Data stream low-delay encryption transmission system, method and device, storage medium and program product

Abstract

The invention provides the technical field of seismic data transmission security, and particularly relates to an ultra-low time delay encryption transmission system and method based on multistage risk seismic data. The system comprises a kernel mode multi-level risk data ultra-low time delay judgment transmission module, a kernel mode multi-level risk data ultra-low time delay judgment module, a kernel mode multi-level risk data ultra-low time delay judgment module and a kernel mode multi-level risk data ultra-low time delay judgment module, and selecting to use the kernel data encryption module in the kernel mode or use the user data encryption module to encrypt and decrypt the link data packet when the link data packet is transmitted to the user mode. According to the invention, real-time and confidentiality protection at the sending end and the receiving end of the seismic data is realized, and the transmission link of the seismic data is protected. The data security and confidentiality in the seismic data transmission process are ensured, and the problem that the overhead is increased due to encryption from the seismic data acquisition end to the seismic data analysis end at the present stage is solved.

Description

Technical Field

[0001] The present application relates to the field of earthquake data transmission security technology, and in particular to a data low-latency encrypted transmission system, method, device, storage medium and program product. Background Art

[0002] Earthquakes occur frequently in China, affecting the safety of more than one billion people. The rapid transmission of earthquake data enables monitoring agencies to quickly issue earthquake alerts, and the secure transmission of earthquake data helps the government and the media manage the public's perception of earthquake events. This prevents the spread of panic and misinformation, thereby maintaining social stability and public safety, and provides a scientific basis for government emergency response and rescue decisions. Therefore, the rapid and secure transmission of earthquake monitoring data has become a key issue. At present, no effective solution has been proposed for how to improve the security of low-latency transmission of data in a more fine-grained manner in the relevant technologies during the transmission of earthquake data. Summary of the invention

[0003] The embodiments of the present application provide a system and method for low-latency encrypted data transmission to at least solve the problem of how to improve the data security and real-time performance in the seismic data transmission process in a more fine-grained manner in the related art.

[0004] The embodiment of the present application provides a low-latency encrypted transmission system and method, the system includes a data low-latency transmission module and a data encryption module, the data encryption module includes a kernel data encryption module and a user data encryption module. Wherein, the data low-latency transmission module is used in conjunction with the kernel data encryption module; the data low-latency transmission module is used in conjunction with the user data encryption module; after the data is received, it first passes through the data low-latency transmission module, and the module determines that the data packet is encrypted via the user data encryption module or the kernel data encryption module according to the data risk level and the core load situation; wherein the kernel data encryption module and the user data encryption module keys are generated by a cryptographic machine; the data packet is determined to be encrypted via the user data encryption module or the kernel data encryption module according to the data risk level and the core load situation; the kernel encryption module uses weak encryption and strong encryption to partially encrypt the data packet data in the kernel state. The user encryption module uses strong encryption to partially encrypt the datagram data in the user state.

[0005] The data low-latency transmission module uses kernel bypass technology to forward seismic data packets with zero copy, bypassing the network protocol stack and forwarding the kernel-state data packets directly to the user-state encryption program or encrypting them in situ via the kernel encryption module and then forwarding them to the egress network card. In an embodiment, the data low-latency transmission module makes a judgment after receiving the data packet sent by the network card. According to the risk level and data volume of the data packet, the processing method and priority of each data packet are determined; or, larger data packets require more computing resources, and the weights of each risk level can be adjusted dynamically. During scheduling, the load of each core needs to be calculated in real time. The load of each core will change with the allocation of tasks. The load of the core is mainly determined by the encryption consumption of the task it is currently processing. The processing of each data packet consumes a certain amount of CPU resources, and the load of each core is the sum of the tasks it is currently processing, which can be scheduled by regularly updating the load of each core. Task scheduling is performed by calculating the load of each core and the priority of each data packet in real time. During scheduling, it is necessary to dynamically select the appropriate core to allocate data packets. The core selection should consider the following factors: Core load: To ensure system efficiency, you need to select a core with light load to process new tasks. Task priority: Prioritize high-risk and large-data tasks, so you need to ensure that these tasks are assigned to the lightest cores possible.

[0006] In an embodiment, the kernel data encryption module uses a symmetric key to encrypt the data part of the original data packet to generate a ciphertext of the original data; the user data encryption module uses a symmetric key to encrypt the data part of the original data packet to generate a ciphertext of the original data; in an embodiment, the user data encryption module and the kernel data encryption module include a data encryption end and a data decryption end, which are distributed at the data acquisition end where the seismic data sensor is located and the data analysis end where the seismic data analysis server is located after dedicated line transmission, and the data collection end uses the data low-latency transmission module to determine the risk level in combination with the data length, and uses the kernel data encryption module to encrypt the data and then forward it to the export network card for transmission; or the data is first forwarded to the user state, and the user data encryption module is used by the user state program to encrypt the data at the encryption end; after the data packet is transmitted through the dedicated line, it enters the data low-latency transmission module again and is forwarded to the user state program, and then the data encryption module uses the decryption end to decrypt the data and then forward it to the data analysis end.

[0007] In an embodiment, the data low-latency transmission module adopts kernel bypass technology, and the data will be transmitted in a fast path opened in the kernel based on the extended Berkeley packet filter, and the purpose of low-latency transmission of data packets is achieved through the data packet zero copy technology. The system includes: the data low-latency transmission module uses data fast path technology for the low-latency transmission technology, so that the data is sent directly to the user-state program by bypassing the protocol stack after being received via the network card.

[0008] In an embodiment, the data low-latency transmission module determines the risk status information of the data packet entering the module. If the risk level is low, the kernel data encryption module is used to encrypt the data in situ in the kernel state and then directly forward it to the egress network card. If the risk level is high, the user data encryption module is used to encrypt the data after it enters the user state program through the kernel bypass technology, and then forward it to the egress network card for forwarding.

[0009] In an embodiment, the user data encryption module and the kernel data encryption module perform data encryption by receiving data packets transmitted by the data low-latency transmission module, and the system to which they belong includes: the user data encryption module and the kernel data encryption module receive data packets by means of instructions issued by the data low-latency transmission module, and if the data flow risk level is low, the kernel data encryption module is selected, and if the risk level is high, the user data encryption module is selected.

[0010] In an embodiment, the user data encryption module and the kernel data encryption module use format-preserving encryption (FPE) to encrypt data packets, ensure the security of the information transmission link through link layer encryption, and achieve low-latency stateless encryption. The system includes: the data encryption module uses format-preserving encryption to prevent the format of part of the data packet from changing, thereby causing additional fragmentation and other operations that increase the data packet transmission overhead.

[0011] In addition, the present application example provides a multi-level risk seismic data stream ultra-low latency encrypted transmission method, the execution of the method is based on the system described in any one of the first aspects above, the method includes: the data low latency transmission module adopts kernel bypass technology, and achieves low latency transmission of data packets through data packet zero copy technology; load-aware scheduling technology is adopted to control data streams of different risk levels to enter different cores, and the module function implementation is described in the first aspect of the system description;

[0012] The kernel data encryption module encrypts data packets in the kernel state program by using format-preserving encryption, and ensures the security of the information path through link layer encryption;

[0013] The user data encryption module encrypts data packets in user-mode programs by using format-preserving encryption, and ensures the security of information paths by means of link-layer encryption;

[0014] By setting up encryption and decryption ends, the seismic data transmission link is encrypted and then transmitted to a complex network environment such as a dedicated line network. The encrypted data is decrypted after being received in a complex network environment such as a dedicated line network and sent to the data analysis end for analysis.

[0015] Compared with the related art, the embodiment of the present application provides a data stream low-latency encrypted transmission system and method, the data low-latency transmission module is used in conjunction with the user data encryption module; the data low-latency transmission module is used in conjunction with the kernel data encryption module; after the data is received, it first passes through the data low-latency transmission module for low-latency transmission and risk level determination to direct the data packet to different cores, and the core is responsible for scheduling the kernel encryption module and the user encryption module to encrypt the data packet, and then forward it to the export network card after encryption; the data low-latency transmission module uses a data fast path technology, and reduces the high overhead caused by encryption of the data packet by using kernel bypass. The encryption algorithm of the kernel data encryption module and the user data encryption module is a symmetric encryption algorithm that maintains the data format, and the data encryption and decryption is efficient and safe. Through the data low-latency transmission security encryption method provided by the embodiment of the present application, it is realized that in a confidential network with physical isolation between the data sending end and the receiving end, the delay requirements of the data in the transmission process are ensured by based on the data fast path technology; the confidentiality requirements of the seismic data in the transmission process are ensured by the format-preserving encryption technology. Compared with traditional solutions, the technical solution of the present application has higher transmission efficiency, the encryption solution is more efficient and secure, and can achieve reliable transmission with ultra-low latency. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The accompanying drawings are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the accompanying drawings:

[0017] Figure 1 It is a structural block diagram of a multi-level risk seismic data stream ultra-low delay encrypted transmission system according to an embodiment of the present application;

[0018] Figure 2 It is a schematic diagram of the data low-latency transmission module flow of the multi-level risk seismic data stream ultra-low-latency encrypted transmission system according to an embodiment of the present application;

[0019] Figure 3 It is a flow chart of a data encryption module of a multi-level risk seismic data stream ultra-low delay encryption transmission system according to an embodiment of the present application;

[0020] Figure 4It is a flow chart of seismic data packet processing in a multi-level risk seismic data stream ultra-low delay encrypted transmission system according to an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is described and illustrated below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. Based on the embodiments provided in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application.

[0022] The drawings described below are only some examples or embodiments of the present application. For ordinary technicians in this field, the present application can also be applied to other similar scenarios based on these drawings without creative work. In addition, it can be understood that although the efforts made in this development process may be complicated and lengthy, for ordinary technicians in this field related to the content disclosed in this application, some changes in design, manufacturing or production based on the technical content disclosed in this application are just conventional technical means, and should not be understood as insufficient content disclosed in this application.

[0023] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those of ordinary skill in the art that the embodiments described in this application may be combined with other embodiments without conflict.

[0024] Unless otherwise defined, the technical terms or scientific terms involved in this application should be understood by people with ordinary skills in the technical field to which this application belongs. The words "one", "a", "a", "the" and the like involved in this application do not indicate a quantitative limitation and may represent the singular or plural. The terms "include", "comprise", "have" and any of their variations involved in this application are intended to cover non-exclusive inclusions; for example, a process, method, system, product or device that includes a series of steps or modules (units) is not limited to the listed steps or units, but may also include steps or units that are not listed, or may also include other steps or units inherent to these processes, methods, products or devices. The "multiple" involved in this application refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there may be three relationships, for example, "A and / or B" can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. The terms "first", "second", "third" and the like involved in the present application are merely used to distinguish similar objects and do not represent a specific ordering of the objects.

[0025] The present application provides a multi-level risk seismic data stream ultra-low delay encrypted transmission system and method system. Figure 1 is a structural block diagram of a seismic data low-latency transmission security encryption system according to an embodiment of the present application, such as Figure 1 As shown in the figure, the overall architecture of the system includes five parts: seismic data collector cluster, data encryption transmission system, IoT network layer, decryption transmission system and data analysis server cluster. In the system, the devices on the left collect seismic data and generate information through local processing. After encryption through zero-copy low-latency technology and format-preserving encryption, it is sent to the IoT network layer via a dedicated network line. As a central processing and data aggregation point, the IoT network receives data from the encryption system and then sends the processing results to the decryption system on the right. Decryption is performed to send the data to the data analysis server cluster. This architecture can realize the instant processing, response and confidentiality protection of information, thereby protecting the security and low-latency transmission of data.

[0026] The data low-latency transmission module uses a data fast path (eXpress Data Path, XDP) technology and load sensing technology based on the extended Berkeley Packet Filter (eBPF); the kernel data encryption module directly encrypts the data packets transmitted by the data low-latency transmission module in the kernel state, and the user data encryption module encrypts the data packets transmitted from the data low-latency transmission module to the user state in the user state program. The encryption algorithm is a symmetric encryption algorithm that maintains the data format. The algorithm formula is: ; In the formula, F: K represents the key space, and S represents the plaintext and ciphertext space. This feature ensures that the message space of plaintext and ciphertext remains consistent during the format-preserving encryption of seismic data, thereby preserving the data format during the encryption process. It should be noted that format-preserving encryption is an encryption technology that keeps the encrypted data in the format of the original plaintext. In the above encryption algorithm, F represents the encryption function, which is the core component used to perform encryption operations in the algorithm; K represents the key, which is a key input in the encryption process and is used to control the specific behavior of the encryption algorithm. The key is a symmetric key (the same key is used for encryption and decryption); × represents a combination operation, which here refers to combining the key K with the plaintext S as the input of the encryption function F; S represents the plaintext and ciphertext space; → represents a mapping or conversion operation, indicating that the input is output after passing through the encryption function F; under the operation of format-preserving encryption, the output ciphertext has the same format and length as the input plaintext. Traditional encryption methods often change the original properties of data, especially in scenarios that require strict formats, such as the data portion of a data packet transmitted in a seismic data transmission system. If the data portion changes, problems such as additional fragmentation may occur. These problems require additional modifications to the encrypted data, increasing system complexity. Format-preserving encryption can solve this problem by preserving the format of the data. Preferably, the format-preserving encryption of an embodiment of the present application protects data transmission security by encrypting at the data link layer, that is, at the transmission link.

[0027] It should be noted that the kernel bypass technology based on the kernel itself is a low-latency data packet transmission technology, which processes the network packet before it enters the kernel protocol stack. After the data is received by the network card, the kernel protocol stack will be bypassed, so that the data is transmitted in the channel formed by the bypass without data copying, so as to reduce the transmission time of the data packet and realize the low-latency transmission of the seismic data packet. It should be noted that the data low-latency transmission module uses load-aware scheduling technology to select the path for encryption after data packet transmission, and selects by weighing the risk level, data packet length and core load situation. The data low-latency transmission module judges the risk status information of the data packet entering the module. If the risk level is low, the kernel data encryption module is used to encrypt the data in situ in the kernel state and then forward it directly to the egress network card. If the risk level is high, the user data encryption module is used, and the data is first entered into the user state program through the above-mentioned kernel bypass technology, and then encrypted by the user data encryption module, and then forwarded to the egress network card for forwarding. Among them, the data low-latency transmission module is used in conjunction with the kernel data encryption module; the data low-latency transmission module is used in conjunction with the user data encryption module; after the data is received, it first passes through the data low-latency transmission module, and the module determines that the data packet is encrypted via the user data encryption module or the kernel data encryption module according to the data risk level and the core load situation; the data low-latency transmission module uses the data fast path technology and load sensing technology based on the extended Berkeley packet filter; the kernel data encryption module directly encrypts the data packet transmitted by the data low-latency transmission module in the kernel state, and the user data encryption module encrypts the data packet transmitted from the data low-latency transmission module to the user state in the user state program, and the encryption algorithm is a symmetric encryption algorithm that maintains the data format. This feature ensures that the system keeps the message space of the plaintext and the ciphertext consistent during the process of format-preserving encryption of seismic data, thereby retaining the data format during the encryption process. The user data encryption module and the kernel data encryption module send the original data ciphertext to the decryption end user data encryption module and the kernel data encryption module through a dedicated network line to decrypt the original data ciphertext.

[0028] The above modules can be functional modules or program modules, and can be implemented by software or hardware. For modules implemented by hardware, the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0029] In some of these embodiments, Figure 2 is a schematic diagram of a process of low-latency data transmission according to an embodiment of the present application, such as Figure 2 As shown, the data low-latency transmission system of the embodiment of the present application performs data transmission including the following steps:

[0030] S1, seismic data packets are sent from the processing module via the network interface card and transmitted through the underlying data transmission facilities;

[0031] S2. The traditional data transmission method is to send data through the network protocol stack to the seismic data encryption system. The seismic data low-latency transmission security encryption system uses a kernel bypass zero-copy method to send data packets directly to user-mode applications;

[0032] S3, the user state or kernel state encryption program performs encryption processing after receiving.

[0033] In some of these embodiments, Figure 3 is a schematic diagram of a data encryption process according to an embodiment of the present application, such as Figure 3 As shown, the data encryption system of the embodiment of the present application performs data encryption including the following steps:

[0034] S1, seismic data packets are collected by seismic data acquisition sensors, and the sensors send them to the seismic data low-latency transmission security encryption system;

[0035] S2. After receiving the data packet, the seismic data low-latency transmission security encryption system encrypts the data packet using a format-preserving encryption algorithm. The format-preserving algorithm will not change the length and format of the data portion of the data packet.

[0036] In some of these embodiments, Figure 4 is a flow chart of seismic data packet processing of a seismic data low-latency transmission security encryption system according to an embodiment of the present application, such as Figure 4 As shown, the seismic data packet processing process of the embodiment of the present application mainly includes the following steps:

[0037] S1. The network interface card first captures the incoming data packets, and the data low-latency transmission module uses the data fast path socket to quickly transmit the data packets. It supports zero-copy data transmission from kernel space to user space, greatly reducing memory copy operations during data processing, reducing latency and improving throughput.

[0038] S2. Select the encryption module. The data low-latency transmission module uses load-aware scheduling technology to automatically identify the risk level and other status information of the input data packet data, and makes a judgment based on the core load and data risk level. If the data flow risk level is high, the core with low load will be given priority for processing, and the user-mode data encryption module will be used for encryption. Otherwise, the kernel data encryption module will be used for encryption.

[0039] It should be noted that compared with the traditional method of processing through the entire network stack, this method significantly improves the speed and efficiency of data processing, and is particularly suitable for scenarios that require high-performance network processing. Compared with traditional software encryption methods, this method significantly improves the confidentiality of data, and the key has a more secure storage location, which is particularly suitable for scenarios that require high-confidentiality network processing. Ensure the flexibility and responsiveness of the system.

[0040] In one embodiment of the present application, the data low-latency transmission module adopts kernel bypass technology, and the data is transmitted in a fast path opened in the kernel based on the extended Berkeley packet filter, and the purpose of low-latency transmission of data packets is achieved through the data packet zero copy technology. The system includes:

[0041] The data low-latency transmission module uses data fast path technology for the low-latency transmission technology, so that the data is directly sent to the user-mode program bypassing the protocol stack after being received via the network card.

[0042] In one embodiment of the present application, the data low-latency transmission module makes a determination after receiving a data packet sent by a network card.

[0043] 1. Determine the processing method and priority of each data packet based on the risk level and data volume of the data packet. The encryption strategy for each data packet is determined by the following rules:

[0044] Risk level 1: Data is directly forwarded to the egress network card by the low latency function without encryption;

[0045] Risk Level 2: Calling the kernel encryption module for weak encryption, which is suitable for scenarios with large data volumes but low security requirements;

[0046] Risk level 3: Calling the kernel encryption module for strong encryption, suitable for scenarios with small data volumes and high security requirements;

[0047] Risk Level 4: User-mode strong encryption, suitable for scenarios with large amounts of data and high security requirements.

[0048] The priority is determined based on the risk level and data volume. The specific formula is:

[0049] (1)

[0050] Among them is The weighting of risk levels, higher risk packages require higher priority. It is the weight of the data packet size. Larger data packets require more computing resources. The weight of each risk level can be adjusted dynamically.

[0051] 2. Dynamically calculate the load of each core.

[0052] During scheduling, the load of each core needs to be calculated in real time. The load of each core will change as the tasks are assigned. The load of the core is mainly determined by the encryption consumption of the task it is currently processing. The processing of each data packet consumes a certain amount of CPU resources, and the consumed resources can be calculated using the given formula:

[0053] (2)

[0054] in, is the set of packets assigned to core 𝑘, is the resource consumption of the 𝑖th packet. The load of each core is the sum of the tasks it is currently processing, and scheduling can be performed by periodically updating the load of each core.

[0055] 3. Determine the processing core of the data packet

[0056] Task scheduling is performed by calculating the load of each core and the priority of each data packet in real time. During scheduling, the appropriate core needs to be dynamically selected to allocate data packets. The core selected should consider the following factors:

[0057] Core load: To ensure system efficiency, a lightly loaded core needs to be selected to process new tasks.

[0058] Task priority: Prioritize tasks with high risk and large data volume, so ensure that these tasks are assigned to cores with lighter loads as much as possible.

[0059] In summary, the data packet selects the core , the formula is (assuming the device has cores):

[0060] (3)

[0061] It should be noted that the following constraints should be taken into consideration when selecting the core of the module data packet. The constraints are analyzed below to further solve the problem.

[0062] Core load limit:

[0063] The computing power of each core is limited. The maximum load of each core is , for a total number of cores System selection core , should meet the following requirements:

[0064] (4)

[0065] 2. Unique core allocation constraints:

[0066] Each task Must be assigned to a core , and each task can only be assigned to one core, which should meet the following requirements:

[0067] (5)

[0068] in is a binary decision variable, representing the task Is it allocated to the core? :

[0069] (6)

[0070] Therefore, through the above analysis, the objective function is modeled, and by optimizing task allocation, all tasks can be reasonably allocated to appropriate cores. Therefore, the objective function can be written as:

[0071] (7)

[0072] The goal of the system is to optimize the task allocation of each data packet and reasonably allocate each data packet to each core for processing. This is determined by the core load, task priority, and data packet size in the above objective function. It can be written as:

[0073]

[0074] (8)

[0075] in is the number of packets, is the number of system cores, For real-time core load conditions, is a constant, is the priority of task T, is a binary decision variable. Therefore, this problem is an integer linear programming problem.

[0076] The global search for the optimal scheduling solution is very time-consuming, which contradicts the original goal of the system to achieve ultra-low latency. The system proposes an effective heuristic algorithm to solve it. By using an effective heuristic algorithm proposed in this solution, the system can obtain an approximate optimal solution to the optimization problem, ensuring that an approximate solution suitable for real-world applications is quickly provided at a reasonable scheduling time.

[0077] 1. Task allocation based on risk level and data volume

[0078] The system implements a hierarchical scheduling strategy for tasks of different risk levels to ensure that high-risk and large-volume tasks are given priority. Create multiple task queues for hierarchical processing, each with different priorities. scope.

[0079] 2. Core sorting

[0080] Each core has its own performance and load, which are used to determine task allocation. Based on the core characteristics and considering the core's remaining processing capacity, core scheduling is performed on the core with higher remaining capacity combined with data priority.

[0081] 3. Task core scheduling and mapping

[0082] After completing the above steps, the algorithm schedules the tasks to the corresponding cores, dynamically adjusts the remaining performance of the cores after scheduling, and adjusts the task allocation across cores to minimize the overall task completion time and balance the core utilization.

[0083] In one embodiment of the present application, the user data encryption module and the kernel data encryption module perform data encryption by receiving data packets transmitted by the data low-latency transmission module, and the system includes:

[0084] The user data encryption module and the kernel data encryption module receive data packets by sending instructions from the data low-latency transmission module. If the data flow risk level is low, the kernel data encryption module is selected, and if the risk level is high, the user data encryption module is selected.

[0085] In one embodiment of the present application, the user data encryption module and the kernel data encryption module use format-preserving encryption (FPE) to encrypt data packets, ensure the security of information transmission links through link layer encryption, and achieve low-latency stateless encryption. The system includes:

[0086] The data encryption module adopts format-preserving encryption to prevent the format of the data part of the data packet from being changed, thereby causing additional fragmentation operations and increasing the data packet transmission overhead.

[0087] In one embodiment of the present application, the kernel data encryption module uses a symmetric key to encrypt the data portion of the original data packet to generate the original data ciphertext;

[0088] The user data encryption module uses a symmetric key to encrypt the data portion of the original data packet to generate the original data ciphertext; the user encryption module and the kernel encryption module use an encryption algorithm for format-preserving encryption, and the algorithm formula is: ; In the above encryption algorithm, Represents the encryption function, which is the core component of the algorithm used to perform encryption operations; represents the key, which is a key input in the encryption process and is used to control the specific behavior of the encryption algorithm. The key is a symmetric key (the same key is used for encryption and decryption); Indicates a combination operation, which here means to combine the key With plain text Combined, as an encryption function Input; Represents the plaintext and ciphertext space; → represents a mapping or conversion operation, indicating that the input is output after passing through the encryption function F; under the operation of format-preserving encryption, the output ciphertext has the same format and length as the input plaintext. In an embodiment of the present application, the user data encryption module and the kernel data encryption module use format-preserving encryption (FPE) to encrypt the data packet, and use link layer encryption to ensure the security of the information transmission link and achieve low-latency stateless encryption. The data encryption module uses format-preserving encryption to prevent the format of the data packet data part from changing, thereby causing additional fragmentation and other operations that increase the data packet transmission overhead.

[0089] In one embodiment of the present application, the user data encryption module and the kernel data encryption module include a data encryption end and a data decryption end, which are distributed at the data acquisition end where the seismic data sensor is located and the data analysis end where the seismic data analysis server is located after dedicated line transmission. At the data collection end, the data low-latency transmission module performs risk level determination in combination with the data length, and the kernel data encryption module is used to encrypt the data and then forward it to the export network card for transmission; or the data is first forwarded to the user state, and the user data encryption module is used by the user state program to encrypt the data at the encryption end; after the data packet is transmitted through the dedicated line, it enters the data low-latency transmission module again and is forwarded to the user state program, and then the data encryption module is used to decrypt the data at the decryption end, and then forwarded to the data analysis end.

[0090] The data low-latency transmission security encryption method provided by the embodiment of the present application realizes that in a confidential network with physical isolation between the data sending end and the receiving end, the data delay requirement during transmission is ensured by using data fast path technology; the confidentiality requirement of seismic data during transmission is ensured by using format-preserving encryption technology. The problem of how to improve data security during transmission is solved.

[0091] Furthermore, the present application example provides a system for ultra-low-latency encrypted transmission of multi-level risk seismic data streams, the system comprising:

[0092] The low-latency data transmission module is used to: use kernel bypass technology to achieve low-latency data packet transmission through zero-copy technology. Use load-aware scheduling technology to control data flows of different risk levels to enter different cores;

[0093] The encryption module includes a kernel data encryption module and a user data encryption module. The kernel data encryption module is used to: encrypt data packets by using format-preserving encryption in the kernel state program, and ensure the security of the information path by means of link layer encryption; the user data encryption module is used to: encrypt data packets by using format-preserving encryption in the user state program, and ensure the security of the information path by means of link layer encryption;

[0094] In one embodiment of the present application, d

[0095] It should be noted that, in addition to the system, the steps shown in the above process or the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and, although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0096] This embodiment further provides an electronic device, which includes an operating system, in which a computer program is stored. The operating system is configured to run the computer program to execute the steps in any of the above method embodiments.

[0097] It should be noted that the specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0098] In one embodiment, a computer device is provided, which is a terminal. The computer device includes a processor, a memory, and a network interface connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for low-latency secure data transmission is implemented.

[0099] In one embodiment, the seismic data packet enters the network driver through the network card, is received by the XDP program mounted on the network driver, and selects direct user-state encryption to be directly forwarded via the export network card or forwarded to the user state to achieve zero-copy transmission of data and perform user-state program encryption, forwarded via the export network card, and both user and kernel-state encryption keep the data format unchanged and minimize the increase in transmission overhead. The encryption and decryption boxes at the sender and receiver are used together to implement link layer encryption and protect the security of data during transmission: even if the data is intercepted, it cannot be interpreted due to encryption, thereby preventing data leakage or tampering, and protecting the data transmission process from the threat of man-in-the-middle attacks. .

[0100] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0101] Those skilled in the art should understand that the technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0102] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for ordinary technicians in this field, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application.

Claims

1. A data stream low-latency transmission security encryption system, characterized in that: The system includes a low-latency transmission module and a data encryption module, wherein: The low-latency transmission module determines the processing mode and priority of each data packet according to the risk level and data volume of the data packet; According to the confirmation result, load-aware scheduling technology is used to control data flows of different risk levels to enter kernel state or user state programs; By implementing hierarchical scheduling strategies for tasks of different risk levels, we ensure that high-risk and large-data-volume tasks are given priority. Schedule data processing tasks to the corresponding cores, dynamically adjust the remaining performance of the cores after scheduling, and adjust the task allocation across cores to minimize the overall task completion time; The data encryption module uses a symmetric key to encrypt the processed kernel state data packet data portion to generate the original data ciphertext; After the data packet is sent from the low-latency transmission module to the user-mode program, the data encryption module encrypts the user-mode message to obtain the ciphertext, and forwards it through the low-latency transmission module; If the risk level is low, the kernel data encryption module is used to encrypt the data in situ in the kernel state and then directly forward it to the egress network card; If the risk level is high, a user data encryption module is used to encrypt the data after it enters the user state program through the kernel bypass technology, and then forward it to the egress network card for forwarding; After being transmitted through the dedicated line, the data packet enters the data low-latency transmission module again and is forwarded to the user-mode program. The data packet is then decrypted using the data encryption module and then forwarded to the data analysis terminal.

2. The system according to claim 1, characterized in that The data low-latency transmission module is based on the risk level and data volume of the data packet. Determine the processing method and priority of each data packet. The judgment rules of the encryption policy of each data packet are as follows: Risk level 1: Data is directly forwarded to the egress network card by the low latency function without encryption; Risk Level 2: Calling the kernel encryption module for weak encryption, which is suitable for scenarios with large data volumes but low security requirements; Risk level 3: Calling the kernel encryption module for strong encryption, suitable for scenarios with small data volumes and high security requirements; Risk Level 4: User-mode strong encryption, suitable for scenarios with large amounts of data and high security requirements.

3. The system according to claim 2, characterized in that The priority is determined based on the risk level and data volume. The specific formula is: in, is the weight of the risk level, higher risk packages require higher priority, is the weight of the packet size.

4. The system according to claim 3, characterized in that The load scheduling technology adopted by the data low-latency transmission module determines the load of the core according to the encryption consumption of the task currently processed by each core, and the load of the core is determined by the encryption consumption of the task currently processed by each core; The data low-latency transmission module calculates the consumption of a certain amount of CPU resources for each data packet using the following formula: in, is the set of packets that have been assigned to a core, is the resource consumption of the th data packet.

5. The system according to claim 4, characterized in that The data low-latency transmission module performs task scheduling by calculating the load of each core and the priority of each data packet in real time, including the following scheduling strategies: 1) Prefer lightly loaded cores to handle new tasks; 2) Prioritize tasks with high risk and large data volume for processing, and ensure that these tasks are assigned to cores with lighter loads as much as possible. Assuming the device has N cores, the scheduling strategy is to select the core for the data packet. The formula is: The maximum load of each core is , for a system with a total number of cores N, the core k should be selected to satisfy:

6. The system according to claim 5, characterized in that Each of the tasks Must be assigned to a core , and each task can only be assigned to one core, which should meet the following requirements: in is a binary decision variable, representing the task Is it allocated to the core? :

7. The system according to claim 6, characterized in that The optimal task allocation scheme for load scheduling of the data low-latency transmission module is: in is the number of packets, is the number of system cores, For real-time core load conditions, is a constant, is the priority of task T, is a binary decision variable.

8. A method for low-latency transmission and secure encryption of seismic data, characterized in that: The method is performed based on the system according to any one of claims 1 to 7, and the method comprises: Determine the processing method and priority of each data packet based on its risk level and data volume; Based on the above judgment results, load-aware scheduling technology is used to control data flows of different risk levels to enter kernel state or user state programs; By implementing hierarchical scheduling strategies for tasks of different risk levels, we ensure that high-risk and large-data-volume tasks are given priority. Schedule data processing tasks to the corresponding cores, dynamically adjust the remaining performance of the cores after scheduling, and adjust the task allocation across cores to minimize the overall task completion time; The symmetric key is used to encrypt the processed kernel-state data packet data portion to generate the original data ciphertext; After the data packet is sent from the low-latency transmission module to the user-mode program, the data encryption module encrypts the user-mode message to obtain the ciphertext, and forwards it through the low-latency transmission module; If the risk level is low, the kernel data encryption module is used to encrypt the data in situ in the kernel state and then directly forward it to the egress network card; If the risk level is high, the user data encryption module is used to encrypt the data after it enters the user-mode program through the kernel bypass technology mentioned above, and then forward it to the egress network card for forwarding; After being transmitted through the dedicated line, the data packet enters the low-latency transmission module again and is forwarded to the user-mode program, where it is decrypted using the data encryption module and then forwarded to the data analysis terminal for data analysis.

9. A data processing device, characterized in that: include: Memory, used to store programs; A processor is used to execute the program stored in the memory. When the program is executed, the processor is used to execute the method as claimed in claim 8.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method described in claim 8 is implemented.

Images