Certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol

Abstract

The invention relates to the technical field of network security and edge computing, in particular to a trusted asymmetric encryption communication protocol of an edge computing gateway driven by a certificate chain, which comprises the following steps of: generating node characteristic data based on edge node hardware characteristics, generating dynamic certificate chain data through edge node cooperation, and recording the dynamic certificate chain data to a block chain to form global trust data; generating global random number data in combination with the dynamic certificate chain data and a chaotic mapping algorithm, and verifying the integrity of the global random number data; generating quantum initialization vector data in combination with the global random number data and the hardware noise data, and performing block encryption on the original communication data to generate block encrypted data; a secret sharing algorithm is used to distribute a dynamic session key to a highly trusted node to ensure the security of the key; and dynamically optimizing subsequent communication parameters according to a result of decrypting the communication data. According to the method, the security, robustness and adaptability of data transmission in an edge computing scene are improved by introducing a dynamic certificate chain, a chaotic mapping algorithm, block encryption and a feedback optimization mechanism.

Description

Technical Field

[0001] The present invention relates to the fields of network security and edge computing technology, and in particular to a trusted asymmetric encryption communication protocol for an edge computing gateway driven by a certificate chain. Background Art

[0002] With the rapid development of the Internet of Things and edge computing, edge devices need to interact with data efficiently and reliably in dynamic and complex network environments, while traditional secure communication solutions have limitations in processing data integrity, authentication, and privacy protection. Trusted communication based on certificate chains can provide a distributed trust mechanism. By combining dynamic certificate chains with asymmetric encryption algorithms, it significantly improves the security, authenticity, and anti-attack capabilities of data during transmission.

[0003] The existing technology (Chinese invention patent, publication number: CN113591109B, name: Method and system for communication between trusted execution environment and cloud) based on the transmission protocol of trusted execution environment (TEE) and root of trust has solved the communication security problem between the device and the cloud to a certain extent, but it still has the following defects: Existing methods use the device's inherent root of trust or pre-injected key pairs for data protection, which are difficult to dynamically adapt to changes in the network environment and the interoperability between complex devices, and are easy to become targets of attacks; most of them use fixed encryption key generation and transmission strategies, such as a single symmetric or asymmetric encryption method, which lacks flexibility when dealing with complex attack scenarios; existing technologies rely on centralized key management and verification mechanisms, resulting in low verification efficiency in multi-node distributed environments, and are vulnerable to man-in-the-middle attacks and data tampering threats. Summary of the invention

[0004] In view of the many problems existing in the above-mentioned prior art, the present invention provides a certificate chain-driven edge computing gateway trusted asymmetric encryption communication protocol. The present invention generates global random number data through dynamic certificate chain data and chaotic mapping algorithm, encrypts the original communication data in blocks in combination with quantum initialization vector data, and distributes dynamic key fragments to highly trusted nodes using secret sharing algorithm, thus realizing a highly secure encrypted communication process. The dynamic trust management, randomness enhancement and feedback optimization mechanisms are integrated into the communication protocol, which significantly improves the security and robustness of data transmission.

[0005] A certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol, comprising the following steps: Generate node feature data based on the hardware characteristics of edge nodes, generate dynamic certificate chain data through collaboration between edge nodes, and record the dynamic certificate chain data in the blockchain to form global trust data; Generate global random number data based on dynamic certificate chain data and chaotic mapping algorithm, and perform integrity check on the global random number data; The original communication data is encrypted in blocks in combination with the global random number data to generate block encrypted data, and the signature of the block encrypted data and the check value of the block encrypted data are added to form the signed encrypted data; The integrity of the signature encrypted data is verified based on the dynamic certificate chain data, the block encrypted data is decrypted to generate decrypted communication data, and subsequent communication parameters are adjusted according to the result of the decrypted communication data.

[0006] Preferably, the process of generating global random number data based on dynamic certificate chain data and chaotic mapping algorithm includes: processing the initial random number fragment data of the high-trust node by the enhanced chaotic mapping algorithm, combining the initial random number fragment data with the random number collaborative path data for multiple iterations to generate mixed random number data, and finally generating global random number data by combining the mixed random number data with the path hash of the dynamic certificate chain data; wherein, the enhanced chaotic mapping algorithm generates random number fragment data by the following formula:

[0007]

[0008] in, Indicates the random number fragment value of the current iteration; Indicates the collaboration path status value of the current iteration; Indicates the node status value of the current iteration; Represents parameters dynamically generated based on node feature data, used to control the dynamic changes of the mapping function.

[0009] Preferably, the enhanced chaos mapping algorithm processes the highly trusted nodes including: sorting the highly trusted nodes using the trust weights in the dynamic certificate chain data, and adjusting the initial state parameters of the enhanced chaos mapping algorithm based on the sorting result.

[0010] Preferably, the process of block-encrypting the original communication data in combination with the global random number data includes: generating block data by dividing the original communication data into blocks of fixed size, and generating quantum initialization vector data in combination with the global random number data and the hardware noise data, wherein the quantum initialization vector data is generated by the following formula:

[0011] in, Represents quantum initialization vector data; represents a quantum hash function; Represents the global random number data fragments; The hardware noise data Sample values; Represents the total number of fragments for global random number data and hardware noise data.

[0012] Preferably, the process of generating the quantum initialization vector data further includes: preprocessing the hardware noise data, wherein the preprocessing includes denoising and quantization processing.

[0013] Preferably, the block encryption process includes: encrypting each block of block data by using the AES-256-GCM algorithm in combination with quantum initialization vector data to generate block encrypted data, and storing the dynamic session key data in pieces to multiple edge nodes by using a secret sharing algorithm, wherein the dynamic session key data is generated by the following formula:

[0014] in, Represents dynamic session key data; Represents the global random number data fragments; Represents the quantum initialization vector data fragments; Represents the total number of fragments of global random number data and quantum initialization vector data.

[0015] Preferably, the process of storing dynamic session key data in fragments through a secret sharing algorithm includes: dividing the dynamic session key data into multiple key fragments, each key fragment is distributed and stored in a high-trust node according to a predetermined distribution rule, and based on a recovery threshold, it is limited that at least part of the key fragments can restore the complete dynamic session key data.

[0016] Preferably, verifying the integrity of the signed encrypted data based on the dynamic certificate chain data includes: extracting signature verification information and public key data from the dynamic certificate chain data, verifying the signed encrypted data using the extracted public key data, and verifying the integrity of the block encrypted data through an HMAC check value.

[0017] Preferably, the process of adjusting subsequent communication parameters according to the results of decrypted communication data includes: generating optimized feedback data by analyzing the packet loss rate, communication delay and decryption success rate of the decrypted communication data, and dynamically adjusting the block data size, global random number generation path and dynamic key generation strategy based on the optimized feedback data.

[0018] Compared with the prior art, the advantages and beneficial effects of the present invention are: The present invention achieves greater flexibility and adaptability by introducing dynamic certificate chain data, overcomes the limitations of static trust roots, supports dynamic trust management of multiple nodes, and significantly improves the robustness of edge computing networks; The present invention realizes the high randomness and unpredictability of global random number data by combining the chaotic mapping algorithm and the distributed random number generation technology, and effectively prevents pseudo-random number attacks and replay attacks; The present invention improves the security and anti-attack capability of data encryption by combining the block encryption strategy with the innovative encryption method of quantum initialization vector data, and ensures the integrity and confidentiality of block encrypted data during transmission; The present invention realizes dynamic adjustment of communication processes through feedback-based communication parameter optimization, significantly improves communication efficiency and reliability, and meets the needs of complex edge computing scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of the process of the present invention; Figure 2 This is a schematic diagram of dynamic certificate chain generation in the present invention; Figure 3 This is a schematic diagram of global random number generation in the present invention; Figure 4 A schematic diagram of block encryption and dynamic key distribution in the present invention; Figure 5 This is a schematic diagram of communication optimization feedback in the present invention. DETAILED DESCRIPTION

[0020] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is obvious that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0021] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0022] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0023] A certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol, comprising the following steps: Generate node feature data based on the hardware characteristics of edge nodes, generate dynamic certificate chain data through collaboration between edge nodes, and record the dynamic certificate chain data in the blockchain to form global trust data; The present invention analyzes the hardware characteristics of edge nodes and generates node feature data, thereby realizing the generation of dynamic certificate chains and the construction of global trust data. The core of this process is the dynamic trust mechanism and certificate chain generation mechanism based on the collaboration between edge nodes, and its main principles are as follows: Node feature data is a unique identifier generated based on the hardware characteristics of the edge node (such as MAC address, hardware serial number, device timestamp, etc.). This identifier is encrypted using a hash algorithm (such as SHA-256) to ensure its uniqueness and irreversibility. For example, for an edge node, its MAC address is A1:B2:C3:D4:E5:F6, the timestamp is 1672531200, and the hardware serial number is SN12345. The formula for generating node feature data is:

[0024] in, Represents node feature data; Indicates MAC address; Indicates a timestamp; Indicates the hardware serial number; Represents a hash function (such as SHA-256). The node feature data generated in this way not only ensures uniqueness, but also resists conventional data tampering attacks.

[0025] like Figure 2 As shown in Figure 1, the generation of dynamic certificate chains is based on the collaboration between edge nodes, and the main basis for collaboration is the degree of trust between nodes. The calculation of trust takes into account parameters such as the communication behavior, response time, and data integrity of the node. For example, by analyzing the historical behavior data of edge nodes, a trust scoring model for the node is constructed:

[0026] in, represents the trust score; Indicates the node response time; Indicates the data integrity indicator; Indicates the communication success rate; Indicates the weight coefficient that is dynamically adjusted according to different scenarios.

[0027] On this basis, nodes with trust scores higher than the preset threshold are selected as high-trust nodes, and certificate chain data is generated through public key signatures between these nodes. The public key signature process uses asymmetric encryption technology to sign the node feature data of other nodes through the private key of the high-trust node to ensure its identity is credible.

[0028] The generated dynamic certificate chain data is written into the blockchain through distributed storage technology. As a decentralized distributed ledger, the blockchain can ensure the immutability and traceability of the certificate chain data. For example, each block in the blockchain contains information such as the certificate chain data, the hash value of the previous block, and the timestamp:

[0029] in, Represents dynamic certificate chain data; Indicates the hash value of the previous block; Indicates the timestamp when the block was generated.

[0030] The introduction of blockchain not only enhances data security, but also provides a reliable basis for future node trust audits and historical tracking.

[0031] By generating node feature data and combining it with a dynamic certificate chain, the identity of edge nodes can be accurately identified and authenticated to prevent fake nodes from joining. In addition, the combination of the trust scoring model and the dynamic certificate chain can dynamically reflect the behavior changes of nodes and improve the flexibility and anti-attack capabilities of the system.

[0032] After the dynamic certificate chain data is recorded in the blockchain, the integrity of the certificate chain data is ensured by utilizing the blockchain’s immutability and distributed storage characteristics. It also supports tracing the node trust history, which helps to achieve secure global trust management.

[0033] The trust scoring mechanism can dynamically adjust the trust level based on the actual performance of the node. When certain nodes behave abnormally, the system can promptly reduce their trust level or even remove them from the list of highly trusted nodes, thereby enhancing the overall security of the network.

[0034] Example, assuming there are five edge nodes The trust scores of each node are , , , , , the preset trust score threshold is 80. Through the trust score calculation, the list of highly trusted nodes is The system uses these three nodes to generate dynamic certificate chain data and records it through the blockchain.

[0035] When the node The behavior of the node is improved, and its trust score rises to 82. The system will dynamically update the list of highly trusted nodes to , and generates new certificate chain data. This dynamic adjustment mechanism ensures the network's sensitivity to changes in node behavior.

[0036] Generate global random number data based on dynamic certificate chain data and chaotic mapping algorithm, and perform integrity check on the global random number data; Preferably, Figure 3 As shown, the process of generating global random number data based on dynamic certificate chain data and chaotic mapping algorithm includes: processing the initial random number fragment data of the high-trust node by the enhanced chaotic mapping algorithm, combining the initial random number fragment data with the random number collaborative path data for multiple iterations to generate mixed random number data, and finally generating global random number data by combining the mixed random number data with the path hash of the dynamic certificate chain data; wherein, the enhanced chaotic mapping algorithm generates random number fragment data by the following formula:

[0037]

[0038] in, Indicates the random number fragment value of the current iteration; Indicates the collaboration path status value of the current iteration; Indicates the node status value of the current iteration; Represents parameters dynamically generated based on node feature data, used to control the dynamic changes of the mapping function.

[0039] Each high-trust node generates initial random number fragment data based on its own state variables, which include the node's hardware feature data, timestamp, dynamic certificate chain related information, etc. After these state variables are initialized, they are iteratively calculated using the enhanced chaos mapping algorithm to generate random number fragments.

[0040] The enhanced chaos mapping algorithm is calculated based on the above formulas, which realize the generation of initial random number fragments through nonlinear iteration and ensure that the random numbers generated each time are unpredictable and highly sensitive.

[0041] The generated initial random number fragment data needs to be mixed through the collaborative path between nodes. The collaborative path data is determined by the trust weight in the dynamic certificate chain. The higher the trust weight of the node, the greater the weight assigned to its data. For example, for the three nodes in the path, the weights are , , , then the path mixing process is processed by weighted formula:

[0042] in, Represents a path mixed random number fragment; Indicates The initial random number fragment of each node; Indicates The trust weight of each node; Indicates the total number of nodes participating in path blending.

[0043] The random number collaborative path data generates mixed random number data after multiple rounds of iterative mixing. In order to ensure the uniqueness and security of the global random number data, the mixed random number data is combined with the path hash of the dynamic certificate chain data to finally generate the global random number data. The path hash combines the signatures and timestamps of all highly trusted nodes in the dynamic certificate chain, and is implemented through the following formula:

[0044] in, Represents global random number data; Represents a hash function (such as SHA-256); Represents the path hash of the dynamic certificate chain data; || represents a connection operation.

[0045] The chaotic mapping algorithm is characterized by its initial value sensitivity and trajectory unpredictability, which enhances the complexity of random number generation. At the same time, it combines dynamic certificate chain data to further improve the uniqueness and security of random numbers.

[0046] The random number generation process dynamically depends on the trust weight of highly trusted nodes and can reflect the dynamic changes in trust between nodes. This collaborative mechanism ensures that the random number generation process is not only distributed but also adaptive.

[0047] By integrating dynamic certificate chain data through path hashing, the generated global random number data is globally unique. Even if an attacker can obtain the initial random number fragments of some nodes, he cannot predict or reconstruct the complete global random number data.

[0048] Example, assuming that in an edge computing environment, there are three highly trusted nodes Their trust weights are , , Each node generates initial random number fragment data based on its own state variables and chaos mapping algorithm: node The initial random number fragment is ; node The initial random number fragment is ; node The initial random number fragment is .

[0049] Weighted fusion via random number collaborative paths:

[0050] Path hashing combined with dynamic certificate chain data , and finally generate global random number data through global hashing:

[0051] Assuming the hash function If SHA-256 is used, the generated global random number data is a random value of fixed length, for example .

[0052] Preferably, the enhanced chaos mapping algorithm processes the highly trusted nodes including: sorting the highly trusted nodes using the trust weights in the dynamic certificate chain data, and adjusting the initial state parameters of the enhanced chaos mapping algorithm based on the sorting result.

[0053] The dynamic certificate chain data records the trust score of each node, which is calculated by comprehensively calculating the node's historical behavior data, communication response time, data integrity and other parameters (for example, by the formula ). Based on the trust score, the system sorts the high-trust nodes in descending order to form a list of high-trust nodes.

[0054] The purpose of sorting is to determine the priority and influence weight of each node in the random number generation process. For example, nodes with high trust scores will have a greater impact on the initial state parameters of the chaos mapping algorithm.

[0055] The initial state parameters of the chaos mapping algorithm (such as ) is the key to generating random number fragments. According to the ranking results of highly trusted nodes, the initial values ​​of these parameters are dynamically adjusted to ensure that the random number generation process has higher dynamics and security. For example:

[0056]

[0057]

[0058] in, Represents the initial state parameters of the chaos mapping algorithm; Represents the weight of highly trusted nodes after trust score sorting; Represents the characteristic data of the corresponding node; Represents a hash function that maps input data to an initial value of fixed length.

[0059] After the initial state parameters are determined, the chaotic mapping algorithm begins iterative operation to generate unpredictable random number fragments. The iterative formula is:

[0060]

[0061] This enhanced dynamic adjustment mechanism not only ensures that the generation of random number fragments is highly randomized, but also enhances the anti-attack capability of the generation process.

[0062] By dynamically adjusting the initial state parameters in combination with the sorting results of highly trusted nodes, the enhanced chaotic mapping algorithm can generate more secure and unpredictable random numbers, avoiding the security risks caused by fixed initial parameters.

[0063] The present invention updates the order of highly trusted nodes in real time through dynamic certificate chain data, thereby dynamically adjusting the initial state parameters of the chaotic mapping algorithm. This dynamism enables the random number generation process to adapt to changes in node behavior, significantly improving the flexibility of the system.

[0064] Traditional random number generation algorithms usually have security risks due to the leakage or fixation of initial parameters. The present invention uses the sorting results of highly trusted nodes in the dynamic certificate chain data to dynamically adjust the initial state parameters, making it difficult for attackers to predict the final result of random number generation even if they have mastered some node information.

[0065] In this embodiment, it is assumed that three highly trusted nodes are recorded in the dynamic certificate chain. , whose trust scores are The system sorts the nodes according to their scores, and the result is Based on the sorting results, the system assigns a weight to each node: , , .

[0066] These weights are then used to generate the initial state parameters of the chaos mapping algorithm:

[0067]

[0068]

[0069] in , , Is a node characteristic data (such as MAC address and hardware serial number).

[0070] After the initial parameters are determined, the chaos mapping algorithm starts running and generates random number fragments after multiple iterations. Assume that after five iterations, the random number fragments obtained are: node : ; node : ; node : .

[0071] These random number fragments then participate in the global random number generation, ensuring the security and flexibility of the entire system.

[0072] The original communication data is encrypted in blocks in combination with the global random number data to generate block encrypted data, and the signature of the block encrypted data and the check value of the block encrypted data are added to form the signed encrypted data; Preferably, the process of block-encrypting the original communication data in combination with the global random number data includes: generating block data by dividing the original communication data into blocks of fixed size, and generating quantum initialization vector data in combination with the global random number data and the hardware noise data, wherein the quantum initialization vector data is generated by the following formula:

[0073] in, Represents quantum initialization vector data; represents a quantum hash function; Represents the global random number data fragments; The hardware noise data Sample values; Represents the total number of fragments for global random number data and hardware noise data.

[0074] like Figure 4 As shown, the original communication data is segmented according to a fixed block size to generate multiple block data. This block operation not only facilitates subsequent encryption processing, but also makes data encryption and transmission more flexible.

[0075] Assume that the original communication data is of length Byte stream , the fixed block size is , then the total number of block data is Each block of data The size is or the number of bytes remaining.

[0076] Quantum Initialization Vector (IV) is a key component of block encryption. Its generation combines global random number data and hardware noise data to ensure the uniqueness and security of each block data encryption process. The specific generation formula is: .

[0077] Quantum hash functions It is an improved hash function that can efficiently process input data and output a hash value of fixed length, which is used to initialize the state of the encryption algorithm.

[0078] After the quantum initialization vector data is generated, each block of data is encrypted in combination with a symmetric encryption algorithm (such as AES-256-GCM). The encryption process uses the quantum initialization vector As part of the encryption key, the encryption result of each block is ensured to be unique and secure.

[0079] By combining quantum initialization vector data generated by global random number data and hardware noise data, the present invention ensures the unpredictability of the block encryption process and effectively prevents known plaintext attacks and repeated attacks.

[0080] The block encryption design ensures that even if some blocks are lost or damaged during transmission, it will not affect the encryption and decryption operations of other blocks, thereby enhancing the reliability of the communication system.

[0081] The dynamic generation of quantum initialization vector data makes the encryption result completely different each time, even if the original encrypted data is the same. This feature further improves the security of encrypted communications.

[0082] In this embodiment, it is assumed that the original communication data The length is 1024 bytes, the block size is 256 bytes, and the total number of blocks is The global random number data and hardware noise data are sampled as follows: Global random number data ; Hardware Noise Data .

[0083] The generation process of quantum initialization vector data is as follows: Calculate the quantum initialization vector data input value according to the formula:

[0084] Applying quantum hash functions :

[0085] Assume that the quantum hash function outputs a fixed-length vector .

[0086] use Use the AES-256-GCM algorithm to encrypt each block of data: Encrypted into ciphertext Finally, the ciphertext of each block is generated independently, ensuring the security isolation between blocks and the uniqueness of the encryption result.

[0087] Preferably, the process of generating the quantum initialization vector data further includes: preprocessing the hardware noise data, wherein the preprocessing includes denoising and quantization processing.

[0088] Hardware noise data comes from the hardware devices of edge nodes (such as sensors, oscillators, or other physical noise sources). Due to hardware characteristics, different devices will generate uneven noise signals, which may be mixed with environmental noise or systematic deviations. The core of the denoising process is to retain the randomness of hardware noise data while removing interference signals that may affect randomness or introduce deviations.

[0089] A high-pass filter is used to remove low-frequency system noise and retain high-frequency random noise signals. The specific process includes Fourier transforming the hardware noise data and separating the noise frequency components.

[0090] After frequency domain analysis, a bandpass filter is designed to retain only the random signal components within the frequency range, and the denoised signal is inverse Fourier transformed back to the time domain to obtain the purified hardware noise data.

[0091] In order to ensure that the hardware noise data can adapt to the digital computing environment, it needs to be quantized. The quantization process converts the continuous analog signal into a discrete digital signal while maintaining its randomness and unpredictability. The hardware noise signal is divided into multiple fixed intervals, each of which corresponds to a discrete value. The hardware noise data after denoising and quantization is combined with the global random number data to generate quantum initialization vector data.

[0092] The denoising process removes the interference components in the hardware noise signal, retains the high-frequency random characteristics, and ensures that the generated quantum initialization vector data is highly random and unpredictable.

[0093] Quantization processing discretizes the continuous hardware noise signal so that it can be effectively combined with the global random number data in the same digital computing environment, ensuring the consistency and accuracy of the generated initialization vector data.

[0094] The preprocessed hardware noise data introduces more sources of randomness in the initialization vector generation, further improving the uniqueness and anti-attack capabilities of the block cipher and preventing pattern-based attacks.

[0095] Preferably, the block encryption process includes: encrypting each block of block data by using the AES-256-GCM algorithm in combination with quantum initialization vector data to generate block encrypted data, and storing the dynamic session key data in pieces to multiple edge nodes by using a secret sharing algorithm, wherein the dynamic session key data is generated by the following formula:

[0096] in, Represents dynamic session key data; Represents the global random number data fragments; Represents the quantum initialization vector data fragments; Represents the total number of fragments of global random number data and quantum initialization vector data.

[0097] In the present invention, the block encryption process encrypts the block data by combining the AES-256-GCM algorithm with the quantum initialization vector data, and uses the dynamic session key data as an auxiliary key management mechanism to further enhance the security and flexibility of the system. The dynamic session key data is jointly generated by the global random number data and the quantum initialization vector data, and after sharding, it is distributed and stored in multiple edge nodes through the secret sharing algorithm to ensure the security and recoverability of the key.

[0098] Block encryption is the process of encrypting the original communication data block by block after it is divided into fixed block sizes. Each block of data is processed separately and encrypted using the AES-256-GCM algorithm combined with quantum initialization vector data, where the quantum initialization vector data As part of the encryption key, it ensures the independence and randomness of each encryption result. The AES-256-GCM algorithm has the following characteristics: Symmetric encryption: the same key is used for encryption and decryption; Authenticated encryption: GCM mode supports integrity verification to ensure that the block data has not been tampered with; High performance: Suitable for efficient processing requirements of edge computing environments.

[0099] For each block of data , the encryption formula is:

[0100] in, Indicates block encrypted data; Represents block data; Represents dynamic session key data; Represents quantum initialization vector data.

[0101] Dynamic session key data It is an important key generated in the block encryption process, which is calculated by the global random number data and the quantum initialization vector data. The specific generation formula is: This generation process ensures the uniqueness of the dynamic session key data, while making it more closely associated with the global random number and quantum initialization vector data, improving the key's ability to resist attacks.

[0102] The generated dynamic session key data is stored in shards through a secret sharing algorithm. The secret sharing algorithm is a secure distribution method that can split the key into Each piece is stored independently on different edge nodes, and the recovery threshold is set , just any The complete key can be restored from the shard key fragment. This shard storage mechanism has the following advantages: Security: Even if some nodes are compromised, the attacker still cannot obtain the complete key; Redundancy: When a node fails, the complete key can be restored through key fragments from other nodes. The sharding formula of the secret sharing algorithm is:

[0103] in, represents the key sharding function; Represents complete dynamic session key data; represents randomly generated polynomial coefficients; Indicates the key recovery threshold. Each node stores key fragments ,in is the node number.

[0104] Block encryption combines quantum initialization vector data and dynamic session key data to ensure that the encryption result is highly random and can effectively resist known plaintext attacks and pattern analysis attacks.

[0105] Dynamic session key data is dynamically generated through global random number data and quantum initialization vector data, and is stored in shards using a secret sharing algorithm, effectively preventing key leakage and enhancing the security of key management.

[0106] The block encryption design makes the encryption results of each block independent. Even if some block data is damaged or lost, other blocks can still be decrypted normally. Combined with the dynamic session key data stored in the shards, the system has strong fault tolerance for node failures or partial fragment loss.

[0107] In the embodiment, it is assumed that the original communication data is divided into blocks , the quantum initialization vector data is , the global random number data is , each block of data is 256 bytes in size.

[0108] Dynamic session key data is generated according to the formula:

[0109] Assumptions but:

[0110] Use the AES-256-GCM algorithm to encrypt each block of data:

[0111]

[0112]

[0113] Dynamic session key Divided into three fragments and stored in nodes through a secret sharing algorithm .For example: node storage ; node storage ; node storage .

[0114] Set threshold , any two pieces can recover the complete key.

[0115] Preferably, the process of storing dynamic session key data in fragments through a secret sharing algorithm includes: dividing the dynamic session key data into multiple key fragments, each key fragment is distributed and stored in a high-trust node according to a predetermined distribution rule, and based on a recovery threshold, it is limited that at least part of the key fragments can restore the complete dynamic session key data.

[0116] In the present invention, dynamic session key data is the core key information in the block encryption process. To ensure the security of the key and the fault tolerance of the system, the present invention uses a secret sharing algorithm to divide the dynamic session key data into multiple key fragments, and distributes and stores these fragments to different high-trust nodes through a predetermined allocation rule. At the same time, a recovery threshold is set to ensure that the complete dynamic session key data can still be restored in the event that some key fragments are lost. The specific principle is as follows: The secret sharing algorithm is a method to split the complete key into multiple parts, where each part is stored separately in different nodes. , you can get at least The process is based on the mathematical principle of polynomial interpolation.

[0117] Assume that the complete dynamic session key data is , using a randomly generated Polynomial :

[0118] in, Represents complete dynamic session key data; represents randomly generated polynomial coefficients; Indicates the recovery threshold.

[0119] for Highly trusted nodes, each node stores a key fragment ,in Is a unique identifier for the node.

[0120] The storage process of dynamic session key fragments is based on the trust weight of highly trusted nodes in the dynamic certificate chain data. Nodes with higher trust weights are given priority to store more important key fragments to reduce the risk of key leakage. For example, the trust weight is Node Store separately This allocation rule ensures the security of fragment storage.

[0121] To recover the complete dynamic session key data, at least The key fragment can be recovered using the Lagrange interpolation method:

[0122] in, Representation Node stored key fragments; Representation Node Identifier of the .

[0123] The keys are sharded and stored in multiple highly trusted nodes. Even if an attacker destroys some nodes, he cannot directly obtain the complete key, which improves overall security.

[0124] The secret sharing algorithm sets a recovery threshold , ensuring that the system can still recover the complete key when some nodes fail or key fragments are lost, thereby enhancing fault tolerance.

[0125] Dynamic session key fragments can be dynamically allocated to different nodes, and the introduction of trust weights makes the key storage strategy more intelligent and adaptable to the dynamic network environment of the edge computing gateway.

[0126] In the embodiment, it is assumed that the dynamic session key data is , set the recovery threshold , the number of participating nodes The randomly generated quadratic polynomial is:

[0127] right Each node calculates the key fragment: Node 1:

[0128] Node 2:

[0129] Node 3:

[0130] Node 4:

[0131] Node 5:

[0132] The key fragments are distributed to nodes 1-5, and the respective key fragments are stored.

[0133] If nodes 2, 4, and 5 fail, only the key fragments of nodes 1, 3, and 5 are still available, and the complete key is restored through Lagrange interpolation:

[0134] The final recovery result is .

[0135] The integrity of the signature encrypted data is verified based on the dynamic certificate chain data, the block encrypted data is decrypted to generate decrypted communication data, and subsequent communication parameters are adjusted according to the result of the decrypted communication data.

[0136] Preferably, verifying the integrity of the signed encrypted data based on the dynamic certificate chain data includes: extracting signature verification information and public key data from the dynamic certificate chain data, verifying the signed encrypted data using the extracted public key data, and verifying the integrity of the block encrypted data through an HMAC check value.

[0137] The dynamic certificate chain data is a trusted data chain generated by multiple highly trusted nodes, which records the signature information, public key data, trust relationship, etc. of each node. During the verification process, the signature verification information and public key data of the corresponding node are first extracted from the dynamic certificate chain data.

[0138] Signature verification information: records the hash summary used when generating the signature; Public key data: generated by an asymmetric key pair of a highly trusted node and used for signature verification.

[0139] The structured design of dynamic certificate chain data allows for fast indexing and efficient parsing. For example, the format of each block record is:

[0140] in, Represents a node identifier; Represents the public key data of the node; Indicates node signature information; Indicates the generation timestamp; Indicates the hash value of the previous block.

[0141] The first step in verifying signature encrypted data is to verify the signature using the extracted public key data. Signature encrypted data contains encrypted block data and its signature. The authenticity of the source and non-tampering of the data are confirmed by decrypting the signature and comparing the hash value. The verification process includes the following steps: Calculate the hash digest of the signed encrypted data: in Encrypt data for signature, is the calculated hash value.

[0142] Decrypt the signature using the extracted public key: ,in is the decrypted hash value.

[0143] Comparing two hash values and : If they are consistent, the signature verification is successful.

[0144] To further ensure the integrity of the block encrypted data, the present invention introduces an integrity verification mechanism based on the Hash Message Authentication Code (HMAC). The HMAC verification value is pre-generated during the encryption process and attached to the signed encrypted data. During verification, the HMAC value of the block data is recalculated and compared with the attached HMAC value. The HMAC calculation formula is:

[0145] in, Represents dynamic session key data; Indicates block encrypted data.

[0146] The dynamic certificate chain data verifies the signature and encrypted data to ensure that the data source is credible and has not been tampered with, thus ensuring the security of the communication process.

[0147] The real-time and updatability of dynamic certificate chain data enables the system to quickly adapt to node changes, improving the flexibility and robustness of the verification process.

[0148] Combined with the HMAC verification mechanism, the integrity of the block encrypted data is further ensured, effectively resisting data tampering and forgery attacks.

[0149] In the embodiment, it is assumed that in the edge computing environment, the latest block record of the dynamic certificate chain data is:

[0150] Signing encrypted data The structure is:

[0151] The verification process includes the following steps: (1) Extract the public key from the dynamic certificate chain data and signature .

[0152] (2) Calculate the hash summary of the signed encrypted data .

[0153] (3) Decrypt the signature using the extracted public key:

[0154] (4) Comparison and : If they are consistent, the signature verification is successful.

[0155] (5) Calculate the HMAC value of the block encrypted data:

[0156] (6) Comparison and additional : If they are consistent, the block encryption data integrity verification is passed.

[0157] Preferably, Figure 5 As shown, the process of adjusting subsequent communication parameters according to the results of decrypted communication data includes: generating optimized feedback data by analyzing the packet loss rate, communication delay and decryption success rate of the decrypted communication data, and dynamically adjusting the block data size, global random number generation path and dynamic key generation strategy based on the optimized feedback data.

[0158] The analysis of decrypted communication data is the basis for optimizing the generation of feedback data. The following is the specific analysis process: Packet loss rate: The packet loss rate is calculated by counting the difference between the number of packets received and the number of packets sent:

[0159] in, is the number of packets sent, is the number of packets received. A high packet loss rate may indicate that the current communication parameters need to be adjusted, such as reducing the chunk size to reduce the risk of loss.

[0160] Communication latency: Analyzes the time it takes for each block of data to be sent and successfully decrypted (including transmission time and decryption time). High latency may indicate a need to optimize the global random number generation path or dynamic key generation strategy.

[0161] Decryption success rate: The decryption success rate is calculated by comparing the number of successfully decrypted packets with the number of received packets:

[0162] A low decryption success rate may indicate that there are problems with the current dynamic key generation strategy and that it needs to be improved.

[0163] Based on the above performance indicators, optimization feedback data is generated through a weighted model:

[0164] in, Indicates optimization feedback data; Indicates the packet loss rate; Indicates communication delay; Indicates the decryption success rate; Represents the weight parameters that are dynamically adjusted according to different scenarios.

[0165] After the optimization feedback data is generated, the system dynamically adjusts the following communication parameters based on the feedback results: Chunk data size: Reduce the probability of data loss by reducing the chunk size while taking into account transmission efficiency. For example, if the packet loss rate exceeds a preset threshold (such as 10%), the chunk size is reduced from 256 bytes to 128 bytes.

[0166] Global random number generation path: Optimize the collaborative path for global random number generation by adjusting the priority of highly trusted nodes to reduce latency. For example, nodes with shorter response times are prioritized for global random number generation.

[0167] Dynamic key generation strategy: Make the key generation process more efficient by adjusting the parameter weights of the dynamic session key generation formula. For example, increase the weight associated with the quantum initialization vector data to improve the dynamics and randomness of key generation.

[0168] Dynamically adjusting the block size can effectively reduce data loss, and optimizing the global random number generation path can reduce communication delays and improve the overall efficiency of the system.

[0169] Improving the dynamic key generation strategy makes the key generation process more efficient and random, enhances the system's resistance to various attacks, and ensures the security of communication data.

[0170] The feedback-based dynamic adjustment mechanism can respond to changes in the communication environment (such as network fluctuations or node status changes) in real time, ensuring that the system is always in an optimized state and adapting to complex edge computing environments.

[0171] Example, assuming that in an edge computing environment, the statistical results of decrypted data during communication are as follows: Number of packets sent ; Number of packets received ; The number of packets successfully decrypted ; Average packet delay .

[0172] Calculate the performance indicators based on the above data: Packet loss rate:

[0173] Decryption success rate:

[0174] Optimize feedback data: Assume that the weight parameter is :

[0175] According to the optimization feedback data , the system adjusts the communication parameters: (1) Chunk data size: Reduce the chunk size from 256 bytes to 128 bytes to reduce packet loss.

[0176] (2) Global random number generation path: Reorder highly trusted nodes and give priority to nodes with response time less than 50ms to participate in random number generation.

[0177] (3) Dynamic key generation strategy: Increase the weight of quantum initialization vector data to make the key generation process more dynamic.

[0178] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware.

[0179] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol, characterized in that: The following steps are involved: Generate node feature data based on the hardware characteristics of edge nodes, generate dynamic certificate chain data through collaboration between edge nodes, and record the dynamic certificate chain data in the blockchain to form global trust data; Generate global random number data based on dynamic certificate chain data and chaotic mapping algorithm, and perform integrity check on the global random number data; The original communication data is encrypted in blocks in combination with the global random number data to generate block encrypted data, and the signature of the block encrypted data and the check value of the block encrypted data are added to form the signed encrypted data; The integrity of the signature encrypted data is verified based on the dynamic certificate chain data, the block encrypted data is decrypted to generate decrypted communication data, and subsequent communication parameters are adjusted according to the result of the decrypted communication data.

2. The certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol according to claim 1, characterized in that: The process of generating global random number data based on dynamic certificate chain data and chaotic mapping algorithm includes: processing the initial random number fragment data of the high-trust node by the enhanced chaotic mapping algorithm, combining the initial random number fragment data with the random number cooperative path data for multiple iterations to generate mixed random number data, and finally generating global random number data by combining the mixed random number data with the path hash of the dynamic certificate chain data; wherein, the enhanced chaotic mapping algorithm generates random number fragment data by the following formula: in, Indicates the random number fragment value of the current iteration; Indicates the collaboration path status value of the current iteration; Indicates the node status value of the current iteration; Represents parameters dynamically generated based on node feature data, used to control the dynamic changes of the mapping function.

3. The certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol according to claim 2, characterized in that: The enhanced chaos mapping algorithm processes high-trust nodes, including: sorting the high-trust nodes using the trust weights in the dynamic certificate chain data, and adjusting the initial state parameters of the enhanced chaos mapping algorithm based on the sorting results.

4. The certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol according to claim 1, characterized in that: The process of block-encrypting the original communication data in combination with the global random number data includes: generating block data by dividing the original communication data into blocks of fixed size, and generating quantum initialization vector data in combination with the global random number data and the hardware noise data, wherein the quantum initialization vector data is generated by the following formula: in, Represents quantum initialization vector data; represents a quantum hash function; Represents the global random number data fragments; The hardware noise data Sample values; Represents the total number of fragments for global random number data and hardware noise data.

5. The certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol according to claim 4, characterized in that: The process of generating the quantum initialization vector data further includes: preprocessing the hardware noise data, wherein the preprocessing includes denoising and quantization processing.

6. The certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol according to claim 1, characterized in that: The block encryption process includes: encrypting each block of block data by using the AES-256-GCM algorithm combined with quantum initialization vector data to generate block encrypted data, and storing the dynamic session key data in pieces to multiple edge nodes by using a secret sharing algorithm, wherein the dynamic session key data is generated by the following formula: in, Represents dynamic session key data; Represents the global random number data fragments; Represents the quantum initialization vector data fragments; Represents the total number of fragments of global random number data and quantum initialization vector data.

7. The certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol according to claim 6, characterized in that: The process of storing dynamic session key data in fragments through a secret sharing algorithm includes: dividing the dynamic session key data into multiple key fragments, distributing and storing each key fragment to a high-trust node according to a predetermined distribution rule, and limiting at least some of the key fragments to restore the complete dynamic session key data based on a recovery threshold.

8. The certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol according to claim 1, characterized in that: The verification of the integrity of the signature encrypted data based on the dynamic certificate chain data includes: extracting signature verification information and public key data from the dynamic certificate chain data, verifying the signature encrypted data using the extracted public key data, and verifying the integrity of the block encrypted data through an HMAC check value.

9. The certificate chain driven edge computing gateway trusted asymmetric encryption communication protocol according to claim 1, characterized in that: The process of adjusting subsequent communication parameters according to the results of decrypted communication data includes: generating optimized feedback data by analyzing the packet loss rate, communication delay and decryption success rate of the decrypted communication data, and dynamically adjusting the block data size, global random number generation path and dynamic key generation strategy based on the optimized feedback data.

Images