transmission and storage security problems are increasingly prominent. In the process of hard disk data transmission, data security and transmission efficiency become important concerns. Traditional data transmission encryption technology mainly adopts a single encryption algorithm or a fixed key system, which protects the transmission data by encryption to prevent data from being illegally obtained or tampered with during transmission. At present, common data transmission encryption methods include symmetric encryption, asymmetric encryption and hybrid encryption technology, which are widely used in various network environments and application scenarios.

[0003] However, the existing data transmission encryption technology has some obvious defects and deficiencies. The traditional encryption method cannot automatically adjust the encryption strategy and transmission priority according to the urgency of data transmission requirements, which may affect the business process due to the delay of the encryption process. The existing technology mainly uses a single key system or a simple key combination method, which lacks the ability to dynamically construct a key fusion structure according to the data characteristics, and the security is relatively weak and vulnerable to targeted attacks. The existing technology often lacks a complete data integrity verification mechanism and a secure log recording system during data transmission, making it difficult to effectively track the entire data transmission process and unable to timely discover and respond to potential security threats. SUMMARY

[0004] The embodiments of the present application provide a data transmission encryption method and system, which can at least solve some of the problems existing in the prior art.

[0005] In a first aspect of the embodiments of the present application, a data transmission encryption method is provided, comprising:

[0006] The received hard disk data transmission request is parsed to obtain a transmission identifier, a time-sensitive coefficient is calculated according to the transmission identifier, and a data transmission priority is determined according to the time-sensitive coefficient;

[0007] A key fusion tree is determined based on the time-sensitive coefficient and the data transmission priority, and a hybrid encryption key is determined based on the key fusion tree;

[0008] The data transmission object corresponding to the transmission identifier is obtained, and the data transmission object is processed by block to obtain a plurality of data transmission blocks according to the branch structure of the key fusion tree;

[0009] The data transmission blocks are matched with the hybrid encryption key according to the data transmission priority, the data transmission blocks are encrypted using the matched hybrid encryption key, and a data integrity check value of each data transmission block is calculated;

[0010] The hybrid encryption key is adjusted based on the change curve of the time-sensitive coefficient, a data integrity check value is regenerated based on the adjusted hybrid encryption key, and a data transmission log is formed by recording the data integrity check value and the change curve of the time-sensitive coefficient.

[0011] The received hard disk data transmission request is parsed to obtain a transmission identifier, a time-sensitive coefficient is calculated according to the transmission identifier, and a data transmission priority is determined according to the time-sensitive coefficient, including:

[0012] A hard disk data transmission request is received, the hard disk data transmission request is parsed to obtain a transmission identifier, a data transmission start time and a data transmission end time are extracted based on the transmission identifier, and a task attribute field and a time attribute field are obtained by segmenting and encoding the transmission identifier;

[0013] A time-sensitive transmission task is established according to the combination of the task attribute field and the time attribute field;

[0014] The data transmission start time and the data transmission end time in the time-sensitive transmission task are calculated to obtain a data transmission time window, and a real-time time slice sequence is generated according to the data transmission time window;

[0015] A time-sensitive threshold value is calculated according to the real-time time slice sequence, the time-sensitive threshold value is matched with a preset data transmission task type to obtain a time-sensitive mapping matrix;

[0016] The element value of the time-sensitive mapping matrix is convoluted with a preset time weight coefficient to obtain a time-sensitive coefficient, a priority offset is calculated by calculating the difference between the time-sensitive coefficient and a preset priority reference value, and a data transmission priority is obtained by dynamically adjusting the preset priority reference value according to the priority offset.

[0017] A key fusion tree is determined based on the time-sensitive coefficient and the data transmission priority, and a hybrid encryption key is determined based on the key fusion tree, including:

[0018] A time feature key is generated according to the time-sensitive coefficient, and a master key is determined according to the data transmission priority;

[0019] The key components of the time feature key are used as row vectors, and the key components of the master key are used as column vectors to determine a key feature matrix;

[0020] The key feature matrix is blocked to obtain a plurality of sub-matrices, a key fusion tree is determined based on the plurality of sub-matrices, a root node of the key fusion tree stores the key feature matrix, an intermediate node of the key fusion tree stores the plurality of sub-matrices, and a leaf node of the key fusion tree stores row vectors and column vectors of the plurality of sub-matrices.

[0021] The key feature matrix is singular value decomposed to obtain a feature space mapping matrix, the time feature key and the master key are projected into the feature space mapping matrix to obtain key projection vectors, and a key fusion coefficient is calculated according to orthogonality of the key projection vectors.

[0022] The time feature key and the master key are fused based on the key fusion coefficient to obtain a hybrid encryption key.

[0023] The key feature matrix is singular value decomposed to obtain a feature space mapping matrix, the time feature key and the master key are projected into the feature space mapping matrix to obtain key projection vectors, and a key fusion coefficient is calculated according to orthogonality of the key projection vectors.

[0024] The key feature matrix is singular value decomposed to obtain a left singular matrix, a singular value matrix, and a right singular matrix, and a feature weight vector is obtained according to diagonal elements of the singular value matrix.

[0025] The left singular matrix and the right singular matrix are orthogonally transformed to obtain a feature space mapping matrix, and an orthogonal feature base is obtained by using the feature space mapping matrix and the feature weight vector.

[0026] The time feature key and the master key are projected into the orthogonal feature base to obtain a time feature projection vector and a master key projection vector.

[0027] An orthogonal degree measure value is obtained based on the feature weight vector and a weighted included angle between the time feature projection vector and the master key projection vector, and an initial fusion coefficient is calculated according to the orthogonal degree measure value and the feature weight vector.

[0028] A normalized weight is obtained by normalizing the feature weight vector, an entropy value adjustment factor is obtained by calculating an information entropy of the normalized weight, and a fusion coefficient adjustment function is obtained.

[0029] A function coefficient of the fusion coefficient adjustment function is dynamically adjusted according to the entropy value adjustment factor, the initial fusion coefficient is input into the adjusted fusion coefficient adjustment function to obtain the key fusion coefficient.

[0030] Obtain the data transmission object corresponding to the transmission identifier, and divide the data transmission object into multiple data transmission blocks according to the branch structure of the key fusion tree, including:

[0031] The data transmission object and the node hierarchy and node weight of the key fusion tree are obtained based on the transmission identifier;

[0032] The data transmission object is hierarchically decomposed according to the node hierarchy of the key fusion tree to generate multi-level data blocks corresponding to the number of levels of the key fusion tree.

[0033] Data distribution feature sequence is obtained by statistically analyzing the data distribution characteristics of each data block in the multi-layer data block.

[0034] Information entropy is calculated on the data distribution feature sequence to obtain a hierarchical entropy value sequence, and the data block priority is determined based on the hierarchical entropy value sequence;

[0035] The data block priority is weighted and fused with the node weight of the key fusion tree to obtain the block weight coefficient, and the multi-layer data block is adaptively divided according to the block weight coefficient;

[0036] A data block correlation matrix is ​​constructed based on the hierarchical entropy value sequence. The data block correlation matrix is ​​then clustered using a spectral clustering algorithm to obtain the target number of blocks. The multi-level data blocks are then merged and recombined into multiple data transmission blocks corresponding to the target number of blocks.

[0037] The data transmission blocks are matched with the hybrid encryption key according to the data transmission priority, the matched hybrid encryption key is used to encrypt the data transmission blocks, and a data integrity check value is calculated for each data transmission block, including:

[0038] Using the data transmission blocks as nodes, a priority graph is constructed based on the data transmission priority of the data transmission blocks;

[0039] Calculate the data transmission priority difference between adjacent nodes in the priority graph, use the data transmission priority difference as the edge weight between nodes, and calculate the degree centrality and clustering coefficient of the nodes based on the edge weight;

[0040] The priority graph is grouped based on the degree centrality of the nodes and the clustering coefficients to obtain multiple node groups;

[0041] calculating average degree centrality and average clustering coefficient of nodes in each node group, determining a key fusion ratio according to the average degree centrality and the average clustering coefficient, fusing the hybrid encryption key in each node group according to the key fusion ratio to obtain an intra-group encryption key;

[0042] matching the data transmission block with the intra-group encryption key of the corresponding node group according to the data transmission priority, encrypting the data transmission block using the matched intra-group encryption key, and calculating an integrity check value of the encrypted data transmission block based on the degree centrality and the clustering coefficient of the nodes.

[0043] calculating average degree centrality and average clustering coefficient of nodes in each node group, determining a key fusion ratio according to the average degree centrality and the average clustering coefficient, fusing the hybrid encryption key in each node group according to the key fusion ratio to obtain an intra-group encryption key, comprising:

[0044] generating a degree centrality distribution sequence according to the degree centrality of each node in the node group, and calculating the average degree centrality by calculating the mean value of the degree centrality distribution sequence;

[0045] generating a clustering coefficient distribution sequence according to the clustering coefficient of each node in the node group, and calculating the average clustering coefficient by calculating the mean value of the clustering coefficient distribution sequence;

[0046] determining a two-dimensional feature space according to the average degree centrality and the average clustering coefficient, calculating a distribution angle of the nodes in the two-dimensional feature space to obtain an angle sequence, and constructing a weight mapping curve according to the angle sequence;

[0047] converting the average degree centrality and the average clustering coefficient into an initial weight vector using the weight mapping curve, and calculating a projection distribution of the initial weight vector in the two-dimensional feature space to obtain a node group feature entropy;

[0048] segmenting the degree centrality distribution sequence and the clustering coefficient distribution sequence to obtain a plurality of feature intervals, counting the number of nodes in each feature interval to obtain a distribution density, and determining a key fusion ratio according to the distribution density and the node group feature entropy;

[0049] fusing the hybrid encryption key in the node group according to the key fusion ratio to obtain an intra-group encryption key.

[0050] In a second aspect of the embodiment of the application, a data transmission encryption system is provided, comprising:

[0051] The first unit is configured to parse the received hard disk data transmission request to obtain a transmission identifier, calculate a time-sensitive coefficient according to the transmission identifier, and determine a data transmission priority according to the time-sensitive coefficient.

[0052] The second unit is configured to determine a key fusion tree based on the time-sensitive coefficient and the data transmission priority, and determine a hybrid encryption key based on the key fusion tree.

[0053] The third unit is configured to obtain a data transmission object corresponding to the transmission identifier, and perform block processing on the data transmission object according to a branch structure of the key fusion tree to obtain a plurality of data transmission blocks.

[0054] The fourth unit is configured to match the data transmission blocks with the hybrid encryption key according to the data transmission priority, encrypt the data transmission blocks using the matched hybrid encryption key, and calculate a data integrity check value of each data transmission block.

[0055] The fifth unit is configured to adjust the hybrid encryption key based on a change curve of the time-sensitive coefficient, regenerate a data integrity check value based on the adjusted hybrid encryption key, and record the data integrity check value and the change curve of the time-sensitive coefficient to form a data transmission log.

[0056] In a third aspect, an electronic device is provided, including:

[0057] a processor;

[0058] a memory for storing processor-executable instructions;

[0059] The processor is configured to invoke the instructions stored in the memory to execute the method described above.

[0060] In a fourth aspect, a computer-readable storage medium is provided, which stores computer program instructions, and the computer program instructions are executed by a processor to implement the method described above.

[0061] The data transmission encryption method provided by the application can dynamically adjust the encryption strategy according to the actual demand of data transmission, and improve the flexibility and adaptability of data transmission encryption.

[0062] The application realizes data hierarchical encryption protection by constructing a key fusion tree based on a time sensitivity coefficient and a data transmission priority, and performing block processing on a data transmission object according to the key fusion tree, so that data blocks of different importance degrees can adopt different encryption measures, the security of key data is ensured, the waste of encryption resources is avoided, and the overall system performance is improved.

[0063] The application dynamically adjusts the hybrid encryption key according to the change curve of the time sensitivity coefficient, and regenerates the data integrity check value to form a complete data transmission log, which not only enhances the security of the data transmission process, but also provides a perfect audit traceability mechanism, effectively prevents data from being illegally tampered with or stolen, and guarantees the reliability and integrity of data transmission. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 A flowchart of the data transmission encryption method of the embodiment of the application is shown.

[0065] Figure 2 A flowchart of determining the hybrid encryption key of the embodiment of the application is shown. DETAILED DESCRIPTION

[0066] To make the purpose, technical scheme and advantages of the embodiments of the application clearer, the technical scheme of the embodiments of the application will be described in detail below with reference to the drawings of the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all the embodiments of the application. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0067] The technical scheme of the application will be described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in some embodiments.

[0068] Figure 1 A flowchart of the data transmission encryption method of the embodiment of the application is shown. As shown in Figure 1 The method comprises:

[0069] The received hard disk data transmission request is parsed, the time sensitivity coefficient is calculated according to the transmission identifier, and the data transmission priority is determined according to the time sensitivity coefficient; the key fusion tree is determined based on the time sensitivity coefficient and the data transmission priority, and the hybrid encryption key is determined based on the key fusion tree;

[0070] The data transmission object corresponding to the transmission identifier is obtained, and the data transmission object is block processed according to the branch structure of the key fusion tree to obtain a plurality of data transmission blocks;

[0071] The data transmission blocks are matched with the hybrid encryption key according to the data transmission priority, the matched hybrid encryption key is used to encrypt the data transmission blocks, and a data integrity check value of each data transmission block is calculated;

[0072] The hybrid encryption key is adjusted based on the change curve of the time sensitivity coefficient, a data integrity check value is regenerated based on the adjusted hybrid encryption key, and the data integrity check value and the change curve of the time sensitivity coefficient are recorded to form a data transmission log.

[0073] The hard disk data transmission request can include information such as a transmission identifier, data source information, a target address, and transmission content. The priority is divided into five levels: highest, high, medium, low, and lowest, and the corresponding priority values are 5, 4, 3, 2, and 1, respectively. When the time sensitivity coefficient is between 0.9 and 1, it is set to the highest priority; when it is between 0.7 and 0.9, it is set to the high priority; when it is between 0.5 and 0.7, it is set to the medium priority; when it is between 0.3 and 0.5, it is set to the low priority; and when it is between 0.1 and 0.3, it is set to the lowest priority.

[0074] The key fusion tree is a multi-level tree structure used to organize and manage encryption keys. In this embodiment, the depth of the key fusion tree is related to the time sensitivity coefficient. The higher the time sensitivity coefficient, the greater the depth of the tree and the more branches. Specifically, the time sensitivity coefficient multiplied by 10 gives the maximum depth of the key fusion tree, for example, a time sensitivity coefficient of 0.95 corresponds to a maximum depth of 9 layers. The data transmission priority determines the number of branches at each node, with 5 child nodes per node for a priority of 5, 4 child nodes per node for a priority of 4, and so on. Therefore, for a time sensitivity coefficient of 0.95 and a priority of 5, the key fusion tree constructed is a 5-ary tree with a depth of 9 layers.

[0075] After the key fusion tree is constructed, the hybrid encryption key can be generated based on the structure of the tree, and the base key fragments are distributed at each node of the tree. From the root node to the leaf node, the length of the key fragments increases layer by layer. The length of the key fragment at the root node is 32 bits, and increases by 8 bits for each descending layer until the leaf node. Then the key fragments are fused from the leaf node upwards, and the key fragments of the child nodes are combined with the key fragments of the parent nodes using the bitwise XOR operation to finally generate the hybrid encryption key at the root node.

[0076] After obtaining the data transmission object corresponding to the transmission identifier, the data object can be processed in blocks according to the branch structure of the key fusion tree. The block processing follows the branch characteristics of the tree, that is, if the key fusion tree is a 5-ary tree, the data transmission object is evenly divided into 5 main blocks, and each main block is further subdivided according to the number of branches of the next layer until the set minimum block size (usually 4 KB) is reached or the maximum depth of the tree is reached. For example, for a 100 MB data transmission object, a 5-ary tree structure is used for block division. The first layer divides it into 5 blocks of 20 MB each, the second layer divides each 20 MB block into 5 blocks of 4 MB each, and so on. After block division, each data block is associated with the node at the corresponding position in the tree, facilitating subsequent encryption processing.

[0077] When matching the data transmission blocks with the hybrid encryption keys according to the data transmission priority, the higher the priority of the data block, the more complex the key combination can be used. Specifically, the hybrid encryption key of the root node is used as the basis, combined with the position information of the data block in the tree, and the encryption key dedicated to the data block is generated through the key expansion algorithm. For example, a data block with a priority of 5 can use all 256 bits of the hybrid encryption key for encryption, while a data block with a priority of 4 can only use the first 204 bits (256 x 0.8 = 204.8). For large data volumes, a segmented encryption strategy can also be implemented, i.e. large data blocks are further divided into fixed-size segments (such as 1 MB), and each segment is encrypted using a slightly changed key. The change is a bit rotation of the base key, and the number of bits moved is related to the segment number.

[0078] After encrypting the data transmission blocks using the matching hybrid encryption keys, the data integrity check value of each data transmission block can be calculated. The calculation method uses a combination of cyclic redundancy check (CRC) and hash function. First, apply the CRC32 algorithm to the data block to get a 32-bit check value, then combine the check value with the first 32 bytes of the data block, and apply the SHA-256 hash algorithm to generate the final 256-bit integrity check value. For example, for a 4 KB encrypted data block, the CRC32 calculation result is "A1B2C3D4", and the SHA-256 hash value generated by combining the first 32 bytes of the data block is "F7E6D5C4B3A2918F7E6D5C4B3A2918F7E6D5C4B3A2918F7E6D5C4B3A2918".

[0079] The change curve of the time-sensitive coefficient is generally a curve decreasing with time, and the embodiment adopts an exponential decay model to describe the change process. The time-sensitive coefficient is recalculated every certain time interval (e.g., 1 hour), and a change curve is formed by recording. For example, the initial time-sensitive coefficient is 0.95, which can be reduced to 0.94 after one hour, to 0.93 after two hours, and so on. According to the change curve, the hybrid encryption key is adjusted regularly, and the adjustment method is to perform bit operation transformation on the original key, including bit inversion, bit movement and bit replacement. The adjustment amplitude is proportional to the reduction amplitude of the time-sensitive coefficient, for example, the time-sensitive coefficient is reduced by 0.01, and the key is transformed by 1% of the bit operation.

[0080] The adjusted hybrid encryption key can be used to regenerate the data integrity check value, and the new check value calculation method is the same as the foregoing, but the adjusted key is used for processing. The original check value, the new check value, the check time point and the corresponding time-sensitive coefficient are recorded in the data transmission log. The log is stored in a key-value pair format, including a transmission identifier, a data block identifier, a timestamp, a time-sensitive coefficient, an integrity check value and the like. The newly generated log can be appended to the log file regularly, and a complete transmission report is generated after the transmission is completed, which includes the complete change curve of the time-sensitive coefficient and the integrity check record of all data blocks.

[0081] Through the above technical means, the application can dynamically adjust the encryption strategy and transmission priority according to the time-sensitive characteristics of the data, improve the security and efficiency of the data transmission, and is particularly suitable for data transmission scenarios with high time efficiency requirements.

[0082] In an optional embodiment, the received hard disk data transmission request is parsed to obtain a transmission identifier, a time-sensitive coefficient is calculated according to the transmission identifier, and a data transmission priority is determined according to the time-sensitive coefficient, comprising:

[0083] A hard disk data transmission request is received, the hard disk data transmission request is parsed to obtain a transmission identifier, a data transmission start time and a data transmission end time are extracted based on the transmission identifier, and a task attribute field and a time attribute field are obtained by segmenting and encoding the transmission identifier;

[0084] A time-sensitive transmission task is established according to the combination of the task attribute field and the time attribute field;

[0085] The data transmission start time and the data transmission end time in the time-sensitive transmission task are calculated to obtain a data transmission time window, and a real-time time slice sequence is generated according to the data transmission time window;

[0086] According to the real-time time slicing sequence, a time-sensitive threshold is calculated, the time-sensitive threshold is matched with a preset data transmission task type, and a time-sensitive mapping matrix is obtained;

[0087] The element value of the time-sensitive mapping matrix is convolved with a preset time weight coefficient to obtain a time-sensitive coefficient, the difference between the time-sensitive coefficient and a preset priority reference value is calculated to obtain a priority offset, and the preset priority reference value is dynamically adjusted according to the priority offset to obtain a data transmission priority.

[0088] Among them, the hard disk data transmission request can come from a user terminal, a server or other storage devices. The received hard disk data transmission request is parsed, and the transmission identifier therein is extracted. The transmission identifier is a data structure containing multiple information, usually stored in binary or hexadecimal format. For example, the transmission identifier can be represented as "0x8F2E7D3A6B5C", which contains information such as task type, data size, time window, etc.

[0089] Based on the extracted transmission identifier, the start time and end time of data transmission can be further extracted, for example, from the transmission identifier "0x8F2E7D3A6B5C", the start time can be parsed as "2023-07-15 08:30:00" and the end time as "2023-07-15 09:15:00". The transmission identifier is segmented and encoded, which is divided into a task attribute field and a time attribute field. The task attribute field contains task type, data volume, priority basic information, etc., such as "0x8F2E7D"; the time attribute field contains time window, delay sensitivity, etc., such as "0x3A6B5C".

[0090] A time-sensitive transmission task can be established according to the combination of the extracted task attribute field and time attribute field, which contains complete transmission requirement information such as transmission content, data size, time constraint, etc. For example, a time-sensitive transmission task containing a file transmission task can be created, with a data size of 500MB, a start time of "2023-07-15 08:30:00" and an end time of "2023-07-15 09:15:00".

[0091] A data transmission time window, i.e. the difference between the end time and the start time, can be calculated, which in the above example is 45 minutes. Based on the time window, a real-time time slicing sequence is generated, dividing the time window into several time slices. For example, the 45-minute time window can be divided into 9 time slices of 5 minutes each: [0-5 minutes], [5-10 minutes], [10-15 minutes], [15-20 minutes], [20-25 minutes], [25-30 minutes], [30-35 minutes], [35-40 minutes], [40-45 minutes].

[0092] The sensitivity of each time slice is analyzed, taking into account factors such as the position of the time slice in the entire window, the current system load, historical transmission data, etc. For example, the sensitivity of the time slice at the end of the window [40-45 minutes] will be higher than that of the time slice at the beginning of the window [0-5 minutes], because transmission tasks close to the deadline are usually more urgent. A sensitivity value is assigned to each time slice, such as 0.2 for [0-5 minutes], 0.25 for [5-10 minutes], 0.3 for [10-15 minutes], and so on, up to 0.6 for [40-45 minutes].

[0093] The calculated time sensitivity threshold can be matched with preset data transmission task types, which can include high-priority real-time transmission, medium-priority scheduled transmission, low-priority batch transmission, etc. Through matching, a time sensitivity mapping matrix is generated. For example, if the time sensitivity threshold of the current task is 0.45 and the task type is "real-time data backup", the corresponding element value in the time sensitivity mapping matrix is 0.8.

[0094] The element value of the time sensitivity mapping matrix can be convolved with a preset time weight coefficient to obtain a time sensitivity coefficient, which reflects the influence of different time periods on transmission tasks, for example, higher weights can be assigned to working hours and lower weights to non-working hours. Assuming the element value of the time sensitivity mapping matrix is 0.8 and the time weight coefficient is 1.2 (working hours), the time sensitivity coefficient obtained by convolution operation is 0.96.

[0095] The difference between the time sensitivity coefficient and the preset priority reference value can be calculated to obtain a priority offset, for example, if the preset priority reference value is 0.5 and the time sensitivity coefficient is 0.96, the priority offset is 0.46.

[0096] The preset priority reference value can be dynamically adjusted according to the priority offset to obtain the final data transmission priority, in the above example, the adjusted data transmission priority is 0.96, indicating that this data transmission task has a high priority and will be given priority in resource allocation.

[0097] Through the above steps, the data transmission priority can be dynamically adjusted based on time sensitivity, so that tasks with strict time requirements can obtain more system resources and improve transmission efficiency. This method is especially suitable for scenarios such as data centers and cloud storage systems, and can significantly improve response performance and resource utilization. In practical applications, load balancing, network congestion control and other technologies can be combined to further optimize the hard disk data transmission process.

[0098] In an optional implementation, the method further includes determining a key fusion tree based on the time sensitivity coefficient and the data transmission priority, and determining a hybrid encryption key based on the key fusion tree.

[0099] The method further includes generating a time feature key based on the time sensitivity coefficient, and determining a master key based on the data transmission priority.

[0100] The method further includes determining a key feature matrix by taking key components of the time feature key as row vectors and taking key components of the master key as column vectors.

[0101] The method further includes performing block processing on the key feature matrix to obtain a plurality of sub-matrices, determining a key fusion tree based on the plurality of sub-matrices, and storing the key feature matrix in a root node of the key fusion tree, storing the plurality of sub-matrices in intermediate nodes of the key fusion tree, and storing row vectors and column vectors of the plurality of sub-matrices in leaf nodes of the key fusion tree.

[0102] The method further includes performing singular value decomposition on the key feature matrix to obtain a feature space mapping matrix, projecting the time feature key and the master key into the feature space mapping matrix to obtain key projection vectors, and calculating key fusion coefficients based on orthogonality of the key projection vectors.

[0103] The method further includes fusing the time feature key and the master key based on the key fusion coefficients to obtain a hybrid encryption key.

[0104] In the method, a time feature key is first generated based on a time sensitivity coefficient, and a master key is determined based on a data transmission priority, then a key fusion tree is constructed and a hybrid encryption key is determined based on the key fusion tree, thereby realizing dynamic generation and secure management of the key.

[0105] Figure 2 FIG. 1 is a flowchart of a method for determining a hybrid encryption key according to an embodiment of the present application. Figure 2As shown, in the implementation process, the time feature key can be generated first according to the time sensitivity coefficient, which is a parameter representing the time effectiveness requirement of data transmission, and the value range can be 0 to 1, where 0 represents time insensitivity and 1 represents extreme time sensitivity. The time sensitivity coefficient can be mapped into a preset key generation function to obtain the time feature key. For example, for a time sensitivity coefficient of 0.8, a 128-bit time feature key "A7B3C9D2E5F8G1H6" can be generated.

[0106] At the same time, the master key can be determined according to the data transmission priority, which can be divided into multiple levels, such as high, medium and low, corresponding to different preset master keys. For example, for data transmission with a priority of "high", a 256-bit master key "P2Q7R3S8T5U1V9W4" can be specified.

[0107] After obtaining the time feature key and the master key, the key components of the time feature key are taken as row vectors and the key components of the master key are taken as column vectors to construct a key feature matrix. Assuming that the time feature key is decomposed into 8 components [A7, B3, C9, D2, E5, F8, G1, H6] and the master key is decomposed into 8 components [P2, Q7, R3, S8, T5, U1, V9, W4], an 8x8 key feature matrix can be constructed, where the element in the ith row and jth column is the combined value of the ith component of the time feature key and the jth component of the master key.

[0108] After constructing the key feature matrix, the matrix can be processed by blocking, which is divided into multiple sub-matrices. The division method can use a quadtree division strategy, that is, the original matrix is equally divided into four sub-matrices, and then the sub-matrices are further divided according to needs. Assuming that the 8x8 key feature matrix is divided into four 4x4 sub-matrices M11, M12, M21 and M22.

[0109] Based on these sub-matrices, a key fusion tree can be constructed, which is a tree-shaped data structure. The root node stores the complete key feature matrix, the intermediate nodes store the blocked sub-matrices, and the leaf nodes store the row vectors and column vectors of the sub-matrices. In this example, the root node of the key fusion tree stores the 8x8 key feature matrix, the four nodes of the second layer store the four 4x4 sub-matrices M11, M12, M21 and M22, and the leaf nodes store the row vectors and column vectors of these sub-matrices.

[0110] Next, the key feature matrix can be singular value decomposed to obtain a feature space mapping matrix. Singular value decomposition can decompose the original matrix into the product of three matrices, which represent different feature spaces. For an 8x8 key feature matrix, a 8x8 feature space mapping matrix can be obtained after singular value decomposition.

[0111] The time feature key and the master key can be projected onto the feature space mapping matrix to obtain key projection vectors. The projection vector of the time feature key can be calculated by multiplying the time feature key and the feature space mapping matrix, and the projection vector of the master key is the same. Assuming that the obtained time feature key projection vector is [0.3, 0.5, 0.1, 0.6, 0.2, 0.7, 0.4, 0.8], and the master key projection vector is [0.5, 0.2, 0.8, 0.3, 0.6, 0.1, 0.9, 0.4].

[0112] The key fusion coefficients can be calculated according to the orthogonality of the key projection vectors. Orthogonality refers to the inner product of two vectors being zero, indicating that they are not related in the feature space. The angle between the time feature key projection vector and the master key projection vector is calculated, and the fusion coefficients are determined according to the angle size. For example, if the calculated angle is 60 degrees, the fusion coefficient of the time feature key can be set to 0.6, and the fusion coefficient of the master key can be set to 0.4.

[0113] Finally, the time feature key and the master key can be fused based on the key fusion coefficients to obtain a hybrid encryption key. The fusion process is to multiply the time feature key by its fusion coefficient, multiply the master key by its fusion coefficient, and then add or perform bit operation combination. For example, for the time feature key "A7B3C9D2E5F8G1H6" with a fusion coefficient of 0.6 and the master key "P2Q7R3S8T5U1V9W4" with a fusion coefficient of 0.4, a hybrid encryption key "C4D8E5F7G3H2J6K9" can be generated.

[0114] Through the above steps, a hybrid encryption key is successfully determined based on the time sensitivity coefficient and the data transmission priority. This method fully considers the timeliness and priority requirements of data transmission, and the generated hybrid encryption key contains both time feature information and reflects the priority of data transmission, which can effectively guarantee the security and efficiency of data transmission. In practical applications, key generation parameters can be adjusted according to different scene requirements to realize flexible key management strategy.

[0115] In an alternative embodiment, singular value decomposition is performed on the key feature matrix to obtain a feature space mapping matrix, the time feature key and the master key are projected into the feature space mapping matrix to obtain key projection vectors, a key fusion coefficient is calculated according to the orthogonality of the key projection vectors, comprising:

[0116] The singular value decomposition is performed on the key feature matrix to obtain a left singular matrix, a singular value matrix and a right singular matrix, and a feature weight vector is obtained according to the diagonal elements of the singular value matrix;

[0117] The left singular matrix and the right singular matrix are orthogonally transformed to obtain a feature space mapping matrix, and an orthogonal feature base is obtained by using the feature space mapping matrix and the feature weight vector;

[0118] The time feature key and the master key are projected into the orthogonal feature base to obtain a time feature projection vector and a master key projection vector;

[0119] An orthogonal measure value is obtained based on the feature weight vector, the time feature projection vector and the master key projection vector, and an initial fusion coefficient is calculated according to the orthogonal measure value and the feature weight vector;

[0120] The feature weight vector is normalized to obtain a normalized weight, an entropy value adjustment factor is calculated by calculating the information entropy of the normalized weight, and a fusion coefficient adjustment function is obtained;

[0121] The function coefficient of the fusion coefficient adjustment function is dynamically adjusted according to the entropy value adjustment factor, and the initial fusion coefficient is input into the adjusted fusion coefficient adjustment function to obtain the key fusion coefficient.

[0122] In the specific implementation process, first, a key feature matrix is received, which can be composed of a plurality of key feature vectors. For example, it is assumed that 10 key feature vectors are collected, each vector containing 256 elements, and these vectors can form a 10x256 key feature matrix. Singular value decomposition is performed on the key feature matrix, and after decomposition, a left singular matrix U (dimension 10x10), a singular value matrix S (dimension 10x256) and a right singular matrix V^T (dimension 256x256) are obtained. In the singular value matrix S, the diagonal elements are arranged in descending order, for example, the first five singular values obtained can be [12.5, 8.3, 5.2, 3.1, 1.7], and these singular values constitute a feature weight vector.

[0123] The left singular matrix U is orthogonally transformed with the right singular matrix V^T to obtain a characteristic space mapping matrix M. This step can be realized by point multiplication operation between each column of U and the corresponding row of V^T, and the obtained M matrix will keep the main structure information of the original characteristic space. Using the characteristic space mapping matrix M and the characteristic weight vector, an orthogonal characteristic basis B is constructed. For example, for a characteristic space with a dimension of 256, 256 orthogonal basis vectors can be obtained, each of which is orthogonal to other basis vectors and the length is normalized to 1.

[0124] Next, the time characteristic key T and the master key K can be projected into the orthogonal characteristic basis B. Assuming that the time characteristic key T is a 256-dimensional vector, the element value of which fluctuates in the range of [-1, 1], for example, [0.3, -0.5, 0.7,...]; the master key K is also a 256-dimensional vector, for example, [0.8, 0.2, -0.4,...]. By calculating the inner product of T and K with each basis vector in the orthogonal characteristic basis B, the time characteristic projection vector Pt and the master key projection vector Pk are obtained. For example, if the first five main characteristic bases are selected, Pt=[2.1, -1.5, 0.8, 0.3, -0.2] and Pk=[1.8, 1.2, -0.5, -0.9, 0.4] are obtained.

[0125] The weighted angle between the time characteristic projection vector Pt and the master key projection vector Pk can be calculated based on the characteristic weight vector to obtain the orthogonal measure value θ. Specifically, for each dimension i, the product of Pt[i] and Pk[i] is calculated, then multiplied by the corresponding characteristic weight, and finally the sum of all results is summed and normalized. For example, assuming that the calculated orthogonal measure value θ is 0.65. According to the orthogonal measure value θ and the characteristic weight vector, the initial fusion coefficient α0 is calculated. A method similar to cosine similarity can be used to convert θ into the initial fusion coefficient, for example, α0=0.4.

[0126] The characteristic weight vector can be normalized to obtain the normalized weight w. For example, the first five singular values [12.5, 8.3, 5.2, 3.1, 1.7] are normalized to obtain w=[0.41, 0.27, 0.17, 0.10, 0.05]. The information entropy of the normalized weight w is calculated to obtain the entropy value adjustment factor H. For example, the information entropy calculated according to w=[0.41, 0.27, 0.17, 0.10, 0.05] is H=1.92. Based on the entropy value adjustment factor H, a fusion coefficient adjustment function F(x) is established. The function can adopt the form of S-type function, for example, F(x)=(1 / (1+e^(-ax+b))), where a and b are undetermined coefficients.

[0127] The function coefficients a and b of the fusion coefficient adjustment function F(x) can be dynamically adjusted according to the entropy value adjustment factor H. For example, when H = 1.92, a = 2.5 * (2-H) = 0.2 and b = 1.5 * H = 2.88 can be set. In this way, the adjusted function is F(x) = (1 / (1+e^(-0.2x+2.88))). Finally, the initial fusion coefficient α0 is input into the adjusted fusion coefficient adjustment function to obtain the final key fusion coefficient α. For example, α = F(α0) = F(0.4) = (1 / (1+e^(-0.2*0.4+2.88))) = 0.06.

[0128] In this way, the calculation process from the key feature matrix to the key fusion coefficient is completed. The obtained fusion coefficient α can be used for subsequent key fusion operations, such as generating a fused key F = α * T + (1-α) * K. In actual applications, the parameters of singular value decomposition, the selection of the orthogonal feature basis, and the form of the fusion coefficient adjustment function can be adjusted according to different security requirements and scene characteristics to obtain better key fusion effect. In this way, the embodiments of the present application can effectively fuse time feature information while ensuring key security, thereby improving the security and reliability of the cryptographic system.

[0129] In an optional embodiment, the data transmission object corresponding to the transmission identifier is obtained, and the data transmission object is processed by block to obtain a plurality of data transmission blocks according to the branch structure of the key fusion tree, including:

[0130] The node hierarchical relationship and the node weight of the key fusion tree are obtained according to the transmission identifier;

[0131] The data transmission object is hierarchically decomposed according to the node hierarchical relationship of the key fusion tree, to generate a plurality of layers of data blocks corresponding to the number of levels of the key fusion tree;

[0132] The data distribution characteristics of each layer of data blocks in the plurality of layers of data blocks are statistically analyzed to obtain a data distribution characteristic sequence;

[0133] The information entropy of the data distribution characteristic sequence is calculated to obtain a hierarchical entropy value sequence, and the data block priority is determined according to the hierarchical entropy value sequence;

[0134] The data block priority and the node weight of the key fusion tree are weighted and fused to obtain a block weight coefficient, and the plurality of layers of data blocks are adaptively blocked according to the block weight coefficient;

[0135] A data block correlation matrix is constructed based on the hierarchical entropy value sequence, and a spectral clustering algorithm is used to perform clustering analysis on the data block correlation matrix to obtain a target block quantity, and the multi-layer data blocks are merged and reorganized into a plurality of data transmission blocks corresponding to the target block quantity.

[0136] In the implementation process, first, the corresponding data transmission object and the node hierarchical relationship and node weight information of the key fusion tree associated therewith are obtained through the transmission identifier. The data transmission object can be a composite structure containing multiple data types, such as a multimedia file of 100 MB in size, which contains different types of information such as images, audio, and metadata. The node hierarchical relationship of the key fusion tree defines the hierarchical structure of data decomposition, such as a four-layer key fusion tree structure, in which the root node is at the first layer, the second layer contains 3 child nodes, the third layer contains 9 child nodes, and the fourth layer contains 27 leaf nodes. Each node has a corresponding weight value, for example, the root node weight is 1.0, the second layer node weights are 0.5, 0.3, and 0.2, respectively, and so on to the leaf nodes.

[0137] The data transmission object can be hierarchically decomposed according to the node hierarchical relationship of the key fusion tree. Taking the above four-layer key fusion tree as an example, the 100 MB data transmission object is first decomposed into 3 second-layer data blocks of sizes 50 MB, 30 MB, and 20 MB. Then each data block of the second layer is further decomposed into a third-layer data block, for example, the 50 MB data block is decomposed into three data blocks of sizes 25 MB, 15 MB, and 10 MB. In this way, the fourth-layer data blocks are finally generated, which are the same as the number of leaf nodes of the key fusion tree, and each data block size is between 1-5 MB.

[0138] Statistical analysis can be performed on the data distribution characteristics of each layer of the multi-layer data blocks to obtain a data distribution characteristic sequence. Specifically, the byte distribution of the content of each data block is analyzed, for example, for the 50 MB data block of the second layer, it is found that the ASCII character accounts for 60%, and the binary data accounts for 40%; while in the 30 MB data block, the ASCII character accounts for 30%, and the binary data accounts for 70%. In this way, a feature vector is generated for each data block of each layer, such as [0.6, 0.4] and [0.3, 0.7], representing the distribution proportion of different types of data.

[0139] The data distribution feature sequence can be subjected to information entropy calculation to obtain a hierarchical entropy value sequence. For example, the calculation result shows that the entropy values of the second layer data blocks are 0.97, 0.88 and 0.75 respectively; the entropy values of the third layer data blocks range from 0.65 to 0.95; and the entropy values of the fourth layer data blocks range from 0.55 to 0.90. The higher the entropy value, the higher the data complexity, and the more priority processing is required. The priority of the data blocks is determined according to the entropy values, for example, the data blocks with an entropy value higher than 0.9 are assigned a high priority, the data blocks with an entropy value between 0.7 and 0.9 are assigned a medium priority, and the data blocks with an entropy value lower than 0.7 are assigned a low priority.

[0140] The data block priority and the node weight of the key fusion tree can be weighted and fused to obtain a block weight coefficient. For example, a data block with an entropy value of 0.95 (high priority) corresponds to a node weight of 0.5, and its block weight coefficient is 0.95 x 0.5 x 1.2 (high priority coefficient) = 0.57. A data block with an entropy value of 0.65 (low priority) corresponds to a node weight of 0.2, and its block weight coefficient is 0.65 x 0.2 x 0.8 (low priority coefficient) = 0.104. The multi-layer data blocks are adaptively blocked according to the block weight coefficients, the data blocks with high weight coefficients maintain a small block size to improve processing flexibility, and the data blocks with low weight coefficients can be merged to reduce processing overhead.

[0141] Based on the hierarchical entropy value sequence, a data block correlation matrix can be constructed, in which each element represents the correlation degree between two data blocks. For example, two data blocks with entropy values of 0.95 and 0.92 have a correlation of 0.97, and two data blocks with entropy values of 0.95 and 0.65 have a correlation of 0.70. The data block correlation matrix is analyzed using a spectral clustering algorithm to determine the optimal target block number.

[0142] In a specific example, the original 27 fourth layer data blocks are subjected to spectral clustering analysis to determine that the optimal target block number is 8. Subsequently, the 27 data blocks are reorganized and merged into 8 data transmission blocks. The 8 data transmission blocks have different sizes, which are 16 MB, 14 MB, 13 MB, 12 MB, 11 MB, 12 MB, 11 MB and 11 MB respectively, and the total size is 100 MB, which completely covers the entire content of the original data transmission object. The data within each data transmission block has high correlation, and the data correlation between different blocks is low, which helps to improve the efficiency of subsequent data processing and transmission.

[0143] Through in-depth analysis of the data distribution features and entropy calculation, combined with node weight information, the above-mentioned intelligent data blocking is realized, which makes the data transmission more efficient and secure, and is particularly suitable for data optimization processing in large-scale data transmission scenarios.

[0144] In an optional embodiment, the data transmission blocks are matched with the hybrid encryption keys according to the data transmission priorities, the data transmission blocks are encrypted using the matched hybrid encryption keys, and the data integrity check values of the encrypted data transmission blocks are calculated, comprising:

[0145] The data transmission blocks are taken as nodes, and a priority graph is constructed based on the data transmission priorities of the data transmission blocks;

[0146] The data transmission priority differences between adjacent nodes in the priority graph are calculated, the data transmission priority differences are taken as edge weights between nodes, and the degree centrality and clustering coefficient of a node are calculated according to the edge weights;

[0147] The priority graph is grouped based on the degree centrality and clustering coefficient of the nodes, and a plurality of node groups are obtained;

[0148] The average degree centrality and average clustering coefficient of nodes in each node group are calculated, the key fusion ratio is determined according to the average degree centrality and average clustering coefficient, the hybrid encryption keys are fused in each node group according to the key fusion ratio, and the intra-group encryption keys are obtained;

[0149] The data transmission blocks are matched with the intra-group encryption keys of the corresponding node groups according to the data transmission priorities, the data transmission blocks are encrypted using the matched intra-group encryption keys, and the integrity check values of the encrypted data transmission blocks are calculated based on the degree centrality and clustering coefficient of the nodes.

[0150] In this embodiment, for the received data, it is first divided into a plurality of data transmission blocks, and each data transmission block is assigned a data transmission priority. Based on these data transmission blocks and their priorities, data encryption and integrity checking are performed through a series of processing steps.

[0151] Before data encryption, the data transmission blocks are first taken as nodes, and a priority graph is constructed based on their data transmission priorities. For example, assuming that there are 5 data transmission blocks with priorities of 10, 8, 6, 9, and 7, respectively, the constructed priority graph contains 5 nodes corresponding to the 5 data transmission blocks.

[0152] After the priority graph is constructed, the data transmission priority differences between adjacent nodes are calculated, and these differences are taken as edge weights between nodes. Taking the above 5 nodes as an example, the priority difference between node 1 and node 2 is |10-8|=2, the priority difference between node 1 and node 4 is |10-9|=1, and the edge weights between all adjacent node pairs are calculated in this way.

[0153] Based on these edge weights, the degree centrality and clustering coefficient of each node are calculated, the degree centrality reflects the importance of the node in the network, which is usually measured by the number of edges connected to the node. In this embodiment, the degree centrality is calculated as the number of edges connected to the node divided by the maximum number of edges. For example, in a network of 5 nodes, node 1 is connected to 3 edges, and the maximum number of edges is 4, so its degree centrality is 3 / 4 = 0.75.

[0154] The clustering coefficient measures the degree of connection between the neighbors of a node. For each node, the proportion of actual connections among all pairs of its neighbors is calculated. Assuming that node 1 has neighbor nodes 2, 4 and 5, if there is a connection between node 2 and node 4, and a connection between node 2 and node 5, but no connection between node 4 and node 5, then the clustering coefficient of node 1 is 2 / 3 ≈ 0.67.

[0155] After calculating the degree centrality and clustering coefficient of each node, the priority graph is grouped based on these values. Specifically, a clustering algorithm is used to group nodes with similar degree centrality and clustering coefficient into the same group. Assuming that through clustering, the 5 nodes are divided into two groups: group 1 contains nodes 1, 4, 5, and group 2 contains nodes 2, 3.

[0156] For each node group, the average degree centrality and average clustering coefficient of the nodes within the group are calculated. For example, the average degree centrality of group 1 is (0.75 + 0.5 + 0.5) / 3 = 0.58, and the average clustering coefficient is (0.67 + 0.33 + 0.33) / 3 = 0.44. The average degree centrality of group 2 is (0.25 + 0.25) / 2 = 0.25, and the average clustering coefficient is (0 + 0) / 2 = 0.

[0157] Based on the calculated average degree centrality and average clustering coefficient, the key fusion ratio is determined, which determines the distribution of the hybrid encryption key within each node group. Assuming that there is a hybrid encryption key K, with a length of 128 bits, composed of a symmetric key part and an asymmetric key part. Based on the average degree centrality 0.58 and the average clustering coefficient 0.44 of group 1, the key fusion ratio of group 1 is determined to be 65% symmetric key and 35% asymmetric key; based on the average degree centrality 0.25 and the average clustering coefficient 0 of group 2, the key fusion ratio of group 2 is determined to be 40% symmetric key and 60% asymmetric key.

[0158] According to the determined key fusion ratio, the hybrid encryption key K is fused within each node group to obtain the intra-group encryption key. For group 1, its intra-group encryption key K1 is composed of the first 83 bits of the symmetric key part and the last 45 bits of the asymmetric key part of K; for group 2, its intra-group encryption key K2 is composed of the first 51 bits of the symmetric key part and the last 77 bits of the asymmetric key part of K.

[0159] According to the priority of the data transmission block, the data transmission block is matched with the intra-group encryption key of the corresponding node group. The data transmission blocks with priorities of 10, 9, and 7 are matched with the encryption key K1 of group 1; the data transmission blocks with priorities of 8 and 6 are matched with the encryption key K2 of group 2.

[0160] The data transmission block is encrypted using the matched intra-group encryption key, for example, the data transmission block with priority 10 is encrypted using key K1 to obtain ciphertext C1; the data transmission block with priority 8 is encrypted using key K2 to obtain ciphertext C2.

[0161] After the encryption is completed, the integrity check value of the encrypted data transmission block is calculated based on the degree centrality and clustering coefficient of the node. Specifically, for each encrypted data transmission block, the degree centrality and clustering coefficient of the corresponding node are taken as parameters to generate a check value by substituting into a check algorithm. For example, for the data transmission block with priority 10, the degree centrality of the corresponding node is 0.75 and the clustering coefficient is 0.67, based on these two values and the encrypted data content, a 32-bit check value 0xA5B7C9D2 is generated.

[0162] This data block priority analysis and encryption method based on graph structure can dynamically adjust the encryption strategy according to the importance of the data transmission block, improve the overall encryption efficiency and security. At the same time, by introducing the degree centrality and clustering coefficient, the encryption process is more suitable for the characteristics of the network topology structure, and the adaptability in complex network environment is enhanced.

[0163] In an optional implementation, the average degree centrality and the average clustering coefficient of the nodes in each node group are calculated, the key fusion ratio is determined according to the average degree centrality and the average clustering coefficient, the mixed encryption key is fused in each node group according to the key fusion ratio to obtain an intra-group encryption key, including:

[0164] A degree centrality distribution sequence is generated according to the degree centrality of each node in the node group, and the average degree centrality is calculated by calculating the mean value of the degree centrality distribution sequence;

[0165] A clustering coefficient distribution sequence is generated according to the clustering coefficient of each node in the node group, and the average clustering coefficient is calculated by calculating the mean value of the clustering coefficient distribution sequence;

[0166] A two-dimensional feature space is determined according to the average degree centrality and the average clustering coefficient, an angle sequence is obtained by calculating the distribution angle of the nodes in the two-dimensional feature space, and a weight mapping curve is constructed according to the angle sequence;

[0167] The average degree centrality and the average clustering coefficient are converted into an initial weight vector by using the weight mapping curve, and a projection distribution of the initial weight vector in the two-dimensional feature space is calculated to obtain node group feature entropy;

[0168] The degree centrality distribution sequence and the clustering coefficient distribution sequence are segmented to obtain a plurality of feature intervals, the number of nodes in each feature interval is counted to obtain a distribution density, and the distribution density and the node group feature entropy are used to determine a key fusion ratio;

[0169] The mixed encryption key is fused in the node group according to the key fusion ratio to obtain an intra-group encryption key.

[0170] The degree centrality and the clustering coefficient of the nodes are calculated to determine a key fusion ratio suitable for different node group characteristics, thereby improving the network security performance.

[0171] For a given node group, first, the connection of each node with other nodes is obtained. The degree centrality of each node in the node group is calculated, that is, the ratio of the number of directly connected other nodes to the maximum number of connections. For example, in a node group containing 10 nodes, if node A is directly connected to 7 other nodes, the degree centrality of node A is 7 / (10-1)=0.778. The degree centrality values of all nodes form a distribution sequence, such as [0.778, 0.556, 0.667, 0.333, 0.444, 0.889, 0.222, 0.111, 0.667, 0.556]. The average value of the sequence is calculated to obtain the average degree centrality of the node group, which is 0.522.

[0172] At the same time, the clustering coefficient of each node is calculated, which represents the connection density between the neighbors of the node. For node A, if it has 7 neighbor nodes, there are actually 15 connection edges between these neighbor nodes, and the maximum number of connection edges is 7×(7-1) / 2=21, then the clustering coefficient of node A is 15 / 21=0.714. The clustering coefficients of all nodes form a distribution sequence, such as [0.714, 0.800, 0.667, 0.500, 0.933, 0.267, 0.600, 0.833, 0.700, 0.467]. The average value of the sequence is calculated to obtain the average clustering coefficient, which is 0.648.

[0173] Based on the calculated average degree centrality and average clustering coefficient, a two-dimensional feature space is constructed, in which the average degree centrality is taken as the horizontal coordinate and the average clustering coefficient is taken as the vertical coordinate, and the feature point position (0.522, 0.648) of the node group is determined. The angle between the connecting line of the feature point and the horizontal coordinate axis is calculated, and the distribution angle is obtained, such as 51.1 degrees. For each node in the node group, the distribution angle in the feature space is also calculated, forming an angle sequence [40.6, 55.2, 45.0, 56.3, 64.5, 16.7, 69.8, 82.4, 46.4, 40.0].

[0174] According to the angle sequence, a weight mapping curve is constructed, and a piecewise linear interpolation method is adopted. The angle values are sorted from small to large, and the corresponding weights are set from large to small. For example, the angle sequence is sorted to obtain [16.7, 40.0, 40.6, 45.0, 46.4, 55.2, 56.3, 64.5, 69.8, 82.4], and the corresponding weights are set to [0.95, 0.85, 0.80, 0.75, 0.70, 0.65, 0.60, 0.55, 0.50, 0.45]. The feature point angle 51.1 degrees of the node group is converted into a weight value by using this mapping relationship, and the initial weight vector [0.68, 0.32] is obtained by linear interpolation.

[0175] The projection distribution of the initial weight vector in the two-dimensional feature space is calculated. The specific method is to multiply the weight vector by the feature point coordinates to obtain (0.522×0.68, 0.648×0.32)=(0.355, 0.207). The information entropy of the projection point is calculated as the feature entropy of the node group, using -p×log2(p)-(1-p)×log2(1-p), where p=0.355 / (0.355+0.207)=0.632, and the feature entropy is 0.956.

[0176] The degree centrality and clustering coefficient distribution sequences are segmented, and the value range [0, 1] is divided into 5 intervals: [0, 0.2), [0.2, 0.4), [0.4, 0.6), [0.6, 0.8) and [0.8, 1]. The number of nodes in each interval is counted to obtain the degree centrality distribution density [1, 1, 3, 3, 2] and the clustering coefficient distribution density [0, 1, 2, 5, 2]. The distribution density is standardized to a probability distribution to obtain the degree centrality distribution probability [0.1, 0.1, 0.3, 0.3, 0.2] and the clustering coefficient distribution probability [0, 0.1, 0.2, 0.5, 0.2].

[0177] According to the node group characteristic entropy and distribution probability, the key fusion proportion is calculated, the characteristic entropy 0.956 is taken as a balance factor, and the fusion weight is calculated in combination with the distribution probability. The degree centrality weight is 0.956*Sigma(i*Pi)=0.956*(0*0.1+1*0.1+2*0.3+3*0.3+4*0.2)=0.956*2.5=2.39, wherein i represents an interval index, and Pi represents a corresponding probability value. Similarly, the clustering coefficient weight is 0.956*Sigma(i*Qi)=0.956*(0*0+1*0.1+2*0.2+3*0.5+4*0.2)=0.956*2.8=2.68, wherein Qi represents a clustering coefficient distribution probability. The key fusion proportion is obtained by normalizing the two weight values: the degree centrality proportion is 2.39 / (2.39+2.68)=0.471, and the clustering coefficient proportion is 2.68 / (2.39+2.68)=0.529.

[0178] The hybrid encryption key is fused in the node group according to the above proportion. Assuming that the hybrid encryption key is a 128-bit binary sequence, the degree centrality high node and the clustering coefficient high node are allocated according to the proportion of 0.471:0.529. In specific implementation, first, the nodes are sorted according to the degree centrality and the clustering coefficient, 4 nodes with the highest degree centrality and 5 nodes with the highest clustering coefficient are selected (there may be repetition). The key fragments of the selected nodes are subjected to XOR operation to generate 60-bit (128*0.471≈60) and 68-bit (128*0.529≈68) key components, and finally the two parts are connected to form the group encryption key. This method ensures that the key fusion process fully considers the network topology characteristics of the node group, and improves the security and adaptability of the key.

[0179] The data transmission encryption system of the embodiment of the application comprises:

[0180] A first unit is configured to parse a received hard disk data transmission request to obtain a transmission identifier, calculate a time sensitivity coefficient according to the transmission identifier, and determine a data transmission priority according to the time sensitivity coefficient.

[0181] A second unit is configured to determine a key fusion tree based on the time sensitivity coefficient and the data transmission priority, and determine a hybrid encryption key based on the key fusion tree.

[0182] A third unit is configured to obtain a data transmission object corresponding to the transmission identifier, and perform block processing on the data transmission object according to a branch structure of the key fusion tree to obtain a plurality of data transmission blocks.

[0183] The fourth unit is used to match the data transmission block with the hybrid encryption key according to the data transmission priority, encrypt the data transmission block using the matched hybrid encryption key, and calculate the data integrity check value for each data transmission block.

[0184] The fifth unit is used to adjust the hybrid encryption key based on the change curve of the time sensitivity coefficient, regenerate the data integrity verification value based on the adjusted hybrid encryption key, and record the data integrity verification value and the change curve of the time sensitivity coefficient to form a data transmission log.

[0185] A third aspect of the present invention provides an electronic device, comprising:

[0186] processor;

[0187] Memory used to store processor-executable instructions;

[0188] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0189] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0190] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0191] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data transmission encryption method, characterized in that, include: The received hard disk data transfer request is parsed to obtain a transfer identifier. A time sensitivity coefficient is calculated based on the transfer identifier, and the data transfer priority is determined based on the time sensitivity coefficient. A key fusion tree is determined based on the time sensitivity coefficient and the data transmission priority, and a hybrid encryption key is determined based on the key fusion tree; Obtain the data transmission object corresponding to the transmission identifier, and divide the data transmission object into multiple data transmission blocks according to the branch structure of the key fusion tree; The data transmission blocks are matched with the hybrid encryption key according to the data transmission priority, the matched hybrid encryption key is used to encrypt the data transmission blocks, and a data integrity check value is calculated for each data transmission block. The hybrid encryption key is adjusted based on the change curve of the time sensitivity coefficient, and the data integrity verification value is regenerated based on the adjusted hybrid encryption key. The data integrity verification value and the change curve of the time sensitivity coefficient are recorded to form a data transmission log.

2. The method according to claim 1, characterized in that, Parse the received hard disk data transfer request to obtain a transfer identifier, calculate a time sensitivity coefficient based on the transfer identifier, and determine the data transfer priority based on the time sensitivity coefficient, including: Receive a hard disk data transfer request, parse the hard disk data transfer request to obtain a transfer identifier, extract the data transfer start time and data transfer end time based on the transfer identifier, and perform segmented encoding on the transfer identifier to obtain a task attribute field and a time attribute field; A time-sensitive transmission task is created based on the combination of the task attribute field and the time attribute field; The data transmission time window is obtained by calculating the time difference between the data transmission start time and the data transmission end time in the time-sensitive transmission task, and a real-time time segmentation sequence is generated based on the data transmission time window. Calculate the time-sensitive threshold based on the real-time time-sliced ​​sequence, and match the time-sensitive threshold with the preset data transmission task type to obtain a time-sensitive mapping matrix; The time-sensitive mapping matrix is ​​convolved with a preset time weight coefficient to obtain a time-sensitive coefficient. The difference between the time-sensitive coefficient and a preset priority benchmark value is calculated to obtain a priority offset. The preset priority benchmark value is dynamically adjusted according to the priority offset to obtain the data transmission priority.

3. The method according to claim 1, characterized in that, Determining a key fusion tree based on the time sensitivity coefficient and the data transmission priority, and determining a hybrid encryption key based on the key fusion tree, including: A time-sensitive key is generated based on the time sensitivity coefficient, and a master key is determined based on the data transmission priority. The key feature matrix is ​​determined by using the key components of the time feature key as row vectors and the key components of the master key as column vectors. The key feature matrix is ​​divided into blocks to obtain multiple sub-matrices. A key fusion tree is determined based on the multiple sub-matrices. The root node of the key fusion tree stores the key feature matrix, the middle nodes of the key fusion tree store the multiple sub-matrices, and the leaf nodes of the key fusion tree store the row vectors and column vectors of the multiple sub-matrices. The key feature matrix is ​​subjected to singular value decomposition to obtain a feature space mapping matrix. The time feature key and the master key are projected onto the feature space mapping matrix to obtain a key projection vector. The key fusion coefficient is calculated based on the orthogonality of the key projection vector. The time feature key and the master key are fused together based on the key fusion coefficient to obtain a hybrid encryption key.

4. The method according to claim 3, characterized in that, Singular value decomposition is performed on the key feature matrix to obtain a feature space mapping matrix. The time feature key and the master key are projected onto the feature space mapping matrix to obtain a key projection vector. Key fusion coefficients are calculated based on the orthogonality of the key projection vectors, including: The key feature matrix is ​​subjected to singular value decomposition to obtain a left singular matrix, a singular value matrix, and a right singular matrix. The feature weight vector is obtained based on the diagonal elements of the singular value matrix. The left singular matrix and the right singular matrix are orthogonally transformed to obtain the feature space mapping matrix. The orthogonal feature basis is obtained by using the feature space mapping matrix and the feature weight vector. The time feature key and the master key are projected onto the orthogonal feature basis to obtain the time feature projection vector and the master key projection vector; Based on the feature weight vector, the weighted angle between the time feature projection vector and the master key projection vector is calculated to obtain an orthogonality metric. The initial fusion coefficient is then calculated based on the orthogonality metric and the feature weight vector. The feature weight vector is normalized to obtain normalized weights, the information entropy of the normalized weights is calculated to obtain the entropy adjustment factor, and the fusion coefficient adjustment function is obtained. The function coefficients of the fusion coefficient adjustment function are dynamically adjusted according to the entropy adjustment factor, and the initial fusion coefficient is input into the adjusted fusion coefficient adjustment function to obtain the key fusion coefficient.

5. The method according to claim 1, characterized in that, Obtain the data transmission object corresponding to the transmission identifier, and divide the data transmission object into multiple data transmission blocks according to the branch structure of the key fusion tree, including: The data transmission object and the node hierarchy and node weight of the key fusion tree are obtained based on the transmission identifier; The data transmission object is hierarchically decomposed according to the node hierarchy of the key fusion tree to generate multi-level data blocks corresponding to the number of levels of the key fusion tree. Data distribution feature sequence is obtained by statistically analyzing the data distribution characteristics of each data block in the multi-layer data block. Information entropy is calculated on the data distribution feature sequence to obtain a hierarchical entropy value sequence, and the data block priority is determined based on the hierarchical entropy value sequence; The data block priority is weighted and fused with the node weight of the key fusion tree to obtain the block weight coefficient, and the multi-layer data block is adaptively divided according to the block weight coefficient; A data block correlation matrix is ​​constructed based on the hierarchical entropy value sequence. The data block correlation matrix is ​​then clustered using a spectral clustering algorithm to obtain the target number of blocks. The multi-level data blocks are then merged and recombined into multiple data transmission blocks corresponding to the target number of blocks.

6. The method according to claim 1, characterized in that, The data transmission blocks are matched with the hybrid encryption key according to the data transmission priority, the matched hybrid encryption key is used to encrypt the data transmission blocks, and a data integrity check value is calculated for each data transmission block, including: Using the data transmission blocks as nodes, a priority graph is constructed based on the data transmission priority of the data transmission blocks; Calculate the data transmission priority difference between adjacent nodes in the priority graph, use the data transmission priority difference as the edge weight between nodes, and calculate the degree centrality and clustering coefficient of the nodes based on the edge weight; The priority graph is grouped based on the degree centrality of the nodes and the clustering coefficients to obtain multiple node groups; For each node group, the average degree centrality and average clustering coefficient of the nodes within the group are calculated. The key fusion ratio is determined based on the average degree centrality and the average clustering coefficient. The hybrid encryption key is fused within each node group according to the key fusion ratio to obtain the group-specific encryption key. According to the data transmission priority, the data transmission block is matched with the intra-group encryption key of the corresponding node group, the matched intra-group encryption key is used to encrypt the data transmission block, and the integrity verification value of the encrypted data transmission block is calculated based on the degree centrality of the node and the clustering coefficient.

7. The method according to claim 6, characterized in that, For each node group, the average degree centrality and average clustering coefficient of the nodes within the group are calculated. A key fusion ratio is determined based on the average degree centrality and the average clustering coefficient. The hybrid encryption key is then fused within each node group according to the key fusion ratio to obtain the group-specific encryption key, including: The average degree centrality is obtained by generating a degree centrality distribution sequence based on the degree centrality of each node in the node group and calculating the mean of the degree centrality distribution sequence. A clustering coefficient distribution sequence is generated based on the clustering coefficients of each node in the node group, and the mean of the clustering coefficient distribution sequence is calculated to obtain the average clustering coefficient. A two-dimensional feature space is determined based on the average degree centrality and the average clustering coefficient. The distribution angles of nodes in the two-dimensional feature space are calculated to obtain an angle sequence. A weight mapping curve is constructed based on the angle sequence. The average degree centrality and the average clustering coefficient are converted into an initial weight vector using the weight mapping curve. The projection distribution of the initial weight vector in the two-dimensional feature space is calculated to obtain the node group feature entropy. The degree centrality distribution sequence and the clustering coefficient distribution sequence are segmented to obtain multiple feature intervals. The number of nodes in each feature interval is counted to obtain the distribution density. The key fusion ratio is determined based on the distribution density and the node group feature entropy. The hybrid encryption key is fused within the node group according to the key fusion ratio to obtain the group-specific encryption key.

8. A data transmission encryption system for implementing the method as described in any one of claims 1-6, characterized in that, include: The first unit is used to parse the received hard disk data transfer request to obtain a transfer identifier, calculate a time sensitivity coefficient based on the transfer identifier, and determine the data transfer priority based on the time sensitivity coefficient. The second unit is used to determine a key fusion tree based on the time sensitivity coefficient and the data transmission priority, and to determine a hybrid encryption key based on the key fusion tree; The third unit is used to obtain the data transmission object corresponding to the transmission identifier, and to divide the data transmission object into multiple data transmission blocks according to the branch structure of the key fusion tree. The fourth unit is used to match the data transmission block with the hybrid encryption key according to the data transmission priority, encrypt the data transmission block using the matched hybrid encryption key, and calculate the data integrity check value for each data transmission block. The fifth unit is used to adjust the hybrid encryption key based on the change curve of the time sensitivity coefficient, regenerate the data integrity verification value based on the adjusted hybrid encryption key, and record the data integrity verification value and the change curve of the time sensitivity coefficient to form a data transmission log.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images