File transmission protection method, system and equipment based on multiple encryption algorithms

Abstract

The invention discloses a file transmission protection method, system and device based on multiple encryption algorithms, and relates to the technical field of information, and the method comprises the steps: selecting a target file needing to be transmitted, carrying out the preprocessing, and generating file fragments; analyzing the sensitivity of each file fragment, and performing hierarchical encryption processing to obtain an encrypted fragment set; selecting a steganography carrier file, and embedding the encrypted fragments into the carrier file to generate a steganography index table; generating a dynamic session key based on the confusion key pool, encrypting the steganographic file transmission layer and embedding a dynamic key generation parameter; the receiving end generates a session key according to the transmission message header, decrypts the transmission layer data, extracts the steganographic file and decrypts the steganographic file; recombining the decrypted and recovered fragmented data into a complete file according to an identifier sequence; by dynamically matching the steganography carrier file, the efficient embedding of the fragmented data and the generation of the steganography index table are realized, and the concealment and the adaptability in the transmission process are ensured.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a file transmission protection method, system and equipment based on multiple encryption algorithms. Background Art

[0002] With the development of information technology, the transmission of digital files has become an important part of daily work and life. However, during the transmission process, files are extremely vulnerable to security threats such as data leakage, tampering, and unauthorized access. At present, mainstream file transfer technologies mostly rely on a single encryption algorithm for protection. Although it ensures the security of data to a certain extent, it has shortcomings when processing highly sensitive data and is difficult to effectively resist complex attacks. In addition, the existing technology usually relies on the basic verification mechanism of the transmission protocol layer for integrity verification of file transmission, lacks targeted and multi-layer protection, especially in file segmentation processing and encryption protection, and often fails to combine the sensitivity of file content for dynamic encryption, making it difficult to balance transmission efficiency and security.

[0003] Existing file steganographic transmission technology mainly relies on a single carrier for data embedding, but it is difficult to embed efficiently when the data volume is large or the steganographic carrier does not match. At the same time, the dynamic key generation mechanism designed for the transmission of file steganographic data is relatively simple and easy to be predicted or cracked, resulting in a decrease in the security of the steganographic information. Therefore, how to combine multiple encryption algorithms, steganographic technology, dynamic key generation mechanism and integrity verification method in the file transmission process to build a secure, efficient and flexible file transmission protection system has become an urgent problem to be solved. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a file transmission protection method based on multiple encryption algorithms to solve the problems of insufficient data sensitivity identification, inflexible encryption protection and low efficiency of steganographic embedding during file transmission.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a file transmission protection method based on a multiple encryption algorithm, which includes selecting a target file to be transmitted and preprocessing it to generate file fragments;

[0008] Analyze the sensitivity of each file segment and perform layered encryption processing to obtain an encrypted segment set;

[0009] Select a steganographic carrier file, embed the encrypted fragment into the carrier file, and generate a steganographic index table;

[0010] Generate dynamic session keys based on the obfuscated key pool, encrypt the steganographic file transport layer and embed dynamic key generation parameters;

[0011] The receiving end generates a session key based on the transmission message header, decrypts the transport layer data, extracts the steganographic file, and decrypts it;

[0012] The decrypted and restored fragmented data is reassembled into a complete file in the order of identifiers, and the integrity check is performed to verify whether the file is damaged to obtain the verification result.

[0013] As a preferred solution of the file transmission protection method based on multiple encryption algorithms described in the present invention, wherein: selecting the target file to be transmitted and preprocessing it, generating file fragments includes the following steps:

[0014] The user selects the target file to be transferred and performs format verification on the target file to determine whether it belongs to the set of supported file types;

[0015] Detect the size of the target file based on the format verification result;

[0016] For detected oversized files, split them into pieces according to fixed sizes and determine the total number of pieces required;

[0017] According to the determined total number of shards, extract data fragments from the file in order to generate a shard set;

[0018] Assign a unique identifier to each shard in a sharded collection and record the shard order and size.

[0019] As a preferred solution of the file transmission protection method based on multiple encryption algorithms described in the present invention, wherein: analyzing the sensitivity of each file segment and performing layered encryption processing to obtain an encrypted segment set includes the following steps:

[0020] Load the sensitive keyword list and user-configured sensitivity level threshold S from the sensitivity rule database th ;

[0021] Perform keyword matching and context analysis on the content of each shard in the shard set and calculate the sensitivity score of the shard. The expression is:

[0022]

[0023] Among them, S[i] represents the sensitivity score of the i-th shard, i represents the shard index, j represents the sensitive keyword index, m represents the total number of sensitive keywords, and w j represents the weight of the jth sensitive keyword, A[i] represents the total number of bytes of the i-th fragment, O j(A[i] represents the number of times the jth sensitive keyword appears in the i-th fragment;

[0024] According to the sensitivity score, the fragments are classified;

[0025] When S[i]≥S th When S[i] th When , mark the shard as a low-sensitivity shard;

[0026] For shards marked as highly sensitive, double encryption is performed using the elliptic curve cryptography algorithm and the AES-256 symmetric encryption method;

[0027] For shards marked as low sensitivity, single-layer encryption is performed using AES-128 symmetric encryption;

[0028] The encrypted high-sensitivity shards and low-sensitivity shards are packaged, and encryption tags and shard metadata information are added to each encrypted shard to obtain an encrypted shard set.

[0029] As a preferred solution of the file transmission protection method based on multiple encryption algorithms described in the present invention, wherein: selecting a steganographic carrier file, embedding the encrypted fragments into the carrier file, and generating a steganographic index table include the following steps:

[0030] Load the steganographic carrier file library, extract the metadata of each file in the carrier file library, and generate a carrier information table;

[0031] Extracting the size of each encrypted slice from the encrypted slice set, and dynamically matching the carrier file in the carrier information table for each encrypted slice according to the carrier allocation rule;

[0032] For each encrypted segment and its matching carrier file, a steganographic algorithm is used to embed the encrypted segment into a specific position of the carrier file;

[0033] After the steganography is completed, a steganalysis index table is generated for each embedded fragment.

[0034] As a preferred solution of the file transmission protection method based on multiple encryption algorithms described in the present invention, wherein: generating a dynamic session key based on an obfuscated key pool, encrypting the steganographic file transmission layer and embedding the dynamic key generation parameter includes the following steps:

[0035] Obtain the current timestamp and the user's dynamic operation mode, and generate a unique device fingerprint identifier based on the hardware characteristics of the sending device;

[0036] ​The hash function and encryption algorithm are used to confuse the current timestamp, the user's dynamic operation mode and the generated unique device fingerprint identifier to generate a dynamic key seed, which is expressed as:

[0037] Seed key =HMAC-SHA256(T current ||F device ||B user ,K static );

[0038] Among them, Seed key represents the dynamic key seed, T current Indicates the current timestamp, B user represents the user's dynamic operation mode, F device represents the fingerprint identifier of a unique device, HMAC represents a hash-based message authentication code, SHA256 represents mapping input data of any length to a fixed-length 256-bit output value, and K static Represents a secure static root key;

[0039] A key derivation function is used to extract a pseudo-random key from a dynamic key seed. The expression is:

[0040] PRK=HMAC-SHA256(Seed key ,K static );

[0041] Wherein, PRK represents a pseudo-random key;

[0042] Convert the pseudo-random key to a dynamic session key of the required length using the expression:

[0043] K session =HKDF-Expand(PRK,info,L);

[0044] Among them, K session represents a dynamic session key, HKDF-Expand represents the generation of a key of the required length from a pseudo-random key, info represents optional context information, and L represents the required length of the session key;

[0045] Initiate a transport layer encryption session, use the generated dynamic session key to transmit and encrypt the steganographic file in the steganographic index table through the transport layer encryption channel;

[0046] During the transmission process, the dynamic key seed in the dynamic key is embedded in each transmission header.

[0047] As a preferred solution of the file transmission protection method based on multiple encryption algorithms described in the present invention, the receiving end generates a session key according to the transmission message header, decrypts the transmission layer data to extract the steganographic file and decrypts it, including the following steps:

[0048] After receiving the encrypted steganographic file, the receiver parses the dynamic key seed in the transmission message header and generates a dynamic session key through the same logic and key pool as the sender;

[0049] Use the generated dynamic session key to decrypt the encrypted transport layer data and extract the steganographic file;

[0050] Extracting the embedded stego index table from the decrypted stego file, and loading the corresponding stego carrier file according to the stego index table, and extracting the metadata of the carrier file from the stego carrier file;

[0051] Extract the slice data from the pixel data using the least significant bit de-embedding algorithm;

[0052] Extract the slice data from the frequency domain coefficients through the inverse discrete cosine transform algorithm;

[0053] Use the shard identifier to verify that the extracted shard data is complete and correct;

[0054] According to the sensitivity mark of the shard, select the corresponding decryption algorithm and decrypt the shard data one by one;

[0055] Compare the decrypted shard data with the shard identifier to verify the integrity of the decrypted data.

[0056] As a preferred solution of the file transmission protection method based on multiple encryption algorithms described in the present invention, the decrypted and restored fragmented data is reassembled into a complete file according to the identifier sequence, and the integrity check is performed to verify whether the file is damaged, and obtaining the check result includes the following steps:

[0057] Extract all shard data from the decrypted shard data and sort them in ascending order using the quick sort algorithm;

[0058] Create a file buffer and write the sorted shard data into the buffer in sequence to obtain the reorganized file;

[0059] Use the SHA-256 algorithm to perform hash calculation on the buffer of the reassembled file to generate a checksum of the complete file;

[0060] Compare the generated complete file checksum with the original file checksum to obtain a checksum result;

[0061] When the verification passes, the reorganized file buffer is written to the disk to generate the final original file;

[0062] When the verification fails, an error message is returned and the user is prompted to retransmit the relevant fragments.

[0063] In a second aspect, the present invention provides a file transmission protection system based on multiple encryption algorithms, comprising:

[0064] The file preprocessing module selects the target files to be transferred and performs preprocessing to generate file fragments;

[0065] The shard encryption module analyzes the sensitivity of each file shard and performs layered encryption processing to obtain an encrypted shard set;

[0066] The steganographic embedding module selects a steganographic carrier file, embeds the encrypted fragment into the carrier file, and generates a steganographic index table;

[0067] The key generation module generates dynamic session keys based on the obfuscated key pool, encrypts the steganographic file transport layer and embeds dynamic key generation parameters;

[0068] Decryption and extraction module: the receiving end generates a session key based on the transmission message header, decrypts the transport layer data, extracts the steganographic file and decrypts it;

[0069] The file reorganization module reorganizes the decrypted and restored fragmented data into a complete file according to the identifier sequence, and verifies whether the file is damaged through integrity verification to obtain the verification result.

[0070] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the file transfer protection method based on multiple encryption algorithms as described in the first aspect of the present invention.

[0071] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the file transfer protection method based on multiple encryption algorithms as described in the first aspect of the present invention.

[0072] The beneficial effects of the present invention are as follows: by format verification and size detection, the standardization of the transmitted file is ensured, and the super-large file is processed by fragmentation, thereby enhancing the support capability for large-scale files; by utilizing the sensitivity analysis mechanism, dynamic hierarchical encryption is performed on the fragment content, thereby optimizing the encryption efficiency while improving security; by dynamically matching the steganographic carrier file, efficient embedding of the fragmented data and generation of the steganographic index table are realized, thereby ensuring the concealment and adaptability during the transmission process; by adopting an obfuscated key pool to generate a dynamic session key, and dynamically embedding the key generation parameters, thereby enhancing the randomness and anti-attack capability of the session key; by utilizing the dynamic key to restore the steganographic file and extract the fragmented data, and by selecting the corresponding decryption algorithm through the sensitivity tag, thereby ensuring the efficiency and accuracy of data decryption; by quickly sorting and reorganizing the fragmented data, it is verified whether the file has been tampered with or lost, thereby ensuring the integrity and reliability of the transmitted file. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0074] Figure 1 This is a flowchart of the file transmission protection method based on multiple encryption algorithms in Example 1.

[0075] Figure 2 This is a schematic diagram of the layered encryption processing in Example 1. DETAILED DESCRIPTION

[0076] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0077] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0078] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0079] Example 1, reference Figure 1 and Figure 2, which is the first embodiment of the present invention, provides a file transmission protection method based on multiple encryption algorithms, comprising the following steps:

[0080] S1. Select the target file to be transferred and pre-process it to generate file segments.

[0081] S1.1. The user selects the target file to be transferred and performs a format check on the target file to determine whether it belongs to the set of supported file types.

[0082] Specifically, file format verification refers to detecting whether the file format is legal. The format verification is performed by reading the file header identifier. If the file format is not supported, an error message is returned and the operation is terminated; if the file format is legal, the next step of processing is entered.

[0083] S1.2. Detect the size of the target file based on the format verification result.

[0084] Specifically, file size detection refers to reading the size of the file, setting a size threshold, and determining whether the file size is greater than the threshold. If the file size is less than or equal to the size threshold, no fragmentation is required and the encryption process of the next step is directly entered; if the file size is greater than the size threshold, the fragmentation processing process is entered.

[0085] S1.3. For the detected oversized files, fragment them according to fixed sizes and determine the total number of fragments required.

[0086] Specifically, the total number of shards is based on the ratio of the total number of bytes of the file to a single shard, and the size of the ratio is rounded up.

[0087] S1.4. According to the determined total number of shards, extract the data fragments from the file in order to generate a shard set; assign a unique identifier to each shard in the shard set, and record the shard order and size.

[0088] Specifically, the identifier is generated by calculating the hash value of the shard content to generate a unique identifier. The SHA-256 algorithm is used to calculate the hash value of each shard. The output of the SHA-256 algorithm is a fixed 256-bit (32-byte) string. The content of each shard is different and its hash value is unique.

[0089] S2. Analyze the sensitivity of each file shard and perform layered encryption processing to obtain an encrypted shard set.

[0090] Load the sensitive keyword list and user-configured sensitivity level threshold S from the sensitivity rule database th ; Perform keyword matching and context analysis on the content of each shard in the shard set, and calculate the sensitivity score of the shard. The expression is:

[0091]

[0092] Among them, S[i] represents the sensitivity score of the i-th shard. The higher the score, the more sensitive the shard is and the stricter the encryption protection is. i represents the shard index, j represents the sensitive keyword index, m represents the total number of sensitive keywords, and w represents the total number of sensitive keywords. j represents the weight of the jth sensitive keyword, A[i] represents the total number of bytes of the i-th fragment, O j (A[i] represents the number of times the jth sensitive keyword appears in the i-th shard, which is used to count the actual frequency of each keyword in the shard. The more times it appears, the higher the contribution of the keyword to the shard sensitivity score;

[0093] According to the sensitivity score, the fragments are classified; when S[i]≥S th When S[i] th When the shard is marked as a low-sensitivity shard, the shard marked as high-sensitivity is double-encrypted using the elliptic curve encryption algorithm and the AES-256 symmetric encryption method; the shard marked as low-sensitivity is single-layer encrypted using the AES-128 symmetric encryption method; the encrypted high-sensitivity shards and low-sensitivity shards are packaged, and an encryption tag and shard metadata information are added to each encrypted shard to obtain an encrypted shard set.

[0094] S3. Select a steganographic carrier file, embed the encrypted fragment into the carrier file, and generate a steganographic index table.

[0095] S3.1. Load the steganographic carrier file library, extract the metadata of each file in the carrier file library, and generate a carrier information table.

[0096] Specifically, the steganographic carrier file library includes picture files, audio files and video files.

[0097] Image files (such as JPEG, PNG): suitable for pixel-level embedding and support LSB steganography algorithm.

[0098] Audio files (such as MP3, WAV): suitable for frequency domain embedding, such as modifying low-frequency coefficients.

[0099] Video files (such as MP4, AVI): suitable for intra-frame embedding, supporting DCT or motion vector modification.

[0100] Metadata includes file name, file type, and embeddable capacity.

[0101] S3.2. Extract the size of each encrypted slice from the encrypted slice set, and dynamically match the carrier file in the carrier information table for each encrypted slice according to the carrier allocation rule.​

[0102] Specifically, the operation of dynamically matching the carrier file in the carrier information table for each encrypted slice according to the carrier allocation rule is as follows:

[0103] When the encrypted slice size is less than or equal to the embeddable capacity in the carrier file, the carrier is directly allocated; when the encrypted slice size is larger than the embeddable capacity in the carrier file, the encrypted slice is split into multiple sub-slices, and the size of each sub-slice does not exceed the capacity of a single carrier.

[0104] S3.3. For each encrypted slice and its assigned carrier file, a steganographic algorithm is used to embed the encrypted slice into a specific position of the carrier file; after the steganography is completed, a steganographic index table is generated for each embedded slice.

[0105] Specifically, the steganographic algorithms include an LSB (least significant bit) steganographic algorithm applicable to picture carriers and a DCT (discrete cosine transform) steganographic algorithm applicable to audio / video carriers.

[0106] The LSB (Least Significant Bit) steganographic algorithm embeds data by modifying the least significant bit of the image pixel. The change is small and imperceptible to the naked eye. The specific embedding steps are:

[0107] Read the slice data and convert it into a bit stream; read the allocated image carrier, extract its pixel data, embed the bit stream into the least significant bit of the pixel in sequence, embed the kth pixel, and get the embedded pixel value, which is expressed as:

[0108] P k =(P k &254)|b;

[0109] Among them, P' k represents the k-th pixel value after embedding, P k represents the k-th pixel value before embedding, b represents a bit in the bitstream to be embedded, k represents the index number of the pixel, and & represents a bitwise operation.

[0110] The DCT (Discrete Cosine Transform) steganography algorithm embeds data by modifying the frequency domain coefficients of the carrier, usually performing a transformation operation on audio or video frames. The embedding steps are as follows:

[0111] For the encrypted fragment, convert it into a bit stream, extract the frame data of the fragmented audio / video carrier and perform discrete cosine transform. The expression is:

[0112]

[0113] Among them, F(u,v) represents the coefficient at a specific position (u,v) in the frequency domain. The frequency domain coefficient is used to represent the component strength of the original data at different frequencies. Steganography embeds by modifying the low-frequency coefficients (usually the part with the largest energy), which can not only maintain data integrity but also reduce the perceptibility of embedding. u represents the frequency component in the horizontal frequency direction, v represents the component in the vertical frequency direction, N represents the total number of pixels in the horizontal direction, M represents the total number of pixels in the vertical direction, x represents the pixel index in the horizontal direction, y represents the pixel index in the vertical direction, and f(x,y) represents the original value of the pixel (x,y) in the time domain.

[0114] S4. Generate a dynamic session key based on the obfuscated key pool, encrypt the steganographic file transport layer and embed the dynamic key generation parameters.

[0115] The current timestamp and the user's dynamic operation mode are obtained, and a unique device fingerprint identifier is generated based on the hardware characteristics of the sending device; the hash function and encryption algorithm are used to confuse the obtained current timestamp, the user's dynamic operation mode and the generated unique device fingerprint identifier to generate a dynamic key seed, which is expressed as:

[0116] Seed key =HMAC-SHA256(T current ||F device ||B user ,K static );

[0117] Among them, Seed key represents the dynamic key seed, T current Indicates the current timestamp, B user represents the user's dynamic operation mode, F device represents the fingerprint identifier of a unique device, HMAC represents a hash-based message authentication code, SHA256 represents mapping input data of any length to a fixed-length 256-bit output value, and K static Represents a secure static root key, stored at the sender and receiver, used as the key for HMAC;

[0118] A key derivation function is used to extract a pseudo-random key from a dynamic key seed. The expression is:

[0119] PRK = HMAC-SHA256 (Seed key ,K static );

[0120] Wherein, PRK represents a pseudo-random key;

[0121] Convert the pseudo-random key to a dynamic session key of the required length using the expression:

[0122] K session =HKDF-Expand(PRK,info,L);

[0123] Among them, K session Indicates a dynamic session key, HKDF-Expand indicates that a key of the required length is generated from a pseudo-random key, info indicates optional context information used to mark the purpose of the session key, and L indicates the required length of the session key;

[0124] Start a transport layer encryption session, use the generated dynamic session key to transmit and encrypt the steganographic file in the steganographic index table through the transport layer encryption channel; during the transmission process, embed the dynamic key seed in the dynamic key in each transmission header.

[0125] S5. The receiving end generates a session key based on the transmission message header, decrypts the transport layer data, extracts the steganographic file, and decrypts it.

[0126] After receiving the encrypted stego file, the receiving end parses the dynamic key seed in the transmission message header and generates a dynamic session key through the logic and key pool consistent with the sending end; uses the generated dynamic session key to decrypt the encrypted transport layer data and extract the stego file; extracts the embedded stego index table from the decrypted stego file, and loads the corresponding stego carrier file according to the stego index table, and extracts the metadata of the carrier file from the stego carrier file; uses the least significant bit de-embedding algorithm to extract the slice data from the pixel data; uses the inverse discrete cosine transform algorithm to extract the slice data from the frequency domain coefficients; uses the slice identifier to verify whether the extracted slice data is complete and correct; selects the corresponding decryption algorithm according to the sensitivity mark of the slice, and decrypts the slice data one by one; compares the decrypted slice data with the slice identifier to verify the integrity of the decrypted data.

[0127] S6. The decrypted and restored fragmented data is reassembled into a complete file according to the sequence of identifiers, and integrity verification is performed to verify whether the file is damaged to obtain a verification result.

[0128] Extract all the shard data from the decrypted shard data, and sort them in ascending order using the quick sort algorithm; create a file buffer, write the sorted shard data into the buffer in sequence, and obtain the reorganized file; use the SHA-256 algorithm to perform hash calculation on the buffer of the reorganized file to generate a checksum value for the complete file; compare the generated checksum value for the complete file with the checksum value for the original file to obtain the checksum result; when the checksum passes, write the reorganized file buffer to the disk to generate the final original file; when the checksum fails, return an error message and prompt the user to retransmit the relevant shards.

[0129] This embodiment also provides a file transmission protection system based on multiple encryption algorithms, including:

[0130] The file preprocessing module selects the target file to be transmitted and performs preprocessing to generate file fragments; the fragment encryption module analyzes the sensitivity of each file fragment and performs layered encryption processing to obtain a set of encrypted fragments; the steganalysis embedding module selects a steganalysis carrier file, embeds the encrypted fragments into the carrier file, and generates a steganalysis index table; the key generation module generates a dynamic session key based on the obfuscation key pool, encrypts the steganalysis file transmission layer and embeds the dynamic key generation parameters; the decryption and extraction module, the receiving end generates a session key according to the transmission message header, decrypts the transmission layer data to extract the steganalysis file and decrypts it; the file reorganization module reorganizes the decrypted and recovered fragment data into a complete file in the order of identifiers, and verifies whether the file is damaged through integrity verification to obtain the verification result.

[0131] This embodiment also provides a computer device, which is suitable for the case of a file transmission protection method based on multiple encryption algorithms, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the file transmission protection method based on multiple encryption algorithms proposed in the above embodiment.

[0132] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0133] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the file transmission protection method based on multiple encryption algorithms proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0134] In summary, the present invention ensures the standardization of the transmitted files through format verification and size detection, and performs fragmentation processing on super large files, thereby enhancing the support capability for large-scale files; utilizes the sensitivity analysis mechanism to perform dynamic hierarchical encryption on the fragmented content, thereby optimizing the encryption efficiency while improving security; realizes efficient embedding of fragmented data and generation of steganalysis index tables by dynamically matching steganalysis carrier files, thereby ensuring the concealment and adaptability during the transmission process; adopts an obfuscated key pool to generate dynamic session keys, and dynamically embeds key generation parameters, thereby enhancing the randomness and anti-attack capability of session keys; utilizes dynamic keys to restore steganalysis files and extract fragmented data, and selects corresponding decryption algorithms through sensitivity tags, thereby ensuring the efficiency and accuracy of data decryption; verifies whether files have been tampered with or lost by quickly sorting and reorganizing fragmented data, thereby ensuring the integrity and reliability of transmitted files.

[0135] Example 2, referring to Table 1, is the second example of the present invention. To further verify the technical solution of the present invention, experimental simulation data of a file transmission protection method based on multiple encryption algorithms are provided.

[0136] In order to verify the effectiveness of the file transfer protection method of the present invention, a target test file (size 45MB, format PDF, named test_file.pdf) was selected as the test object to conduct a simulation experiment of the file transfer process. The experiment was carried out from six steps: file preprocessing, fragmentation, encryption, steganography, transmission to data recovery and integrity verification.

[0137] First, the test performed a format check on the file. The file header information was identified as PDF format, which met the supported file type set and entered the file size detection phase. According to the set fragmentation threshold (10MB), the file size exceeded the threshold, so fragmentation was required. Through calculation, test_file.pdf was divided into 5 fragments (each fragment was 10MB, and the size of the last fragment was 5MB). Subsequently, the SHA-256 algorithm was used to calculate a unique identifier for each fragment, and the fragmentation order and size information were recorded to generate a fragmentation set, as shown in Table 1 below:

[0138] Table 1 Shard collection data table

[0139]

[0140] Then, a sensitivity analysis is performed on each shard in the shard set. Based on the sensitive keyword list (such as "confidential", "secret", etc.) and the user-configured sensitivity level threshold (S th ), and calculate the sensitivity score for each shard. In the experiment, the shard sensitivity score ranged from 0.2 to 0.8, of which three shards with scores greater than 0.6 were marked as high-sensitivity shards and used elliptic curve encryption and AES-256 double encryption; the remaining two low-sensitivity shards used AES-128 single-layer encryption, as shown in Table 2 below:

[0141] Table 2 Sensitivity results

[0142]

[0143]

[0144] The expression of sensitivity score is:

[0145]

[0146] The experimental data are set as follows:

[0147] Shard information:

[0148] Shard size: Each shard is 10MB in size (the last shard is 5MB).

[0149] Convert to bytes:

[0150] Each 10MB fragment: 10×1024×1024=10,485,760 bytes

[0151] The fifth fragment: 5 × 1024 × 1024 = 5,242,880 bytes

[0152] Sensitive keyword list:

[0153] Keywords: ["confidential","secret","classified","private"]

[0154] Weight (w): [0.4, 0.3, 0.2, 0.1] (set according to keyword sensitivity)

[0155] The number of times the keyword appears in the fragment content (O j ):

[0156] Assume that the number of occurrences of sensitive keywords contained in each shard content is as follows:

[0157] Shard number confidential secret classified private 1 12 8 5 3 2 5 4 8 1 3 15 12 8 6 4 10 8 6 4 5 3 2 1 1

[0158] Taking shard 1 as an example, the calculation process is as follows:

[0159]

[0160] The rest are calculated in the same way as shard 1 to get the final result.

[0161] Load the stego carrier file library and dynamically match the appropriate carrier file according to the size of each fragment. In the experiment, 2 fragments are embedded in the JPEG image carrier and 3 fragments are embedded in the MP3 audio carrier. The LSB steganography algorithm is used to embed the image carrier and the DCT steganography algorithm is used to embed the audio carrier. Finally, a stego index table is generated to record the embedded information. In the transmission stage, a dynamic session key is generated based on the obfuscated key pool. The HMAC-SHA256 algorithm is used to generate a dynamic key seed, which is further derived into a dynamic session key. The stego file and the stego index table are transmitted to the receiving end through the TLS encryption layer, and the dynamic key generation parameters are embedded in the message header. The receiving end parses the dynamic key seed in the transmission message header, generates a dynamic session key, decrypts the transmission layer data to extract the stego file and the stego index table. The encrypted fragments are extracted from the carrier file through the LSB and DCT de-embedding algorithms, and decrypted according to the fragment metadata information. Finally, the quick sort algorithm is used to reorganize the complete file according to the fragment identifier order, and the SHA-256 hash value is used to verify the integrity and verify the consistency of the reorganized file with the original file. The experimental results show that the file was successfully recovered and the data was intact, as shown in Table 3 below:

[0162] Table 1 Steganographic embedding and transmission process records

[0163]

[0164]

[0165] From the above table, we can know that the steganographic embedding success rate is: 100% (all fragments are successfully embedded in the carrier); the extraction success rate is: 80% (4 out of 5 fragments are successfully extracted, and 1 of them is partially successful); the integrity check pass rate is: 60% (the reorganized data of 3 fragments is consistent with the original data).

[0166] Fetching failed for shard 2:

[0167] You can try to retransmit the segment or recover the lost data through redundant coding.

[0168] Part 3 of the fragment was extracted successfully:

[0169] The shard metadata information and error recovery algorithm can be combined to try to repair some of the lost steganographic data.

[0170] Overall file recovery:

[0171] Since some shard data is incomplete, the final file may require manual intervention or retransmission of some data to complete recovery.

[0172] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A file transmission protection method based on multiple encryption algorithms, characterized in that: include, Select the target file to be transferred and pre-process it to generate file segments; Analyze the sensitivity of each file segment and perform layered encryption processing to obtain an encrypted segment set; Select a steganographic carrier file, embed the encrypted fragment into the carrier file, and generate a steganographic index table; Generate dynamic session keys based on the obfuscated key pool, encrypt the steganographic file transport layer and embed dynamic key generation parameters; The receiving end generates a session key based on the transmission message header, decrypts the transport layer data, extracts the steganographic file, and decrypts it; The decrypted and restored fragmented data is reassembled into a complete file in the order of identifiers, and the integrity check is performed to verify whether the file is damaged to obtain the verification result.

2. The file transmission protection method based on multiple encryption algorithms as claimed in claim 1, characterized in that: Select the target file to be transferred and pre-process it. Generating file fragments includes the following steps: The user selects the target file to be transferred and performs format verification on the target file to determine whether it belongs to the set of supported file types; Detect the size of the target file based on the format verification result; For detected oversized files, split them into pieces according to fixed sizes and determine the total number of pieces required; According to the determined total number of shards, extract data fragments from the file in order to generate a shard set; Assign a unique identifier to each shard in a sharded collection and record the shard order and size.

3. The file transmission protection method based on multiple encryption algorithms as claimed in claim 2, characterized in that: Analyze the sensitivity of each file segment and perform layered encryption processing to obtain an encrypted segment set, including the following steps: Load the sensitive keyword list and user-configured sensitivity level threshold S from the sensitivity rule database th ; Perform keyword matching and context analysis on the content of each shard in the shard set and calculate the sensitivity score of the shard. The expression is: Among them, S[i] represents the sensitivity score of the i-th shard, i represents the shard index, j represents the sensitive keyword index, m represents the total number of sensitive keywords, and w j represents the weight of the jth sensitive keyword, A[i] represents the total number of bytes of the i-th fragment, O j (A[i] represents the number of times the jth sensitive keyword appears in the i-th fragment; According to the sensitivity score, the fragments are classified; When S[i]≥S th When S[i] th When , mark the shard as a low-sensitivity shard;​ For shards marked as highly sensitive, double encryption is performed using the elliptic curve cryptography algorithm and the AES-256 symmetric encryption method; For shards marked as low sensitivity, single-layer encryption is performed using AES-128 symmetric encryption; The encrypted high-sensitivity shards and low-sensitivity shards are packaged, and encryption tags and shard metadata information are added to each encrypted shard to obtain an encrypted shard set.

4. The file transmission protection method based on multiple encryption algorithms as claimed in claim 3, characterized in that: Select the steganographic carrier file, embed the encrypted fragment into the carrier file, and generate the steganographic index table The following steps are included: Load the steganographic carrier file library, extract the metadata of each file in the carrier file library, and generate a carrier information table; Extracting the size of each encrypted slice from the encrypted slice set, and dynamically matching the carrier file in the carrier information table for each encrypted slice according to the carrier allocation rule; For each encrypted segment and its matching carrier file, a steganographic algorithm is used to embed the encrypted segment into a specific position of the carrier file; After the steganography is completed, a steganalysis index table is generated for each embedded fragment.

5. The file transmission protection method based on multiple encryption algorithms as claimed in claim 4, characterized in that: Generating dynamic session keys based on the obfuscated key pool, encrypting the steganographic file transport layer and embedding dynamic key generation parameters includes the following steps: Obtain the current timestamp and the user's dynamic operation mode, and generate a unique device fingerprint identifier based on the hardware characteristics of the sending device; The hash function and encryption algorithm are used to confuse the current timestamp, the user's dynamic operation mode and the generated unique device fingerprint identifier to generate a dynamic key seed, which is expressed as: Seed key =HMAC-SHA256(T current ||F device ||B user ,K static ); Among them, Seed key represents the dynamic key seed, T current Indicates the current timestamp, B user represents the user's dynamic operation mode, F device represents the fingerprint identifier of a unique device, HMAC represents a hash-based message authentication code, SHA256 represents mapping input data of any length to a fixed-length 256-bit output value, and K static Represents a secure static root key; A key derivation function is used to extract a pseudo-random key from a dynamic key seed. The expression is: PRK=HMAC-SHA256(Seed key ,K static ); Wherein, PRK represents a pseudo-random key; Convert the pseudo-random key to a dynamic session key of the required length using the expression: K session =HKDF-Expand(PRK,info,L); Among them, K session represents a dynamic session key, HKDF-Expand represents the generation of a key of the required length from a pseudo-random key, info represents optional context information, and L represents the required length of the session key; Initiate a transport layer encryption session, use the generated dynamic session key to transmit and encrypt the steganographic file in the steganographic index table through the transport layer encryption channel; During the transmission process, the dynamic key seed in the dynamic key is embedded in each transmission header.

6. The file transmission protection method based on multiple encryption algorithms as claimed in claim 5, characterized in that: The receiving end generates a session key based on the transmission message header, decrypts the transport layer data to extract the steganographic file and decrypts it, including the following steps: After receiving the encrypted steganographic file, the receiver parses the dynamic key seed in the transmission message header and generates a dynamic session key through the same logic and key pool as the sender; Use the generated dynamic session key to decrypt the encrypted transport layer data and extract the steganographic file; Extracting the embedded stego index table from the decrypted stego file, and loading the corresponding stego carrier file according to the stego index table, and extracting the metadata of the carrier file from the stego carrier file; Extract the slice data from the pixel data using the least significant bit de-embedding algorithm; Extract the slice data from the frequency domain coefficients through the inverse discrete cosine transform algorithm; According to the sensitivity mark of the shard, select the corresponding decryption algorithm and decrypt the shard data one by one; Compare the decrypted shard data with the shard identifier to verify the integrity of the decrypted data.

7. The file transmission protection method based on multiple encryption algorithms as claimed in claim 6, characterized in that: The decrypted and recovered fragmented data is reassembled into a complete file according to the identifier sequence, and the integrity check is performed to verify whether the file is damaged. Obtaining the check result includes the following steps: Extract all shard data from the decrypted shard data and sort them in ascending order using the quick sort algorithm; Create a file buffer and write the sorted shard data into the buffer in sequence to obtain the reorganized file; Use the SHA-256 algorithm to perform hash calculation on the buffer of the reassembled file to generate a checksum of the complete file; Compare the generated complete file checksum with the original file checksum to obtain a checksum result; When the verification passes, the reorganized file buffer is written to the disk to generate the final original file; When the verification fails, an error message is returned and the user is prompted to retransmit the relevant fragments.

8. A file transmission protection system based on multiple encryption algorithms, based on the file transmission protection method based on multiple encryption algorithms according to any one of claims 1 to 7, characterized in that: include, The file preprocessing module selects the target files to be transferred and performs preprocessing to generate file fragments; The shard encryption module analyzes the sensitivity of each file shard and performs layered encryption processing to obtain an encrypted shard set; The steganographic embedding module selects a steganographic carrier file, embeds the encrypted fragment into the carrier file, and generates a steganographic index table; The key generation module generates dynamic session keys based on the obfuscated key pool, encrypts the steganographic file transport layer and embeds dynamic key generation parameters; Decryption and extraction module: the receiving end generates a session key based on the transmission message header, decrypts the transport layer data, extracts the steganographic file and decrypts it; The file reorganization module reorganizes the decrypted and restored fragmented data into a complete file according to the identifier sequence, and verifies whether the file is damaged through integrity verification to obtain the verification result.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the file transmission protection method based on multiple encryption algorithms described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the file transmission protection method based on multiple encryption algorithms described in any one of claims 1 to 7 are implemented.

Images