Cloud edge collaborative security communication system

Abstract

The invention discloses a cloud side collaborative security communication system, and relates to the field of security communication. The cloud-side collaborative security communication system comprises an edge device, an edge computing gateway, a security communication protocol and a cloud platform, and the edge device is responsible for real-time data acquisition and primary processing; the edge computing gateway is used as a bridge between the edge device and the cloud; the secure communication protocol adopts a hybrid encryption system to encrypt and authenticate a data transmission process; and the cloud platform is responsible for receiving data from the edge equipment. According to the cloud side collaborative security communication system, the hybrid encryption system combines the advantages of symmetric encryption and asymmetric encryption at the same time. The symmetric encryption algorithm is widely applied to data encryption due to rapidness and high efficiency, and the asymmetric encryption algorithm is famous in terms of high security, especially in the aspects of key exchange and data integrity verification. By combining the two, the hybrid encryption system can more effectively resist various attack means.

Description

Technical Field

[0001] The present invention relates to the field of secure communication technology, and specifically to a cloud-edge collaborative secure communication system. Background Art

[0002] The cloud-edge collaborative secure communication system is a system that combines the advantages of cloud computing and edge computing. It aims to achieve efficient and secure data interaction and collaborative work between cloud and edge devices through a secure communication mechanism.

[0003] The cloud-edge collaborative secure communication system combines the powerful computing power of the cloud with the real-time data processing capabilities of edge devices to achieve rapid data collection, processing, analysis and secure transmission. The system not only improves the speed and efficiency of data processing, but also ensures the security and reliability of data transmission through secure communication protocols.

[0004] The edge computing gateway acts as a bridge between edge devices and the cloud. During data collection, conversion, and transmission, it needs to encrypt data. Nowadays, most of them use symmetric encryption algorithms and asymmetric encryption algorithms. The symmetric encryption algorithm uses the same key for encryption and decryption, which has high efficiency, but the key management is complex and the security is relatively low. The asymmetric encryption algorithm uses a pair of different keys for encryption and decryption, which has high security, but the encryption and decryption process is relatively complex and consumes more computing resources. Summary of the invention

[0005] In response to the shortcomings of the prior art, the present invention provides a cloud-edge collaborative secure communication system, which solves the problem that most of the current encryption algorithms use symmetric encryption algorithms and asymmetric encryption algorithms, among which symmetric encryption algorithms have higher efficiency, but complex key management and relatively low security, while asymmetric encryption algorithms have higher security, but the encryption and decryption processes are relatively complex and consume more computing resources.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a cloud-edge collaborative secure communication system, including an edge device, an edge computing gateway, a secure communication protocol and a cloud platform, wherein the edge device is responsible for real-time data collection and preliminary processing, including but not limited to sensor data and device status;

[0007] The edge computing gateway acts as a bridge between edge devices and the cloud, responsible for data collection, conversion, encryption and secure transmission to the cloud;

[0008] The secure communication protocol uses a hybrid encryption system to encrypt and authenticate the data transmission process to ensure confidentiality, integrity and non-repudiation during the data transmission process;

[0009] The cloud platform is responsible for receiving data from edge devices and performing more in-depth data analysis, machine learning, and model training tasks;

[0010] The hybrid encryption system comprises the following steps:

[0011] Step 1: Key preparation;

[0012] Step 2: Session key generation and encryption;

[0013] Step 3: Data encryption and transmission;

[0014] Step 4: Data decryption;

[0015] Step 5: Verification and confirmation.

[0016] Preferably, the edge device is deployed close to the data source to reduce data transmission delay and bandwidth consumption. The edge computing gateway also has computing and caching capabilities and can perform preliminary data processing and analysis locally. The cloud platform also has data management capabilities and can store, back up and restore data.

[0017] Preferably, the key preparation step is specifically as follows:

[0018] Generate an asymmetric key pair: The receiver generates an asymmetric key pair, including a public key and a private key. The public key can be made public, while the private key needs to be kept confidential.

[0019] Public key distribution: The recipient distributes the public key to all required senders through a secure channel, which includes but is not limited to a public key distribution center, a certificate authority, and a security protocol.

[0020] Preferably, the session key generation and encryption steps are specifically as follows:

[0021] Generate session key: The sender uses a random number generator to generate a temporary symmetric encryption key, namely the session key, which is used to encrypt the actual transmitted data;

[0022] Encrypted session key: The sender encrypts the session key using the receiver's public key to generate an encrypted session key.

[0023] Preferably, the data encryption and transmission steps are specifically as follows:

[0024] Data encryption: The sender uses the session key to encrypt the plaintext data to be sent to generate ciphertext;

[0025] Combined ciphertext: The sender combines the encrypted session key and ciphertext in a specific format to form the final mixed encrypted ciphertext.

[0026] Transmitting ciphertext: The sender transmits the combined mixed encrypted ciphertext to the receiver through an insecure network.

[0027] Preferably, the specific format includes the following parts:

[0028] Separator: Separators are used to separate session key ciphertext and message ciphertext to distinguish between the two; these separators can be simple characters (such as colon ":", comma ",", semicolon ";", etc.), or complex strings and formats (such as specific header information, version number, length field, etc.).

[0029] Header information: It includes the identifier of the encryption algorithm, the key length, the length of the data block, and the timestamp, which is used to provide more contextual information and metadata; this information helps the receiver to correctly parse and verify the ciphertext.

[0030] Session key ciphertext: It is the encrypted session key, which is part of the combined format. The recipient needs to use the private key to decrypt this part to obtain the session key.

[0031] Message ciphertext: It is the message content encrypted with the session key and is also the key part in the combined format. After obtaining the session key, the receiver will use it to decrypt this part of the content to restore the original message.

[0032] Preferably, the data decryption step is specifically as follows:

[0033] Separating ciphertext: After receiving the mixed encrypted ciphertext, the receiver first separates it into the encrypted session key and ciphertext;

[0034] Decrypting the session key: The receiver uses his own private key to decrypt the encrypted session key and restore the session key;

[0035] Decrypted data: The receiver uses the restored session key to decrypt the ciphertext and restore the plaintext data.

[0036] Preferably, the verification and confirmation steps are specifically as follows:

[0037] Integrity verification: The receiver uses hash function verification technology and message authentication code technology to verify the integrity and authenticity of the ciphertext to ensure that the data has not been tampered with during transmission;

[0038] Confirmation of Receipt: The receiver is able to send a confirmation message to the sender to confirm that the data was successfully received and decrypted.

[0039] Preferably, the hash function verification technology is specifically:

[0040] The hash function can transform an input of any length into an output of a fixed length through a hash algorithm, and this output is the hash value; the hash function has the characteristics of one-way, collision resistance and determinism, making it very suitable for verifying the integrity of data.

[0041] Sender: Before sending data, the sender will calculate the hash value of the plaintext data and send the hash value together with the ciphertext to the receiver;

[0042] Receiver: After receiving the ciphertext and hash value, the receiver first uses the session key to decrypt the ciphertext to obtain the plaintext data, and then calculates the hash value of the decrypted plaintext data;

[0043] If the calculated hash value is the same as the hash value sent by the sender, it can be confirmed that the data has not been tampered with during transmission.

[0044] Preferably, the message authentication code technology is specifically:

[0045] Sender: The sender uses a shared key and hash function to calculate the MAC value of the message and sends the MAC value together with the ciphertext to the receiver. The shared key can be a session key and another dedicated key.

[0046] Receiver: After receiving the ciphertext and MAC value, the receiver will use the same key and hash function to calculate the MAC value of the decrypted plaintext data;

[0047] If the calculated MAC value is the same as the MAC value sent by the sender, it can be confirmed that the data has not been tampered with during transmission and is indeed from the claimed sender.

[0048] The present invention discloses a cloud-edge collaborative secure communication system, which has the following beneficial effects:

[0049] 1. The hybrid encryption system of the cloud-edge collaborative secure communication system combines the advantages of symmetric encryption and asymmetric encryption. Symmetric encryption algorithms are widely used in data encryption because of their speed and efficiency, while asymmetric encryption algorithms are known for their strong security, especially in key exchange and data integrity verification. By combining the two, the hybrid encryption system can more effectively resist various attack methods, such as man-in-the-middle attacks, brute force cracking, etc., thereby greatly improving the security of data transmission.

[0050] 2. In the hybrid encryption system, the cloud-edge collaborative secure communication system uses the public key of the asymmetric encryption algorithm to encrypt the symmetric encryption key, which is used to encrypt the actual transmitted data. This method ensures that even if the session key is intercepted during transmission, the attacker cannot easily decrypt it, because decryption requires the corresponding private key, which is kept securely by the recipient.

[0051] 3. In the actual application of the cloud-edge collaborative secure communication system, in order to improve security, the receiver uses both hash function verification technology and message authentication code technology to verify the integrity and authenticity of the ciphertext. The hash function is mainly used to verify the integrity of the data, while the message authentication code technology provides stronger identity authentication and anti-tampering protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0053] Figure 1 This is a system architecture diagram of the present invention;

[0054] Figure 2 This is a diagram of the architecture of the hybrid encryption system of the present invention;

[0055] Figure 3 This is a schematic diagram of the key preparation steps of the present invention;

[0056] Figure 4 A schematic diagram of the session key generation and encryption steps of the present invention;

[0057] Figure 5 This is a schematic diagram of the data encryption and transmission steps of the present invention;

[0058] Figure 6 This is a schematic diagram of the data decryption steps of the present invention;

[0059] Figure 7 Schematic diagram of the verification and confirmation steps of the present invention. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0061] The embodiments of the present application provide a cloud-edge collaborative secure communication system to solve the problem that most of the current symmetric encryption algorithms and asymmetric encryption algorithms are used, wherein the symmetric encryption algorithm is more efficient, but the key management is complex and the security is relatively low, while the asymmetric encryption algorithm has higher security, but the encryption and decryption process is relatively complex and consumes more computing resources. The hybrid encryption system combines the advantages of both symmetric and asymmetric encryption. Symmetric encryption algorithms are widely used in data encryption because of their fast and efficient performance, while asymmetric encryption algorithms are known for their strong security, especially in key exchange and data integrity verification. By combining the two, the hybrid encryption system can more effectively resist various attack methods, such as man-in-the-middle attacks, brute force cracking, etc., thereby greatly improving the security of data transmission.

[0062] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0063] An embodiment of the present invention discloses a cloud-edge collaborative secure communication system.

[0064] According to the attached Figure 1-7 As shown, it includes edge devices, edge computing gateways, secure communication protocols and cloud platforms, wherein the edge devices are responsible for real-time data collection and preliminary processing, including but not limited to sensor data and device status;

[0065] The edge computing gateway acts as a bridge between edge devices and the cloud, responsible for data collection, conversion, encryption and secure transmission to the cloud;

[0066] The secure communication protocol uses a hybrid encryption system to encrypt and authenticate the data transmission process to ensure confidentiality, integrity and non-repudiation during the data transmission process;

[0067] The cloud platform is responsible for receiving data from edge devices and performing more in-depth data analysis, machine learning, and model training tasks;

[0068] The hybrid encryption system comprises the following steps:

[0069] Step 1: Key preparation;

[0070] Step 2: Session key generation and encryption;

[0071] Step 3: Data encryption and transmission;

[0072] Step 4: Data decryption;

[0073] Step 5: Verification and confirmation.

[0074] Hybrid encryption systems combine the advantages of both symmetric and asymmetric encryption. Symmetric encryption algorithms are widely used for data encryption because of their speed and efficiency, while asymmetric encryption algorithms are known for their strong security, especially in key exchange and data integrity verification. By combining the two, hybrid encryption systems can more effectively resist various attack methods, such as man-in-the-middle attacks, brute force cracking, etc., thereby greatly improving the security of data transmission.

[0075] Furthermore, the edge device is deployed close to the data source to reduce data transmission delay and bandwidth consumption. The edge computing gateway also has computing and caching capabilities, and can perform preliminary data processing and analysis locally. The cloud platform also has data management capabilities and can store, back up and restore data.

[0076] Specifically disclosed, the key preparation steps are:

[0077] Generate an asymmetric key pair: The receiver generates an asymmetric key pair, including a public key and a private key. The public key can be made public, while the private key needs to be kept confidential.

[0078] Public key distribution: The recipient distributes the public key to all required senders through a secure channel, which includes but is not limited to a public key distribution center, a certificate authority, and a security protocol.

[0079] Preferably, the session key generation and encryption steps are specifically as follows:

[0080] Generate session key: The sender uses a random number generator to generate a temporary symmetric encryption key, namely the session key, which is used to encrypt the actual transmitted data;

[0081] Encrypted session key: The sender encrypts the session key using the receiver's public key to generate an encrypted session key.

[0082] Furthermore, the data encryption and transmission steps are specifically as follows:

[0083] Data encryption: The sender uses the session key to encrypt the plaintext data to be sent to generate ciphertext;

[0084] Combined ciphertext: The sender combines the encrypted session key and ciphertext in a specific format to form the final mixed encrypted ciphertext.

[0085] Transmitting ciphertext: The sender transmits the combined mixed encrypted ciphertext to the receiver through an insecure network.

[0086] In a hybrid encryption system, the public key of an asymmetric encryption algorithm is used to encrypt the symmetric encryption key, which is then used to encrypt the actual transmitted data. This ensures that even if the session key is intercepted during transmission, the attacker cannot easily decrypt it because the decryption requires the corresponding private key, which is kept securely by the recipient.

[0087] Specifically disclosed, the specific format includes the following parts:

[0088] Separator: Separators are used to separate session key ciphertext and message ciphertext to distinguish between the two; these separators can be simple characters (such as colon ":", comma ",", semicolon ";"), or complex strings and formats (such as specific header information, version number, length field, etc.).

[0089] Header information: It includes the identifier of the encryption algorithm, the key length, the length of the data block, and the timestamp, which is used to provide more contextual information and metadata; this information helps the receiver to correctly parse and verify the ciphertext.

[0090] Session key ciphertext: It is the encrypted session key, which is part of the combined format. The recipient needs to use the private key to decrypt this part to obtain the session key.

[0091] Message ciphertext: It is the message content encrypted with the session key and is also the key part in the combined format. After obtaining the session key, the receiver will use it to decrypt this part of the content to restore the original message.

[0092] Specifically disclosed, the data decryption steps are as follows:

[0093] Separating ciphertext: After receiving the mixed encrypted ciphertext, the receiver first separates it into the encrypted session key and ciphertext;

[0094] Decrypting the session key: The receiver uses his own private key to decrypt the encrypted session key and restore the session key;

[0095] Decrypted data: The receiver uses the restored session key to decrypt the ciphertext and restore the plaintext data.

[0096] Specifically disclosed, the verification and confirmation steps are:

[0097] Integrity verification: The receiver uses hash function verification technology and message authentication code technology to verify the integrity and authenticity of the ciphertext to ensure that the data has not been tampered with during transmission;

[0098] Confirmation of Receipt: The receiver is able to send a confirmation message to the sender to confirm that the data was successfully received and decrypted.

[0099] Furthermore, the hash function verification technology is specifically as follows:

[0100] The hash function can transform an input of any length into an output of a fixed length through a hash algorithm, and this output is the hash value; the hash function has the characteristics of one-way, collision resistance and determinism, making it very suitable for verifying the integrity of data.

[0101] Sender: Before sending data, the sender will calculate the hash value of the plaintext data and send the hash value together with the ciphertext to the receiver;

[0102] Receiver: After receiving the ciphertext and hash value, the receiver first uses the session key to decrypt the ciphertext to obtain the plaintext data, and then calculates the hash value of the decrypted plaintext data;

[0103] If the calculated hash value is the same as the hash value sent by the sender, it can be confirmed that the data has not been tampered with during transmission.

[0104] Furthermore, the message authentication code technology is specifically:

[0105] Sender: The sender uses a shared key and hash function to calculate the MAC value of the message and sends the MAC value together with the ciphertext to the receiver. The shared key can be a session key and another dedicated key.

[0106] Receiver: After receiving the ciphertext and MAC value, the receiver will use the same key and hash function to calculate the MAC value of the decrypted plaintext data;

[0107] If the calculated MAC value is the same as the MAC value sent by the sender, it can be confirmed that the data has not been tampered with during transmission and is indeed from the claimed sender.

[0108] In practical applications, in order to improve security, the receiver uses both hash function verification technology and message authentication code technology to verify the integrity and authenticity of the ciphertext. Hash functions are mainly used to verify the integrity of data, while message authentication code technology provides stronger identity authentication and anti-tampering protection.

[0109] Hybrid encryption systems combine the advantages of both symmetric and asymmetric encryption. Symmetric encryption algorithms are widely used for data encryption because of their speed and efficiency, while asymmetric encryption algorithms are known for their strong security, especially in key exchange and data integrity verification. By combining the two, hybrid encryption systems can more effectively resist various attack methods, such as man-in-the-middle attacks, brute force cracking, etc., thereby greatly improving the security of data transmission.

[0110] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A cloud-edge collaborative secure communication system, comprising an edge device, an edge computing gateway, a secure communication protocol and a cloud platform, characterized in that: The edge device is responsible for real-time data collection and preliminary processing, including but not limited to sensor data and device status; The edge computing gateway acts as a bridge between edge devices and the cloud, responsible for data collection, conversion, encryption and secure transmission to the cloud; The secure communication protocol uses a hybrid encryption system to encrypt and authenticate the data transmission process to ensure confidentiality, integrity and non-repudiation during the data transmission process; The cloud platform is responsible for receiving data from edge devices and performing more in-depth data analysis, machine learning, and model training tasks; The hybrid encryption system comprises the following steps: Step 1: Key preparation; Step 2: Session key generation and encryption; Step 3: Data encryption and transmission; Step 4: Data decryption; Step 5: Verification and confirmation.

2. A cloud-edge collaborative secure communication system according to claim 1, characterized in that: The edge device is deployed close to the data source to reduce data transmission delay and bandwidth consumption. The edge computing gateway also has computing and caching capabilities, and can perform preliminary data processing and analysis locally. The cloud platform also has data management capabilities and can store, back up and restore data.

3. A cloud-edge collaborative secure communication system according to claim 1, characterized in that: The key preparation steps are specifically as follows: Generate an asymmetric key pair: The receiver generates an asymmetric key pair, including a public key and a private key. The public key can be made public, while the private key needs to be kept confidential. Public key distribution: The recipient distributes the public key to all required senders through a secure channel, which includes but is not limited to a public key distribution center, a certificate authority, and a security protocol.

4. A cloud-edge collaborative secure communication system according to claim 1, characterized in that: The session key generation and encryption steps are specifically as follows: Generate session key: The sender uses a random number generator to generate a temporary symmetric encryption key, namely the session key, which is used to encrypt the actual transmitted data; Encrypted session key: The sender encrypts the session key using the receiver's public key to generate an encrypted session key.

5. The cloud-edge collaborative secure communication system according to claim 1, characterized in that: The data encryption and transmission steps are specifically as follows: Data encryption: The sender uses the session key to encrypt the plaintext data to be sent to generate ciphertext; Combined ciphertext: The sender combines the encrypted session key and ciphertext in a specific format to form the final mixed encrypted ciphertext; Transmitting ciphertext: The sender transmits the combined mixed encrypted ciphertext to the receiver through an insecure network.

6. A cloud-edge collaborative secure communication system according to claim 5, characterized in that: The specific format includes the following parts: Separator: A separator is used to separate the session key ciphertext and the message ciphertext to distinguish between the two. Header information: It includes the identifier of the encryption algorithm, the key length, the length of the data block, and the timestamp, which is used to provide more contextual information and metadata; Session key ciphertext: It is the encrypted session key, which is part of the combined format. The recipient needs to use the private key to decrypt this part to obtain the session key. Message ciphertext: It is the message content encrypted with the session key and is also the key part in the combined format. After obtaining the session key, the receiver will use it to decrypt this part of the content to restore the original message.

7. A cloud-edge collaborative secure communication system according to claim 1, characterized in that: The data decryption steps are specifically as follows: Separating ciphertext: After receiving the mixed encrypted ciphertext, the receiver first separates it into the encrypted session key and ciphertext; Decrypting the session key: The receiver uses his own private key to decrypt the encrypted session key and restore the session key; Decrypted data: The receiver uses the restored session key to decrypt the ciphertext and restore the plaintext data.

8. A cloud-edge collaborative secure communication system according to claim 1, characterized in that: The verification and confirmation steps are specifically as follows: Integrity verification: The receiver uses hash function verification technology and message authentication code technology to verify the integrity and authenticity of the ciphertext to ensure that the data has not been tampered with during transmission; Confirmation of Receipt: The receiver is able to send a confirmation message to the sender to confirm that the data was successfully received and decrypted.

9. A cloud-edge collaborative secure communication system according to claim 8, characterized in that: The hash function verification technology is specifically: The hash function can transform an input of any length into an output of fixed length through a hash algorithm, and this output is the hash value; Sender: Before sending data, the sender will calculate the hash value of the plaintext data and send the hash value together with the ciphertext to the receiver; Receiver: After receiving the ciphertext and hash value, the receiver first uses the session key to decrypt the ciphertext to obtain the plaintext data, and then calculates the hash value of the decrypted plaintext data; If the calculated hash value is the same as the hash value sent by the sender, it can be confirmed that the data has not been tampered with during transmission.

10. A cloud-edge collaborative secure communication system according to claim 8, characterized in that: The message authentication code technology is specifically: Sender: The sender uses a shared key and hash function to calculate the MAC value of the message and sends the MAC value together with the ciphertext to the receiver. The shared key can be a session key and another dedicated key. Receiver: After receiving the ciphertext and MAC value, the receiver will use the same key and hash function to calculate the MAC value of the decrypted plaintext data; If the calculated MAC value is the same as the MAC value sent by the sender, it can be confirmed that the data has not been tampered with during transmission and is indeed from the claimed sender.

Images