An encryption communication method satisfying data privacy requirements in heterogeneous computing

Abstract

The application provides an encryption communication method meeting data privacy requirements in heterogeneous computing, comprising: obtaining hardware and software configuration information of a heterogeneous computing node, judging compatibility of encryption algorithms in different systems; designing an interface adaptation layer based on incompatible nodes; generating a session key in a central control node, determining a security strength level of the system according to an environment verification result; judging performance and security priority, and scheduling encryption operation to a processor core with optimal performance; detecting a direct transmission path of data between various processing nodes without encryption, and inserting an encryption and integrity verification mechanism; obtaining data of various security levels, and performing encryption operation according to encryption data requirements; dynamically adjusting encryption algorithm strength according to environment changes and attack detection results; and if decryption failure is detected, immediately limiting access permission of the node.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to an encryption communication method that meets data privacy requirements in heterogeneous computing. Background Art

[0002] With the widespread adoption of heterogeneous computing, computing nodes have varying hardware and software configurations, leading to increasingly prominent encryption algorithm compatibility issues across different systems. Furthermore, effectively protecting data privacy is a significant challenge that cannot be ignored. In this environment, several key challenges arise: Differing hardware and software configurations between different computing nodes lead to encryption algorithm compatibility issues; the selection of transmission encryption schemes must consider resource consumption and environmental validation results, balancing performance and security; scheduling encryption operations requires selecting the best-performing processor cores to improve the efficiency of encrypted communication; ensuring the security of data transmission paths requires the insertion of encryption and integrity verification mechanisms; and the strength of encryption algorithms requires dynamic adjustment based on environmental changes and attack detection results. To address these challenges, it is necessary to design an encryption communication method that is both efficient and secure while meeting data privacy requirements and addressing related issues in heterogeneous computing environments. Summary of the Invention

[0003] The present invention provides an encryption communication method that meets the data privacy requirements in heterogeneous computing, which mainly includes:

[0004] Obtain hardware and software configuration information of heterogeneous computing nodes to determine the compatibility of encryption algorithms in different systems; design an interface adaptation layer based on incompatible nodes; generate session keys at the central control node and determine the security strength level of the system based on the environmental verification results; determine performance and security priorities and schedule encryption operations to the processor core with the best performance; detect direct unencrypted data transmission paths between processing nodes and insert encryption and integrity verification mechanisms; obtain data at various security levels and perform encryption operations according to the requirements of encrypted data; dynamically adjust the strength of the encryption algorithm based on environmental changes and attack detection results; if decryption failure is detected, immediately restrict the node's access rights.

[0005] Furthermore, obtaining hardware and software configuration information of heterogeneous computing nodes and determining the compatibility of encryption algorithms in different systems includes:

[0006] Obtain the preset information of heterogeneous computing nodes; establish matching rules for encryption algorithms and node configurations based on the preset rules of encryption algorithms; then traverse all heterogeneous nodes, detect the configuration parameters on each node, and determine the operating compatibility of the supported encryption algorithm types and versions in the current environment based on the matching rules; if incompatible algorithm node combinations occur, perform adaptive design of interface adaptation layer compatibility compensation.

[0007] Furthermore, the designing of the interface adaptation layer based on the incompatible nodes includes:

[0008] By analyzing and comparing the configuration information of the nodes, the compatibility between different nodes is determined; based on the results of the compatibility test, the format and type conversion of the data between different nodes is performed; the corresponding communication protocol is adopted for each node to achieve conversion between protocols; when the node changes or is upgraded, the interface adaptation layer is upgraded and compatibility adapted accordingly according to the changed configuration information of the node. The compatibility upgrade at least includes the change of the interface and the update of the data conversion rules.

[0009] Furthermore, generating a session key at the central control node and determining the security strength level of the system according to the environmental verification result include:

[0010] Deploy the key management service on the central control node. The key management service includes a random number generator and a key generation algorithm. When establishing a new session, call the random number generator to obtain a high-entropy seed, input it into the key generation algorithm, and output the session key. Obtain the hardware performance and security simulation test results of all encryption computing nodes. Analyze the CPU and memory usage, network traffic overhead and resource consumption indicators of different encryption algorithms and implementation schemes on each node, and determine the security strength level of each algorithm and mode under the parameter configuration based on simulation tests.

[0011] Furthermore, the determining of performance and security priorities and scheduling the encryption operation to the processor core with the best performance includes:

[0012] Select a corresponding processor core according to the computational complexity of the encryption algorithm; select a processor core according to the performance indicators of the processor core, the performance indicators include one or a preset number of types of main frequency, cache size, instruction-level parallelism and out-of-order execution capability; determine whether the selected processor core has hardware security features, the hardware security features include one or a preset number of types of encryption engine and memory protection mechanism; according to the requirements of the encryption operation, transfer the corresponding data of the encryption operation to the processor core with the best performance for encryption calculation; determine whether the encryption operation is completed, if not, wait for the processor core to complete the encryption calculation; perform the next operation according to the result of the encryption operation, the operation includes data transmission or data storage or data output.

[0013] Furthermore, the detection data is directly transmitted between the processing nodes without encryption, and an encryption and integrity verification mechanism is inserted, including:

[0014] Obtain all physical network connectivity path information between each encryption processing node; determine all point-to-point direct transmission links in the topology, and find communication lines that do not go through third-party transit; determine whether there are unencrypted data packets on the link that are directly transmitted end-to-end; set up an encrypted channel between the encryption processing nodes at both ends where the traffic is disconnected, and use the same monitoring point of the encryption processing nodes at both ends as an intermediate agent to form a tunnel; use identity recognition data to verify the accuracy and true source of data from the encryption processing nodes at both ends to prevent data tampering or replay attacks; simultaneously detect concurrent data connections and transmission frequencies on all end-to-end direct links, and perform trace analysis on traffic with abnormal behavior to prevent data theft or attacks.

[0015] Furthermore, the acquisition of data at each security level and the execution of encryption operations according to encryption data requirements include:

[0016] Obtain data of various security levels; determine the data that needs to be encrypted and the corresponding security level based on the application scenario and security requirements; obtain data with various security levels through identity authentication and permission control mechanisms; select encryption algorithms based on the security level of the data to perform encryption operations.

[0017] Furthermore, the dynamic adjustment of encryption algorithm strength according to environmental changes and attack detection results includes:

[0018] Obtain and analyze environmental change information and attack detection results; evaluate the security status of the system; determine whether the system has security vulnerabilities based on the evaluation results; when security vulnerabilities occur, generate and distribute keys based on the strength of the encryption algorithm.

[0019] Furthermore, if a decryption failure is detected, immediately restricting the access rights of the node includes:

[0020] Obtain the number of decryption failures based on the node identifier; determine whether the number of decryption failures exceeds the set threshold; if the number of decryption failures exceeds the set threshold, record the decryption error time; determine whether the access rights of the corresponding node need to be restricted based on the decryption error time; if the access rights of the corresponding node need to be restricted, update the access rights status of the corresponding node to restricted access; obtain and process the decryption failure information, and update the decryption failure handling measures based on the processing results.

[0021] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0022] The application discloses an encryption communication method meeting data privacy requirements and having high efficiency and safety, and solves related problems in a heterogeneous computing environment. The method obtains hardware and software configuration information of the heterogeneous computing nodes, judges the compatibility of encryption algorithms in different systems, and designs an interface adaptation layer to realize seamless migration of the algorithms. A session key is generated at a central control node, and a transmission encryption scheme with low resource consumption is selected according to an environment verification result. Meanwhile, according to performance and safety priorities, encryption operations are scheduled to processor cores with optimal performance. In order to ensure the safety of data, an encryption and integrity verification mechanism is also inserted on a data transmission path between the processing nodes. According to the security level of the encrypted data, corresponding encryption operations are performed. In order to cope with environmental changes and attack detection results, the strength of the encryption algorithm is also dynamically adjusted. If decryption failure is detected, the access rights of the node are immediately restricted. Through the fusion of the above technologies, the method can effectively meet the data privacy requirements, while ensuring the efficiency and safety of the encryption communication. BRIEF DESCRIPTION OF DRAWINGS

[0023] Figure 1 A flowchart of an encryption communication method meeting data privacy requirements in heterogeneous computing.

[0024] Figure 2 A schematic diagram of an encryption communication method meeting data privacy requirements in heterogeneous computing. DETAILED DESCRIPTION

[0025] In order to enable personnel in the technical field to better understand the technical solutions in the specification, the technical solutions in the specification will be clearly and completely described below in combination with the drawings in the specification. Obviously, the described embodiments are only part of the embodiments of the specification, rather than all the embodiments. Based on the embodiments in the specification, all other embodiments obtained by those of ordinary skill in the art without creative labor should belong to the protection scope of the specification.

[0026] The encryption communication method meeting data privacy requirements in heterogeneous computing can specifically include:

[0027] In step S101, the hardware and software configuration information of the heterogeneous computing nodes are obtained, and the compatibility of the encryption algorithms in different systems is judged.

[0028] The preset information of the heterogeneous computing nodes is obtained. According to the preset rules of the encryption algorithms, the matching rules of the encryption algorithms and the node configurations are established. Then all the heterogeneous nodes are traversed, the configuration parameters on each node are detected, and the running compatibility of the supported encryption algorithm types and versions in the current environment is judged according to the matching rules. If there is an incompatible algorithm node combination, adaptive design of interface adaptation layer compatibility compensation is performed.

[0029] For example, there are three heterogeneous computing nodes: Node A, Node B, and Node C. Now, we need to obtain their preset information. This preset information can include hardware configuration information such as processor type, memory capacity, and network bandwidth, as well as operating system version, library, and driver software configuration information. First, based on the preset encryption algorithm rules, establish matching rules between the encryption algorithm and node configuration. The preset encryption algorithm rules can be based on the implemented language, the version of the cryptographic library it relies on, and the requirements for the operating system kernel and instruction set. Node A supports AES and RSA algorithms, Node B supports AES and DES algorithms, and Node C supports RSA and DES algorithms. The matching rule can be defined as follows: Node A supports AES and RSA, Node B supports AES and DES, and Node C supports RSA and DES. Next, traverse all heterogeneous nodes and check the configuration parameters of each node. Node A's configuration parameters are AES-128 and RSA-2048, Node B's configuration parameters are AES-256 and DES-64, and Node C's configuration parameters are RSA-1024 and DES-128. Based on matching rules, the compatibility of supported encryption algorithm types and versions in the current environment is determined. Based on the root cause of the incompatibility, the functional positioning of the adaptation layer is determined. If the language versions used to implement the algorithms do not match, a language interpreter or compiler is added between the nodes to convert the representation format of the transmitted data in real time. If the issue is a dependency on a cryptographic library, the missing library files or compatible versions are provided for specific nodes. If the requirements of the operating system kernel or CPU instruction set are not met, the hardware abstraction layer is used for encapsulation and emulation. Node A's configuration parameters of AES-128 and RSA-2048 match the AES and RSA algorithms supported by Node A, making them compatible in the current environment. Node B's configuration parameter AES-256 matches the AES algorithm supported by Node B, but the configuration parameter DES-64 does not match the DES algorithm supported by Node B, making them incompatible in the current environment. Node C's configuration parameter RSA-1024 matches the RSA algorithm supported by Node C, but the configuration parameter DES-128 does not match the DES algorithm supported by Node C, making them incompatible in the current environment. If incompatible algorithm node combinations occur, adaptive design of the interface adaptation layer to compensate for compatibility is required. This adaptation layer design eliminates the need to modify the code logic implementing the encryption algorithm, reducing porting costs and enabling seamless algorithm migration between heterogeneous systems. If Node B and Node C need to communicate, an adapter can be inserted between Node B and Node C to convert the AES algorithm supported by Node B to the DES algorithm supported by Node C, thereby achieving compatibility.

[0030] Step S102: designing an interface adaptation layer based on the incompatible nodes.

[0031] By analyzing and comparing node configuration information, the compatibility between different nodes is determined. Based on the compatibility test results, data between different nodes is formatted and converted. The corresponding communication protocol is used for each node to achieve conversion between protocols. When a node is changed or upgraded, the interface adaptation layer is upgraded and adapted for compatibility based on the changed node configuration information. Compatibility upgrades at least include interface changes and updates to data conversion rules.

[0032] For example, compatibility testing can determine the compatibility between two nodes by comparing their configuration information. Node A's configuration information is {"Data Type":"int","Data Range":"0-100"}, while Node B's configuration information is {"Data Type":"float","Data Range":"0-1"}. Based on this configuration information, it can be determined that the data types of Node A and Node B are incompatible, requiring data conversion. During the data conversion phase, Node A transmits integer data [50,60,70], while Node B expects to receive floating-point data [5,6,7]. Based on the compatibility test results, data format conversion and type conversion can be performed to convert the integer data into floating-point data to ensure correct processing and use of the data. Adaptation modules are designed to implement protocol conversion based on the different communication protocols used by different nodes. Node A communicates using HTTP, while Node B communicates using MQTT. HTTP can be converted to MQTT to ensure normal communication between the nodes. During the exception handling phase, a network exception occurred during data transmission at Node A, preventing the data from being successfully transmitted to Node B. Designing an exception handling mechanism can capture such network anomalies and implement error message transmission and retry mechanisms to ensure accurate data transmission. When a node changes or upgrades, the interface adaptation layer is upgraded and adapted for compatibility based on the node's changed configuration. For example, if node A's configuration is upgraded to {"data type":"int","data range":"0-200"}, the interface adaptation layer needs to update data conversion rules and interface changes accordingly to maintain compatibility.

[0033] Step S103: Generate a session key at the central control node and determine the security strength level of the system based on the environment verification result.

[0034] Deploy a key management service on the central control node. The key management service includes a random number generator and a key generation algorithm. When establishing a new session, the random number generator is called to obtain a high-entropy seed, which is input into the key generation algorithm to output the session key. Obtain hardware performance and security simulation test results for all encryption computing nodes. Analyze the CPU and memory usage, network traffic overhead, and resource consumption indicators of different encryption algorithms and implementation schemes on each node. Based on simulation tests, determine the security strength level of each algorithm and mode under the parameter configuration.

[0035] For example, if the network bandwidth margin between encrypted transmission nodes exceeds a preset threshold and bandwidth is not a limiting factor, a higher-security encryption algorithm and mode, including AES-256 and RSA-2048, will be selected based on node processing performance. If network resources are limited and bandwidth is the primary constraint, lightweight encryption algorithms, including RC5, DES, and AES with low parameter configurations, will be selected. Stream ciphers and block ciphers will be used for segmented transmission to reduce the algorithm's communication overhead. Furthermore, if abnormal traffic or cryptanalysis activity is detected, requiring increased security, session keys will be re-established using more complex algorithms to increase the difficulty of attack. By determining and selecting the optimal encryption scheme, security requirements can be met while minimizing efficiency losses, ensuring the confidentiality and integrity of critical data, and maximizing resource efficiency. The central control node can use a 512-bit seed output from a hardware random number generator as input to the PBKDF2 key derivation algorithm, iterating 100,000 times to ultimately output a 256-bit AES session key. A key management service, consisting of a random number generator and a key generation algorithm, is deployed on the central control node. The random number generator generates a 128-bit high-entropy seed each time and inputs it into the key generation algorithm. The key generation algorithm uses the AES-256 algorithm to generate session keys. There are five encryption computing nodes: Node A, Node B, Node C, Node D, and Node E. To evaluate the resource consumption of different encryption algorithms and implementation schemes on each node, the hardware performance and security simulation test results of each node were analyzed. Node A has a 4-core CPU and 8GB of memory, Node B has an 8-core CPU and 16GB of memory, Node C has a 2-core CPU and 4GB of memory, Node D has a 6-core CPU and 12GB of memory, and Node E has a 4-core CPU and 8GB of memory. In the security simulation test, a 1GB file was encrypted using the AES-256 algorithm in CTR mode. The test results showed that Node A had a CPU utilization of 60%, a memory utilization of 70%, and a network traffic overhead of 100MB. Node B had a CPU utilization of 80%, a memory utilization of 90%, and a network traffic overhead of 150MB. Node C has a CPU utilization of 50%, a memory utilization of 60%, and a network traffic overhead of 80MB. Node D has a CPU utilization of 70%, a memory utilization of 80%, and a network traffic overhead of 120MB. Node E has a CPU utilization of 60%, a memory utilization of 70%, and a network traffic overhead of 100MB. By analyzing the above data, we can determine the CPU and memory utilization, as well as the network traffic overhead resource consumption indicators for different encryption algorithms and implementation schemes on each node. Node B has the highest CPU utilization, the highest memory utilization, and the heaviest network traffic overhead. Node C has lower CPU and memory utilization, and a lower network traffic overhead.According to the simulation test results, the security strength level under the parameter configuration of different algorithms and modes can be determined. The security strength of the AES-256 algorithm in the CTR mode is higher, but more resources are consumed. In actual deployment, according to the hardware performance and resource limitations of the node, appropriate encryption algorithms and implementation schemes can be selected to balance resource consumption and security strength.

[0036] Step S104, judging the performance and security priority, scheduling the encryption operation to the processor core with the optimal performance.

[0037] According to the calculation complexity of the encryption algorithm, the corresponding processor core is selected. According to the performance index of the processor core, the processor core is selected, and the performance index includes one or a preset number of types of the main frequency, the cache size, the instruction level parallelism and the out-of-order execution capability. It is judged whether the selected processor core has hardware security features, and the hardware security features include one or a preset number of types of the encryption engine and the memory protection mechanism. According to the requirement of the encryption operation, the data corresponding to the encryption operation is transmitted to the processor core with the optimal performance for encryption calculation. It is judged whether the encryption operation is completed, and if not, the processor core is waited for completing the encryption calculation. According to the result of the encryption operation, the next operation is performed, and the operation includes data transmission or data storage or data output.

[0038] For example, consider performing an AES encryption operation on a 1GB file. Processor core A is selected. It has a 3GHz clock speed, a 6MB cache, an instruction-level parallelism of 4, and an out-of-order execution capability of 8. Core A also features hardware security features, including an encryption engine and memory protection mechanisms. Before the encryption operation begins, the file must be transferred to core A for calculation. With a data transfer rate of 100MB / s, transferring a 1GB file to core A takes 10 seconds. Next, core A begins the encryption operation. Based on the computational complexity of the AES encryption algorithm, core A can complete 1000 encryption calculations per second. Therefore, for a 1GB file, core A takes 1000 seconds to complete the encryption operation. The completion of the encryption operation can be determined by checking the status of core A. Core A provides a status register that changes to 1 when the encryption operation is complete. This status register can be checked periodically; a 1 indicates that the encryption operation is complete. Once the encryption operation is complete, further actions can be taken based on the results. For example, the encrypted file can be transferred to a storage device or exported to a network. If the data transmission speed is 50MB / s, then it takes 20 seconds to transfer the encrypted file to the storage device. In summary, by selecting processor core A with the best performance and performing data transmission and result processing according to the encryption operation requirements, the AES encryption operation for a 1GB file can be completed. The entire process takes 10 seconds (transferring the file to processor core A) + 1000 seconds (processor core A completes the encryption operation) + 20 seconds (transferring the encrypted file to the storage device) = 1030 seconds.

[0039] Step S105: Detect the direct transmission path of data without encryption between the processing nodes, and insert encryption and integrity verification mechanisms.

[0040] Obtain information about all physical network connectivity paths between each encryption processing node. Identify all point-to-point direct transmission links in the topology and identify communication lines that do not require third-party transit. Determine whether unencrypted data packets are being transmitted directly end-to-end on the link. Establish an encrypted channel between the encryption processing nodes at both ends where traffic is disconnected, using the same monitoring point at both ends as an intermediate proxy to form a tunnel. Use identity identification data to verify the accuracy and true source of data from the encryption processing nodes at both ends to prevent data tampering or replay attacks. Simultaneously detect concurrent data connections and transmission frequencies on all end-to-end direct links, and perform trace analysis on traffic exhibiting abnormal behavior to prevent data theft or attacks.

[0041] For example, consider a network topology consisting of five encryption processing nodes. The physical network connectivity paths between the nodes are as follows: a direct link between nodes A and B, a direct link between nodes A and C, a direct link between nodes B and D, a direct link between nodes C and D, and a direct link between nodes C and E. Now, it is necessary to identify communication routes that do not require third-party transit. Based on this link information, the following direct transmission links can be obtained: a direct transmission link from node A to node B, a direct transmission link from node A to node C, a direct transmission link from node B to node D, a direct transmission link from node C to node D, and a direct transmission link from node C to node E. Next, it is necessary to detect whether unencrypted data packets are being transmitted end-to-end on these links. If an unencrypted data packet is detected on the direct transmission link between nodes A and B, an alarm is generated and the transmission is interrupted to prevent the leakage of encrypted data packets. An encrypted channel can be established between the encryption processing nodes at both ends of the disconnected traffic. For example, on a direct transmission link between nodes A and B, an encrypted channel can be formed using the same monitoring point at both nodes as an intermediary. Identity verification can be used to verify the accuracy and true source of data from the encrypted processing nodes at both ends. Digital certificates can be used to verify the identities of nodes A and B to prevent data tampering or replay attacks. Concurrent data connections and transmission frequencies on all end-to-end direct links can also be detected, and traffic exhibiting abnormal behavior can be traced and analyzed to prevent data theft or attacks. If an abnormally high frequency of data transmission occurs on the direct transmission link between nodes A and C, further analysis can be performed to determine whether data theft or attacks have occurred.

[0042] Step S106: Obtain data of each security level and perform encryption operations according to encryption data requirements.

[0043] Obtain data at each security level. Determine the data to be encrypted and the corresponding security level based on the application scenario and security requirements. Obtain data at each security level through authentication and permission control mechanisms. Select an encryption algorithm based on the data's security level and perform encryption operations.

[0044] For example, the sensitivity level and confidentiality requirements of core data and high-availability data are determined based on their specific attributes. Core data is user personal identification information, such as name, address, and mobile phone number, while high-availability data is user transaction records. According to relevant regulations and policies, personal identification information is considered sensitive data and requires high confidentiality. Therefore, the sensitivity level of core data is high, and the confidentiality requirements include strict access control, encrypted storage, and transmission. The integrity requirements of core data and high-availability data can also be determined based on their attributes. Core data is bank account balance information, while high-availability data is real-time trading data from the stock market. In banking, the accuracy of account balances is crucial, so data consistency and verifiability must be guaranteed. In the stock market, the accuracy of real-time trading data is also important, so data consistency and verifiability must also be guaranteed. Therefore, the integrity requirements of both core data and high-availability data are high, requiring the use of appropriate data verification mechanisms and anti-tampering measures. The real-time and availability requirements of high-availability data can also be determined based on its attributes. High-availability data is inventory information and order data on e-commerce platforms. In e-commerce, real-time updates of inventory information and continuous access to order data are crucial for smooth business operations. Therefore, high-availability data requires high real-time performance and timely data updates. Furthermore, high availability requirements demand continuous data access, ensuring users can query and place orders at any time. The appropriate encryption algorithm and key management solution can also be selected based on the data's sensitivity and confidentiality requirements. For core data with high sensitivity, the confidentiality requirements require strict access control, encrypted storage, and transmission. In this case, the AES Advanced Encryption Standard (AES) algorithm can be used for data encryption, and the RSA algorithm for key management. The AES algorithm offers high encryption strength and low complexity, while the RSA algorithm provides a secure key management and exchange mechanism. The impact of encryption on system performance can also be assessed by evaluating the complexity of the encryption algorithm and the processing speed of encryption operations. Using the AES algorithm for data encryption, the encryption operation processing speed is 1,000 data blocks per second. In a highly concurrent system, 10,000 data blocks need to be encrypted per second. This assessment shows that the impact of encryption operations on system performance is a 10% decrease in processing speed per second. Therefore, when designing the system architecture, it is important to consider the concurrency of encryption operations to ensure that the system can handle a large number of encryption operations. Core data and high-availability data can be encrypted based on the selected encryption algorithm and key management scheme. Core data and high-availability data are encrypted using the AES algorithm, while the RSA algorithm is used for key management. Appropriate encryption and key management ensure the security and reliability of encryption operations, preventing data leakage and tampering. The effectiveness of encryption measures can also be evaluated by monitoring system performance indicators and data encryption effectiveness.Monitor the processing speed, concurrency performance, and integrity of encrypted data for encryption operations. Monitoring results allow you to evaluate the performance and effectiveness of encryption measures and promptly identify and address issues and risks in encryption operations. You can also regularly update and maintain encryption algorithms and key management schemes, as well as optimize the performance of encryption operations. Regularly update versions of the AES and RSA algorithms to address known security vulnerabilities and weaknesses. Additionally, optimize the performance of encryption operations, such as optimizing the complexity of encryption algorithms and improving the processing speed and concurrency of encryption operations, to meet growing data processing demands.

[0045] Step S107: Dynamically adjust the encryption algorithm strength according to environmental changes and attack detection results.

[0046] Obtain and analyze environmental change information and attack detection results; evaluate the security status of the system; determine whether the system has security vulnerabilities based on the evaluation results; when security vulnerabilities occur, generate and distribute keys based on the strength of the encryption algorithm.

[0047] For example, real-time monitoring of changes in network bandwidth, computer performance, and user login behavior. Network bandwidth increases from 100 Mbps to 500 Mbps. Real-time intrusion detection and log analysis results are collected. The system detects five malicious login attempts. Based on the collected environmental changes and attack detection results, analysis is performed to assess the system's security status. Analysis is performed to determine whether the increased network bandwidth may lead to more DDoS attacks. Based on the analysis results, the system is determined to have security vulnerabilities. The system is determined to be at risk of DDoS attacks. If a security vulnerability is determined, the encryption algorithm strength is dynamically adjusted based on environmental changes and attack detection results. This includes increasing key length, updating encryption algorithm versions, or using more complex encryption algorithms. The key length is increased from 128 bits to 256 bits. New keys are generated based on the updated encryption algorithm strength. The generated new keys are distributed to relevant systems or users. The new keys are distributed to storage servers and client devices. In specific implementations, the key agreement protocol can also be updated: if the key agreement protocol needs to be updated, the corresponding update is performed. The TLS protocol version is updated. Key-related attributes are updated: the newly generated key and the updated key agreement protocol attributes are updated in the system. Update the key attributes of the storage server and client device. When resource utilization is high, suspend low-priority encryption tasks to help balance system stability. Extract the types of all running tasks in the system: transaction requests are of the highest priority, while background report generation is of low priority. When system resource utilization remains above 90% for two minutes, the report generation task is matched, identified as a low-priority encryption operation, and suspended.

[0048] Step S108: If decryption failure is detected, the node access rights are immediately restricted.

[0049] Obtain the number of decryption failures based on the node ID. Determine whether the number of decryption failures exceeds the set threshold. If so, record the time of the decryption error. Based on the time of the decryption error, determine whether access rights to the corresponding node need to be restricted. If access rights to the corresponding node need to be restricted, update the node's access rights status to restricted access. Obtain and process the decryption failure information, and update the decryption failure handling measures based on the processing results.

[0050] For example, there is a node identified as Node1. Based on the node ID, the number of decryption failures is obtained, which is 3. A threshold is set to 2, meaning that if the number of decryption failures exceeds 2, access rights must be restricted. Since the number of decryption failures exceeds the threshold, the time of the decryption error is recorded. The current time is 10:00 on January 1, 2022. Based on the time of the decryption error, whether access rights to the corresponding node need to be restricted is determined. According to company regulations, if the number of decryption errors exceeds the threshold, access rights must be restricted for 24 hours. Therefore, at the current time of 10:00 on January 1, 2022, access rights to the corresponding node need to be restricted and the node's access rights status updated to restricted access. Next, the decryption failure information is obtained and processed. Based on the processing results, the decryption failure handling measures are updated. By analyzing the decryption failure and finding that it is due to an incorrect password, password rules can be strengthened and users can be reminded to check whether the password they entered is correct.

[0051] The above description is merely a preferred embodiment of the present application and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also encompasses other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the concept of this application. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. An encrypted communication method that meets data privacy requirements in heterogeneous computing, characterized in that: The method comprises: Obtain hardware and software configuration information of heterogeneous computing nodes to determine the compatibility of encryption algorithms in different systems; design an interface adaptation layer based on incompatible nodes; generate session keys at the central control node and determine the security strength level of the system based on the environmental verification results; determine performance and security priorities and schedule encryption operations to the processor core with the best performance; detect direct unencrypted data transmission paths between processing nodes and insert encryption and integrity verification mechanisms; obtain data at various security levels and perform encryption operations according to the requirements of encrypted data; dynamically adjust the strength of the encryption algorithm based on environmental changes and attack detection results; if decryption failure is detected, immediately restrict the node's access rights.

2. The method according to claim 1, wherein The obtaining of hardware and software configuration information of heterogeneous computing nodes and determining the compatibility of encryption algorithms in different systems includes: Obtain the preset information of heterogeneous computing nodes; establish matching rules for encryption algorithms and node configurations based on the preset rules of encryption algorithms; then traverse all heterogeneous nodes, detect the configuration parameters on each node, and determine the operating compatibility of the supported encryption algorithm types and versions in the current environment based on the matching rules; if incompatible algorithm node combinations occur, perform adaptive design of interface adaptation layer compatibility compensation.

3. The method according to claim 1, wherein The interface adaptation layer is designed based on the incompatible nodes, including: By analyzing and comparing the configuration information of nodes, the compatibility between different nodes is determined; based on the results of the compatibility test, the format and type conversion of data between different nodes is performed; A corresponding communication protocol is used for each node to achieve conversion between protocols; when a node changes or is upgraded, the interface adaptation layer is upgraded and compatible according to the configuration information of the node change. The compatibility upgrade at least includes interface changes and updates to data conversion rules.

4. The method according to claim 1, wherein The generating of a session key at the central control node and determining the security strength level of the system according to the environmental verification result include: Deploy the key management service on the central control node. The key management service includes a random number generator and a key generation algorithm. When establishing a new session, the random number generator is called to obtain a high entropy seed, which is input into the key generation algorithm and outputs the session key; Obtain the hardware performance and security simulation test results of all encryption computing nodes; analyze the CPU and memory usage and network traffic overhead resource consumption indicators of different encryption algorithms and implementation schemes on each node, and determine the security strength level under the parameter configuration of each algorithm and mode based on simulation tests.

5. The method according to claim 1, wherein The method of determining performance and security priorities and scheduling encryption operations to the processor core with the best performance includes: Selecting a corresponding processor core based on the computational complexity of the encryption algorithm; selecting a processor core based on performance indicators of the processor core, the performance indicators including one or a predetermined number of indicators selected from the group consisting of main frequency, cache size, instruction-level parallelism, and out-of-order execution capability; determining whether the selected processor core has hardware security features, the hardware security features including one or a predetermined number of types of encryption engines and memory protection mechanisms; According to the requirements of the encryption operation, the corresponding data of the encryption operation is transmitted to the processor core with the best performance for encryption calculation; it is determined whether the encryption operation is completed. If not, the encryption calculation is completed by the processor core; the next operation is performed according to the result of the encryption operation, and the operation includes data transmission, data storage or data output.

6. The method according to claim 1, wherein The detection data is transmitted directly between the processing nodes without encryption, and an encryption and integrity verification mechanism is inserted, including: Obtain all physical network connectivity path information between each encryption processing node; determine all point-to-point direct transmission links in the topology, and find communication lines that do not go through third-party transit; determine whether there are unencrypted data packets on the link that are directly transmitted end-to-end; set up an encrypted channel between the encryption processing nodes at both ends where the traffic is disconnected, and use the same monitoring point of the encryption processing nodes at both ends as an intermediate agent to form a tunnel; use identity recognition data to verify the accuracy and true source of data from the encryption processing nodes at both ends to prevent data tampering or replay attacks; simultaneously detect concurrent data connections and transmission frequencies on all end-to-end direct links, and perform trace analysis on traffic with abnormal behavior to prevent data theft or attacks.

7. The method according to claim 1, wherein The step of obtaining data at each security level and performing encryption operations according to encryption data requirements includes: Obtain data of various security levels; determine the data that needs to be encrypted and the corresponding security level based on the application scenario and security requirements; obtain data with various security levels through identity authentication and permission control mechanisms; select encryption algorithms based on the security level of the data to perform encryption operations.

8. The method according to claim 1, wherein The dynamic adjustment of encryption algorithm strength according to environmental changes and attack detection results includes: Obtain and analyze environmental change information and attack detection results; Evaluate the security status of the system; determine whether the system has security vulnerabilities based on the evaluation results; When a security breach occurs, keys are generated and distributed based on the strength of the encryption algorithm.

9. The method according to claim 1, wherein If a decryption failure is detected, the node access rights are immediately restricted, including: Obtain the number of decryption failures based on the node ID; determine whether the number of decryption failures exceeds the set threshold; If the number of decryption failures exceeds the set threshold, the decryption error time is recorded; based on the decryption error time, it is determined whether the access rights of the corresponding node need to be restricted; If the access rights of the corresponding node need to be restricted, the access rights status of the corresponding node is updated to restricted access; the decryption failure information is obtained and processed, and the decryption failure processing measures are updated according to the processing results.

Images