Dynamic selection of encryption algorithms, cloud computing-based secure communication methods and systems

Abstract

This invention discloses a method and apparatus for dynamically selecting encryption algorithms, and a secure communication method and system based on cloud computing. The dynamic selection method includes the following steps: first, acquiring the current network conditions; then, calculating the score of each available encryption algorithm based on the current network conditions; and finally, selecting the available encryption algorithm with the highest score as the target encryption algorithm, thereby completing the dynamic selection of the encryption algorithm. This dynamic selection method not only selects the most suitable encryption algorithm but also improves user experience, ensuring effective data protection under different environments and conditions. The system includes a client device, edge computing nodes, and a cloud computing platform: the client device is responsible for initiating requests; the edge computing nodes specifically perform preliminary data decryption, verification, sensitivity analysis, preprocessing, and real-time application of security policies; the cloud computing platform specifically performs in-depth data processing and is responsible for updating the system's security policies.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method and apparatus for dynamically selecting encryption algorithms, and a secure communication method and system based on cloud computing. Background Technology

[0002] With the continuous development of network technology, secure communication has become a key challenge in the field of information technology. Especially in cloud computing environments, the centralization of data storage and processing makes ensuring the security of data transmission paramount. However, existing security technologies primarily rely on static security monitoring and encryption strategies. This approach often fails to provide optimal security protection when facing dynamically changing network environments and diverse security threats. The limitations of static strategies become even more apparent when it is necessary to flexibly adjust encryption algorithms based on changes in the sensitivity of the communication content, the security levels of the participants, or network conditions. Summary of the Invention

[0003] The technical problem to be solved by this invention is to address the above-mentioned shortcomings of existing technologies by proposing a dynamic selection method and apparatus for encryption algorithms, and a secure communication method and system based on cloud computing. This dynamic selection method for encryption algorithms can select the optimal encryption algorithm, ensuring effective protection of data under different environments and conditions.

[0004] In a first aspect, the present invention provides a method for dynamically selecting an encryption algorithm, the method comprising the following steps:

[0005] Get the current network conditions;

[0006] Calculate the score for each available encryption algorithm based on the current network conditions;

[0007] The formula for calculating the score of the available encryption algorithm is as follows: (1)

[0008] E i =θ*S i +(1-θ)*e i *C 当前 (1)

[0009] in,

[0010] E i This represents the score of the i-th available encryption algorithm;

[0011] θ represents the trade-off parameter between safety and efficiency, with a value range of [0,1], where 0 indicates a complete preference for efficiency and 1 indicates a complete preference for safety.

[0012] S i This indicates the security level of the i-th available encryption algorithm;

[0013] e i This represents the efficiency of the i-th available encryption algorithm;

[0014] C 当前 Indicates the current network conditions;

[0015] The highest-rated available encryption algorithm is selected as the target encryption algorithm, thus completing the dynamic selection of the encryption algorithm;

[0016] The selection formula for the target encryption algorithm is as shown in equation (2):

[0017] f = argmaxE i =argmax(θ*S i +(1-θ)*e i *C current) (2)

[0019] in,

[0020] f represents the target encryption algorithm;

[0021] argmaxE i This indicates that the highest-rated encryption algorithm is selected from all available encryption algorithms.

[0022] Furthermore, the current network condition C in step S1 当前 It is obtained based on the effective data size and network latency, and its calculation formula is as shown in equation (3):

[0023]

[0024] Among them, S data Indicates the size of the valid data;

[0025] L indicates network latency;

[0026] Based on the calculation formula for the current network conditions, substituting it into equation (2), the calculation formula for the target encryption algorithm is obtained as shown in equation (4):

[0027]

[0028] Secondly, the present invention provides a secure communication method based on cloud computing, the method being applied to a client device, the method comprising the following steps:

[0029] Step A1: Obtain the target data to be sent; and obtain the current network status; the current network status includes network bandwidth, network latency, and current network traffic status;

[0030] Step A2: Based on the current network status, the target encryption algorithm is obtained by using the dynamic selection method of the encryption algorithm described in the first aspect; and, based on the target encryption algorithm, encryption parameters are configured and key negotiation is performed.

[0031] Step A3: Encrypt the target data according to the target encryption algorithm, the encryption parameter configuration, and the key negotiation;

[0032] Step A4: Send the encrypted target data to the edge computing node so that the edge computing node can preprocess the encrypted target data before sending it to the cloud computing platform;

[0033] Step A5: Receive the encrypted processing data returned by the edge computing node, wherein the encrypted processing data is obtained by encrypting the original processing data by the cloud computing platform;

[0034] The original processed data is generated by the cloud computing platform after performing in-depth processing on the target data; the encrypted processed data is returned by the cloud computing platform to the edge computing node.

[0035] Step A6: Decrypt the encrypted data to recover the original processed data, thereby completing secure communication based on cloud computing.

[0036] Furthermore, the current network status includes the current network bandwidth, current network latency, and current network traffic status;

[0037] The current network bandwidth is determined by initiating multiple parallel data requests from the client to a predefined server and counting the rate of data transmission back.

[0038] The current network latency is obtained by sending small network packets to the target server and recording the round-trip time.

[0039] The current network traffic status is obtained by real-time monitoring of the data packet input and output of the network interface, using tools such as Wireshark or built-in operating system tools.

[0040] Thirdly, the present invention provides a secure communication method based on cloud computing, the method being applied to edge computing nodes, the method comprising the following steps:

[0041] Step B1: Receive encrypted target data sent by the client device; the encrypted target data is obtained by the client device using the dynamic selection method of the encryption algorithm described in the first aspect to obtain the target encryption algorithm, and then encrypting the target data to be sent according to the target encryption algorithm;

[0042] Step B2: Decrypt and verify the encrypted target data to recover the target data;

[0043] Step B3: Perform data preprocessing on the target data;

[0044] Step B4: Send the preprocessed target data to the cloud computing platform so that the cloud computing platform can perform in-depth processing on the preprocessed target data and generate the original processed data;

[0045] Step B5: Receive encrypted processing data returned by the cloud computing platform; the encrypted processing data is obtained by the cloud computing platform encrypting the original processed data;

[0046] Step B6: Transmit the encrypted data to the client device so that the client device can decrypt it to obtain the original processed data, thereby completing secure communication based on cloud computing.

[0047] Furthermore, in step B3, the target data undergoes data preprocessing, specifically including the following steps:

[0048] Step B3.1: Perform a data quality check on the target data; the data quality check includes identifying and correcting erroneous data formats and removing redundant information;

[0049] Step B3.2: Perform sensitivity analysis and classification on the target data using predetermined data classification rules or machine learning models;

[0050] Step B3.3: Perform local encryption and data tagging on the target data;

[0051] Step B3.4: Compress and encapsulate the target data.

[0052] Fourthly, the present invention provides a secure communication method based on cloud computing, applied to a cloud computing platform, the method comprising the following steps:

[0053] Step C1: Receive preprocessed target data sent by the edge computing node;

[0054] The preprocessed target data is obtained by the edge computing node receiving encrypted target data sent by the client device, decrypting it, and then preprocessing it.

[0055] The encrypted target data is obtained by the client device using the dynamic selection method of the encryption algorithm described in the first aspect to obtain the target encryption algorithm, and then encrypting the target data to be sent according to the target encryption algorithm.

[0056] Step C2: Perform deep processing on the preprocessed target data to obtain the original processed data;

[0057] Step C3: Use the second encryption algorithm to encrypt the original processed data to obtain encrypted processed data;

[0058] Wherein, the second encryption algorithm is obtained by using the dynamic selection method of the encryption algorithm as described in claim 1 or 2;

[0059] Step C4: Send the encrypted data to the edge computing node, so that the edge computing node sends the encrypted data to the client device, and the client device decrypts the data to obtain the original processed data, thereby completing secure communication based on cloud computing.

[0060] Furthermore, after step C4, the method further includes step C5;

[0061] Step C5: Synchronize the security policies of the edge computing node and the cloud computing platform;

[0062] Step C5 specifically includes:

[0063] Update the security policy and send the security policy to the edge computing node; and / or receive security processing measures sent by the edge computing node.

[0064] Fifthly, the present invention provides a dynamic selection device for encryption algorithms, the device comprising:

[0065] The acquisition unit is used to acquire the current network conditions;

[0066] A calculation unit, connected to the acquisition unit, is used to calculate the score of each available encryption algorithm based on the current network conditions.

[0067] The formula for calculating the score of the available encryption algorithm is as follows:

[0068] E i =θ*S i +(1-θ)*e i *C 当前 ;

[0069] in,

[0070] E i This represents the score of the i-th available encryption algorithm;

[0071] θ represents the trade-off parameter between safety and efficiency, with a value range of [0,1], where 0 indicates a complete preference for efficiency and 1 indicates a complete preference for safety.

[0072] S i This indicates the security level of the i-th available encryption algorithm;

[0073] e i This represents the efficiency of the i-th available encryption algorithm;

[0074] C 当前 Indicates the current network conditions;

[0075] The selection unit, connected to the calculation unit, is used to select the available encryption algorithm with the highest score as the target encryption algorithm, thereby completing the dynamic selection of the encryption algorithm;

[0076] The formula for selecting the target encryption algorithm is as follows:

[0077] f = argmaxE i =argmax(θ*S i +(1-θ)*e i *C 当前 );

[0078] in,

[0079] f represents the target encryption algorithm;

[0080] argmaxE i This indicates that the highest-rated encryption algorithm is selected from all available encryption algorithms.

[0081] Sixthly, the present invention provides a secure communication system based on cloud computing, the system comprising:

[0082] The dynamic selection device for the encryption algorithm described in the fifth aspect is used to acquire the target encryption algorithm;

[0083] A client device, connected to the dynamic selection device, is used to execute the steps of the method in the second aspect;

[0084] An edge computing node, communicatively connected to the client device, is used to execute the steps of the method in the third aspect;

[0085] A cloud computing platform, which is communicatively connected to the edge computing node, is used to perform the steps of the method in the fourth aspect.

[0086] The beneficial effects of this invention are:

[0087] 1. This invention can dynamically select the most suitable encryption algorithm based on real-time requirements, data sensitivity, and the security level of available encryption algorithms.

[0088] 2. This invention can dynamically select the optimal encryption algorithm based on real-time network conditions and resource usage, thereby reducing system latency and computational overhead and improving system performance while ensuring security.

[0089] 3. This invention can select algorithms with lower computational resource consumption based on system load and performance requirements, thereby optimizing resource utilization.

[0090] 4. By introducing a trade-off parameter between security and efficiency, this invention allows for flexible adjustments to the selection of encryption algorithms based on specific needs and the current network conditions, ensuring that the optimal balance between security and efficiency is found.

[0091] 5. By selecting a highly efficient encryption algorithm, this invention reduces the latency of the encryption and decryption process while ensuring security, optimizes network performance, and improves user experience.

[0092] 6. This invention ensures the confidentiality of data during communication and storage by encrypting target data and deeply processing data, preventing unauthorized access and data leakage.

[0093] 7. This invention can quickly respond to changing network environments and security threats, automatically adjusting encryption parameters and algorithms, making the system highly flexible and adaptable.

[0094] 8. This invention utilizes a combination of cloud computing and edge computing to optimize data processing and encryption workflows, particularly focusing on the specific implementation details of how to offload some encryption tasks to edge computing nodes for execution. This reduces latency during data transmission and improves real-time communication. On one hand, edge computing preprocessing enables rapid data transmission and processing, improving system response speed and meeting the demands of real-time communication. On the other hand, the cloud platform allows for centralized management and monitoring of the data transmission process, enabling rapid detection and response to potential security incidents and enhancing overall security protection.

[0095] 9. The cloud computing platform of the present invention has data analysis and machine learning capabilities, and can perform in-depth analysis of data processing results to optimize subsequent data processing and decision-making.

[0096] 10. This invention can intelligently allocate encryption and data processing tasks to cloud and edge nodes, thereby improving the resource utilization efficiency and processing capacity of the entire system. Attached Figure Description

[0097] Figure 1 This is a system architecture diagram in an embodiment of the present invention;

[0098] Figure 2 This is a flowchart illustrating a secure communication process based on cloud computing in an embodiment of the present invention.

[0099] Figure 3 This is a schematic diagram of the dynamic selection method of the encryption algorithm in an embodiment of the present invention;

[0100] Figure 4This is a schematic diagram of the dynamic selection device for the encryption algorithm in an embodiment of the present invention;

[0101] In the attached figures, the reference numerals are: 10, acquisition unit; 20, calculation unit; 30, selection unit. Detailed Implementation

[0102] To enable those skilled in the art to better understand the technical solution of the present invention, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0103] It is understood that the specific embodiments and accompanying drawings described herein are merely for explaining the invention and are not intended to limit the invention.

[0104] It is understood that, without conflict, the various embodiments and features in the embodiments of the present invention can be combined with each other.

[0105] It is understood that, for ease of description, only the parts related to the present invention are shown in the accompanying drawings, while the parts unrelated to the present invention are not shown in the drawings.

[0106] It is understood that each unit or module involved in the embodiments of the present invention may correspond to only one entity structure, or may be composed of multiple entity structures, or multiple units or modules may be integrated into one entity structure.

[0107] It is understood that, without conflict, the functions and steps marked in the flowcharts and block diagrams of this invention may occur in a different order than that marked in the accompanying drawings.

[0108] It is understood that the flowcharts and block diagrams of this invention illustrate the possible architecture, functions, and operations of systems, apparatuses, devices, and methods according to various embodiments of this invention. Each block in the flowchart or block diagram may represent a unit, module, program segment, or code, containing executable instructions for implementing the specified function. Furthermore, each block or combination of blocks in the block diagram and flowchart can be implemented using a hardware-based system to achieve the specified function, or using a combination of hardware and computer instructions.

[0109] It is understood that the units and modules involved in the embodiments of the present invention can be implemented by software or by hardware. For example, the units and modules can be located in a processor.

[0110] Example 1:

[0111] like Figure 1 and Figure 3 As shown, this embodiment provides a method for dynamically selecting an encryption algorithm, the method comprising the following steps:

[0112] Step S1: Obtain the current network conditions.

[0113] Current network conditions refer to the state and performance characteristics of the network during data transmission and communication under a specific time and environment. In this embodiment, the current network conditions are obtained based on the effective data size and network latency, and the calculation formula is as follows:

[0114]

[0115] Among them, S data Indicates the size of the valid data;

[0116] L represents network latency.

[0117] The reason for choosing to obtain the current network conditions based on the size of the valid data and network latency is as follows:

[0118] (1) Directly reflects network performance:

[0119] The effective data size and network latency directly reflect the actual performance of a network. Effective data size indicates the amount of data that can be successfully transmitted within a specific timeframe, while network latency affects data transmission speed and response time. Combining these two factors provides a practical reference for selecting encryption algorithms.

[0120] (2) Dynamic response capability:

[0121] By monitoring the amount of effective data and network latency in real time, we can quickly adapt to changes in network conditions. For example, when the network is congested, we can adjust encryption strategies to improve efficiency and ensure smooth data transmission.

[0122] (3) Optimize data transmission:

[0123] This approach helps the system find the optimal packet size and encryption algorithm, reducing the probability of data retransmission, thereby improving network bandwidth utilization and optimizing overall transmission performance.

[0124] (4) Objectivity and quantifiability:

[0125] Effective data size and network latency are quantitative indicators that are easy to monitor and analyze, enabling the system to make decisions based on this objective data.

[0126] Other methods besides this one for obtaining current network conditions include:

[0127] (1) Bandwidth measurement:

[0128] By measuring actual bandwidth usage (such as using bandwidth measurement tools to perform upload and download tests), the current network capacity can be assessed and encryption strategies can be selected accordingly.

[0129] (2) Packet loss rate monitoring:

[0130] Monitor the percentage of data packets lost during transmission. A high packet loss rate may indicate network instability, making it appropriate to choose a more efficient encryption algorithm to reduce data size and ensure reliable data transmission.

[0131] (3) Network latency statistical analysis:

[0132] By statistically analyzing the delays of multiple communications and constructing average, maximum, and minimum delay values, network conditions can be assessed more accurately.

[0133] (4) Real-time traffic monitoring:

[0134] Monitoring real-time network traffic changes, including current traffic load, and the rate of data packets sent and received, can provide a reference for encryption strategies.

[0135] (5) Network topology change detection:

[0136] By detecting changes in network topology (such as route changes, the addition or removal of nodes), network conditions can be obtained so that strategies can be adjusted in a timely manner.

[0137] (6) User feedback and perception evaluation:

[0138] Collect user feedback during use, such as network lag and slow transmission, and combine these subjective feelings with technical indicators to evaluate network conditions.

[0139] Step S2: Calculate the score for each available encryption algorithm based on the current network conditions.

[0140] The formula for calculating the score of the available encryption algorithm is as follows:

[0141] E i =θ*S i +(1-θ)*e i *C 当前

[0142] in,

[0143] E i This represents the score of the i-th available encryption algorithm;

[0144] θ represents the trade-off parameter between safety and efficiency, with a value range of [0,1], where 0 indicates a complete preference for efficiency and 1 indicates a complete preference for safety.

[0145] S i This indicates the security level of the i-th available encryption algorithm;

[0146] e iThis represents the efficiency of the i-th available encryption algorithm;

[0147] C 当前 Indicates the current network conditions;

[0148] Step S3: Select the available encryption algorithm with the highest score as the target encryption algorithm, thereby completing the dynamic selection of the encryption algorithm.

[0149] The formula for selecting the target encryption algorithm is as follows:

[0150] f = argmaxE i =argmax(θ*S i +(1-θ)*e i *C current)

[0151] in,

[0152] f represents the target encryption algorithm;

[0153] argmaxE i This indicates that the highest-rated encryption algorithm is selected from all available encryption algorithms.

[0154] Substituting the current network conditions above, we get...

[0155]

[0156] Example 2:

[0157] like Figure 1 As shown, this embodiment provides a secure communication method based on cloud computing. The method is applied to a client device and includes the following steps:

[0158] Step A1: Obtain the target data to be sent; and obtain the current network status.

[0159] Specifically, the current network status includes the current network bandwidth, current network latency, and current network traffic status;

[0160] The current network bandwidth is determined by initiating multiple parallel data requests from the client to a predefined server and counting the rate of data transmission back.

[0161] The current network latency is obtained by sending small network packets to the target server and recording the round-trip time.

[0162] The current network traffic status is obtained by real-time monitoring of the data packet input and output of the network interface, using tools such as Wireshark or built-in operating system tools.

[0163] Step A2: Based on the current network status, the target encryption algorithm is obtained by using the dynamic selection method of the encryption algorithm described in Example 1; and, based on the target encryption algorithm, encryption parameters are configured and key negotiation is performed.

[0164] Step A3: Encrypt the target data according to the target encryption algorithm, the encryption parameter configuration, and the key negotiation.

[0165] Step A4: Send the encrypted target data to the edge computing node so that the edge computing node can preprocess the encrypted target data before sending it to the cloud computing platform.

[0166] Step A5: Receive the encrypted processing data returned by the edge computing node, wherein the encrypted processing data is obtained by encrypting the original processing data by the cloud computing platform;

[0167] The original processed data is generated by the cloud computing platform after performing in-depth processing on the target data; the encrypted processed data is returned by the cloud computing platform to the edge computing node.

[0168] Step A6: Decrypt the encrypted data to recover the original processed data, thereby completing secure communication based on cloud computing.

[0169] like Figure 2 As shown, the implementation process of this embodiment is as follows:

[0170] Step 1. Client request initialization

[0171] Step 1.1 Environmental Perception and Parameter Acquisition

[0172] The client device monitors network conditions in real time through built-in sensors and network monitoring tools, including but not limited to network bandwidth, latency, and current network traffic status. The measurement methods for each parameter are defined as follows:

[0173] A. Network bandwidth:

[0174] Definition: Network bandwidth refers to the maximum amount of data that a network connection can transmit per unit of time.

[0175] Unit: Mbps (megabits per second).

[0176] Measurement method: The measurement is determined by initiating multiple parallel data requests from the client to a predefined server and counting the rate of data return.

[0177] Data source: Real-time data provided by the built-in network interface card, or obtained through dedicated network testing software.

[0178] Network bandwidth affects data transmission speed, which in turn affects the choice of encryption algorithm and data compression ratio.

[0179] B. Network latency:

[0180] Definition: Network latency refers to the time it takes for data to travel from the sender to the receiver.

[0181] Unit: milliseconds (ms).

[0182] Measurement method: Send small network packets to the target server and record the round-trip time.

[0183] Data source: Using ICMP (Internet Control Message Protocol) echo requests, or utilizing the response time of TCP / UDP connections.

[0184] Latency is an important factor to consider when choosing an encryption algorithm, especially in applications that require real-time performance.

[0185] C. Current network traffic status:

[0186] Definition: Current network traffic status refers to the amount of data traffic passing through a network interface within a specific time period.

[0187] Unit: MB / s (megabytes per second).

[0188] Measurement method: Monitor the data packet input and output of the network interface in real time, and use tools such as Wireshark or built-in operating system tools for statistical analysis.

[0189] Data source: Network statistics tools provided by the client operating system or third-party network monitoring software.

[0190] The level of network traffic can affect data encryption and transmission strategies. High traffic conditions may require optimization of data processing strategies to alleviate network congestion.

[0191] Step 1.2 Dynamic selection of encryption algorithm

[0192] The client dynamically selects the most suitable encryption method based on real-time network status parameters, data security level, predetermined security protocols, and packet size using an encryption algorithm selection function. Assume there is a set of encryption algorithms {E1, E2, ..., E...} n}, each encryption algorithm E i There is a corresponding security level S i and efficiency e i S i E represents the security strength of the algorithm. iThis indicates the encryption efficiency of the algorithm (Bytes / ms). Specific values ​​for the security level and efficiency of encryption algorithms are assessed by experts and experience, considering the following dimensions:

[0193] A. Security Level S i

[0194] a. Key length:

[0195] Evaluation criteria: Generally, as the key length increases, the time required to crack it increases exponentially.

[0196] Quantization methods: For example, algorithms with key lengths of less than 128 bits may score lower (e.g., 10 points), algorithms with key lengths between 128 and 256 bits may score higher (e.g., 20 points), and algorithms with key lengths exceeding 256 bits may score the highest (e.g., 30 points).

[0197] b. Ability to resist known attacks:

[0198] Evaluation criteria: What types of known attacks can the algorithm resist (e.g., differential attacks, linear attacks, time attacks, etc.)?

[0199] Quantification method: Assign a score to each type of attack that is resisted, and the total score is the algorithm's score in this dimension.

[0200] a. Processing speed:

[0201] Test conditions: The algorithm is encrypted and decrypted in a standardized test environment using a standard dataset.

[0202] Quantization method: Record the time (ms) required to process the same amount of data, and calculate the amount of data that can be processed per unit time (Bytes / ms). This value is e. i .

[0203] The security-efficiency tradeoff parameter θ represents the preference between security and efficiency, ranging from [0,1], where 0 indicates a complete preference for efficiency and 1 indicates a complete preference for security. The selection function for the encryption algorithm is:

[0204]

[0205] in:

[0206] argmax Ei This refers to a specific algorithm within a set of encryption algorithms; that is, finding an algorithm from all available encryption algorithms that, considering the security-efficiency trade-off parameter θ and the security level S... i Encryption efficiency e of encryption algorithms i and network conditions In this case, the algorithm that can provide the maximum weighted score; θ represents the security-efficiency trade-off parameter, which adjusts the relative importance of security and efficiency in the choice of encryption method, 0, 1, with a value range of [0, 1], where 0 completely favors efficiency and 1 completely favors security; S i This indicates the security level of an encryption algorithm, reflecting the strength of its security. It is determined based on the algorithm's design features and security test results. A score can be given based on security tests such as key length and known vulnerabilities. i S represents the data processing rate of the encryption algorithm, measured in bytes per millisecond (ms). data L represents the data packet size in bytes; L represents the network latency, which is the transmission time of data from the sending point to the receiving point in milliseconds.

[0207] Step 1.3 Encryption Parameter Configuration and Key Negotiation

[0208] The client sets the necessary encryption parameters based on the characteristics of the selected algorithm. This includes key length, block size (for block encryption algorithms), initialization vector (IV), and operating mode (such as CBC, GCM, etc.). Key length and operating mode are typically dependent on the algorithm's design and security requirements. For example, for AES encryption, a key length of 128 bits, 192 bits, or 256 bits might be chosen. A lightweight key negotiation process may also be performed with the server to ensure both parties have the capability for subsequent encrypted communication. This process considers the encryption algorithm's requirements for key length and type, as well as the current security policy.

[0209] Step 1.4 Data Encryption and Request Initiation

[0210] Using a dynamically selected encryption algorithm and a negotiated key, the client device encrypts the data to be sent. Then, the client encapsulates the encrypted data and relevant security parameters (such as the selected encryption algorithm identifier and encryption parameters) in a secure communication request and sends it to the nearest edge computing node.

[0211] Step 2. Edge node preprocessing

[0212] Edge computing nodes not only perform basic data decryption and verification, but also conduct real-time security checks and preprocessing based on the latest security policies issued by the cloud computing platform. This mechanism of real-time synchronization of security policies enhances data security before transmission.

[0213] Step 2.1 Data Decoding and Verification

[0214] The edge node first decodes the received encrypted data packets. The decoding process includes verifying the integrity of the data packets and the legitimacy of their origin, using techniques such as HMAC (Hash-Based Message Authentication Code) to ensure that the data has not been tampered with, and to confirm the identity of the sender.

[0215] Step 2.2 Preliminary Decryption

[0216] Using a key agreed upon with the client, the edge node performs initial decryption of the data. This step ensures that the data is parsed and processed securely.

[0217] Step 2.3 Data Quality Check

[0218] The decrypted data undergoes quality checks, including identifying and correcting erroneous data formats and removing redundant information. This process utilizes automated scripts and a rules engine to improve the accuracy and efficiency of data processing.

[0219] Step 2.4 Sensitivity Analysis and Classification

[0220] Edge nodes perform sensitivity analysis and classification of data using predetermined data classification rules or machine learning models. This step assesses the sensitivity level of the data based on its content and context, and determines the subsequent processing flow accordingly.

[0221] Step 2.5 Preprocessing and Data Labeling

[0222] Local encryption is performed on data with specific sensitivity levels, and all data is tagged, including sensitivity levels and preprocessing information, for subsequent processing.

[0223] Step 2.6 Data Compression and Encapsulation

[0224] To optimize transmission efficiency, compression is performed on the preprocessed data. Data compression selects the most suitable compression algorithm based on the data type and characteristics, aiming to reduce data size without loss of information. The compressed data will then be encapsulated and prepared for secure transmission to the cloud computing platform.

[0225] Step 2.7 Log Recording and Monitoring

[0226] While processing data, edge nodes record detailed operation logs, including timestamps and status information for data reception, decryption, processing, and transmission.

[0227] Step 3. Deep processing on the cloud computing platform

[0228] Step 3.1 Advanced Data Encryption

[0229] The cloud computing platform selects a suitable encryption algorithm based on the sensitivity label of the data, using the method described in step 1.2. Furthermore, it sets a security-efficiency trade-off parameter θ based on the sensitivity label results; the two are positively correlated. For example, for highly sensitive data, the security-efficiency trade-off parameter θ can be set close to 1 to select a more secure encryption algorithm from the encryption algorithm library.

[0230] Step 3.2 Data Storage and Backup

[0231] End-to-end encryption technology ensures data security during storage and transmission. Simultaneously, regular data backups are performed, employing distributed storage and multi-site backup strategies to enhance data resilience and reliability.

[0232] Step 4: Automatically update security policy

[0233] Step 4.1 Real-time synchronization of security policies

[0234] The cloud computing platform dynamically updates its security policies based on the latest threat intelligence and system operational status. These updates include adjustments to encryption parameters, modifications to access control rules, and the introduction of new security rules. These policies are synchronized in real time to edge computing nodes and communication management modules via secure channels, ensuring that the entire system's security configuration is always up-to-date.

[0235] Step 4.2 Security Incident Response and Adjustment

[0236] The cloud computing platform monitors and analyzes security events in the system, such as unauthorized access attempts and suspicious traffic patterns. Based on the analysis results, it automatically adjusts security policies to address current threats, including but not limited to adjusting encryption strength, changing communication protocols, and blocking suspicious IP addresses.

[0237] Step 5. Network optimization and security channel maintenance

[0238] Step 5.1 Dynamic Network Routing Optimization

[0239] The communication management module dynamically adjusts network routing and bandwidth allocation based on the current network conditions and data transmission requirements, optimizes data transmission paths, reduces latency, and improves data transmission efficiency.

[0240] Step 5.2 Establishment and Maintenance of Secure Communication Channels

[0241] Manage and maintain secure communication channels, such as TLS / SSL connections, to ensure data encryption and integrity during transmission. Regularly update keys and certificates to prevent security vulnerabilities.

[0242] Step 6: Policy Update and Application for Edge Computing Nodes

[0243] Step 6.1 Receive and apply the new security policy

[0244] Edge computing nodes receive security policy updates synchronized with the cloud computing platform in real time and apply these updates immediately, such as adjusting encryption methods and updating access control lists.

[0245] Step 6.2 Local Security Incident Handling

[0246] Promptly respond to and handle detected local security incidents (such as data tampering, abnormal access, etc.). Take appropriate security measures based on the severity and type of the incident, such as isolation and reporting to the cloud computing platform.

[0247] Step 7: Data Return and Client Processing

[0248] Step 7.1 Secure Data Transmission

[0249] Data processed with encryption and security policies is transmitted securely and efficiently back to the client device via a network path optimized by the communication management module.

[0250] Step 7.2 Client Data Reception and Decryption

[0251] The client device receives the data and decrypts it using the key negotiated with the edge computing node to obtain the original data content, thus completing the entire secure communication process.

[0252] Example 3:

[0253] like Figure 1 As shown, this embodiment provides a secure communication method based on cloud computing. The method is applied to edge computing nodes and includes the following steps:

[0254] Step B1: Receive encrypted target data sent by the client device; the encrypted target data is obtained by the client device using the dynamic selection method of the encryption algorithm described in Embodiment 1 to obtain the target encryption algorithm, and then encrypting the target data to be sent according to the target encryption algorithm.

[0255] Step B2: Decrypt and verify the encrypted target data to recover the target data.

[0256] Step B3: Perform data preprocessing on the target data.

[0257] Specifically, in step B3, the target data undergoes data preprocessing, which includes the following steps:

[0258] Step B3.1: Perform a data quality check on the target data; the data quality check includes identifying and correcting erroneous data formats and removing redundant information;

[0259] Step B3.2: Perform sensitivity analysis and classification on the target data using predetermined data classification rules or machine learning models;

[0260] Step B3.3: Perform local encryption and data tagging on the target data;

[0261] Step B3.4: Compress and encapsulate the target data.

[0262] Step B4: Send the preprocessed target data to the cloud computing platform so that the cloud computing platform can perform in-depth processing on the preprocessed target data and generate the original processed data.

[0263] Step B5: Receive the encrypted processing data returned by the cloud computing platform; the encrypted processing data is obtained by the cloud computing platform encrypting the original processing data.

[0264] Step B6: Transmit the encrypted data to the client device so that the client device can decrypt it to obtain the original processed data, thereby completing secure communication based on cloud computing.

[0265] This embodiment corresponds to Embodiment 2, except that the application objects are different. The application object of Embodiment 2 is the client device, while the application object of this embodiment is the edge computing node.

[0266] Example 4:

[0267] like Figure 1 As shown, this embodiment provides a secure communication method based on cloud computing, applied to a cloud computing platform. The method includes the following steps:

[0268] Step C1: Receive preprocessed target data sent by the edge computing node;

[0269] The preprocessed target data is obtained by the edge computing node receiving encrypted target data sent by the client device and then decrypting and preprocessing it. The encrypted target data is obtained by the client device encrypting the target data to be sent according to a target encryption algorithm; the target encryption algorithm is obtained by the client device based on the current network state using the dynamic selection method of the encryption algorithm described in the first aspect. That is, the target encryption algorithm is obtained first, and then the target data to be sent is encrypted according to the target encryption algorithm to obtain the encrypted target data.

[0270] Step C2: Perform deep processing on the preprocessed target data to obtain the original processed data.

[0271] Step C3: Encrypt the original processed data using a second encryption algorithm to obtain encrypted processed data. The second encryption algorithm is obtained using the dynamic selection method of the encryption algorithm described in claim 1 or 2.

[0272] Step C4: Send the encrypted data to the edge computing node, so that the edge computing node sends the encrypted data to the client device, and the client device decrypts the data to obtain the original processed data, thereby completing secure communication based on cloud computing.

[0273] Step C5: Synchronize the security policies of the edge computing node and the cloud computing platform;

[0274] Step C5 specifically includes:

[0275] Update the security policy and send the security policy to the edge computing node; and / or receive security processing measures sent by the edge computing node.

[0276] Example 5:

[0277] like Figure 4 As shown, this embodiment provides a dynamic selection device for encryption algorithms, the device comprising:

[0278] Acquisition unit 10 is used to acquire the current network conditions;

[0279] The calculation unit 20, connected to the acquisition unit 10, is used to calculate the score of each available encryption algorithm based on the current network conditions.

[0280] The formula for calculating the score of the available encryption algorithm is as follows:

[0281] E i =θ*S i +(1-θ)*e i *C 当前 ;

[0282] in,

[0283] E i This represents the score of the i-th available encryption algorithm;

[0284] θ represents the trade-off parameter between safety and efficiency, with a value range of [0,1], where 0 indicates a complete preference for efficiency and 1 indicates a complete preference for safety.

[0285] S i This indicates the security level of the i-th available encryption algorithm;

[0286] e i This represents the efficiency of the i-th available encryption algorithm;

[0287] C 当前 Indicates the current network conditions;

[0288] Selection unit 30, connected to calculation unit 20, is used to select the available encryption algorithm with the highest score as the target encryption algorithm, thereby completing the dynamic selection of encryption algorithm;

[0289] The formula for selecting the target encryption algorithm is as follows:

[0290] f = argmaxE i =argmax(θ*S i +(1-θ)*e i *C 当前 );

[0291] in,

[0292] f represents the target encryption algorithm;

[0293] argmaxE i This indicates that the highest-rated encryption algorithm is selected from all available encryption algorithms.

[0294] This embodiment can execute the method in Embodiment 1.

[0295] Example 6:

[0296] like Figure 1 As shown, this embodiment provides a secure communication system based on cloud computing, the system comprising:

[0297] The dynamic selection device for encryption algorithms described in Example 5 is used to obtain the target encryption algorithm;

[0298] A client device, connected to the dynamic selection device, is used to execute the steps of the method in Embodiment 2;

[0299] An edge computing node, which is communicatively connected to the client device, is used to execute the steps of the method in Embodiment 3;

[0300] The cloud computing platform is communicatively connected to the edge computing node and is used to execute the steps of the method in Embodiment 4.

[0301] In fact, the system also includes a communication management module, which is responsible for the system's network configuration and optimization, including dynamic routing adjustment and maintenance of secure communication channels to ensure secure and efficient data transmission.

[0302] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A method for dynamically selecting an encryption algorithm, characterized in that, The method includes the following steps: Get the current network conditions; Calculate the score for each available encryption algorithm based on the current network conditions; The formula for calculating the score of the available encryption algorithm is as follows: (1) E i =θ*S i +(1-θ)*e i *C 当前 (1) in, E i This represents the score of the i-th available encryption algorithm; θ represents the trade-off parameter between safety and efficiency, with a value range of [0,1], where 0 indicates a complete preference for efficiency and 1 indicates a complete preference for safety. S i This indicates the security level of the i-th available encryption algorithm; e i This represents the efficiency of the i-th available encryption algorithm; C 当前 Indicates the current network conditions; The highest-rated available encryption algorithm is selected as the target encryption algorithm, thus completing the dynamic selection of the encryption algorithm; The formula for selecting the target encryption algorithm is as shown in equation (2): f6argmaxE i argmax(θ*S i +(1-θ)*e i *C 当前 )(2) in, f represents the target encryption algorithm; argmaxE i This indicates that the highest-rated encryption algorithm is selected from all available encryption algorithms. The current network condition C 当前 It is obtained based on the effective data size and network latency, and its calculation formula is as shown in equation (3): Among them, S data Indicates the effective data size; the effective data size indicates the amount of data that can be successfully transmitted within a specific time period. L represents network latency.

2. A secure communication method based on cloud computing, wherein the method is applied to a client device, characterized in that, The method includes the following steps: Step A1: Obtain the target data to be sent; and obtain the current network status; the current network status includes network bandwidth, network latency, and current network traffic status; Step A2: Based on the current network status, the target encryption algorithm is obtained by using the dynamic selection method of the encryption algorithm described in claim 1; and, based on the target encryption algorithm, encryption parameters are configured and key negotiation is performed. Step A3: Encrypt the target data according to the target encryption algorithm, the encryption parameter configuration, and the key negotiation; Step A4: Send the encrypted target data to the edge computing node so that the edge computing node can preprocess the encrypted target data before sending it to the cloud computing platform; Step A5: Receive the encrypted processing data returned by the edge computing node, wherein the encrypted processing data is obtained by encrypting the original processing data by the cloud computing platform; The original processed data is generated by the cloud computing platform after performing in-depth processing on the target data; the encrypted processed data is returned by the cloud computing platform to the edge computing node. Step A6: Decrypt the encrypted data to recover the original processed data, thereby completing secure communication based on cloud computing.

3. The secure communication method based on cloud computing according to claim 2, characterized in that, The current network status includes the current network bandwidth, current network latency, and current network traffic status; The current network bandwidth is determined by initiating multiple parallel data requests from the client to a predefined server and counting the rate of data transmission back. The current network latency is obtained by sending small network packets to the target server and recording the round-trip time. The current network traffic status is obtained by real-time monitoring of the data packet input and output of the network interface, using tools such as Wireshark or built-in operating system tools.

4. A secure communication method based on cloud computing, the method being applied to edge computing nodes, characterized in that, The method includes the following steps: Step B1: Receive encrypted target data sent by the client device; the encrypted target data is obtained by the client device using the dynamic selection method of the encryption algorithm described in claim 1 to obtain the target encryption algorithm, and then encrypting the target data to be sent according to the target encryption algorithm; Step B2: Decrypt and verify the encrypted target data to recover the target data; Step B3: Perform data preprocessing on the target data; Step B4: Send the preprocessed target data to the cloud computing platform so that the cloud computing platform can perform in-depth processing on the preprocessed target data and generate the original processed data; Step B5: Receive encrypted processing data returned by the cloud computing platform; the encrypted processing data is obtained by the cloud computing platform encrypting the original processed data; Step B6: Transmit the encrypted data to the client device so that the client device can decrypt it to obtain the original processed data, thereby completing secure communication based on cloud computing.

5. The secure communication method based on cloud computing according to claim 4, characterized in that, Step B3 involves preprocessing the target data, specifically including the following steps: Step B3.1: Perform a data quality check on the target data; the data quality check includes identifying and correcting erroneous data formats and removing redundant information; Step B3.2: Perform sensitivity analysis and classification on the target data using predetermined data classification rules or machine learning models; Step B3.3: Perform local encryption and data tagging on the target data; Step B3.4: Compress and encapsulate the target data.

6. A secure communication method based on cloud computing, applied to a cloud computing platform, characterized in that, The method includes the following steps: Step C1: Receive preprocessed target data sent by the edge computing node; The preprocessed target data is obtained by the edge computing node receiving encrypted target data sent by the client device, and then decrypting and preprocessing it. The encrypted target data is obtained by the client device using the dynamic selection method of the encryption algorithm described in claim 1 to obtain the target encryption algorithm, and then encrypting the target data to be sent according to the target encryption algorithm. Step C2: Perform deep processing on the preprocessed target data to obtain the original processed data; Step C3: Use the second encryption algorithm to encrypt the original processed data to obtain encrypted processed data; The second encryption algorithm is obtained by using the dynamic selection method of the encryption algorithm described in claim 1; Step C4: Send the encrypted data to the edge computing node, so that the edge computing node sends the encrypted data to the client device, and the client device decrypts the data to obtain the original processed data, thereby completing secure communication based on cloud computing.

7. The secure communication method based on cloud computing according to claim 6, characterized in that, After step C4, the method further includes step C5; Step C5: Synchronize the security policies of the edge computing node and the cloud computing platform; Step C5 specifically includes: Update the security policy and send the security policy to the edge computing node; And / or, receive security processing measures sent by the edge computing node.

8. A dynamic selection device for an encryption algorithm, characterized in that, The device includes: The acquisition unit is used to acquire the current network conditions; A calculation unit, connected to the acquisition unit, is used to calculate the score of each available encryption algorithm based on the current network conditions. The formula for calculating the score of the available encryption algorithm is as follows: E i =θ*S i +(1-θ)*e i *C 当前 ; in, E i This represents the score of the i-th available encryption algorithm; θ represents the trade-off parameter between safety and efficiency, with a value range of [0,1], where 0 indicates a complete preference for efficiency and 1 indicates a complete preference for safety. S i This indicates the security level of the i-th available encryption algorithm; e i This represents the efficiency of the i-th available encryption algorithm; C 当前 Indicates the current network conditions; The selection unit, connected to the calculation unit, is used to select the available encryption algorithm with the highest score as the target encryption algorithm, thereby completing the dynamic selection of the encryption algorithm; The formula for selecting the target encryption algorithm is as follows: f6argmaxE i argmax(θ*S i +(1-θ)*e i *C 当前 )4 in, f represents the target encryption algorithm; argmaxE i This indicates that the highest-rated encryption algorithm is selected from all available encryption algorithms. The current network condition C 当前 It is obtained based on the effective data size and network latency, and its calculation formula is as follows: Among them, S data Indicates the effective data size; the effective data size indicates the amount of data that can be successfully transmitted within a specific time period. L represents network latency.

9. A secure communication system based on cloud computing, characterized in that, The system includes: The dynamic selection device for the encryption algorithm according to claim 8 is used to acquire the target encryption algorithm; A client device, connected to the dynamic selection device, is used to perform the steps of the method described in claim 2 or 3; An edge computing node, communicatively connected to the client device, is used to perform the steps of the method described in claim 4 or 5; A cloud computing platform, communicatively connected to the edge computing node, is used to perform the steps of the method described in claim 6 or 7.

Images