A data security transmission method based on encryption algorithm

Abstract

The present invention discloses a data security transmission method based on an encryption algorithm, which relates to the technical field of data security transmission, and comprises splitting original data into multiple fragments, generating a key for encryption for each data fragment, and performing distributed processing on the key through a secret sharing algorithm; encrypting each data fragment by using an encryption algorithm, and distributively storing the encrypted data fragments on different servers and nodes; performing multi-level identity authentication on devices and users requesting transmission, and dynamically allocating channels based on the identity authentication results; establishing a channel encryption mechanism, monitoring the status of the network and the channel in real time, and dynamically adjusting the channel allocation according to actual conditions; restoring the encryption key of each data fragment for the received encrypted data by using a secret sharing algorithm, and decrypting the data fragments by using the restored key to obtain the original data; the present invention significantly improves the security and reliability of data transmission through distributed storage and multi-node transmission.

Description

Technical Field

[0001] The present invention relates to the technical field of data security transmission, and in particular to a data security transmission method based on an encryption algorithm. Background Art

[0002] With the rapid development of the Internet and information technology, the security of data transmission has received increasing attention. Traditional single encryption strategies are gradually becoming incapable of dealing with advanced persistent threats (APTs) and distributed attacks. In addition, in a multi-node, multi-server distributed environment, once data is intercepted or tampered with during transmission, it may cause serious security consequences.

[0003] Traditional encryption algorithms are unable to effectively deal with distributed management of data fragments and key security issues when faced with distributed storage and multi-node transmission. At the same time, they also ignore the dynamic management of transmission channels and real-time monitoring of encryption mechanisms, and are unable to make corresponding adjustments based on changes in network status, resulting in relatively weak risk resistance when faced with man-in-the-middle attacks and traffic analysis. Existing technologies also lack multi-level identity authentication and permission management mechanisms during data security transmission, and are unable to effectively respond to the diverse security needs of different user devices. Potential threat identification during storage and transmission is also relatively lagging, and there is a lack of rapid response to high-risk scenarios. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a data security transmission method based on an encryption algorithm to solve the problems of secure transmission of encrypted data, dynamic channel management and multi-level identity authentication in a distributed environment.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] The embodiment of the present invention provides a data security transmission method based on an encryption algorithm, which comprises:

[0008] Split the original data into multiple fragments, generate a key for encryption for each data fragment, and distribute the key through a secret sharing algorithm;

[0009] Use encryption algorithms to encrypt each data fragment, and store the encrypted data fragments in different servers and nodes in a distributed manner;

[0010] Perform multi-level identity authentication on the devices and users requesting transmission, and dynamically allocate channels based on the identity authentication results;

[0011] Establish a channel encryption mechanism, monitor the status of the network and channels in real time, and dynamically adjust channel allocation according to actual conditions;

[0012] For the received encrypted data, the encryption key of each data fragment is recovered using a secret sharing algorithm, and the data fragment is decrypted using the recovered key to obtain the original data;

[0013] Verify the device's operating authority. After the authority verification is passed, operate on the original data and re-encrypt and store the modified data;

[0014] Based on a variety of key security indicators, the encrypted data is monitored in real time, the threat level is assessed, and the self-destruct mechanism is triggered;

[0015] Establish a channel encryption mechanism, monitor the status of the network and channels in real time, and dynamically adjust channel allocation according to actual conditions, including the following steps:

[0016] For each channel, a random matrix and a key vector are generated, and the encrypted data vector is calculated. The encrypted data will be transmitted through the channel;

[0017] Establish independent encryption mechanisms for the channels for reading and writing data, and use independent keys and random matrices for the encryption process of each channel;

[0018] Regularly check the load, delay and security parameters of each channel. If the load or delay of a channel exceeds the set threshold, switch to other channels.

[0019] If the status of a channel is no longer suitable for data transmission, the current transmission task will be migrated to a new channel.

[0020] As a preferred solution of the data security transmission method based on encryption algorithm described in the present invention, the original data is divided into multiple fragments, a key for encryption is generated for each data fragment, and the key is distributedly processed through a secret sharing algorithm, including the following steps:

[0021] Set the original data to be encrypted to , whose size is A bytes, the original data Split into equal-sized fragments , ,…, , each fragment is of equal size;

[0022] For each data fragment, generate a 256-bit key and convert each AES-256 key Divide into multiple fragments and distribute them through Shamir's secret sharing algorithm.

[0023] As a preferred solution of the data security transmission method based on encryption algorithm described in the present invention, wherein: each data fragment is encrypted using an encryption algorithm, and the encrypted data fragments are distributed and stored on different servers and nodes, including the following steps:

[0024] For each piece of data, use the corresponding key Encrypt it to get the encrypted data fragment ;

[0025] Different servers and storage nodes are selected according to the network topology and data access requirements, and each node stores one or more encrypted data fragments;

[0026] Distribute storage nodes through geographic distribution and load balancing;

[0027] Blockchain technology is used to form a block for the storage location of each data fragment and its related metadata. The new block will be linked to the previous block to form an unalterable chain.

[0028] As a preferred solution of the data security transmission method based on encryption algorithm described in the present invention, wherein: multi-level identity authentication is performed on the device and user of the transmission request, and dynamic channel allocation is performed based on the identity authentication result, including the following steps:

[0029] Receive the digital certificate of the device, check whether the issuing authority of the certificate is credible, whether the certificate is within the validity period, and whether the signature of the certificate is valid;

[0030] If the certificate verification fails, terminate the transfer process. If it passes, proceed to the next step.

[0031] Verify the unique identification of the device, record the historical access behavior of the device, and use machine learning models to analyze the current behavior of the device to determine whether it conforms to its normal mode;

[0032] Evaluate the security level of the device based on the device's digital certificate and behavior analysis results. Dynamically assign corresponding permissions to the device based on the device's security level. If the device passes the authentication, assign it a temporary access token.

[0033] Select channels with different encryption levels based on data sensitivity, with sensitive data preferring high-security channels;

[0034] Monitor the network load in real time and select channels with low current load and low latency;

[0035] Allocate channels with different priorities according to the importance and authority of the device;

[0036] Allocate multiple channels for the same device, one channel for data reading and another channel for data writing.

[0037] As a preferred solution of the data security transmission method based on encryption algorithm described in the present invention, wherein: the use of machine learning model to analyze the current behavior of the device to determine whether it conforms to its normal mode includes the following steps:

[0038] Collect data on device access frequency and time period, operation type, network connection, and request content;

[0039] Use autoencoders for unsupervised learning, where the encoder compresses input features into low-dimensional latent features;

[0040] Taking the potential features as input, supervised learning is performed through support vector machines to identify the normal behavior patterns of the device, classify the behaviors, and identify abnormal behaviors;

[0041] Monitor the current operation behavior of the device in real time. Each time the device issues an operation request, extract its operation behavior features and compress them through the autoencoder to obtain latent features. Then, input the latent features into the trained SVM model to determine whether the behavior conforms to the normal mode of the device.

[0042] If the classification result is greater than zero, the behavior is considered normal behavior, and if the classification result is less than or equal to zero, the behavior is considered abnormal behavior.

[0043] As a preferred solution of the data security transmission method based on encryption algorithm described in the present invention, wherein: for the received encrypted data, the encryption key of each data fragment is restored using a secret sharing algorithm, and the data fragment is decrypted using the restored key to obtain the original data, including the following steps:

[0044] The device collects at least key fragments, assuming that the collected key fragments are , ,…, ,in, Represents a key fragment;

[0045] Recover the original key using the Lagrange interpolation formula , the expression is,

[0046]

[0047] in, is the minimum number of key fragments required for key recovery, Is the key fragment The corresponding value, is the corresponding fragment number, is the index of the key fragment, is the Lagrangian basis function, For Fragment indexes of key fragments other than For index The corresponding fragment number;

[0048] For each encrypted data segment , using the recovered original key Decrypt to get the original data fragment ;

[0049] After all data fragments are decrypted, they are combined into the complete original data .

[0050] As a preferred solution of the data security transmission method based on encryption algorithm described in the present invention, wherein: verifying the operation authority of the device, after the authority verification is passed, operating the original data, and re-encrypting and storing the modified data, including the following steps,

[0051] When the device passes authentication, it is assigned a temporary access token, based on which its validity is verified;

[0052] If the token verification fails, the operation process is terminated. If the verification is successful, proceed to the next step;

[0053] While verifying the token, the machine learning model is used to monitor the operation behavior of the device. If the similarity between the operation behavior and the expected behavior is lower than the threshold, the operation is rejected.

[0054] If the device's permissions allow the read operation, the system provides the decrypted data to the device and records the read log;

[0055] If the device's permissions allow write operations, the device can modify the data, and the modified data will be returned to the server. The server will re-encrypt and store the modified data and overwrite the original data;

[0056] For each piece of data that is modified, a new AES-256 key is generated , use the Shamir secret sharing algorithm to divide each new key into multiple key fragments and distribute them to different storage nodes;

[0057] Use the generated key Encrypt the modified data fragment to obtain the encrypted data fragment ;

[0058] The encrypted data fragment Distributed storage is carried out in different servers, and the storage path is recorded through blockchain technology.

[0059] As a preferred solution of the data security transmission method based on encryption algorithm described in the present invention, wherein: according to multiple key security indicators, the encrypted data is monitored in real time, the threat level is evaluated, and the self-destruction mechanism is triggered, including the following steps:

[0060] Detect whether the network has sudden large-scale data packet transmission and traffic peaks in abnormal time periods;

[0061] The number of consecutive authentication failures for devices and users within a specified time period;

[0062] Whether the number of connections initiated by the device increases abnormally in a short period of time;

[0063] The device attempts to access resources or data that it does not have the permissions for;

[0064] Check external threat intelligence sources. If the device IP and domain name information appear in the list of known attack sources, increase the threat score directly.

[0065] Each indicator is scored on a scale of 0 to 1, with higher values ​​indicating greater threat;

[0066] According to the scoring rules, each indicator is scored separately and finally weighted and combined into a comprehensive threat score. ;

[0067] Based on the scoring results, the comprehensive threat score Divided into different levels, 0≤ <0.3 is a low threat, no obvious threat, continue monitoring; 0.3≤T<0.6 is a medium threat, there is a potential threat, it is recommended to restrict some operations; 0.6≤T<0.8 is a high threat, there is an obvious threat, it is recommended to isolate the device or traffic; 0.8≤T<1.0 is an extremely high threat, immediately trigger the self-destruct mechanism to destroy some key fragments and data;

[0068] Choose different response measures based on the threat level;

[0069] When the threat is assessed as extremely high, a self-destruct mechanism will be triggered to prevent attackers from obtaining data and keys.

[0070] As a preferred solution of the data security transmission method based on encryption algorithm described in the present invention, wherein: the triggering self-destruction mechanism comprises the following steps:

[0071] In the data encryption process, the AES-256 symmetric encryption algorithm is used. The key is divided and distributed in different storage nodes. When the self-destruct mechanism is triggered, the keys will be destroyed immediately. key fragments;

[0072] For stored sensitive data, the data is overwritten multiple times through secure erasure technology;

[0073] For data stored in shards, some data fragments are destroyed in a manner similar to the destruction of keys.

[0074] The beneficial effects of the present invention are as follows: by splitting the data and using key encryption, the confidentiality of the data is improved, and even if part of the key fragment is leaked, the complete information cannot be restored, thereby increasing security. Distributed storage and blockchain technology ensure the tamper-resistance and transparency of the data, reducing the risk of leakage. Strict device identity authentication and dynamic channel allocation mechanisms ensure that sensitive data is transmitted through secure channels first, reducing delays and achieving a balance between security and performance. Channel encryption and real-time monitoring mechanisms further enhance the system's defense capabilities and transmission efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0076] Figure 1 This is a flow chart of the data security transmission method based on the encryption algorithm in Example 1.

[0077] Figure 2 A schematic diagram of the threat level of the data security transmission method based on the encryption algorithm in Example 1. DETAILED DESCRIPTION

[0078] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0079] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0080] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0081] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a data security transmission method based on an encryption algorithm, comprising the following steps:

[0082] S1. Split the original data into multiple fragments, generate a key for encryption for each data fragment, and perform distributed processing on the key through a secret sharing algorithm, including the following steps:

[0083] Set the original data to be encrypted to , whose size is A bytes, the original data Split into equal-sized fragments , ,…, , the size of each fragment is equal. Generally, the size of the fragment can be set according to the network environment or the performance of the storage node. The common size is 1MB to 10MB;

[0084] For each data fragment, a 256-bit key is generated , which is used to encrypt the fragment. AES-256 key generation can ensure the uniqueness of each key through a random number generator.

[0085] To ensure that even if the key is compromised, the complete data cannot be recovered. Divide into multiple fragments and distribute them through Shamir's secret sharing algorithm.

[0086] S2. Encrypt each data fragment using an encryption algorithm, and store the encrypted data fragments in a distributed manner on different servers and nodes, including the following steps:

[0087] For each piece of data, use the corresponding key Encrypting the data to obtain encrypted data fragments;

[0088] Different servers and storage nodes are selected according to the network topology and data access requirements, and each node stores one or more encrypted data fragments;

[0089] The distribution of storage nodes can be done in the following ways:

[0090] Through geographical distribution, data fragments are ensured to be stored in different geographical locations, further improving data redundancy and anti-attack capabilities; load balancing, intelligently distributes data fragments according to the load of storage nodes to ensure load balance on each node;

[0091] Blockchain technology is used to form a block for the storage location of each data fragment and its related metadata (such as storage time, node ID, etc.). The new block will be linked to the previous block to form an unalterable chain, ensuring that each storage operation has a clear record.

[0092] S3, performing multi-level identity authentication on the device and user of the transmission request, and dynamically allocating channels based on the identity authentication results, including the following steps:

[0093] When a device initiates a data transmission request, it first needs to provide a digital certificate, which is used to prove the identity of the device and ensure that the certificate has not been tampered with;

[0094] Receive the digital certificate of the device, check whether the issuing authority of the certificate is credible, whether the certificate is within the validity period, and whether the signature of the certificate is valid, to ensure that the device identity is authentic and has not been forged;

[0095] If the certificate verification fails, terminate the transfer process. If it passes, proceed to the next step.

[0096] To further enhance security, additional authentication steps include: Device fingerprint verification: verifying the unique identifier of the device (such as MAC address, hardware ID, etc.); Behavior analysis: recording the historical access behavior of the device, using machine learning models to analyze the current behavior of the device to determine whether it conforms to the normal mode, for example, calculating the behavior vector of the device and comparing the similarity with the historical behavior vector, presetting a behavior similarity threshold, and denying access if the similarity between the current behavior and the historical behavior is lower than this threshold;

[0097] According to the digital certificate and behavior analysis results of the device, the security level of the device is evaluated. The security level is divided into high-level security, medium-level security, low-level security and dangerous status;

[0098] According to the security level of the device, the corresponding permissions are dynamically assigned to the device. For example, in a high-level security state, the device can perform all operations; in a medium-level security state, the device is restricted from performing highly sensitive operations (such as deleting and modifying key data); in a low-level security state, the device can only perform read-only operations and cannot make any modifications; in a dangerous state, all operations on the device are denied and the device connection is cut off;

[0099] If the device passes the authentication, a temporary access token is assigned to it, which contains the device's access rights and validity period;

[0100] Select channels with different encryption levels based on data sensitivity, with sensitive data preferring high-security channels;

[0101] Monitor the network load in real time and select channels with low current load and low latency;

[0102] Allocate channels with different priorities according to the importance and authority of the device;

[0103] To improve the security and efficiency of data transmission, multiple channels can be allocated to the same device, one channel for data reading (such as decrypted data) and another channel for data writing (such as modified data);

[0104] For large data transmission, multiple channels can be used for parallel transmission to avoid the bottleneck of a single channel.

[0105] S4, the machine learning model is used to analyze the current behavior of the device to determine whether it conforms to its normal mode, including the following steps:

[0106] Before model training, we first need to collect data on the device's operational behavior. Device behavior includes access frequency and time period: the device's access request frequency and the time period in which the operation occurs; operation type: such as read, modify, and delete operations; network connection: the device's network connection status, such as the target IP address, port, and bandwidth usage; request content: the type of data or size requested by the device; each device operation behavior can be represented as a feature vector;

[0107] Use autoencoders for unsupervised learning, where the encoder compresses input features into low-dimensional latent features;

[0108] Taking the potential features as input, supervised learning is performed through support vector machines to identify the normal behavior patterns of the device, classify the behaviors, and identify abnormal behaviors;

[0109] Monitor the current operation behavior of the device in real time. Each time the device issues an operation request, extract its operation behavior features and compress them through the autoencoder to obtain latent features. Then, input the latent features into the trained SVM model to determine whether the behavior conforms to the normal mode of the device.

[0110] If the classification result is greater than zero, the behavior is considered normal behavior, and if the classification result is less than or equal to zero, the behavior is considered abnormal behavior.

[0111] S5. Establish a channel encryption mechanism, monitor the status of the network and channel in real time, and dynamically adjust channel allocation according to actual conditions, including the following steps:

[0112] For each channel, a random matrix and a key vector are generated, and the encrypted data vector is calculated. The encrypted data will be transmitted through the channel;

[0113] To ensure the security of two-way data transmission, independent encryption mechanisms are established for the channels for reading and writing data. Specifically, read channel encryption is used for decrypted data transmission to ensure the security of data transmission from the server to the device; write channel encryption is used for uploading modified data to ensure the security of data transmission from the device to the server.

[0114] The encryption process of each channel uses an independent key and random matrix;

[0115] Regularly check the load, delay, and security parameters of each channel to ensure that the channel status meets expectations. If the load or delay of a channel is found to exceed the set threshold, switch to other channels;

[0116] If the status of a channel is no longer suitable for data transmission, the current transmission task will be migrated to a new channel. The migration process is as follows: a new channel is allocated to the device, and the device is notified to switch to the channel. The data transmission task is migrated from the old channel to the new channel. During the migration process, the data transmission of the old channel will be gradually stopped to ensure that data is not lost.

[0117] S6. For the received encrypted data, the encryption key of each data fragment is recovered using a secret sharing algorithm, and the data fragment is decrypted using the recovered key to obtain the original data, including the following steps:

[0118] The device collects at least key fragments, assuming that the collected key fragments are , ,…, ,in, Represents a key fragment;

[0119] Recover the original key using the Lagrange interpolation formula , the expression is,

[0120]

[0121] in, is the minimum number of key fragments required for key recovery, Is the key fragment The corresponding value, is the corresponding fragment number, is the index of the key fragment, is the Lagrangian basis function, For Fragment indexes of key fragments other than For index The corresponding fragment number;

[0122] This formula recovers the original key by interpolation , only when enough (at least The key can only be correctly recovered when there are key fragments of

[0123] For each encrypted data segment , using the recovered original key Decrypt to get the original data fragment ;

[0124] After all data fragments are decrypted, they are combined into the complete original data .

[0125] S7, verify the operation authority of the device. After the authority verification is passed, operate the original data, and re-encrypt and store the modified data, including the following steps:

[0126] When the device passes the authentication, it is assigned a temporary access token. The content of the token includes the unique identification of the device, the device's operation permissions (such as reading, writing and modifying, etc.) and the expiration time of the token. The validity of the temporary access token is verified based on the following procedures: Time validity: check whether the current time is within the validity period of the token; Permission validity: check whether the device has the permissions required for the current operation to ensure that the device has legal operation permissions;

[0127] If the token verification fails, the operation process is terminated. If the verification is successful, proceed to the next step;

[0128] While verifying the token, the machine learning model is used to monitor the device's operating behavior to ensure that its operating behavior conforms to the normal mode. If the similarity between the operating behavior and the expected behavior is lower than the threshold, the operation is rejected.

[0129] If the device's permissions allow the read operation, the decrypted data is provided to the device and the read log is recorded. Data reading does not involve re-encryption and storage of the data;

[0130] If the device's permissions allow write operations, the device can modify the data, and the modified data will be returned to the server. The server will re-encrypt and store the modified data and overwrite the original data;

[0131] The modification operation is to modify part of the data. The modified data needs to be re-encrypted and overwrite the original data. The specific process is as follows: Data modification: The device re-encrypts the decrypted original data. Modify and obtain the modified data; Re-shard: shard the modified data, the steps are the same as data sharding; Re-encrypt: use a new AES-256 key for each data fragment Encryption is performed;

[0132] Use the Shamir secret sharing algorithm to split each new key into multiple key fragments and distribute them to different storage nodes;

[0133] Use the generated key Encrypt the modified data fragment to obtain the encrypted data fragment ;

[0134] The encrypted data fragment Distributed storage is stored in different servers, and the storage path is recorded through blockchain technology to ensure the transparency and non-tamperability of storage operations.

[0135] S8. Based on a variety of key security indicators, the encrypted data is monitored in real time, the threat level is assessed, and the self-destruct mechanism is triggered, including the following steps:

[0136] The threat level is assessed based on a number of key security indicators, including:

[0137] Traffic anomaly: detects whether the network has sudden large-scale data packet transmission and traffic peaks in abnormal time periods;

[0138] Authentication failure count: The number of consecutive authentication failures of the device and user within a specified time period;

[0139] Connection frequency: whether the number of connections initiated by the device in a short period of time increases abnormally;

[0140] Abnormal access rights: The device attempts to access resources or data that do not match its permissions;

[0141] Threat intelligence: Check external threat intelligence sources. If the device IP and domain name information appear in the list of known attack sources, the threat score will be increased directly.

[0142] Each indicator is scored on a scale of 0 to 1, with higher values ​​indicating greater threat;

[0143] The specific scoring rules are as follows:

[0144] Traffic anomaly score: If a significant increase in monitored traffic is detected (for example, the instantaneous traffic is 50% higher than the normal traffic), the traffic anomaly score is 0.6. If the traffic peak exceeds the normal value by 100%, the anomaly score is 1.0, and the normal traffic score is 0.

[0145] Authentication failure score: If authentication fails less than 3 times within a unit of time (for example, within 5 minutes), the score is 0; if authentication fails 3-5 times, the score is 0.4; if authentication fails more than 5 times, the score is 0.8; if authentication fails more than 10 times and comes from the same device or IP, the score is 1.0;

[0146] Connection frequency score: If the number of connections initiated by a device in a unit of time (for example, within 1 minute) exceeds 2 times the normal value, the score is 0.5; if it exceeds 3 times, the score is 1.0; if the connection frequency is normal, the score is 0;

[0147] Access permission anomaly score: If the device attempts to access unauthorized resources, the score is 0.5; if the device repeatedly attempts to access restricted resources, the score is 1.0; if the access behavior is in compliance with the permissions, the score is 0;

[0148] Threat intelligence score: If the device or IP address appears in the threat intelligence source (such as a blacklisted IP), the score is directly 1.0. If no relevant threat intelligence is found, the score is 0;

[0149] According to the scoring rules, each indicator is scored separately and finally weighted and combined into a comprehensive threat score. ;

[0150] Based on the scoring results, the comprehensive threat score Divided into different levels, 0≤ <0.3 is low threat, no obvious threat, continue monitoring, 0.3≤ <0.6 is a medium threat, there is a potential threat, it is recommended to limit some operations, 0.6≤ <0.8 is a high threat, there is an obvious threat, it is recommended to isolate the device or traffic, 0.8≤ <1.0 indicates extremely high threat, triggering the self-destruct mechanism immediately;

[0151] Different response measures are selected according to the threat level, for example: Low threat: record logs and continuously monitor without other intervention; Medium threat: restrict some highly sensitive operations (such as write and delete operations) and issue an alarm to notify the administrator; High threat: cut off some connections of suspicious devices or traffic and isolate their access rights; Extremely high threat: immediately trigger the self-destruct mechanism to destroy related data or keys to prevent further attacks;

[0152] When the threat is assessed as extremely high, a self-destruct mechanism will be triggered to prevent attackers from obtaining data and keys.

[0153] S9, triggering the self-destruction mechanism, including the following steps:

[0154] In the data encryption process, the AES-256 symmetric encryption algorithm is used. The key is divided and distributed in different storage nodes. When the self-destruct mechanism is triggered, the keys will be destroyed immediately. key fragments, ensuring that the original key cannot be recovered by the Lagrange interpolation formula, because The key fragments are destroyed, and the attacker cannot recover the original key even if he obtains other key fragments;

[0155] For stored sensitive data, secure erasure technology is used to overwrite the data multiple times to ensure that the data on the physical media cannot be recovered;

[0156] For data stored in shards, some data fragments are destroyed in a way similar to the destruction of keys. Even if an attacker obtains some data fragments, he cannot reconstruct the complete original data.

[0157] In summary, the present invention improves the confidentiality of data by splitting data and using key encryption, ensuring that even if some key fragments are leaked or lost, the complete information cannot be easily interpreted, thereby increasing the security of data, and further dispersing the risk of data leakage by encrypting and distributing the data. At the same time, the distributed storage combined with blockchain technology ensures that the data is not tampered with, improves the transparency and security of data storage and access, and further enhances the privacy and anti-tampering ability of the data. By performing more stringent identity authentication on devices and users requesting transmission, the accuracy and security of device identity authentication are improved. At the same time, the dynamic channel allocation mechanism based on the identity authentication result ensures that sensitive data is transmitted through high-security channels first, reducing the delay problem caused by network congestion or attacks, and achieving a balance between security and transmission performance. By establishing a channel encryption mechanism, the status of the network and channel is monitored in real time, and the channel allocation is dynamically adjusted according to the actual situation, not only the system's defense capability against malicious attacks is improved, but also the transmission performance and resource allocation are optimized, achieving the beneficial effect of improving data transmission efficiency and enhancing channel security.

[0158] Example 2, referring to Table 1, is the second example of the present invention. To further verify the technical solution of the present invention, experimental simulation data of a data security transmission method based on an encryption algorithm is provided.

[0159] The test environment of this embodiment includes 10 distributed servers, each of which is located in a different geographical location to simulate a distributed storage system in a wide area network. The original data is set as a file of 10GB in size, and the file is split into 1000 data fragments, each of which is 10MB. Each data fragment is encrypted using the AES-256 encryption algorithm, and an independent key is generated for each fragment. Each key is divided into 5 parts by the Shamir secret sharing algorithm and distributedly stored on different servers. In order to compare with the traditional single key encryption method, the test also compares the performance and security of the traditional AES-256 encryption method.

[0160] During the data transmission process, multi-level identity authentication is performed on the requesting device and user. During the verification process, the issuing authority of the digital certificate, the validity of the certificate signature, the unique identification of the device, and the historical access behavior of the device are comprehensively evaluated. Through behavioral analysis of machine learning models (autoencoder + SVM model), it is ensured that the device behavior conforms to the normal mode. According to the security level of the device, channels are dynamically allocated to it, and high-security channels are selected for sensitive data first. The network load is monitored in real time, and channels of different priorities are allocated according to the importance of the device.

[0161] During the decryption process, the device collects at least three key fragments from the storage node, recovers the original key of each data fragment through the Lagrange interpolation formula, and then decrypts the data fragment to finally recover the complete original data. The experiment also includes real-time monitoring of potential threats during transmission, and through a multi-level detection mechanism, assesses the threat level and triggers the self-destruct mechanism. When an extremely high threat is detected, the self-destruct mechanism is triggered to destroy some key fragments to prevent data leakage.

[0162] The details are shown in Table 1 below:

[0163]

[0164] It can be seen from the table data that the method of the present invention has significant advantages in multiple key parameters. First, in terms of data encryption time and decryption time, the method of the present invention is 120 seconds and 135 seconds respectively, which is significantly better than the 180 seconds and 210 seconds of the prior art 1 (traditional encryption scheme) and the 170 seconds and 195 seconds of the prior art 2 (single key encryption scheme). This shows that the time consumption of encryption operations is effectively reduced in the case of distributed storage and multi-node simultaneous processing.

[0165] Secondly, in terms of transmission failure rate, the failure rates of prior art 1 and prior art 2 were 2.5% and 1.8% respectively, while the failure rate of the method of the present invention was only 0.2%. This data shows that the multi-level identity authentication, dynamic channel allocation and real-time monitoring of network status in the method of the present invention can effectively reduce the failure rate in the data transmission process and ensure the integrity and stability of the data in the transmission process.

[0166] In terms of security score, the method of the present invention scored 9.8 points, which is much higher than the 7.3 points of prior art 1 and the 6.5 points of prior art 2. This is mainly due to the distributed key management, multi-level identity authentication, dynamic channel encryption mechanism, threat detection and self-destruction mechanism of the present invention, which effectively improves the security of data during transmission.

[0167] In addition, in terms of the number of channel switching times, the method of the present invention has a channel switching number of 3 times, which is significantly less than the prior art. This result shows that through the dynamic channel allocation mechanism in the method of the present invention, the channel allocation can be adjusted in real time according to the network status during the transmission process, thereby reducing unnecessary channel switching.

[0168] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A data security transmission method based on an encryption algorithm, characterized in that: include, Split the original data into multiple fragments, generate a key for encryption for each data fragment, and distribute the key through a secret sharing algorithm; Use encryption algorithms to encrypt each data fragment, and store the encrypted data fragments in different servers and nodes in a distributed manner; Perform multi-level identity authentication on the devices and users requesting transmission, and dynamically allocate channels based on the identity authentication results; Establish a channel encryption mechanism, monitor the status of the network and channels in real time, and dynamically adjust channel allocation according to actual conditions; For the received encrypted data, the encryption key of each data fragment is recovered using a secret sharing algorithm, and the data fragment is decrypted using the recovered key to obtain the original data; Verify the device's operating authority. After the authority verification is passed, operate on the original data and re-encrypt and store the modified data; Based on a variety of key security indicators, the encrypted data is monitored in real time, the threat level is assessed, and the self-destruct mechanism is triggered; Establish a channel encryption mechanism, monitor the status of the network and channels in real time, and dynamically adjust channel allocation according to actual conditions, including the following steps: For each channel, a random matrix and a key vector are generated, and the encrypted data vector is calculated. The encrypted data will be transmitted through the channel; Establish independent encryption mechanisms for the channels for reading and writing data, and use independent keys and random matrices for the encryption process of each channel; Regularly check the load, delay and security parameters of each channel. If the load or delay of a channel exceeds the set threshold, switch to other channels. If the status of a channel is no longer suitable for data transmission, the current transmission task will be migrated to a new channel.

2. The data security transmission method based on encryption algorithm as claimed in claim 1, characterized in that: The original data is split into multiple fragments, a key for encryption is generated for each data fragment, and the key is distributed through a secret sharing algorithm, including the following steps: Set the original data to be encrypted to , whose size is A bytes, the original data Split into equal-sized fragments , ,…, , each fragment is of equal size; For each data fragment, a 256-bit key is generated , each AES-256 key Divide into multiple fragments and distribute them through Shamir's secret sharing algorithm.

3. The data security transmission method based on encryption algorithm as claimed in claim 2, characterized in that: Use an encryption algorithm to encrypt each data fragment, and store the encrypted data fragments in a distributed manner on different servers and nodes, including the following steps: For each piece of data, use the corresponding key Encrypting the data to obtain encrypted data fragments; Different servers and storage nodes are selected according to the network topology and data access requirements, and each node stores one or more encrypted data fragments; Distribute storage nodes through geographic distribution and load balancing; Blockchain technology is used to form a block for the storage location of each data fragment and its related metadata. The new block will be linked to the previous block to form an unalterable chain.

4. The data security transmission method based on encryption algorithm as claimed in claim 3 is characterized in that: Perform multi-level identity authentication on the device and user requesting the transmission, and dynamically allocate channels based on the identity authentication results, including the following steps: Receive the digital certificate of the device, check whether the issuing authority of the certificate is credible, whether the certificate is within the validity period, and whether the signature of the certificate is valid; If the certificate verification fails, terminate the transfer process. If it passes, proceed to the next step. Verify the unique identification of the device, record the historical access behavior of the device, and use machine learning models to analyze the current behavior of the device to determine whether it conforms to its normal mode; Evaluate the security level of the device based on the device's digital certificate and behavior analysis results. Dynamically assign corresponding permissions to the device based on the device's security level. If the device passes the authentication, assign it a temporary access token. Select channels with different encryption levels based on data sensitivity, with sensitive data preferring high-security channels; Monitor the network load in real time and select channels with low current load and low latency; Allocate channels with different priorities according to the importance and authority of the device; Allocate multiple channels for the same device, one channel for data reading and another channel for data writing.

5. The data security transmission method based on encryption algorithm as claimed in claim 4, characterized in that: The method of using a machine learning model to analyze the current behavior of the device and determine whether it conforms to its normal mode includes the following steps: Collect data on device access frequency and time period, operation type, network connection, and operation behavior of request content; Use autoencoders for unsupervised learning, where the encoder compresses input features into low-dimensional latent features; Taking the potential features as input, supervised learning is performed through support vector machines to identify the normal behavior patterns of the device, classify the behaviors, and identify abnormal behaviors; Monitor the current operation behavior of the device in real time. Each time the device issues an operation request, extract its operation behavior features and compress them through the autoencoder to obtain latent features. Then, input the latent features into the trained SVM model to determine whether the behavior conforms to the normal mode of the device. If the classification result is greater than zero, the behavior is considered normal behavior, and if the classification result is less than or equal to zero, the behavior is considered abnormal behavior.

6. The data security transmission method based on encryption algorithm as claimed in claim 5, characterized in that: For the received encrypted data, the encryption key of each data fragment is recovered using a secret sharing algorithm, and the data fragment is decrypted using the recovered key to obtain the original data, including the following steps: The device collects at least key fragments, assuming that the collected key fragments are , ,…, ,in, Represents a key fragment; Recover the original key using the Lagrange interpolation formula , the expression is, in, is the minimum number of key fragments required for key recovery, Is the key fragment The corresponding value, is the corresponding fragment number, is the index of the key fragment, is the Lagrangian basis function, For Fragment indexes of key fragments other than For index The corresponding fragment number; For each encrypted data segment , using the recovered original key Decrypt to get the original data fragment ; After all data fragments are decrypted, they are combined into the complete original data .

7. The data security transmission method based on encryption algorithm as claimed in claim 6, characterized in that: Verify the device's operating authority. After the authority verification is passed, operate on the original data and re-encrypt and store the modified data, including the following steps: When the device passes authentication, it is assigned a temporary access token, based on which its validity is verified; If the token verification fails, the operation process is terminated. If the verification is successful, proceed to the next step; While verifying the token, the machine learning model is used to monitor the operation behavior of the device. If the similarity between the operation behavior and the expected behavior is lower than the threshold, the operation is rejected. If the device's permissions allow the read operation, the system provides the decrypted data to the device and records the read log; If the device's permissions allow write operations, the device can modify the data, and the modified data will be returned to the server. The server will re-encrypt and store the modified data and overwrite the original data; For each piece of data that is modified, a new AES-256 key is generated , use the Shamir secret sharing algorithm to divide each new key into multiple key fragments and distribute them to different storage nodes; Use the generated key Encrypt the modified data fragment to obtain the encrypted data fragment ; The encrypted data fragment Distributed storage is carried out in different servers, and the storage path is recorded through blockchain technology.

8. The data security transmission method based on encryption algorithm as claimed in claim 7, characterized in that: Based on a variety of key security indicators, the encrypted data is monitored in real time, the threat level is assessed, and the self-destruct mechanism is triggered, including the following steps: Detect whether the network has sudden large-scale data packet transmission and traffic peaks in abnormal time periods; The number of consecutive authentication failures for devices and users within a specified time period; Whether the number of connections initiated by the device increases abnormally in a short period of time; The device attempts to access resources or data that it does not have the permissions for; Check external threat intelligence sources. If the device IP and domain name information appear in the list of known attack sources, increase the threat score directly. Each indicator is scored on a scale of 0 to 1, with higher values ​​indicating greater threat; According to the scoring rules, each indicator is scored separately and finally weighted and combined into a comprehensive threat score. ; Based on the scoring results, the comprehensive threat score Divided into different levels, 0≤ <0.3 is a low threat, no obvious threat, continue monitoring, 0.3≤T<0.6 is a medium threat, there is a potential threat, it is recommended to restrict some operations, 0.6≤T<0.8 is a high threat, there is an obvious threat, it is recommended to isolate the device or traffic, 0.8≤T<1.0 is an extremely high threat, immediately trigger the self-destruct mechanism; Choose different response measures based on the threat level; When the threat is assessed as extremely high, a self-destruct mechanism will be triggered to prevent attackers from obtaining data and keys.

9. The data security transmission method based on encryption algorithm as claimed in claim 8, characterized in that: The triggering self-destruction mechanism comprises the following steps: In the data encryption process, the AES-256 symmetric encryption algorithm is used. The key is divided and distributed in different storage nodes. When the self-destruct mechanism is triggered, the keys will be destroyed immediately. key fragments; For stored sensitive data, the data is overwritten multiple times through secure erasure technology; For data stored in shards, some data fragments are destroyed in a manner similar to the destruction of keys.

Images