QUIC protocol secure transmission method based on layered encryption

Abstract

The invention discloses a QUIC protocol secure transmission method based on hierarchical encryption, and the method comprises the steps: collecting control message data, sensor data and video image data, and adding feature parameters to the data; introducing an XGBoost decision tree model, and training the XGBoost decision tree model by using the data added with the characteristic parameters to obtain a trained XGBoost decision tree model; dividing data input into the model into control message data, sensor data and video image data by using the trained XGBoost decision tree model; the control message data is classified as a high-level data layer, the sensor data and the video image data are classified as a secondary data layer, and the data sending end encrypts the high-level data layer and the secondary data layer respectively to obtain encrypted data streams; in combination with the QUIC protocol, the data sending end encapsulates and integrates the encrypted data streams into the QUIC encrypted data packets, and completes the secure transmission of the data, thereby achieving the improvement of the encryption efficiency and overall performance of the QUIC protocol.

Description

Technical Field

[0001] The present invention relates to a QUIC protocol secure transmission method based on layered encryption, and belongs to the technical field of secure transmission. Background Art

[0002] In the Internet of Things (IoT) scenario, hundreds of millions of devices exchange data over the network, including smart home devices, industrial sensors, medical monitoring equipment, etc. The data packets generated by these devices are of various types and sizes, such as control messages, sensor data, and video streams. Control messages are used to transmit instructions between devices. They are usually small in size, but have extremely high requirements for transmission timeliness and security. Sensor data comes from regular data uploads from various sensors. The data volume is medium and requires certain real-time and security. Video streams, such as video data transmitted by security monitoring equipment, have large data volumes and high requirements for transmission bandwidth and encryption processing performance. As a modern transmission protocol, the QUIC protocol is widely used in data transmission of IoT devices. The QUIC protocol provides higher transmission efficiency and built-in encryption mechanisms, but in resource-constrained IoT devices, the traditional one-size-fits-all encryption method uses the same encryption algorithm and strength for all data packets, which often leads to the following problems: high-intensity encryption algorithms take up a lot of computing resources, affecting the normal operation of the device; using high-intensity encryption for all data packets leads to a waste of computing resources and energy, especially for some less sensitive data; in scenarios where large amounts of data are transmitted (such as video streaming), a single encryption strategy is prone to cause higher transmission delays, affecting real-time performance. Summary of the invention

[0003] The technical problem solved by the present invention is: to overcome the shortcomings of the prior art and provide a QUIC protocol secure transmission method based on layered encryption, which improves the encryption efficiency and overall performance of the QUIC protocol by designing a data classification method, applying different layered encryption methods, and introducing a batch encryption queue.

[0004] The technical solution of the present invention is: a QUIC protocol secure transmission method based on layered encryption, comprising:

[0005] Collect control message data, sensor data, and video image data, and add feature parameters to the data; introduce the XGBoost decision tree model, and train it using the data with added feature parameters to obtain the trained XGBoost decision tree model;

[0006] Use the trained XGBoost decision tree model to divide the input model data into three categories: control message data, sensor data, and video image data;

[0007] The control message data is classified as a high-level data layer, and the sensor data and video image data are classified as a secondary data layer. The data sending end encrypts the high-level data layer and the secondary data layer respectively to obtain an encrypted data stream;

[0008] Combined with the QUIC protocol, the data sender encapsulates and integrates the encrypted data streams into QUIC encrypted data packets and completes secure data transmission.

[0009] Preferably, when training the XGBoost decision tree model, the sparse perception algorithm and the weighted quantile loss function are combined to improve the training speed and model performance.

[0010] Preferably, the advanced encryption standard AES-counter mode GCM encryption strategy is applied to the advanced data layer obtained by classification based on the XGBoost decision tree model, specifically:

[0011] The Advanced Encryption Standard AES is introduced as the symmetric key block encryption standard, and the CTR mode of the counter mode GCM is used to encrypt data packets in batches. The plaintext data is XORed with the encrypted counter block, and then the result is XORed with the key stream generated by the encryption function again to obtain the corresponding encrypted data stream.

[0012] Preferably, the ChaCha20 encryption strategy is used for the secondary data layer obtained by classification based on the XGBoost decision tree model:

[0013] 20 rounds of ChaCha20 encryption iterations are used, and the encryption iterations operate data through a hybrid transformation based on 32-bit integers; the hybrid transformation includes 32-bit addition, rotation and XOR operations, as well as specific constant values ​​and key arrangements to obtain a corresponding encrypted data stream.

[0014] Preferably, the encrypted data streams are respectively encapsulated and integrated into QUIC encrypted data packets, and data secure transmission is completed, including:

[0015] The client establishes a QUIC connection with the server;

[0016] The client and server create multiple QUIC encrypted packets using the encrypted data stream before the transmission begins;

[0017] The data sender uses the UDP protocol in the QUIC connection to send data packets to the data receiver;

[0018] After receiving the data packet, the data receiving end decrypts and repackages it, and sends a confirmation packet to the data sending end to complete the transmission;

[0019] Among them, the client or the server can serve as a data sender or a data receiver.

[0020] Preferably, when the client establishes a QUIC connection with the server:

[0021] The client sends an Initial data packet to the server, which contains the connection request and initial information of encryption negotiation;

[0022] After receiving the request, the server generates a Server Initial data packet containing the encryption key and encryption negotiation information and sends it back to the client;

[0023] The client and server perform a transport layer security protocol handshake through QUIC packets. The handshake process is embedded in the establishment of the QUIC connection to negotiate encryption keys and encryption algorithms;

[0024] After the client and server confirm that the handshake is successful, the client sends a Handshake packet to complete the connection establishment.

[0025] Preferably, the data receiving end decrypts and repackages the data packet after receiving it, and sends a confirmation data packet to the data sending end, specifically:

[0026] The data receiving end decrypts the QUIC encrypted data packet after receiving it. The decrypted data packet contains the data stream identifier and data content;

[0027] The data receiver uses the QUIC protocol to return the received information to the sender according to the stream identifier. The QUIC protocol includes a stream control mechanism to ensure the reasonable distribution of data traffic between the two parties.

[0028] The data receiving end sends an ACK confirmation data packet to the data sending end to inform the data sending end of the sequence of data packets that have been received.

[0029] Preferably, data packets transmitted using the QUIC protocol all adopt an improved QUIC protocol data packet structure, including:

[0030] UDP port number: used to identify the network application or service that sends or receives QUIC data packets during the UDP transmission service. The length is 2 bytes;

[0031] Identifier: used to identify the specific attributes of the data packet, with a length of 1 byte;

[0032] Connection ID: used to identify the connection between the client and the server. It can maintain the stability of the connection even if the network conditions change. The length is 1-4 bytes.

[0033] Characteristic parameter: used to identify whether the data information in the data packet comes from the high-level or low-level data layer, with a length of 1 byte;

[0034] Packet number: used to provide sequence information of data packets to ensure that the receiver can correctly reassemble the sender's data stream. It is set according to the encryption verification mechanism and has a length of 1-8 bytes.

[0035] QUIC frame: QUIC frames include multiple types, including ACK frames, window frames, option frames, and http data frames; the details are as follows:

[0036] ACK frame: used to confirm the received data packet, with a length of 1 byte;

[0037] Window frame: The window is used for flow control, identifies the size of the receiving window, and controls the amount of data that the sender can send when encountering network congestion. The length is 1-8 bytes.

[0038] Option frame: The option structure is included in the initial and handshake packets and is used to negotiate connection parameters. The length is 8-32 bytes.

[0039] HTTP data frame: used to transmit the message body, the length depends on the content of the message body.

[0040] Compared with the prior art, the present invention has the following advantages:

[0041] (1) According to the specific needs of IoT applications, the present invention divides data packets into several categories, such as control messages, sensor data, video streams, image data, etc., and adds a type identification field to the header of the data packet, or identifies its type by parsing the data packet content. For more sensitive control messages, privacy data, etc., they are classified into the advanced data layer, while ordinary data (sensor data, image data) are classified into the secondary data layer. For data packets in the advanced data layer, the highly secure AES-GCM encryption operation is adopted, and for the secondary data layer, the lightweight encryption algorithm ChaCha20 encryption algorithm operation is adopted. While ensuring the security of data transmission, the overall transmission speed of the QUIC protocol is significantly improved by reducing encryption overhead and improving processing efficiency;

[0042] (2) The present invention introduces an encryption queue to aggregate multiple data packets at each layer and perform batch encryption processing in a unified manner, thereby reducing the overhead caused by encrypting each data packet separately. At the same time, it avoids the performance bottleneck caused by frequent key exchanges. It effectively improves the security and performance of IoT devices during data transmission, ensuring that efficient encryption services can still be provided in resource-constrained environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 The data packet classification process based on XGBoost of the present invention;

[0044] Figure 2 The improved QUIC protocol processing data packet process of the present invention;

[0045] Figure 3 This is the improved QUIC protocol data packet structure of the present invention. DETAILED DESCRIPTION

[0046] In order to improve the encryption efficiency of the QUIC protocol in the IoT scenario while ensuring data transmission security, the present invention provides a QUIC protocol secure transmission method based on layered encryption, which performs layered processing according to the type and size of data packets and uses an encryption algorithm for batch encryption, which helps to improve encryption efficiency and overall performance. The specific process is:

[0047] The first step is to collect data from smart IoT devices and add feature parameters to the data. Then, based on XGBoost, data streams from different sources are classified into three categories: control message data, sensor data, and video image data. Control message data is classified as the high-level data layer, and sensor data and video image data are classified as the secondary data layer.

[0048] The second step is to introduce encryption queues to encrypt multiple data streams at each layer in batches. The highly secure AES-GCM encryption operation is used for data packets in the advanced data layer, and the lightweight encryption algorithm ChaCha20 encryption algorithm is used for the secondary data layer. While ensuring the security of data transmission, the overall transmission speed of the QUIC protocol is significantly improved by reducing encryption overhead and improving processing efficiency.

[0049] The third step is to combine the multiplexing, flow control, congestion control, connection management and other mechanisms in the QUIC protocol to encapsulate the encrypted data stream into a QUIC data packet and complete data secure transmission.

[0050] Furthermore, the specific process of the first step of this scheme is:

[0051] (1) In the data collection phase, this scheme adds feature parameters P to the data according to the different sources of the collected data. The data from different sources are divided into three categories, and different preprocessing and feature extraction are performed on the data packets in the subsequent process according to the classification.

[0052] (2) After the data preprocessing step is completed, the model training phase begins. Receive the data set S = {x1, x2...x3}. Perform a single encoding on the data set, extract the data size, data source parameter P, and data information format characteristics as the partitioning features.

[0053] (3) The XGBoost decision tree model is introduced for data classification and combined with the sparse awareness algorithm (Sparse Aware) and the weighted quantile loss function (Weighted Quantile Sketch) to improve the training speed and model performance.

[0054] (4) The trained and tested XGBoost decision tree model is used for batch stratification of data sources to classify the data into three categories: control message data, sensor data, and video image data. Control message data is classified as the high-level data layer, and sensor data and video image data are classified as the secondary data layer.

[0055] The specific process of the second step of this solution is as follows:

[0056] (1) The Advanced Encryption Standard-Counter Mode (AES-GCM) and ChaCha20 deployed at the sending end receive data streams from the high-level data layer and the secondary data layer respectively.

[0057] (2) For the advanced data layer obtained based on XGBoost classification, the AES-GCM encryption strategy is introduced. AES-GCM (Advanced Encryption Standard-Galois / Counter Mode). AES is introduced as the symmetric key block encryption standard. The CTR (Counter) mode of GCM is used to batch encrypt data packets, which XORs the plaintext data with the encrypted counter block, and then XORs the result with the encrypted key stream (generated by the encryption function). (3) For the secondary data layer obtained based on XGBoost classification, the ChaCha20 encryption strategy is adopted. 20 rounds of encryption iterations are used, which operate on the data through mixed transformations (quarter round) based on 32-bit integers. These transformations include 32-bit addition, rotation and XOR operations, as well as specific constant values ​​and key arrangements.

[0058] (4) After encrypting the data streams at different levels according to the above method, an encrypted data stream is obtained;

[0059] The different levels of data classified by the XGBoost decision tree model are concentrated and batch encrypted at different levels in a unified and centralized manner, reducing the overhead caused by encrypting each data packet separately, avoiding performance bottlenecks caused by frequent key exchanges, and improving the security and performance of IoT devices during data transmission.

[0060] The specific process of the third step of this solution is as follows:

[0061] (1) Establishing a connection

[0062] The client sends an Initial packet to the server, which contains the connection request and the initial information of the encryption negotiation. After receiving the request, the server generates a Server Initial packet and sends it back to the client, which contains the encryption key and encryption negotiation information. The client and server perform a TLS (Transport Layer Security) handshake through the QUIC packet. The handshake process is embedded in the establishment process of the QUIC connection to negotiate the encryption key and encryption algorithm. After the client and server confirm that the handshake is successful, the client sends a Handshake packet to complete the connection establishment.

[0063] (2) Packet creation and transmission

[0064] After the QUIC connection is established, the client and server use the encrypted data stream to create multiple QUIC encrypted packets. Each packet has a unique identifier and can transmit data in parallel. This process uses UDP for data transmission, which has the characteristics of low overhead and high flexibility.

[0065] The data flow is: sensor data, XGBOOST decision tree model, data to be encrypted classified into two levels, layered batch encryption, encrypted data stream, QUIC encrypted data packet, and finally transmitted to the receiver.

[0066] (3) Data packet reception

[0067] After the receiver (client or server) receives the QUIC encrypted data packet, it first decrypts the QUIC encrypted data packet. The decrypted QUIC encrypted data packet contains the data stream identifier and data content. The receiver uses the QUIC protocol to return the receiving information to the sender. The QUIC protocol includes a flow control mechanism to ensure the reasonable distribution of data traffic between the two parties. The receiver sends an ACK (confirmation) packet to the sender to inform the sender of the sequence of data packets that have been received. The transmission is completed.

[0068] The data packets transmitted by the QUIC protocol in the present invention all adopt an improved QUIC protocol data packet structure, such as Figure 3 As shown, the improved QUIC protocol packet structure includes:

[0069] UDP port number: used to identify the network application or service that sends or receives QUIC packets when running UDP transport services. Each service running on the host is bound to a specific UDP port number, allowing the operating system to clearly know which service the packet belongs to. The length is 2 bytes.

[0070] Identifier: used to identify the specific attributes of a data packet, such as whether it is an initial data packet, a handshake data packet, or a retransmission data packet. The length is 1 byte.

[0071] Connection ID: Used to identify the connection between the client and the server, and to maintain the stability of the connection even if the network conditions change. The length is variable, usually 1-4 bytes.

[0072] Characteristic parameter: used to identify whether the data information in the data packet comes from the high-level or low-level data layer. The length is 1 byte.

[0073] Packet number: used to provide sequence information for data packets, ensuring that the receiver can correctly reassemble the sender's data stream. Its encryption verification mechanism helps prevent attackers from replaying old data packets. Depending on the packet number, the length is variable, usually 1-8 bytes.

[0074] QUIC frame: QUIC frames include multiple types, including ACK frame, window frame, option frame, and http data frame. The content and length of each part are as follows.

[0075] ACK frame: used to confirm the received data packet. The length is 1 byte.

[0076] Window frame: The window is used for flow control. It identifies the size of the receiving window and controls the amount of data that the sender can send when encountering network congestion. The length varies depending on the content, usually 1-8 bytes.

[0077] Option frame: The option structure is included in the initial and handshake packets and is used to negotiate connection parameters. Depending on the number and value of the negotiated parameters, the length is variable, usually 8-32 bytes.

[0078] HTTP data frame: used to transmit the message body. Depending on the content of the message body, the length can vary from a few bytes to several hundred bytes.

[0079] The contents not described in detail in the specification of the present invention belong to the prior art known to the professional and technical personnel in this field.

Claims

1. A QUIC protocol secure transmission method based on layered encryption, characterized in that include: Collect control message data, sensor data, video image data, and add feature parameters to the data; introduce XGBoost decision tree model, which is trained using data with added feature parameters to obtain a trained XGBoost decision tree model; Use the trained XGBoost decision tree model to divide the input model data into three categories: control message data, sensor data, and video image data; The control message data is classified as a high-level data layer, and the sensor data and video image data are classified as a secondary data layer. The data sending end encrypts the high-level data layer and the secondary data layer respectively to obtain an encrypted data stream; Combined with the QUIC protocol, the data sender encapsulates and integrates the encrypted data streams into QUIC encrypted data packets and completes secure data transmission.

2. According to claim 1, a QUIC protocol secure transmission method based on layered encryption is characterized in that: When training the XGBoost decision tree model, the sparse-aware algorithm and the weighted quantile loss function are combined to improve the training speed and model performance.

3. According to claim 1, a QUIC protocol secure transmission method based on layered encryption is characterized in that: The Advanced Encryption Standard AES-Counter Mode GCM encryption strategy is applied to the high-level data layer obtained by classification based on the XGBoost decision tree model. Specifically: The Advanced Encryption Standard AES is introduced as the symmetric key block encryption standard, and the CTR mode of the counter mode GCM is used to encrypt data packets in batches. The plaintext data is XORed with the encrypted counter block, and then the result is XORed with the key stream generated by the encryption function again to obtain the corresponding encrypted data stream.

4. According to claim 1, a QUIC protocol secure transmission method based on layered encryption is characterized in that: For the secondary data layer obtained by classification based on the XGBoost decision tree model, the ChaCha20 encryption strategy is adopted: 20 rounds of ChaCha20 encryption iterations are used, and the encryption iterations operate data through a hybrid transformation based on 32-bit integers; the hybrid transformation includes 32-bit addition, rotation and XOR operations, as well as specific constant values ​​and key arrangements to obtain a corresponding encrypted data stream.

5. According to claim 1, a QUIC protocol secure transmission method based on layered encryption is characterized in that: Encapsulate and integrate encrypted data streams into QUIC encrypted data packets and complete data security transmission, including: The client establishes a QUIC connection with the server; The client and server create multiple QUIC encrypted packets using the encrypted data stream before the transmission begins; The data sender uses the UDP protocol in the QUIC connection to send data packets to the data receiver; After receiving the data packet, the data receiving end decrypts and repackages it, and sends a confirmation packet to the data sending end to complete the transmission; Among them, the client or the server can serve as a data sender or a data receiver.

6. A QUIC protocol secure transmission method based on layered encryption according to claim 5, characterized in that: When the client establishes a QUIC connection with the server: The client sends an Initial data packet to the server, which contains the connection request and initial information of encryption negotiation; After receiving the request, the server generates a Server Initial data packet containing the encryption key and encryption negotiation information and sends it back to the client; The client and server perform a transport layer security protocol handshake through QUIC packets. The handshake process is embedded in the establishment of the QUIC connection to negotiate encryption keys and encryption algorithms; After the client and server confirm that the handshake is successful, the client sends a Handshake packet to complete the connection establishment.

7. According to claim 5, a QUIC protocol secure transmission method based on layered encryption is characterized in that: After receiving the data packet, the data receiving end decrypts and repackages it, and sends a confirmation packet to the data sending end, specifically: The data receiver decrypts the QUIC encrypted data packet after receiving it. The decrypted data packet contains the data stream identifier and data content; The data receiver uses the QUIC protocol to return the received information to the sender according to the stream identifier. The QUIC protocol includes a stream control mechanism to ensure the reasonable distribution of data traffic between the two parties. The data receiving end sends an ACK confirmation data packet to the data sending end to inform the data sending end of the sequence of data packets that have been received.

8. According to claim 5, a QUIC protocol secure transmission method based on layered encryption is characterized in that: Data packets transmitted using the QUIC protocol all use an improved QUIC protocol data packet structure, including: UDP port number: used to identify the network application or service that sends or receives QUIC data packets during the UDP transmission service. The length is 2 bytes; Identifier: used to identify the specific attributes of the data packet, with a length of 1 byte; Connection ID: used to identify the connection between the client and the server. It can maintain the stability of the connection even if the network conditions change. The length is 1-4 bytes. Characteristic parameter: used to identify whether the data information in the data packet comes from the high-level or low-level data layer, with a length of 1 byte; Packet number: used to provide sequence information of data packets to ensure that the receiver can correctly reassemble the sender's data stream. It is set according to the encryption verification mechanism and has a length of 1-8 bytes. QUIC frame: QUIC frames include multiple types, including ACK frames, window frames, option frames, and http data frames; the details are as follows: ACK frame: used to confirm the received data packet, with a length of 1 byte; Window frame: The window is used for flow control, identifies the size of the receiving window, and controls the amount of data that the sender can send when encountering network congestion. The length is 1-8 bytes. Option frame: The option structure is included in the initial and handshake packets and is used to negotiate connection parameters. The length is 8-32 bytes. HTTP data frame: used to transmit the message body, the length depends on the content of the message body.

Images