Data encryption transmission method and device with early warning mechanism

Abstract

The invention relates to a data encryption transmission method and device with an early warning mechanism, and aims to improve the security and reliability of data transmission. According to the method, a plurality of encryption schemes with unique names are preset and stored at the front end and the rear end of a data transmission system. The front end randomly selects a set of encryption scheme according to security requirements, encrypts request data, sends the encrypted data and a unique name corresponding to the encrypted data to the rear end, and records necessary transmission indexes at the same time. And after receiving the data, the rear end performs decryption and re-encryption processing by using the same encryption scheme, and then sends a result back to the front end. And after receiving the data, the front end decrypts the data and verifies whether the data meets a preset transmission index. And if exceptions are found, such as decryption failure or data delay, the front end records and feeds back the exceptions to the rear end and stops data processing. According to the method, through random selection of an encryption scheme and a bidirectional verification mechanism, the security monitoring and exception handling capabilities in a data transmission process are enhanced.

Description

Technical Field

[0001] The present application relates to the technical field of encrypted transmission, and in particular to a data encryption transmission method and device with an early warning mechanism. Background Art

[0002] In existing data transmission technologies, encryption technology is widely used to ensure the security and privacy of data transmitted in the network. These technologies usually involve the use of static, preset encryption schemes at the front and back ends of data transmission to protect data from unauthorized access or theft. In addition, some systems use the method of dynamically selecting encryption algorithms to adapt to the ever-changing network security environment and attack patterns to increase the security and adaptability of the system.

[0003] However, despite these cryptographic measures, existing technologies still have some important problems. First, static encryption schemes are prone to being cracked over time because attackers can continue to study the same algorithm to discover its weaknesses. Second, even systems that dynamically select encryption algorithms are often subject to security threats due to the predictability of the algorithm selection process, especially when the algorithm selection depends on observable parameters. In addition, these systems often lack effective early warning mechanisms to deal with security issues discovered during data transmission, such as data tampering or latency anomalies, which limits their effectiveness in the face of advanced persistent threats (APTs).

[0004] Therefore, it is necessary to develop a new data encryption transmission method. Summary of the invention

[0005] The present application provides a data encryption transmission method and device with an early warning mechanism to improve the security and reliability of data transmission.

[0006] The present application provides a data encryption transmission method with an early warning mechanism, comprising: Preset and store multiple sets of encryption schemes with unique names at the front end and back end of the data transmission system, wherein the unique names are only known within the system; The front end randomly selects a set of encryption schemes based on security requirements, and uses the selected encryption scheme to encrypt the request data before sending it to generate encrypted request data; the encrypted request data and the unique name corresponding to the selected encryption scheme are sent to the back end; the unique name corresponding to the selected encryption scheme and related transmission indicators are recorded; wherein the request data includes user identity authentication information, transaction instructions and query requests; the related transmission indicators include sending time and restrictions on return messages; After receiving the encrypted request data and the unique name corresponding to the selected encryption scheme, the backend uses the same encryption scheme as the frontend to decrypt the data; processes the decrypted request data, and encrypts the processing result data again using the same encryption scheme as the frontend; and sends the encrypted processing result data back to the frontend; After receiving the encrypted data, the front end decrypts the encrypted data and verifies whether the encrypted data meets the time requirements of the relevant transmission indicators recorded and the restriction conditions of the returned message; If an abnormality is found during data decryption or index calculation, the front end will record the abnormality and feedback the abnormality to the back end, and stop the current data processing; wherein the abnormality includes decryption failure, data delay abnormality, data format and length inconsistency; After receiving abnormal feedback from the front end, the back end takes security measures to deal with potential data security threats.

[0007] Furthermore, the multiple encryption schemes include at least one symmetric encryption algorithm and at least one asymmetric encryption algorithm, and each algorithm has independent naming and configuration parameters.

[0008] Furthermore, the front end randomly selects a set of encryption schemes based on security requirements, including: Define a safety factor set , where each safety factor Representative Influencing parameters that affect the selection of encryption schemes, including the security level of the current network environment, the computing power of the user's device, and the data sensitivity score; According to the following formula (1), the comprehensive safety index is calculated :

[0009] in, is the weight coefficient; Indicates the number of influencing parameters; According to the following formula (2), the index of the encryption scheme is obtained :

[0010] in, is the adjustment coefficient; is the total number of encryption schemes; According to the index , determine the encryption scheme you choose.

[0011] Furthermore, the encrypted data and the unique name of the encryption scheme are sent to the backend via a secure channel, and the secure channel uses the TLS protocol to encrypt all transmitted data.

[0012] Furthermore, after decrypting the request data, the backend performs an integrity check on the data content and only processes and re-encrypts it after confirming that it has not been tampered with.

[0013] Furthermore, after decrypting the encrypted data, the front end verifies whether the data is received within a predetermined time window. If the time window is exceeded, it is considered as a data delay anomaly.

[0014] Furthermore, when the front end finds an abnormality, it also generates a security event log, which includes: type and severity of abnormality; A snapshot of the system status when an anomaly occurs; Related network traffic characteristics.

[0015] Furthermore, when the front end finds an anomaly, it adjusts the local security policy according to the severity of the anomaly, and the local security policy includes increasing the authentication requirements or restricting the use of specified functions.

[0016] Furthermore, after receiving the abnormal feedback from the front end, the back end performs the following steps: Compare the received abnormal information with the global security intelligence database in real time; Based on the comparison results, the threat level is assessed using a pre-trained security expert system; Automatically generate and execute security response measures based on the assessed threat level, where the security response measures include: Dynamically adjust network firewall rules; Start the deep packet inspection process; Isolate suspicious network segments or devices.

[0017] The present application provides a data encryption transmission device with an early warning mechanism, comprising: A data storage unit configured to pre-store multiple sets of encryption schemes with unique names at the front end and the back end of the data transmission system, wherein the unique names are only known within the system; an encryption selection unit, configured to randomly select a set of encryption schemes based on security requirements, and to encrypt the request data using the selected encryption scheme before sending the request data to generate encrypted request data, wherein the request data includes user identity authentication information, transaction instructions, and query requests; A transmission control unit configured to send the encrypted request data and the unique name corresponding to the selected encryption scheme to the back end, and record the unique name corresponding to the selected encryption scheme and related transmission indicators, wherein the related transmission indicators include the sending time and the restriction conditions on the return message; A receiving processing unit, configured to receive the encrypted request data and the unique name corresponding to the selected encryption scheme at the back end, decrypt the data using the same encryption scheme as the front end, process the decrypted request data, encrypt the processing result data again using the same encryption scheme as the front end, and send the encrypted processing result data back to the front end; A decryption verification unit, configured to decrypt the encrypted data after receiving the encrypted data at the front end, and verify whether the encrypted data meets the time requirements of the relevant transmission indicators recorded and the restriction conditions of the returned message; An exception handling unit is configured to record an exception and feed it back to the backend when an exception is found during data decryption or index calculation, and stop current data processing, wherein the exception includes decryption failure, data delay exception, and data format and length inconsistency; The security response unit is configured to take security measures to deal with potential data security threats after receiving abnormal feedback from the front end at the back end.

[0018] The technical solution proposed in this application has the following beneficial technical effects: (1) By presetting and storing multiple sets of encryption schemes with unique names at the front and back ends of the data transmission system, and ensuring that these names are only known within the system, the present application significantly improves data security. The use of unique names reduces the possibility of external attackers identifying and exploiting specific encryption schemes, thereby enhancing the confidentiality and security of encrypted data.

[0019] (2) This application allows the front-end to randomly select an encryption scheme based on current security requirements and encrypt the requested data before sending it. This dynamic selection mechanism adapts to changing security threats, allowing the system to more effectively combat attacks against specific encryption algorithms, thereby protecting data from advanced persistent threats (APTs) and other malicious attacks.

[0020] (3) By recording and monitoring key transmission indicators (such as sending time and return message constraints), this application can detect potential security issues in real time during data transmission. Once an abnormal situation is detected, such as decryption failure, data delay, or data format and length inconsistency, the system can take immediate action, such as notifying the backend through a feedback mechanism and suspending current data processing, thereby preventing data leakage or damage.

[0021] (4) After the backend receives abnormal feedback from the frontend, this application allows the backend to quickly take appropriate security measures to deal with potential data security threats. This rapid response mechanism not only reduces the risk of data loss or leakage, but also increases the overall resilience of the system, allowing the data transmission environment to maintain a high level of security and stability in the face of various threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 This is a flow chart of a data encryption transmission method with an early warning mechanism provided in the first embodiment of the present application.

[0023] Figure 2 It is a schematic diagram of a data encryption transmission device with an early warning mechanism provided in the second embodiment of the present application. DETAILED DESCRIPTION

[0024] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0025] The first embodiment of the present application provides a data encryption transmission method with an early warning mechanism. Figure 1 , which is a schematic diagram of the first embodiment of the present application. Figure 1 A data encryption transmission method with an early warning mechanism is described in detail in the first embodiment of the present application.

[0026] Step S101: Preset and store multiple sets of encryption schemes with unique names at the front end and back end of the data transmission system, wherein the unique names are only known within the system.

[0027] The concepts of front-end and back-end in this embodiment are key components, representing the two main stages and locations of processing data in the system. These terms may have different meanings in different contexts, but in this embodiment, they specifically refer to the starting point and end point in the data security processing flow.

[0028] The front end generally refers to the part of the system that interacts directly with the user and acts as the sender of data during the data transfer process. For example, consider an online banking system, where the front end might be the banking app or website used by customers to submit transaction requests, such as money transfers or bill payments. This part of the system is responsible for collecting user input, such as account information and transaction details, and then encrypting this data for secure transmission over the Internet to the bank's servers, which is the back end.

[0029] The backend is the part that runs on the server, and it usually plays the role of the receiver in the data transmission process. Continuing with the example of online banking, the backend is the server system that processes customer requests. It is responsible for receiving encrypted data from the frontend, decrypting this data to obtain the actual request content, and processing it, such as updating account balances, recording transaction history, etc. After processing is completed, the backend may also need to encrypt confirmation information or other response data again and send it back to the frontend to notify the user that the transaction has been successfully processed.

[0030] First, system administrators or developers need to deploy encryption schemes at the front and back ends of the data transmission system. These encryption schemes may include various public and private key systems, symmetric key systems, or any other encryption technology suitable for ensuring data security. Each encryption scheme will have a complete set of configurations, including the encryption algorithm used, key length, operation mode, etc.

[0031] Public key systems and private key systems are two major categories in the field of data encryption, which use different technologies to ensure the secure transmission of electronic data. Public key systems, also known as asymmetric encryption systems, involve two keys: a public key for encrypting data and a private key for decrypting it. A typical example is RSA, which is based on the difficulty of factoring large numbers. Commonly used key lengths include 1024 bits, 2048 bits, and 4096 bits. RSA is usually used to encrypt small blocks of data or encrypt transmission session keys, which is a symmetric key. Another popular public key encryption technology is elliptic curve cryptography (ECC), which provides relatively short key lengths (such as 256 bits, 384 bits, 521 bits) and is more computationally efficient while providing the same level of security.

[0032] On the other hand, private key systems, or symmetric encryption systems, use the same key to encrypt and decrypt data. Of these systems, the Advanced Encryption Standard (AES) is the most widely used, supporting 128-bit, 192-bit, and 256-bit key lengths. AES can operate in a variety of operating modes, such as Electronic Codebook Mode (ECB), Cipher Block Chaining Mode (CBC), and Galois / Counter Mode (GCM), where GCM also provides encryption and authentication capabilities. The Data Encryption Standard (DES) and its successor Triple DES are older but are still used, especially Triple DES, which increases security by using a triple-length key, although its key length is 168 bits, in fact using 112 bits or 168 bits.

[0033] Operation mode refers to how encryption algorithms (such as AES, DES) are repeatedly used to process data blocks in symmetric encryption. Symmetric encryption algorithms themselves are usually designed to encrypt only fixed-size data blocks (such as 128 bits for AES), but actual data often exceeds this size, so a mechanism is needed to safely process data of arbitrary length. Operation mode is such a mechanism that defines the rules for how to encrypt data blocks and how to link these data blocks to ensure the encryption security and integrity of the overall data.

[0034] The following are some basic operation modes, each with its own specific uses and characteristics: 1. Electronic Codebook Mode (ECB): In this mode, each data block is encrypted independently. When the same content of the same data block is encrypted with the same key, the same encryption result will be produced. The main disadvantage of this mode is that it may expose the mode and make the encryption process vulnerable to attack, so it is not recommended for encryption of information longer than one data block.

[0035] 2. Cipher Block Chaining Mode (CBC): CBC mode increases the dependency between data blocks by XORing each block with the encryption result of the previous block before encrypting it. This mode requires an initialization vector (IV) and ensures that each block in the encryption process depends on all previous blocks, improving security.

[0036] 3. Cipher Feedback Mode (CFB): CFB mode turns the symmetric encryption algorithm into a self-synchronizing stream cipher. It uses part of the output of the previous encrypted block as the input of the next block. This mode allows data to be encrypted into an output that is the same size as the input data.

[0037] 4. Output Feedback Mode (OFB): OFB mode is similar to CFB, but provides a true streaming mode. It generates a key stream that is XORed with the plaintext data to produce the ciphertext. The advantage of OFB mode is that an error in the encryption and decryption process will not be propagated to subsequent data blocks.

[0038] 5. Counter Mode (CTR, Counter Mode): In CTR mode, each data block position corresponds to a counter, which is encrypted together with the key, and then its output is XORed with the data block to generate the ciphertext. This mode converts the symmetric encryption algorithm into a stream cipher, so that the encryption and decryption processes can be processed completely in parallel.

[0039] Each mode has its advantages and limitations, and the choice of which mode depends on the specific application scenario and security requirements. For example, the CBC mode is widely used in applications that require high security due to its enhanced security, while the CTR mode is suitable for high-performance applications due to its fast processing speed and parallel processing.

[0040] In practical applications, public key encryption is often used to securely transmit the key itself, for example, during the SSL / TLS handshake process, RSA or ECC may be used to securely transmit symmetric keys. Symmetric encryption is often used to encrypt large amounts of data due to its high efficiency, such as encryption of online data transmission or large-scale data storage. The choice of these encryption technologies depends on specific security needs, performance requirements, and implementation environment. Each technology has its own unique advantages and best application scenarios.

[0041] Next, a unique name is generated for each encryption scheme. These names can be generated based on a variety of factors, such as the specific configuration details of the encryption scheme or the creation timestamp, which are then processed through a cryptographic hash function to generate a unique name. It is important that these unique names remain internal to the system and not disclosed to the public to prevent potential security threats. This can be achieved by storing these names encrypted in the system's secure database, ensuring that only authorized system components can access them.

[0042] In addition, the system should have a mechanism to ensure that these encryption schemes and their unique names are updated and managed synchronously on the front-end and back-end. This may be implemented through a central management system that is responsible for pushing updates to all relevant front-end and back-end devices to ensure that the encryption policies are consistent and up-to-date.

[0043] Through the implementation of step S101, the data transmission system can maintain a high degree of security and flexibility. Each component in the system can select the most appropriate encryption scheme according to the needs, while ensuring the uniqueness and privacy of these encryption schemes. Such a setting provides a solid security foundation for data transmission, effectively preventing the encryption scheme from being accessed or identified by unauthorized persons.

[0044] Furthermore, the multiple encryption schemes include at least one symmetric encryption algorithm and at least one asymmetric encryption algorithm, and each algorithm has independent naming and configuration parameters.

[0045] This embodiment provides multiple encryption schemes used in the data encryption transmission method. These encryption schemes include not only symmetric encryption algorithms and asymmetric encryption algorithms, but also each algorithm has independent naming and configuration parameters. Such a design allows the system to select the most suitable encryption method according to different security requirements and scenarios while maintaining a high degree of flexibility and security.

[0046] First, you need to ensure that both the front-end and back-end of the system can store and manage multiple encryption algorithms. These algorithms include but are not limited to: Symmetric encryption algorithm: This type of algorithm uses the same key to encrypt and decrypt data. Common symmetric encryption algorithms include AES (Advanced Encryption Standard), DES (Data Encryption Standard) and its more secure version Triple DES. For each symmetric algorithm, the system needs to be configured with the relevant key length, block size, and possible operation mode (such as CBC, ECB, CFB, etc.).

[0047] Asymmetric encryption algorithms: These algorithms use a pair of keys, namely a public key and a private key. The public key is used to encrypt data, and the private key is used to decrypt it. Common asymmetric encryption algorithms include RSA, ECC (elliptic curve cryptography), and DSA (digital signature algorithm). For each asymmetric algorithm, you need to configure parameters such as key length and encryption strength.

[0048] Furthermore, the unique names of the plurality of encryption schemes are generated by: Encoding the key attributes of each encryption scheme to generate a string representation; performing hashing on the generated string to obtain a hash value H; wherein the key attributes include algorithm type, key length, and operation mode; A random seed S generated by a dynamic factor based on the system operating environment and a preset key K are used to generate a time key TK through a secure hash algorithm; Connect the hash value H with the time key TK, perform a hash process using a secure hash function, and obtain the intermediate value M; The intermediate value M is mapped to a phrase consisting of an adjective and a noun, wherein the adjective and the noun are from a predefined vocabulary related to the security protocol; wherein the mapping rule includes: using different bit segment values ​​of M to determine the selection of adjectives and nouns in the vocabulary to ensure the diversity and uniqueness of the name.

[0049] First, the key attributes of each encryption scheme are encoded. These key attributes include the type of encryption algorithm (such as AES or RSA), the length of the key (such as 128 bits, 256 bits, etc.), and the operation mode (such as CBC, GCM, etc.). These attributes are fundamental to the performance and security of the encryption scheme, so they are chosen as the source information for generating unique names. These attributes are encoded into a string representation, ensuring that every detail is converted into an easy-to-process text format.

[0050] Next, the generated string is hashed to obtain a hash value H. The hashing process is to ensure the uniqueness of the name, and even a small change in the attribute will produce a significant difference in the hash value. In addition, a random seed S generated by a dynamic factor based on the system operating environment is used, combined with a preset key K, to generate a time key TK through a secure hash algorithm (such as SHA-256). This time key TK uses the current system environment and time variables to ensure that each generated key is timely and random, thereby enhancing security.

[0051] The obtained hash value H is concatenated with the time key TK, and then hashed again using another secure hash function to obtain the intermediate value M. This step is to further increase the complexity and randomness of the generation process to ensure that even very similar encryption schemes can produce different unique names.

[0052] Finally, the intermediate value M is mapped to a phrase consisting of an adjective and a noun. The adjectives and nouns here come from a predefined vocabulary related to the security protocol, and the mapping rule is to determine the selection of adjectives and nouns in the vocabulary according to the different bit segment values ​​of M. This method not only ensures the diversity and uniqueness of the name, but also makes the name easy to remember and express, while retaining the metaphorical description of the properties of the encryption scheme.

[0053] Through this complex generation process, each encryption scheme is given a secure, unique, and expressive name, which helps users and technicians clearly distinguish and reference each scheme when using and managing multiple encryption schemes.

[0054] The following example shows how to generate an encrypted name: 1. Selection and encoding of encryption scheme attributes Suppose there is an encryption scheme whose key properties are as follows: Algorithm type: AES Key length: 256 bits Operation mode: CBC First encode these properties into a string representation, for example: "AES-256-CBC".

[0055] 2. Hash processing and time key generation Next, the "AES-256-CBC" string is hashed using the SHA-256 algorithm to obtain a hash value H. For example, the hash value may be a string of hexadecimal values.

[0056] Assume that the current time of the system is "September 7, 2023 10:15", combine this time information with a preset key K (assumed to be "my_secret_key"), and use the SHA-256 algorithm to generate the time key TK.

[0057] 3. Generate the final hash value The hash value H obtained above is connected with the time key TK, and the intermediate value M is obtained by hashing with SHA-256 again.

[0058] 4. Name mapping Now we need to map the intermediate value M to a phrase composed of a Chinese adjective and a noun. Assume that the vocabulary includes the following words: Adjectives: ["safe", "fast", "stable", "efficient"] Noun: ["shield", "matrix", "lock", "net"] Assuming that the first bit segment value of the intermediate value M points to "security" and the second bit segment value of the intermediate value M points to "lock", then the generated unique name can be "security lock".

[0059] Step S102: The front end randomly selects a set of encryption schemes based on security requirements, and encrypts the request data using the selected encryption scheme before sending it to generate encrypted request data; the encrypted request data and the unique name corresponding to the selected encryption scheme are sent to the back end; the unique name corresponding to the selected encryption scheme and related transmission indicators are recorded; wherein the request data includes user identity authentication information, transaction instructions and query requests; the related transmission indicators include sending time and restrictions on return messages.

[0060] In step S102, the steps of how the front end selects an encryption scheme according to security requirements are provided, and the encryption process of processing the request data is provided in detail. This step involves several key operations, including the selection of the encryption scheme, the encryption of the request data, the sending of the encrypted data, and the recording of related transmission indicators. The following is the detailed implementation method of these operations: First, the front-end system needs to evaluate the current security requirements, which may be based on a variety of factors, such as the security level of the network, the sensitivity of the data, and the latest threat intelligence. Based on these security requirements, the front-end system randomly selects a set of encryption schemes from multiple pre-stored ones. This selection depends not only on security requirements, but may also take into account the performance of the algorithm to adapt to different operating environments. The selection process can be implemented by an algorithm, such as using a random number generator combined with a weighted evaluation to select the encryption scheme that best suits the current situation.

[0061] After the encryption scheme is selected, the front-end system will use this scheme to encrypt the request data. The request data may include user authentication information, transaction instructions, and query requests. These data usually contain sensitive information and must be encrypted before transmission to ensure security. The encryption process involves taking these data as input and converting them into ciphertext through an encryption algorithm to ensure that only the recipient with the appropriate key can decrypt them.

[0062] After encryption is completed, the front-end system packages the encrypted request data and the unique name of the encryption scheme and sends it to the back-end. The unique name is used to confirm that the same encryption scheme is used for decryption on the back-end. At the same time, the front-end system will also record indicators related to this transmission, such as the sending time and specific restrictions on the return message. These indicators are crucial for subsequent data security analysis and verification.

[0063] In data encryption and network communications, specific constraints on return messages usually specify a set of requirements or parameters used to ensure the security and integrity of data transmission. These constraints help verify the status of the returned data and ensure that it has not been damaged or tampered with during transmission. Here are some specific examples to illustrate such constraints: 1. Response time limit: In many sensitive data exchange scenarios, such as online transactions or real-time monitoring systems, the response time of messages is one of the key security measures. A maximum response time limit can be set, for example, all return messages must arrive at the front end within 5 seconds after the request is made. Timed messages may be regarded as an indication of network delay or potential replay attack, and therefore will be rejected or marked as suspicious by the system.

[0064] 2. Data integrity check: The return message usually contains a checksum or digital signature to verify that the data has not been tampered with during transmission. Specific restrictions may stipulate that the message must contain a valid signature that matches the public key held by the front end. This ensures the origin and integrity of the data and is a key security measure to prevent data tampering.

[0065] 3. Message size limit: To prevent malicious attempts to attack the system by sending packets of abnormal size, you can set a size limit for the return message. For example, the system may preset that any return packet must not exceed 1MB. This limit helps prevent denial of service attacks (DoS) and buffer overflow attacks, and ensures that system resources are not consumed maliciously.

[0066] 4. Content Security Policy: The content of the return message may also be restricted, especially when transferring data involving executable code or configuration information. For example, the return message may need to comply with a specific content security policy (CSP), such as not containing JavaScript code or only allowing scripts to be loaded from specific sources. This helps prevent cross-site scripting attacks (XSS) and other forms of malicious content injection.

[0067] By setting these specific restrictions, the system can effectively enhance security measures and improve the security and reliability of data transmission. These measures ensure that the returned data is not only safe, but also able to meet the real-time needs of business processes and system operations.

[0068] These recorded transmission indicators can be used in subsequent steps to verify the integrity and timeliness of the returned data, helping to ensure that the data has not been tampered with during transmission and has not been affected by network security threats such as delay attacks. If anomalies are found during data decryption or indicator calculation, these records will support the system to quickly and accurately locate the problem and take appropriate countermeasures.

[0069] Furthermore, the front end randomly selects a set of encryption schemes based on security requirements, including: Define a safety factor set , where each safety factor Representative Influencing parameters that affect the selection of encryption schemes, including the security level of the current network environment, the computing power of the user's device, and the data sensitivity score; According to the following formula (1), the comprehensive safety index is calculated :

[0070] in, is the weight coefficient; Indicates the number of influencing parameters; According to the following formula (2), the index of the encryption scheme is obtained :

[0071] in, is the adjustment coefficient; is the total number of encryption schemes; According to the index , determine the encryption scheme you choose.

[0072] In this embodiment, the front-end system adopts a method based on comprehensive security assessment when selecting an encryption scheme to ensure that the selected encryption strategy best suits the current data security requirements.

[0073] First, the front end defines a set of safety factors , where each safety factor Represents a specific parameter that affects the selection of encryption schemes. These parameters include but are not limited to the security level of the current network environment, the computing power of the user's device, and the data sensitivity score. Each parameter is derived from the actual security environment and system performance analysis to reflect the security requirements and device capabilities in a specific environment.

[0074] In the data encryption transmission method, it is crucial to accurately evaluate the security level of the current network environment, the computing power of the user's device, and the data sensitivity score. These parameters directly affect the selection of encryption schemes to ensure maximum data security. The following details how these parameters are calculated and obtained.

[0075] The security level of the current network environment is usually assessed by a network monitoring system based on abnormal activities of network traffic, known threat intelligence, recent security event records, and alerts from network intrusion detection systems. For example, if unauthorized access attempts are frequently found in a network environment or there is a large amount of malware communication, the security level of the network will be assessed as low. On the contrary, if network monitoring shows few or no security threats and there are effective firewalls and intrusion detection systems running, the security level of the network will be assessed as high. These assessment results can be expressed as a value from 1 to 10, where 10 represents extremely high security and 1 represents extremely low security.

[0076] The computing power of a user's device refers to the ability of the user's device to process data and run encryption algorithms. This is usually determined by the device's processor speed, available memory, and current system load. For example, a device with a recent processor and a lot of RAM will have a high computing power score, while an older phone or a low-profile device will have a lower score. This score can be obtained by running benchmark software that compares the performance of the device to standard performance indicators and gives a numerical representation, such as from 1 to 10, with 10 indicating the highest computing power.

[0077] Data sensitivity is scored based on the importance of the data and the need for security. This usually involves a data classification process, where the data owner or administrator scores the data based on the confidentiality, integrity and availability needs of the data. For example, data containing personally identifiable information, financial records or corporate secrets will be given a high sensitivity score, while public news data or advertising content may receive a low sensitivity score. This scoring can be done using a preset standard table that lists the sensitivity levels of different types of data and assigns a score range to each level.

[0078] The comprehensive evaluation of these parameters provides a scientific basis for the selection of encryption strategies. In actual operation, the system will select the most appropriate encryption algorithm and configuration based on these dynamically calculated scores to adapt to specific security requirements and performance constraints. In this way, the encrypted transmission system can not only effectively protect data, but also ensure the efficiency of system operation.

[0079] Next, the front end uses formula (1) to calculate the comprehensive safety index :

[0080] In this formula, Represents the weight coefficient, which determines the influence of each safety factor in the total score. is the total number of influencing parameters. The choice of this formula is based on the desire to increase the complexity of the calculation through logarithmic and exponential functions, thereby making nonlinear adjustments to the contribution of each safety factor. This makes the score more sensitive to smaller safety changes, thereby providing a more refined safety level judgment.

[0081] In order to obtain the comprehensive safety index Get the final encryption scheme index , using formula (2):

[0082] In this formula, is the adjustment coefficient, which is used to adjust the output of the formula to match the range of available encryption schemes and can be obtained through experimental data or set based on expert knowledge. is the total number of available encryption schemes. This formula further increases the randomness and complexity of selecting encryption schemes by introducing a combination of cubic, quadratic, and trigonometric functions, ensuring that the selection of encryption schemes is not based solely on linear security scores, but on more complex calculation results, thereby improving the security of the method. In the formula 2, round is a mathematical function used to round the calculated value to the nearest integer. This function is often used when processing calculation results involving real numbers (i.e., floating-point numbers) in order to obtain integer results, which are often used in indexing, counting, or other situations where integer values ​​are required.

[0083] Finally, according to the calculated index ,The front-end system can select a specific encryption strategy from a preset encryption scheme list to apply. This selection process is automatic, ensuring that the most appropriate encryption method is used for each data transmission, thereby maximizing the security of data transmission.

[0084] Furthermore, the encrypted data and the unique name of the encryption scheme are sent to the backend via a secure channel, and the secure channel uses the TLS protocol to encrypt all transmitted data.

[0085] The TLS protocol is a widely used protocol that provides privacy and data integrity during data transmission. TLS achieves this by performing encryption operations on data packets transmitted in the network, ensuring that data is not eavesdropped and tampered with when transmitted on the Internet. In the present invention, using the TLS protocol to establish a secure channel is very critical because it not only protects the content of the transmitted data, but also protects the security of the data transmission process itself.

[0086] To implement this step, the following operations are required: 1. Configure TLS protocol: Configure TLS protocol on the front-end and back-end systems, which includes installing a valid security certificate and selecting the appropriate TLS version. The certificate is usually issued by a certified certificate authority (CA), which proves the identity of the server and provides the necessary public key information for establishing an encrypted connection.

[0087] 2. Establishing a TLS connection: When the front-end needs to send encrypted data and its unique name to the back-end, it first initiates a TLS handshake request. During the TLS handshake, the front-end and back-end negotiate the encryption algorithm, exchange key information, and finally establish an encrypted connection. This handshake process ensures that both parties have verified the identity of the other party and agreed on the encryption parameters used during the communication process.

[0088] 3. Data encryption and transmission: Once a TLS connection is established, all data sent through this channel will be encrypted. This includes the encrypted request data and the unique name of the encryption scheme. The encryption process is automatic and implemented by the TLS protocol to ensure the privacy and integrity of the data during transmission.

[0089] 4. Data reception and decryption: After receiving the data transmitted through the TLS channel, the backend will automatically decrypt the data. Since the same TLS protocol is used, the backend can correctly parse and restore the original data content, including the encrypted request data and the unique name of the encryption scheme required for subsequent processing.

[0090] Through the above operations, the security of the encrypted data and related information transmitted between the front-end and the back-end is ensured, and the data leakage and tampering during the transmission process are prevented. This security measure is extremely important for protecting sensitive data and maintaining the security of the entire system. It makes the data encryption transmission method more reliable and effective in practical applications.

[0091] Step S103: After the backend receives the encrypted request data and the unique name corresponding to the selected encryption scheme, it decrypts it using the same encryption scheme as the frontend; processes the decrypted request data, and encrypts the processing result data again using the same encryption scheme as the frontend; and sends the encrypted processing result data back to the frontend.

[0092] In step S103, it is explained how the backend system processes the received encrypted request data. This step involves three key operations: decrypting the received data, processing the data, and re-encrypting the data for transmission back to the front end. The detailed implementation method of this step ensures the security and integrity of the data during the entire transmission process.

[0093] First, when the backend system receives encrypted data sent from the frontend, the data includes the encrypted request content and its corresponding unique name of the encryption scheme. The backend system first determines which encryption scheme was used to encrypt the data based on the received unique name. This information enables the backend to decrypt the data using the same encryption scheme, ensuring the accuracy of the decryption process. The decryption operation requires the backend to have the appropriate decryption key, which corresponds to the key used by the frontend to encrypt the data. This process usually involves retrieving the corresponding key from a secure key management system.

[0094] After decryption, the backend will process the data in response to the frontend's request. This may include executing database queries, processing transaction instructions, or verifying user identity information. During data processing, the backend system must ensure the security of operations and the accuracy of data processing logic to avoid erroneous results or data leakage.

[0095] The processed data then needs to be encrypted again so that it can be securely sent back to the front end. The back end uses the same encryption scheme as the initial encryption to encrypt the data again, ensuring that the front end can restore the data using the corresponding decryption scheme. This re-encryption process also involves the use of security keys, which should be the same as the keys used for the initial encryption to ensure that the data can be successfully decrypted by the front end.

[0096] Finally, the encrypted data is sent back to the front end. During the sending process, the back end will also record necessary transmission indicators, such as sending time and data packet size, which are crucial for the front end to verify data integrity and real-time performance.

[0097] Furthermore, after decrypting the request data, the backend performs an integrity check on the data content and only processes and re-encrypts it after confirming that it has not been tampered with.

[0098] Implementing this step first involves the decryption process. Once the data is successfully transmitted to the backend through a secure channel (such as TLS), the backend uses the same decryption key and encryption algorithm as the frontend to decrypt the data. The decryption process ensures that the correct key and parameters are used to restore the original state of the data.

[0099] After decryption is complete, the backend will perform an integrity check. This usually involves the following key operations: 1. Checksum or hash verification: On the sending end (front end), the data is usually attached with a checksum or hash value, which is generated before encryption. After the back end decrypts the data, it recalculates the checksum or hash value of the received data and compares it with the transmitted checksum or hash value. If the two match, it indicates that the data has not been changed since encryption and maintains its integrity.

[0100] 2. Digital signature verification: If the data is protected using digital signature technology, the backend will use the sender's public key to verify the validity of the signature. Successful signature verification not only proves the integrity of the data, but also verifies the authenticity of the data source.

[0101] 3. Anomaly detection: The backend system should also have the ability to detect data anomalies, such as checking whether the data content contains any predefined illogical or non-compliant patterns in security policies. This detection helps identify and prevent advanced persistent threats (APTs) or internal tampering attempts.

[0102] Once the data passes the integrity check, the backend can process the data securely and perform necessary business operations such as database updates, transaction processing, etc. After processing, if the data needs to be sent back to the frontend or other systems, the backend will encrypt the processed result data again using the selected encryption scheme to ensure the security of the data during the return process.

[0103] This integrity check and confirmation step is crucial. It not only ensures the security of data processing, but also enhances the overall system's defense against data tampering and external attacks.

[0104] Step S104: After receiving the encrypted data, the front end decrypts the encrypted data and verifies whether the encrypted data meets the time requirements of the recorded relevant transmission indicators and the restriction conditions of the returned message.

[0105] Step S104 is a key step to ensure the security and data integrity of the encrypted data transmission process. In this step, the front end first receives the encrypted data sent back from the back end. After receiving the data, the front end uses the same encryption scheme as when sending it for decryption, which requires the front end to maintain the consistency of the encryption scheme and correct key management to ensure that the data can be successfully decrypted.

[0106] The decryption process should be error-free so that the data content before transmission can be accurately restored. After decryption, the front-end system will perform a series of verifications on the data to ensure that the data has not been tampered with during transmission and meets the preset transmission and security standards. These verifications include but are not limited to checking the integrity of the data, verifying whether the sending and receiving time of the data meets the set time window, and confirming whether the size and format of the data packet meet the predetermined parameters.

[0107] Specifically, the front end will evaluate the transmission time of the encrypted data to ensure that it arrives within an acceptable time frame, which is particularly important for preventing and identifying delay attacks. The front end will also check whether the structure and length of the data are consistent with those before sending, so as to exclude the possibility that the data was truncated or additional content was added during the transmission process. The execution of this step requires the front-end system to be able to access the relevant transmission indicators recorded during the transmission, such as the specific time of data transmission and the specific requirements of the data packet, which should be properly recorded in step S102 and used for verification here.

[0108] During the implementation process, the front end may use automated scripts or software tools to handle these verification tasks. These tools will automatically check various indicators of the data according to preset rules and parameters and generate verification results. If the data is found to not meet the preset conditions during the verification process, such as decryption failure, abnormal data delay, or data format and length that do not meet the requirements, the front end should record these abnormal conditions and handle them according to the set process. Possible handling measures include feedback to the back end to investigate and solve the problem, or stop the current data processing operation to protect system security.

[0109] In step S104, after the front-end system receives the encrypted data sent by the back-end, it must perform a series of verifications on the data to ensure that they meet the predetermined transmission indicators and return message restrictions. These verification operations are to ensure the security and integrity of the data during transmission and prevent the data from being tampered with or abused. The following are some specific verification examples to show how to check whether the encrypted data meets these standards.

[0110] First, considering the response time limit, the front-end system will check whether the time from sending to receiving the data packet meets the preset time frame. For example, if a rule is set that all return data must arrive at the front end within 5 seconds, the system will compare the sending and receiving timestamps of the data packet to ensure that there is no timeout. If the packet delay is found to exceed this threshold, the system may reject the packet or mark it as suspicious, because such a delay may indicate a network problem or a potential replay attack.

[0111] Next, the front end will perform a data integrity check to ensure that the returned data packet contains a valid checksum or digital signature. This step involves verifying the signature in the data packet using the public key held by the front end to confirm that the data has not been tampered with during transmission. If the signature verification fails, this indicates that the data may have been modified during transmission, so the data must be further reviewed or directly rejected.

[0112] In addition, the front-end system will verify whether the size of the returned packet meets the predetermined limit. For example, if the system stipulates that the size of the returned packet cannot exceed 1MB, the system will check whether the actual size of the packet exceeds this limit. This check helps prevent denial of service attacks or buffer overflow attacks that attempt to exhaust system resources by sending large amounts of data.

[0113] Finally, the front end will check whether the content of the returned data complies with the content security policy. This includes verifying whether the data contains unauthorized code or scripts, and whether the data is loaded only from trusted sources. These checks help prevent cross-site scripting attacks or other types of malicious content injection, ensuring the security of the system's data processing.

[0114] Through these meticulous inspection steps, the front-end system can effectively evaluate the security status of the returned data, ensure the integrity and compliance of the data, and thus protect the entire data transmission process from a variety of potential threats. These operations not only enhance the security of the system, but also improve the reliability of data processing.

[0115] Furthermore, after decrypting the encrypted data, the front end verifies whether the data is received within a predetermined time window. If the time window is exceeded, it is considered as a data delay anomaly.

[0116] This process is designed to ensure timely data transmission and prevent potential replay attacks, where delayed receipt of data could represent a sign of network problems or malicious tampering.

[0117] Implementing this step requires the front-end system to have accurate time tracking and data reception verification capabilities. This can be achieved in detail through the following steps: 1. Set the time window: Before data transmission begins, the system needs to define a clear time window, which refers to the maximum allowed time from the time the data is sent to the time the data should be received. For example, for a financial transaction, a time window may be set that data must be received within 30 seconds.

[0118] 2. Record the sending time: Before the front end sends the encrypted data, the precise timestamp of the data sending must be recorded. This timestamp should be encrypted along with the data and sent to the back end to ensure the security and immutability of the timestamp during the entire transmission process.

[0119] 3. Decryption and verification of timestamp: When the data arrives at the front end and is decrypted, the system extracts the timestamp and compares it with the current time. This comparison operation determines whether the received data is within the predetermined time window.

[0120] 4. Handling data delay anomalies: If the data reception time exceeds the set time window, the front-end system should identify this as a data delay anomaly. The system needs to have a clear set of response measures to handle this anomaly, such as immediately issuing an alarm, refusing to process data, or conducting further security checks.

[0121] 5. Records and reports: All time window verification results and any abnormalities should be recorded in detail for subsequent security analysis and audits. These records are very important for identifying potential security threats and improving future security strategies.

[0122] Through these steps, the front-end system can effectively verify whether the data is received within a safe time frame, thereby preventing the data from being tampered with or subjected to other forms of attacks due to network delays. This time window verification mechanism enhances the security of the data transmission process and ensures the timeliness and integrity of the data.

[0123] Step S105: If an abnormality is found during data decryption or index calculation, the front end will record the abnormality and feed it back to the back end, and stop the current data processing; wherein the abnormality includes decryption failure, data delay abnormality, and data format and length inconsistency.

[0124] Step S105 details how the front end handles and responds to any abnormalities found during data transmission. This step is critical because it not only ensures the correctness and integrity of the data, but also enhances the system's ability to respond to potential security threats.

[0125] After the front end receives and decrypts the encrypted data from the back end, a series of checks will be performed to ensure that the data meets the expected security standards and operating specifications. This includes checking whether the data is successfully transmitted within the specified time (such as the response time check described in step S104 above), the integrity of the data packet and whether the format is correct. These checks are performed based on the transmission indicators previously recorded in step S102 and the security standards set by the system.

[0126] If data decryption fails at this stage, i.e., the ciphertext is not correctly converted to the original plaintext, or if the data exhibits unusual delays during the verification process, this may indicate that the data has been intercepted or tampered with during transmission. Similarly, if the data format and length are detected to be inconsistent with what was recorded before sending, this may indicate that the data has been modified or truncated without authorization during delivery.

[0127] Once the front-end system identifies these anomalies, it will immediately perform the operation of recording the anomalies. This involves recording in detail the nature of the anomaly, the time of occurrence, and the scope of data that may be affected, so as to facilitate subsequent analysis. In addition, the front-end will feed back these anomalies to the back-end system through a secure channel. This communication is encrypted, ensuring that any information about security vulnerabilities will not be leaked during transmission or exploited by third parties.

[0128] After an anomaly is reported, the front-end system usually stops the current data processing operation. This is a precautionary measure to prevent potential data leakage or wider system impact until the security and integrity of the data are confirmed. This operating mode ensures that no further data operations are carried out without a full understanding of the situation, thereby protecting user and system security.

[0129] Furthermore, when the front end finds an abnormality, it also generates a security event log, which includes: type and severity of abnormality; A snapshot of the system status when an anomaly occurs; Related network traffic characteristics.

[0130] This log not only records the details of the anomaly, but also provides enough contextual information so that technicians can thoroughly analyze and respond to these security incidents.

[0131] When the front-end system finds any anomaly during data encryption, transmission or decryption, the system will automatically trigger a logging mechanism. The function of this mechanism is to capture and store various information about the anomaly, including: 1. Exception type and severity: The system first identifies the type of exception, such as decryption failure, data delay, data tampering, etc. Each exception type is assigned a predefined severity level, which helps with subsequent processing and priority allocation. The severity may be assessed based on the potential impact of the exception on system operation or data security. For example, the severity of a data leak will be higher than a general performance exception.

[0132] 2. System status snapshot when an exception occurs: In order to better understand the context of the exception, the system will automatically capture a snapshot of the system status when the exception occurs. This includes but is not limited to CPU usage, memory usage, currently active process list, and system logs. This information provides the necessary background for analyzing the exception and helps technicians determine the specific working status and load of the system when the exception occurs.

[0133] 3. Related network traffic characteristics: In addition, the log will also include network traffic characteristics related to the anomaly. This may involve the packet size, transmission frequency, source and destination IP addresses, port information, and possible transmission protocols before and after the anomaly occurs. This information is of great value in identifying whether there is a network attack, such as a DDoS attack, network monitoring, or data interception.

[0134] All this information will be automatically collected and saved in the security event log, which needs to be maintained in a secure, isolated storage location to prevent unauthorized access or tampering. In addition, the log file should be stored in encrypted form to ensure that the log content is protected even in the event of a data breach.

[0135] Authorized security analysts will have access to these logs for detailed security analysis and troubleshooting. Log analysis may involve finding the cause of anomalies, assessing the scope of impact, and developing targeted solutions. Effective log management and analysis mechanisms are key to improving data transmission security and quickly responding to security incidents.

[0136] By implementing the above detailed steps, it is ensured that when anomalies are detected at the front end, a security event log containing rich information can be generated. This not only enhances the monitoring capability of the system, but also greatly improves the efficiency of responding to security threats and ensures the security of the entire data encryption transmission process.

[0137] Furthermore, when the front end finds an anomaly, it adjusts the local security policy according to the severity of the anomaly, and the local security policy includes increasing the authentication requirements or restricting the use of specified functions.

[0138] These measures not only involve generating detailed security event logs, but also include adjusting local security policies based on the nature and severity of the anomaly. This dynamic security management approach can significantly improve the system's adaptability and defense capabilities, ensuring that the system can take appropriate protective measures when faced with potential security threats.

[0139] To adjust the local security policy: 1. Assess the severity of the abnormality: When the front-end system detects a security anomaly, it first needs to assess the severity of the anomaly. This assessment is based on the type of anomaly (such as data tampering, unauthorized access, excessive use of system resources, etc.), the degree of damage that may be caused to the system or data, and the impact on user services. For example, a high-severity anomaly may be a data leak, while a low-severity anomaly may only be a degradation of system performance.

[0140] 2. Adjust certification requirements: For anomalies that are assessed as high severity, the front-end system can increase user authentication requirements. This may include enabling multi-factor authentication, requiring users to log in again, or using more complex password policies. For example, if a possible account hijacking or abnormal login attempt is detected, the system can require all users to perform secondary verification or temporarily lock the affected account until the user's identity is confirmed.

[0141] 3. Use of restricted functions: Another tuning strategy is to limit or temporarily disable certain system functions. This is often used to prevent abnormal behavior from causing wider system impact. For example, if a service module is detected to be infected or attacked by malware, the system may temporarily disable the operation of the module to prevent the problem from spreading to other parts of the system. Functional restrictions can also reduce the operating permissions of the system, limit the ability to access and modify files, or reduce the responsiveness of network services to avoid excessive consumption of resources.

[0142] Implementing these security policy adjustments requires the front-end system to have a high degree of configuration flexibility and a fast response mechanism. The system should be able to quickly change security settings based on predefined rules or administrator instructions, and promptly notify all users of security policy changes.

[0143] Step S106: After receiving abnormal feedback from the front end, the back end takes security measures to deal with potential data security threats.

[0144] Step S106 includes the security measures taken by the backend after receiving abnormal feedback from the frontend to effectively deal with possible data security threats. This step is to ensure that the entire data transmission system can not only identify potential security issues, but also respond quickly to prevent the problem from expanding and protect system security.

[0145] When implementing this step, first, the backend system must be set up to receive and correctly parse the exception report sent by the frontend. This includes parsing the details of the exception from the encrypted message received by the frontend, such as the type of exception (decryption failure, data delay, data format and length issues, etc.), the time when the exception occurred, and any data information that may be affected. The backend system should have the ability to automatically identify and classify various exceptions in order to determine the appropriate response measures.

[0146] Next, based on the type of exception received, the backend needs to quickly decide on the security measures to take. These measures may include but are not limited to: 1. Isolate the affected data immediately: To prevent the potential security threat from spreading, the backend may need to immediately isolate the affected data to prevent it from being further processed or accessed.

[0147] 2. Review and strengthen security protocols: The backend may need to review the current security protocols to check if there are any loopholes or weaknesses, especially those related parts that may cause current anomalies. In addition, strengthening security measures, such as updating encryption algorithms or adjusting security settings, is also a necessary response measure.

[0148] 3. Start the backup system or recovery plan: For serious security incidents, the backend may need to start the backup system or execute the data recovery plan to ensure business continuity and data integrity.

[0149] 4. Notify relevant personnel and departments: Ensure that all relevant security personnel and management are notified of the abnormal event so that further actions can be taken. This may include technical support teams, security analysis teams, and senior management.

[0150] 5. Record and analyze events: Record all anomaly-related information and subsequent handling measures in detail, conduct post-event analysis to draw lessons and improve future security strategies and response processes.

[0151] All of these measures require a high degree of flexibility and rapid response capabilities from the backend system. The system should be designed to automatically handle common security incidents while also allowing operators to manually intervene to handle more complex or serious situations. In addition, the entire process should ensure transparency and traceability of all operations to facilitate audits and compliance assessments when necessary.

[0152] Furthermore, after receiving the abnormal feedback from the front end, the back end performs the following steps: Compare the received abnormal information with the global security intelligence database in real time; Based on the comparison results, the threat level is assessed using a pre-trained security expert system; Automatically generate and execute security response measures based on the assessed threat level, where the security response measures include: Dynamically adjust network firewall rules; Start the deep packet inspection process; Isolate suspicious network segments or devices.

[0153] When the back-end system receives abnormal feedback from the front-end, it first compares the abnormal information with a global security intelligence database in real time. The global security intelligence database stores a wide range of security threat data, including known malware signatures, IP address blacklists, abnormal behavior patterns, etc. This database is frequently updated to include the latest threat intelligence.

[0154] During the comparison process, the backend system uses an efficient matching algorithm to check whether the received abnormal information matches the known threat patterns in the database. This may include checking whether the IP address in the abnormal data appears in the blacklist, or whether the abnormal behavior conforms to a known attack pattern.

[0155] If a match is found in the global security intelligence database, the backend system will use a pre-trained security expert system to assess the threat level. The security expert system is an artificial intelligence-based analysis tool that can accurately assess the current threat level by analyzing historical data and learning the impact of different security events. The system may classify threats into three levels: low, medium, and high, and each level corresponds to a set of predefined response measures.

[0156] The pre-trained security expert system is an advanced artificial intelligence application that plays an increasingly important role in the security field. The system uses machine learning and artificial intelligence technology, trained with a large amount of historical security data, and can effectively identify and evaluate complex security threats.

[0157] The core of the security expert system is one or more machine learning models, which are "fed" with a large amount of security event data during the training phase. This data includes but is not limited to logs of network attacks, known malware behavior patterns, system vulnerability reports, and the consequences of security incidents. Through in-depth analysis of this data, the model learns which behavior patterns and indicators are most likely to indicate the existence of security threats, as well as the potential severity of these threats.

[0158] During the training process, various statistical and machine learning techniques, such as decision trees, neural networks, or ensemble learning methods, are used to optimize the model’s predictive accuracy. Once the model is trained, it can automatically analyze and rate new security events without human intervention.

[0159] When the backend system finds a match related to the current event in the global security intelligence database, the security expert system will be called to assess the potential threat level of the event. This assessment process usually involves the following steps: 1. Feature extraction: Extract key features from the received event data. These features are determined during the training phase and may include the type of event, frequency of occurrence, system components involved, complexity of the attack, etc.

[0160] 2. Threat rating: The extracted features are analyzed using a pre-trained model, which outputs a threat level. This level is usually based on the potential damage and urgency of the incident, and is divided into low, medium, and high levels.

[0161] 3. Response recommendations: Based on the level of the threat, the system may also provide corresponding security response recommendations, which are designed to quickly and effectively mitigate or defend against possible security threats.

[0162] After the security expert system is deployed, its database needs to be updated and the model retrained regularly to include the latest threat intelligence and security technologies. This process ensures that the system's assessment capabilities can keep up with the rapidly changing security environment.

[0163] In addition, the performance and accuracy of the system need to be continuously monitored and evaluated to ensure that the expected results are achieved in actual applications. The data collected during use through feedback mechanisms can be further optimized and adjusted.

[0164] In this way, the pre-trained security expert system provides a powerful tool for network security management, which can automatically handle and respond to security incidents and greatly improve the efficiency and effectiveness of the security team.

[0165] Based on the threat level assessed by the security expert system, the backend system will automatically trigger corresponding security response measures. These measures include but are not limited to: Dynamically adjust network firewall rules: The system may adjust firewall rules to block attacks or limit attack traffic based on the nature and source of the threat. For example, if a DDoS attack is detected from a specific IP address, the system can automatically update the firewall configuration to block all traffic from that address.

[0166] Initiate deep packet inspection: For medium to high-level threats, the system may initiate a deep packet inspection process to perform a deeper analysis of network traffic. This process helps identify and block complex network attacks such as zero-day attacks and advanced persistent threats (APTs).

[0167] Isolate suspicious network segments or devices: In the event that network segments or devices are confirmed to be infected or controlled by malware, the system can automatically isolate these sections to prevent the threat from spreading to other parts of the network.

[0168] Through these detailed steps, the back-end system can not only quickly respond to anomalies found by the front-end, but also automatically take effective security measures based on global security intelligence and advanced threat assessment technology. This highly automated security response mechanism greatly improves the security and response capabilities of the entire data transmission system, enabling the system to resist various complex security threats.

[0169] In the above-mentioned embodiment, a data encryption transmission method with an early warning mechanism is provided. Correspondingly, the present application also provides a data encryption transmission device with an early warning mechanism. Figure 2 , which is a schematic diagram of an embodiment of a data encryption transmission device with an early warning mechanism of the present application. Since this embodiment, i.e., the second embodiment, is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The embodiment described below is only illustrative.

[0170] The second embodiment of the present application provides a data encryption transmission device with an early warning mechanism, comprising: The data storage unit 201 is configured to pre-store multiple sets of encryption schemes with unique names at the front end and the back end of the data transmission system, wherein the unique names are only known within the system; The encryption selection unit 202 is configured to randomly select an encryption scheme based on security requirements, and before sending the request data, encrypt the request data using the selected encryption scheme to generate encrypted request data, wherein the request data includes user identity authentication information, transaction instructions, and query requests; The transmission control unit 203 is configured to send the encrypted request data and the unique name corresponding to the selected encryption scheme to the backend, and record the unique name corresponding to the selected encryption scheme and related transmission indicators, wherein the related transmission indicators include the sending time and the restriction conditions on the return message; The receiving processing unit 204 is configured to receive the encrypted request data and the unique name corresponding to the selected encryption scheme at the back end, decrypt the data using the same encryption scheme as the front end, process the decrypted request data, encrypt the processing result data again using the same encryption scheme as the front end, and send the encrypted processing result data back to the front end; The decryption verification unit 205 is configured to decrypt the encrypted data after receiving the encrypted data at the front end, and verify whether the encrypted data meets the time requirements of the relevant transmission indicators recorded and the restriction conditions of the return message; The exception handling unit 206 is configured to record the exception and feed back the exception to the backend when an exception is found during data decryption or index calculation, and stop the current data processing, wherein the exception includes decryption failure, data delay exception, data format and length inconsistency; The security response unit 207 is configured to take security measures to deal with potential data security threats after the back end receives abnormal feedback from the front end.

[0171] A third embodiment of the present application provides an electronic device, the electronic device comprising: processor; The memory is used to store a program, and when the program is read and executed by the processor, the data encryption transmission method with an early warning mechanism provided in the first embodiment of the present application is executed.

[0172] The fourth embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the data encryption transmission method with an early warning mechanism provided in the first embodiment of the present application is executed.

[0173] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. A data encryption transmission method with an early warning mechanism, characterized in that: include: Preset and store multiple sets of encryption schemes with unique names at the front end and back end of the data transmission system, wherein the unique names are only known within the system; The front end randomly selects a set of encryption schemes based on security requirements, and uses the selected encryption scheme to encrypt the request data before sending it to generate encrypted request data; the encrypted request data and the unique name corresponding to the selected encryption scheme are sent to the back end; the unique name corresponding to the selected encryption scheme and related transmission indicators are recorded; wherein the request data includes user identity authentication information, transaction instructions and query requests; the related transmission indicators include sending time and restrictions on return messages; After receiving the encrypted request data and the unique name corresponding to the selected encryption scheme, the backend uses the same encryption scheme as the frontend to decrypt the data; processes the decrypted request data, and encrypts the processing result data again using the same encryption scheme as the frontend; and sends the encrypted processing result data back to the frontend; After receiving the encrypted data, the front end decrypts the encrypted data and verifies whether the encrypted data meets the time requirements of the relevant transmission indicators recorded and the restriction conditions of the returned message; If an abnormality is found during data decryption or index calculation, the front end will record the abnormality and feedback the abnormality to the back end, and stop the current data processing; wherein the abnormality includes decryption failure, data delay abnormality, data format and length inconsistency; After receiving abnormal feedback from the front end, the back end takes security measures to deal with potential data security threats.

2. The data encryption transmission method according to claim 1, characterized in that: The multiple encryption schemes include at least one symmetric encryption algorithm and at least one asymmetric encryption algorithm, and each algorithm has independent naming and configuration parameters.

3. The data encryption transmission method according to claim 1, characterized in that: The front end randomly selects a set of encryption schemes based on security requirements, including: Define a safety factor set , where each safety factor Representative Influencing parameters that affect the selection of encryption schemes, including the security level of the current network environment, the computing power of the user's device, and the data sensitivity score; According to the following formula (1), the comprehensive safety index is calculated : in, is the weight coefficient; Indicates the number of influencing parameters; According to the following formula (2), the index of the encryption scheme is obtained : in, is the adjustment coefficient; is the total number of encryption schemes; According to the index , determine the encryption scheme you choose.

4. The data encryption transmission method according to claim 1, characterized in that: The encrypted data and the unique name of the encryption scheme are sent to the backend via a secure channel, and the secure channel uses the TLS protocol to encrypt all transmitted data.

5. The data encryption transmission method according to claim 1, characterized in that: After decrypting the request data, the backend performs an integrity check on the data content and processes and re-encrypts it after confirming that it has not been tampered with.

6. The data encryption transmission method according to claim 1, characterized in that: After decrypting the encrypted data, the front end verifies whether the data is received within the predetermined time window. If the time window is exceeded, it is considered as data delay abnormality.

7. The data encryption transmission method according to claim 1, characterized in that: When the front end finds an abnormality, it also generates a security event log, which includes: type and severity of abnormality; A snapshot of the system status when an anomaly occurs; Related network traffic characteristics.

8. The data encryption transmission method according to claim 7, characterized in that: When the front end finds an exception, it adjusts the local security policy according to the severity of the exception. The local security policy includes increasing the authentication requirements or limiting the use of specified functions.

9. The data encryption transmission method according to claim 1, characterized in that: After receiving the abnormal feedback from the front end, the back end performs the following steps: Compare the received abnormal information with the global security intelligence database in real time; Based on the comparison results, the threat level is assessed using a pre-trained security expert system; Automatically generate and execute security response measures based on the assessed threat level, where the security response measures include: Dynamically adjust network firewall rules; Start the deep packet inspection process; Isolate suspicious network segments or devices.

10. A data encryption transmission device with an early warning mechanism, characterized in that: include: A data storage unit configured to pre-store multiple sets of encryption schemes with unique names at the front end and the back end of the data transmission system, wherein the unique names are only known within the system; an encryption selection unit, configured to randomly select a set of encryption schemes based on security requirements, and to encrypt the request data using the selected encryption scheme before sending the request data to generate encrypted request data, wherein the request data includes user identity authentication information, transaction instructions, and query requests; A transmission control unit configured to send the encrypted request data and the unique name corresponding to the selected encryption scheme to the back end, and record the unique name corresponding to the selected encryption scheme and related transmission indicators, wherein the related transmission indicators include the sending time and the restriction conditions on the return message; A receiving processing unit, configured to receive the encrypted request data and the unique name corresponding to the selected encryption scheme at the back end, decrypt the data using the same encryption scheme as the front end, process the decrypted request data, encrypt the processing result data again using the same encryption scheme as the front end, and send the encrypted processing result data back to the front end; A decryption verification unit, configured to decrypt the encrypted data after receiving the encrypted data at the front end, and verify whether the encrypted data meets the time requirements of the relevant transmission indicators recorded and the restriction conditions of the returned message; An exception handling unit is configured to record an exception and feed it back to the backend when an exception is found during data decryption or index calculation, and stop current data processing, wherein the exception includes decryption failure, data delay exception, and data format and length inconsistency; The security response unit is configured to take security measures to deal with potential data security threats after receiving abnormal feedback from the front end at the back end.

Images