Data security transmission method and system based on data encryption algorithm

Abstract

The invention belongs to the technical field of data transmission, and discloses a data security transmission method and system based on a data encryption algorithm. The method comprises the following steps that: a third-party mechanism carries out asymmetric key generation and digital identity registration on all data transmission devices; the first data transmission device is used for establishing a quantum communication line and a data communication line and generating homomorphic symmetric keys; the first data transmission device performs communication attack detection by using the communication attack detection model; the first data transmission device is used for generating a model by using an encryption updating strategy and carrying out encryption updating; the first data transmission device performs double-layer encryption and signature on the real-time transmission data and transmits the real-time transmission data to the second data transmission device; and the second data transmission device performs identity authentication, asymmetric decryption and symmetric decryption to obtain completely decrypted real-time transmission data. According to the invention, the problems of low data security, low intelligent degree and low practicability in the prior art are solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of data transmission, and in particular relates to a data security transmission method and system based on a data encryption algorithm. Background Art

[0002] Data transmission technology refers to the methods and means of transmitting data between different devices or networks. With the rapid development of information technology, data transmission technology plays a vital role in modern society. In the process of data transmission, data security is particularly important because data is more vulnerable to attacks during transmission, including threats such as unauthorized access, leakage, tampering, and destruction. Therefore, encryption technology was introduced into the field of data transmission, and a data security transmission technology that uses encryption algorithms to encrypt the data transmission process was proposed, which improved the security of data transmission.

[0003] However, with the development and proliferation of attack technologies, existing data security transmission technologies can no longer meet the needs and have the following defects: 1) The encryption algorithm used in the existing data security transmission technology is relatively simple and can be easily intercepted and cracked by malicious third parties, thereby decrypting the transmitted data, and the security of the data cannot be guaranteed; 2) The existing data security transmission technology has a low level of intelligence and lacks communication attack detection on data communication lines, and is unable to detect potential communication attacks in a timely manner before or during data transmission; 3) The key update mechanism of existing data security transmission technology mostly adopts a timed update method, which has low practicality and cannot be adaptively adjusted according to the real-time situation of data transmission. Summary of the invention

[0004] In order to solve the problems of low data security, low intelligence and low practicality in the prior art, the present invention aims to provide a data security transmission method and system based on a data encryption algorithm.

[0005] The technical solution adopted by the present invention is: A data security transmission method based on a data encryption algorithm comprises the following steps: The third-party institution generates asymmetric keys and registers digital identities for all data transmission devices, obtains the public-private key pair and signature information of the data transmission device, stores the public key in the public-private key pair to the third-party institution, and returns the signature information and the private key in the public-private key pair to the corresponding data transmission device; The first data transmission device as the sender confirms the second data transmission device as the receiver, builds a quantum communication line and a data communication line, and uses the QKD technology to perform symmetric key interaction through the quantum communication line to generate a homomorphic symmetric key; The first data transmission device collects real-time communication flow data of the data communication line, and performs communication attack detection based on the real-time communication flow data using a pre-trained communication attack detection model to obtain a real-time attack detection result; The first data transmission device, if the real-time attack detection result is that an attack exists, uses a pre-trained encryption update strategy generation model according to the real-time attack detection result to encrypt and update the public-private key pair and the symmetric key, and returns to the communication attack detection step; The first data transmission device double-encrypts the real-time transmission data according to the symmetric key and the private key, signs the obtained double-encrypted real-time transmission data according to the signature information, and transmits the double-encrypted real-time transmission data and the obtained real-time signature data to the second data transmission device through the data communication line; The second data transmission device performs identity authentication on the real-time signature data. After the identity authentication is passed, the real-time transmission data after double-layer encryption is asymmetrically decrypted according to the public key of the first data transmission device, and the single-layer decrypted real-time transmission data is symmetrically decrypted according to the symmetric key to obtain the real-time transmission data after complete decryption.

[0006] Furthermore, the first data transmission device as the sender confirms the second data transmission device as the receiver, builds a quantum communication line and a data communication line, and uses the QKD technology through the quantum communication line to perform symmetric key interaction and generate a homomorphic symmetric key, including the following steps: A first data transmission device as a sender confirms a second data transmission device as a receiver, and defines a quantum communication line and a data communication line between the first data transmission device and the second data transmission device; Use swarm intelligence optimization algorithm to configure quantum repeaters for quantum communication lines and obtain the optimal quantum repeater configuration scheme; Use wireless transmission technology to build data communication lines, and configure several quantum repeaters connected in sequence according to the optimal quantum repeater configuration plan to build quantum communication lines; The first data transmission device prepares a key quantum state, sends the key quantum state to the second data transmission device through a quantum communication line, and measures the key quantum state to obtain a first measurement result; The second data transmission device uses a preset error correction code to perform error correction on the key quantum state, and measures the error-corrected key quantum state to obtain a second measurement result; The first data transmission device and the second data transmission device compare the public basis vectors and estimate the error rate of the first measurement result and the second measurement result through the data communication line, and generate a homomorphic symmetric key.

[0007] Furthermore, the swarm intelligence optimization algorithm is the IFWA algorithm; The communication attack detection model is constructed based on the RF-DANN-Elman algorithm, and the communication attack detection model includes a feature extraction module constructed based on the RF algorithm, a domain adversarial training module constructed based on the DANN algorithm, and a feature classifier constructed based on the Elman algorithm. The domain adversarial training module includes a gradient reversal layer and a domain classifier connected in sequence, and the feature extraction module is connected to the gradient reversal layer and the feature classifier respectively; The encrypted update strategy generation model is constructed based on the MPO-DQN algorithm, and the encrypted update strategy generation model includes a meta-strategy optimization module constructed based on the MPO algorithm and a reinforcement learning module constructed based on the DQN algorithm. The reinforcement learning module is provided with an intelligent agent, a deep Q network and an experience replay pool. The intelligent agent is respectively connected to the deep Q network, the experience replay pool and the meta-strategy optimization module, and the meta-strategy optimization module is connected to the experience replay pool.

[0008] Furthermore, a swarm intelligence optimization algorithm is used to configure quantum repeaters of quantum communication lines to obtain an optimal quantum repeater configuration scheme, including the following steps: Taking minimizing quantum transmission cost as the optimization goal, setting boundary conditions, and setting individual encoding vector format and algorithm parameters according to the quantum repeater configuration format The optimization objective is used as the fitness function, and according to the fitness function, boundary conditions, individual encoding vector format and algorithm parameters, a swarm intelligence optimization algorithm is used to iteratively search for the best and retain the best individual. If the number of iterations reaches the maximum number of iterations or the fitness value of the optimal individual meets the requirements, the individual encoding vector of the optimal individual is decoded to obtain the optimal quantum repeater configuration scheme.

[0009] Furthermore, the construction and deployment method of the communication attack detection model includes the following steps: A third-party organization collects some historical communication traffic data and uses the RF-DANN-Elman algorithm to build an initial communication attack detection model based on the data format of the historical communication traffic data; Dividing a number of historical communication traffic data into a pre-training set without setting true labels, and a training set and a test set with true labels; Input a pre-training set to pre-train the initial communication attack detection model, and obtain a pre-trained communication attack detection model; Input the training set, optimize the pre-trained communication attack detection model, obtain the optimized communication attack detection model, and generate several historical key features; Input the test set to test the optimized communication attack detection model and obtain the test accuracy. If the test accuracy is greater than the accuracy threshold, the final communication attack detection model is output and several historical attack detection results are generated. Otherwise, the optimization training continues. Extracting first model metadata of the final communication attack detection model, and sending the first model metadata to all data transmission devices connected to the third-party organization; The data transmission device reconstructs the model according to the first model metadata to obtain a reconstructed communication attack detection model.

[0010] Furthermore, the construction and deployment method of the encryption update strategy generation model includes the following steps: A third-party organization collects several historical attack detection results and corresponding historical key features, and uses the MPO-DQN algorithm to build an initial encryption update strategy generation model; Input several historical attack detection results and several historical key features, optimize and train the initial encryption update strategy generation model, and obtain the final encryption update strategy generation model; Extracting the second model metadata of the final encryption update strategy generation model, and sending the second model metadata to all data transmission devices connected to the third-party organization; The data transmission device reconstructs the model according to the second model metadata to obtain a reconstructed encryption update strategy generation model.

[0011] Further, the first data transmission device collects real-time communication flow data of the data communication line, and performs communication attack detection based on the real-time communication flow data using a pre-trained communication attack detection model to obtain a real-time attack detection result, including the following steps: A first data transmission device collects real-time communication flow data of a data communication line and performs preprocessing to obtain preprocessed real-time communication flow data; Input the preprocessed real-time communication traffic data into a pre-trained communication attack detection model, and use the communication attack detection model to extract corresponding real-time key features; According to the real-time key features, communication attack detection is performed to obtain real-time attack detection results.

[0012] Further, if the real-time attack detection result of the first data transmission device is that an attack exists, the first data transmission device uses a pre-trained encryption update strategy generation model according to the real-time attack detection result to encrypt and update the public-private key pair and the symmetric key of the first data transmission device and the second data transmission device, and returns to the communication attack detection step, including the following steps: The first data transmission device, if the real-time attack detection result is that an attack exists, then proceeds to the next step, otherwise, proceeds to the data encryption step; According to the real-time attack detection results and real-time key features, a pre-trained encryption update strategy generation model is used to generate an encryption update strategy to obtain a real-time encryption update strategy; According to the real-time encryption update strategy, a third party organization is called to encrypt and update the public-private key pair of the data transmission device to obtain an updated public-private key pair of the data transmission device; According to the real-time encryption update strategy, the symmetric key interaction is performed again between the first data transmission device and the second data transmission device to obtain an updated symmetric key, and then the communication attack detection step is returned.

[0013] Further, the second data transmission device performs identity authentication on the real-time signature data. After the identity authentication is passed, the real-time transmission data after the double-layer encryption is asymmetrically decrypted according to the public key of the first data transmission device, and the single-layer decrypted real-time transmission data is symmetrically decrypted according to the symmetric key to obtain the completely decrypted real-time transmission data, including the following steps: The second data transmission device calls a third party organization to perform identity authentication on the real-time signature data. If the identity authentication is passed, the next step is entered; otherwise, the data transmission is terminated; Extracting the public key of the first data transmission device stored by the third-party organization, and asymmetrically decrypting the double-layer encrypted real-time transmission data according to the public key to obtain the single-layer decrypted real-time transmission data; The obtained single-layer decrypted real-time transmission data is symmetrically decrypted according to the symmetric key to obtain the completely decrypted real-time transmission data.

[0014] A data security transmission system based on a data encryption algorithm is used to implement a data security transmission method. The system includes a third-party organization and several data transmission devices. The third-party organization is respectively connected to the several data transmission devices for communication; The data transmission device includes a first data transmission device as a sender and a second data transmission device as a receiver. The first data transmission device is communicatively connected to the second data transmission device, and the first data transmission device is provided with a symmetric key interaction unit, a communication attack detection unit, an encryption update strategy generation unit and a double-layer encryption unit, and the second data transmission device is provided with an identity authentication unit and a complete decryption unit.

[0015] The beneficial effects of the present invention are: The present invention provides a data security transmission method and system based on a data encryption algorithm. During data transmission, an asymmetric encryption algorithm and a symmetric encryption algorithm are combined to perform double-layer encryption on the data. Even if a malicious third party intercepts and violently cracks one layer of the key, the transmitted data cannot be decrypted, thereby improving the security of the data and ensuring the reliability of data transmission. In addition, the digital identity authentication technology is combined to further improve the security level, effectively prevent middleman attacks, and ensure the integrity of data during transmission. Quantum communication technology is used for key distribution, which is almost impossible to be intercepted or cracked, thereby further ensuring the security of the key. Key pairs are automatically generated and managed by a third party organization, reducing human errors and improving the efficiency of key management. The constructed communication attack detection model performs real-time communication attack detection on the data communication line, and can timely detect potential communication attacks before or during data transmission, thereby improving the degree of intelligence. The constructed encryption update strategy generation model can adaptively adjust the encryption key update mechanism according to the real-time situation of data transmission, and update the key in time as soon as possible after being attacked, thereby avoiding a vacuum period in security key protection.

[0016] Other beneficial effects of the present invention will be further described in the specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a flowchart of the data security transmission method based on the data encryption algorithm in the present invention.

[0018] Figure 2 It is a structural block diagram of the data security transmission system based on the data encryption algorithm in the present invention. DETAILED DESCRIPTION

[0019] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments.

[0020] Embodiment 1: like Figure 1 As shown, this embodiment provides a data security transmission method based on a data encryption algorithm, comprising the following steps: S1: A third-party institution generates asymmetric keys and registers digital identities for all data transmission devices, obtains public-private key pairs and signature information of the data transmission devices, stores the public key in the public-private key pair to the third-party institution, and returns the signature information and the private key in the public-private key pair to the corresponding data transmission device, including the following steps: S1-1: The trusted institution performs key initialization, obtains public parameters, master keys and original public keys, and collects attribute information and identity numbers of each data transmission device; The formula is:

[0021] In the formula, is a public parameter; is the master key; is the original public key; Integer domain A random number; Hash function for target hash; for The random number of the generator; is a random number Bilinear mapping of ; It is the base point of the prime domain; S1-2: Generate an asymmetric key according to the public parameter, the master key, the original public key and the attribute information of the data transmission device to obtain a public-private key pair of the corresponding data transmission device; the public-private key pair includes a public key and a private key;

[0022] In the formula, Data transmission device The private key of Integer domain A random number; All are private key parameters; Public parameters The target hash hash function; Indicator quantity for data transmission device; is the master key; is the original public key; Data transmission device 's public key; for The random number of the generator; Data transmission device Attribute information of A random number for the private key; S1-3: Perform digital identity registration according to the public key and identity number of the data transmission device to obtain the signature information of the corresponding data transmission device; The formula is: ; In the formula, k is a random number; For signature information; k u is the registration parameter; KID u For registration ID ; Hash function for target hash; ID u Data transmission device identification number; Data transmission device The private key of is the prime order; mod(*) is the remainder function; S1-4: traverse all data transmission devices, obtain the public-private key pair and signature information of each data transmission device, store the public key in a trusted institution, and return the signature information and private key to the corresponding data transmission device; S2: The first data transmission device as the sender confirms the second data transmission device as the receiver, builds a quantum communication line and a data communication line, and uses the quantum key distribution (QKD) technology through the quantum communication line to perform symmetric key interaction and generate a homomorphic symmetric key, including the following steps: S2-1: The first data transmission device as the sender confirms the second data transmission device as the receiver, and defines a quantum communication line and a data communication line between the first data transmission device and the second data transmission device, including the following steps: S2-1-1: The first data transmission device as the sender sets the second data transmission device as the receiver, and obtains the second physical address and the second IP address of the second data transmission device; S2-1-2: According to the first physical address of the first data transmission device and the second physical address of the second data transmission device, the quantum repeater position space within the physical range is set, and the quantum communication line is defined; S2-1-3: defining a data communication line according to a first IP address of the first data transmission device and a second IP address of the second data transmission device; S2-2: Use the Improved Fireworks Optimization Algorithm (IFWA) algorithm to configure quantum repeaters for quantum communication lines and obtain the optimal quantum repeater configuration scheme, including the following steps: S2-2-1: Taking minimizing quantum transmission cost as the optimization goal, set boundary conditions according to the quantum repeater position space, and set individual encoding vector format and algorithm parameters according to the quantum repeater configuration format S2-2-2: Take the optimization target as the fitness function, and use the swarm intelligence optimization algorithm according to the fitness function, boundary conditions, individual encoding vector format and algorithm parameters to iteratively search for the best and retain the best individual, including the following steps: S2-2-2-1: Set the fitness function of the IFWA algorithm according to the optimization goal; The formula is:

[0023] In the formula, is the fitness function; To optimize the objective function; is the time cost of quantum transmission; is the quantum transmission distance cost; Refers to the parameters for the solution; All are fitness weight values; S2-2-2-2: Initialize using the Circle chaotic mapping sequence according to the IFWA population parameters and individual vectors to generate several initial IFWA individuals of the initial IFWA population; The formula is:

[0024] In the formula, is the initial IFWA individual of Circle chaos mapping; is the randomly generated initial IFWA individual; It is the IFWA individual indicator; S2-2-2-3: According to the fitness function, the explosion radius, number of sparks and fitness value of the initial IFWA individual are obtained; The formula is:

[0025] In the formula, For the initial IFWA individuals The number of sparks; is a numerical constant; is the maximum fitness value in the initialized IFWA population; For the initial IFWA individuals The fitness value of is an infinitesimal constant; is the convergence factor; is a positive real number that is not 0;

[0026] In the formula, For the initial IFWA individuals Explosion radius; Adjusted constant for explosion radius; is the minimum fitness value in the initialized IFWA population; is the total number of IFWA individuals;

[0027] In the formula, is the convergence factor; tanh(.) is the hyperbolic tangent function; is the iteration indicator; is the maximum number of iterations; a max , a min are the maximum and minimum values ​​of the convergence factor, respectively; λ is the deceleration rate parameter, is the decreasing cycle parameter, λ =-2 π , = π ; The number of sparks determines the number of sub-fireworks produced after each firework explodes, and the explosion radius determines the distribution range of the sparks produced after the firework explodes in the solution space. In the early stage of iteration, a When the value of is large, the number of sparks of IFWA individuals is small and the explosion radius is large, which helps to reduce the computational burden and is more widely distributed, which helps to explore more solution spaces. In the later stage of iteration, a smaller explosion radius helps to perform fine search in local areas, and a larger number of sparks helps to increase the diversity of search; S2-2-2-4: Perform fireworks explosion according to the explosion radius, the number of sparks and the fitness value to obtain a number of updated IFWA individuals of the updated IFWA population; The formula is:

[0028] In the formula, For updated IFWA individuals; A random number between -1 and 1; S2-2-2-5: Use the Gaussian mutation algorithm to perform Gaussian mutation on the initialized IFWA population to generate several Gaussian mutated IFWA individuals of the Gaussian mutated IFWA population; The formula is:

[0029] In the formula, is the IFWA individual of Gaussian variation; is a Gaussian distributed random number with mean and variance both 1; S2-2-2-6: Use the dynamic reverse learning algorithm to perform dynamic reverse learning on the initialized IFWA population to obtain several reverse IFWA individuals of the reverse IFWA population; The formula is:

[0030] In the formula, For reverse IFWA individuals; γis the decreasing inertia coefficient; L max , L min are the maximum and minimum values ​​of the vector space respectively; S2-2-2-7: Obtain the fitness value of each updated IFWA individual, Gaussian mutated IFWA individual and reverse IFWA individual, and take the IFWA individual with the minimum fitness value as the optimal individual; S2-2-3: If the number of iterations reaches the maximum number of iterations or the fitness value of the optimal individual meets the requirements, the individual encoding vector of the optimal individual is decoded to obtain the optimal quantum repeater configuration scheme; S2-3: Use wireless transmission technology to build data communication lines, and configure several quantum repeaters connected in sequence according to the optimal quantum repeater configuration plan to build quantum communication lines; At the quantum repeater in the middle, an entanglement exchange operation is performed, which can connect two remote entangled states, thereby establishing quantum entanglement over a longer distance. By deploying quantum repeaters, the communication range of quantum key distribution can be expanded; S2-4: The first data transmission device prepares a key quantum state, sends the key quantum state to the second data transmission device through a quantum communication line, and measures the key quantum state to obtain a first measurement result; S2-5: The second data transmission device uses a preset error correction code to perform error correction on the key quantum state, and measures the error-corrected key quantum state to obtain a second measurement result; S2-6: The first data transmission device and the second data transmission device compare the first measurement result and the second measurement result through the data communication line, and estimate the error rate, and generate a homomorphic symmetric key; The first data transmission device and the second data transmission device publicly compare the basis vectors used to measure the quantum state through the data communication channel. Only when the basis vectors of the first data transmission device and the second data transmission device are the same, the measurement result of the second data transmission device is valid. By comparing some measurement results, the error rate of the quantum communication line is estimated. If the error rate is too high, it may indicate that there is eavesdropping, and the quantum key interaction should be abandoned at this time; S3: The first data transmission device collects real-time communication flow data of the data communication line, and performs communication attack detection based on the real-time communication flow data using a pre-trained communication attack detection model to obtain a real-time attack detection result, including the following steps: S3-1: a first data transmission device collects real-time communication flow data of a data communication line and performs preprocessing to obtain preprocessed real-time communication flow data; S3-2: input the pre-processed real-time communication traffic data into the pre-trained communication attack detection model, and use the communication attack detection model to extract the corresponding real-time key features; The communication attack detection model is constructed based on the Random Forest (RF)-Domain-Adversarial Neural Network (DANN)-Elman algorithm, and the communication attack detection model includes a feature extraction module constructed based on the RF algorithm, a domain adversarial training module constructed based on the DANN algorithm, and a feature classifier constructed based on the Elman algorithm. The domain adversarial training module includes a gradient reversal layer and a domain classifier connected in sequence, and the feature extraction module is connected to the gradient reversal layer and the feature classifier respectively; The feature extraction module uses the internal classification and regression tree The trained RF structure can directly screen the newly input communication traffic data according to the selected key features to obtain the corresponding key features, including transmission frequency features, traffic packet size features, transmission timestamp features and other key features; the gradient reversal layer is located between the feature extractor and the domain classifier, and its function is to reverse the gradient during the back propagation process, so that the domain classifier can learn the features that distinguish the source domain from the target domain during the training process, thereby realizing adversarial training. The domain classifier is used to predict whether the feature belongs to the source domain or the target domain according to the inverted features output by the gradient reversal layer. The constructed domain adversarial training module is used to distinguish the features of the source domain and the target domain, and try to distinguish which domain these features come from. Through this adversarial training, the feature extraction module gradually learns to ignore the information related to other domains and only retains the information related to the source domain, thereby improving the prediction efficiency. The memory function of the feature classifier performs classification prediction by pre-training better key features, further improving the prediction accuracy and prediction efficiency; The construction and deployment method of the communication attack detection model includes the following steps: A-1: A third-party organization collects some historical communication traffic data and uses the RF-DANN-Elman algorithm to build an initial communication attack detection model based on the data format of the historical communication traffic data; A-2: Divide a number of historical communication traffic data into a pre-training set without real labels, and a training set and a test set with real labels; A-3: Input the pre-training set to pre-train the initial communication attack detection model to obtain a pre-trained communication attack detection model; A-4: Input the training set, optimize the pre-trained communication attack detection model, obtain the optimized communication attack detection model, and generate several historical key features; A-5: Input the test set to test the optimized communication attack detection model and obtain the test accuracy. If the test accuracy is greater than the accuracy threshold, output the final communication attack detection model and generate several historical attack detection results. Otherwise, continue the optimization training. A-6: extracting the first model metadata of the final communication attack detection model, and sending the first model metadata to all data transmission devices connected to the third-party organization; A-7: a data transmission device, performing model reconstruction according to the first model metadata to obtain a reconstructed communication attack detection model; S3-3: Perform communication attack detection based on real-time key features to obtain real-time attack detection results; Real-time attack detection results include whether there is an attack and the corresponding attack type; S4: The first data transmission device, if the real-time attack detection result is that an attack exists, uses a pre-trained encryption update strategy generation model according to the real-time attack detection result to encrypt and update the public-private key pair and the symmetric key, and returns to the communication attack detection step, including the following steps: S4-1: The first data transmission device, if the real-time attack detection result is that an attack exists, proceeds to the next step, otherwise, proceeds to the data encryption step; S4-2: Based on the real-time attack detection results and the real-time key features, the encryption update strategy is generated using the pre-trained encryption update strategy generation model to obtain the real-time encryption update strategy; The encryption update strategy generation model is constructed based on the Meta-Policy Optimization (MPO)-Deep Q Network (DQN) algorithm, and the encryption update strategy generation model includes a meta-policy optimization module constructed based on the MPO algorithm and a reinforcement learning module constructed based on the DQN algorithm. The reinforcement learning module is provided with an intelligent agent, a deep Q network and an experience replay pool. The intelligent agent is connected to the deep Q network, the experience replay pool and the meta-policy optimization module respectively, and the meta-policy optimization module is connected to the experience replay pool. The meta-policy optimization module is used to optimize the deep Q network parameters in the reinforcement learning module so that these parameters can quickly adapt to new and unseen tasks, improve the generalization ability of the model, and update the deep Q network based on previous learning experience even under unseen data; through meta-policy optimization, the DQN algorithm can converge faster, reduce the amount of data and time required for training, and significantly improve learning efficiency; the reinforcement learning module is used to generate encryption update strategies based on real-time attack detection results and the status of real-time key features; The construction and deployment method of the encryption update strategy generation model includes the following steps: B-1: A third-party organization collects several historical attack detection results and corresponding historical key features, and uses the MPO-DQN algorithm to build an initial encryption update strategy generation model; B-2: Input several historical attack detection results and several historical key features, optimize and train the initial encryption update strategy generation model, and obtain the final encryption update strategy generation model, including the following steps: B-2-1: Generate questions based on the encryption update strategy, set up the simulation environment of the DQN algorithm, and set up several sub-scenarios of the MPO algorithm based on different encryption update scenarios; B-2-2: Based on several sub-scenarios, several historical attack detection results and several historical key features are input to train the initial meta-strategy optimization module, obtain the final meta-strategy optimization module, and generate several historical meta-strategy optimization experiences; B-2-3: Use the final meta-strategy optimization module to output the historical initial network parameters of the deep Q network of the initial reinforcement learning module, initialize the deep Q network according to the historical initial network parameters, and obtain the initialized reinforcement learning module; B-2-4: Define the state space of the reinforcement learning module based on historical attack detection results and historical key features, define the action space of the reinforcement learning module based on the preset encrypted update action, and set the reward function based on the impact of the preset encrypted update action on the state in the state space; B-2-5: Based on the state space, action space and reward function, input several historical attack detection results and several historical key features, train the initialized reinforcement learning module, obtain the final reinforcement learning module, and generate several historical reinforcement learning experiences; B-2-6: Store several historical meta-strategy optimization experiences and several historical reinforcement learning experiences in the experience replay pool of the final reinforcement learning module, and integrate the final meta-strategy optimization module and the final reinforcement learning module to obtain the final encrypted update strategy generation model; B-3: extracting the second model metadata of the final encryption update strategy generation model, and sending the second model metadata to all data transmission devices connected to the third-party organization; B-4: a data transmission device, performing model reconstruction according to the second model metadata to obtain a reconstructed encryption update strategy generation model; According to the real-time attack detection results and real-time key features, the encryption update strategy is generated using the pre-trained encryption update strategy generation model to obtain the real-time encryption update strategy, including the following steps: S4-2-1: Based on the real-time attack detection results and real-time key features, search and match in the experience playback pool of the encryption update strategy generation model to obtain the real-time meta-strategy optimization experience of successful matching; S4-2-2: Based on the real-time meta-strategy optimization experience, use the meta-strategy optimization module to output the real-time initial network parameters of the reinforcement learning module; S4-2-3: adjusting the deep Q network of the reinforcement learning module according to the real-time initial network parameters to obtain an adjusted reinforcement learning module, wherein the adjusted reinforcement learning module is provided with the adjusted deep Q network; S4-2-4: Based on the real-time attack detection results and real-time key features, search and match in the experience replay pool of the encryption update strategy generation model to obtain the real-time reinforcement learning experience of successful matching; S4-2-5: updating the action space of the reinforcement learning module according to a number of preset encrypted update actions corresponding to the real-time reinforcement learning experience to obtain an updated action space; S4-2-6: Update the state space of the reinforcement learning module according to the real-time attack detection results and the real-time key features to obtain an updated state space; S4-2-7: Input the updated state space into the adjusted reinforcement learning module, and generate the Q value of each possible action in the updated action space using the adjusted deep Q network based on the updated state space; S4-2-8: According to the reward function, the Q value of the possible action is iteratively updated to obtain the updated Q value of each possible action in the updated action space; S4-2-9: Repeat the above Q value update steps until the number of iterations reaches the iteration number threshold, and use the greedy strategy to select the possible action with the highest updated Q value as the real-time encryption update action; S4-2-10: Integrate several real-time encryption update actions to obtain a real-time encryption update strategy; The encryption update strategy includes adjusting the asymmetric encryption algorithm parameters of the asymmetric encryption algorithm, increasing the key update frequency of the asymmetric encryption algorithm, adjusting the symmetric encryption algorithm parameters of the symmetric key interaction, and re-performing the symmetric key interaction; In this embodiment, if the real-time attack detection result is that an attack exists and the attack type is a high-frequency attack, the updated state space includes the existence of an attack, a high-frequency attack, a high-frequency attack transmission frequency feature, a high-frequency attack traffic packet size feature, a high-frequency attack transmission timestamp feature, etc. The real-time encryption update strategy is to adjust the asymmetric encryption algorithm parameters of the asymmetric encryption algorithm, increase the key update frequency of the asymmetric encryption algorithm, adjust the symmetric encryption algorithm parameters of the symmetric key interaction, and re-perform the symmetric key interaction; If the real-time attack detection result is that an attack exists and the attack type is a low-frequency attack, the updated state space includes the existence of an attack, a low-frequency attack, the transmission frequency characteristics of a low-frequency attack, the size characteristics of a low-frequency attack traffic packet, the transmission timestamp characteristics of a low-frequency attack, etc. The real-time encryption update strategy only includes adjusting the symmetric encryption algorithm parameters of the symmetric key interaction and re-performing the symmetric key interaction; S4-3: According to the real-time encryption update strategy, a third party organization is called to encrypt and update the public-private key pair of the data transmission device to obtain an updated public-private key pair of the data transmission device; S4-4: according to the real-time encryption update strategy, re-perform symmetric key interaction between the first data transmission device and the second data transmission device to obtain an updated symmetric key, and return to the communication attack detection step; S5: The first data transmission device double-encrypts the real-time transmission data according to the symmetric key and the private key, signs the obtained double-encrypted real-time transmission data according to the signature information, and transmits the double-encrypted real-time transmission data and the obtained real-time signature data to the second data transmission device through the data communication line, including the following steps: S5-1: The first data transmission device uses a symmetric encryption algorithm according to a symmetric key to symmetrically encrypt the real-time transmission data to obtain single-layer encrypted real-time transmission data; The formula is:

[0031] In the formula, Data is transmitted in real time after single-layer encryption; is a symmetric encryption function; To transmit data in real time; is a symmetric key; An indication quantity for a first data transmission device; S5-2: using an asymmetric encryption algorithm according to the private key of the first data transmission device, asymmetric encryption is performed on the single-layer encrypted real-time transmission data to obtain double-layer encrypted real-time transmission data; The formula is:

[0032] In the formula, Real-time data transmission after double-layer encryption; is an asymmetric encryption function; The first data transmission device The private key of S5-3: According to the signature information of the first data transmission device and the digital identity signature technology, the double-encrypted real-time transmission data is signed to obtain real-time signature data of the double-encrypted real-time transmission data;

[0033] In the formula, The first data transmission device Registration parameters; The first data transmission device Registration ID ; constitute the first data transmission device Signature information ; The first data transmission device The terminal number of Real-time data transmission after double-layer encryption; is a random number; is a prime number order; It is the base point of the prime domain; is a one-way mapping hash function; constituting a first data transmission device Real-time signature data ; , Signature parameter; mod is the remainder function; S5-4: sending the double-layer encrypted real-time transmission data and the real-time signature data to the second data transmission device through the data communication line; S6: The second data transmission device performs identity authentication on the real-time signature data. After the identity authentication is passed, the real-time transmission data after the double-layer encryption is asymmetrically decrypted according to the public key of the first data transmission device, and the single-layer decrypted real-time transmission data is symmetrically decrypted according to the symmetric key to obtain the completely decrypted real-time transmission data, including the following steps: S5-1: The second data transmission device calls a trusted institution to perform identity authentication on the real-time signature data. If the identity authentication is successful, the next step is entered; otherwise, the data transmission is terminated;

[0034] In the formula, is the signature authentication parameter. If the left formula is equal to the right formula, the identity authentication is successful. S5-2: extracting the public key of the first data transmission device stored in the trusted institution, and asymmetrically decrypting the double-layer encrypted real-time transmission data according to the public key to obtain the single-layer decrypted real-time transmission data; The formula is:

[0035] In the formula, It is a single-layer decryption and real-time data transmission; is an asymmetric decryption function; The first data transmission device 's public key; S5-3: symmetrically decrypting the obtained single-layer decrypted real-time transmission data according to the symmetric key to obtain fully decrypted real-time transmission data; The formula is:

[0036] In the formula, To transmit data in real time after full decryption; is the symmetric decryption function.

[0037] Embodiment 2: like Figure 2 As shown, this embodiment provides a data security transmission system based on a data encryption algorithm, which is used to implement a data security transmission method. The system includes a third-party organization and several data transmission devices, and the third-party organization is respectively connected to the several data transmission devices for communication; The data transmission device includes a first data transmission device as a sender and a second data transmission device as a receiver, the first data transmission device is communicatively connected with the second data transmission device, and the first data transmission device is provided with a symmetric key interaction unit, a communication attack detection unit, an encryption update strategy generation unit and a double-layer encryption unit, and the second data transmission device is provided with an identity authentication unit and a complete decryption unit; A third-party institution is used to generate asymmetric keys and register digital identities for all data transmission devices, obtain the public-private key pair and signature information of the data transmission device, store the public key in the public-private key pair to the third-party institution, and return the signature information and the private key in the public-private key pair to the corresponding data transmission device; A symmetric key interaction unit is used to confirm the second data transmission device as the recipient, build a quantum communication line and a data communication line, and use the QKD technology to perform symmetric key interaction through the quantum communication line to generate a homomorphic symmetric key; A communication attack detection unit, used to collect real-time communication flow data of the data communication line, and perform communication attack detection based on the real-time communication flow data using a pre-trained communication attack detection model to obtain a real-time attack detection result; An encryption update strategy generation unit, for performing encryption update on the public-private key pair and the symmetric key using a pre-trained encryption update strategy generation model according to the real-time attack detection result when the real-time attack detection result indicates that an attack exists; A double-layer encryption unit, used to perform double-layer encryption on the real-time transmission data according to the symmetric key and the private key, sign the obtained double-layer encrypted real-time transmission data according to the signature information, and transmit the double-layer encrypted real-time transmission data and the obtained real-time signature data to the second data transmission device through the data communication line; An identity authentication unit, used for authenticating the real-time signature data; The complete decryption unit is used to asymmetrically decrypt the double-layer encrypted real-time transmission data according to the public key of the first data transmission device, and symmetrically decrypt the obtained single-layer decrypted real-time transmission data according to the symmetric key to obtain the completely decrypted real-time transmission data.

[0038] The present invention provides a data security transmission method and system based on a data encryption algorithm. During data transmission, an asymmetric encryption algorithm and a symmetric encryption algorithm are combined to perform double-layer encryption on the data. Even if a malicious third party intercepts and violently cracks one layer of the key, the transmitted data cannot be decrypted, thereby improving the security of the data and ensuring the reliability of data transmission. In addition, the digital identity authentication technology is combined to further improve the security level, effectively prevent middleman attacks, and ensure the integrity of data during transmission. Quantum communication technology is used for key distribution, which is almost impossible to be intercepted or cracked, thereby further ensuring the security of the key. Key pairs are automatically generated and managed by a third party organization, reducing human errors and improving the efficiency of key management. The constructed communication attack detection model performs real-time communication attack detection on the data communication line, and can timely detect potential communication attacks before or during data transmission, thereby improving the degree of intelligence. The constructed encryption update strategy generation model can adaptively adjust the encryption key update mechanism according to the real-time situation of data transmission, and update the key in time as soon as possible after being attacked, thereby avoiding a vacuum period in security key protection.

[0039] The present invention is not limited to the above optional implementations, and anyone can derive other various forms of products under the enlightenment of the present invention. The above specific implementations should not be understood as limiting the scope of protection of the present invention. The scope of protection of the present invention should be based on the definition in the claims, and the description can be used to interpret the claims.

Claims

1. A data security transmission method based on a data encryption algorithm, characterized in that: The steps include: The third-party institution generates asymmetric keys and registers digital identities for all data transmission devices, obtains the public-private key pair and signature information of the data transmission device, stores the public key in the public-private key pair to the third-party institution, and returns the signature information and the private key in the public-private key pair to the corresponding data transmission device; The first data transmission device as the sender confirms the second data transmission device as the receiver, builds a quantum communication line and a data communication line, and uses the QKD technology to perform symmetric key interaction through the quantum communication line to generate a homomorphic symmetric key; The first data transmission device collects real-time communication flow data of the data communication line, and performs communication attack detection based on the real-time communication flow data using a pre-trained communication attack detection model to obtain a real-time attack detection result; The first data transmission device, if the real-time attack detection result is that an attack exists, uses a pre-trained encryption update strategy generation model according to the real-time attack detection result to encrypt and update the public-private key pair and the symmetric key, and returns to the communication attack detection step; The first data transmission device double-encrypts the real-time transmission data according to the symmetric key and the private key, signs the obtained double-encrypted real-time transmission data according to the signature information, and transmits the double-encrypted real-time transmission data and the obtained real-time signature data to the second data transmission device through the data communication line; The second data transmission device performs identity authentication on the real-time signature data. After the identity authentication is passed, the real-time transmission data after double-layer encryption is asymmetrically decrypted according to the public key of the first data transmission device, and the single-layer decrypted real-time transmission data is symmetrically decrypted according to the symmetric key to obtain the real-time transmission data after complete decryption.

2. The data security transmission method based on the data encryption algorithm according to claim 1 is characterized in that: The first data transmission device as the sender confirms the second data transmission device as the receiver, builds a quantum communication line and a data communication line, and uses the QKD technology through the quantum communication line to perform symmetric key interaction and generate a homomorphic symmetric key, including the following steps: A first data transmission device as a sender confirms a second data transmission device as a receiver, and defines a quantum communication line and a data communication line between the first data transmission device and the second data transmission device; Use swarm intelligence optimization algorithm to configure quantum repeaters for quantum communication lines and obtain the optimal quantum repeater configuration scheme; Use wireless transmission technology to build data communication lines, and configure several quantum repeaters connected in sequence according to the optimal quantum repeater configuration plan to build quantum communication lines; The first data transmission device prepares a key quantum state, sends the key quantum state to the second data transmission device through a quantum communication line, and measures the key quantum state to obtain a first measurement result; The second data transmission device uses a preset error correction code to perform error correction on the key quantum state, and measures the error-corrected key quantum state to obtain a second measurement result; The first data transmission device and the second data transmission device compare the public basis vectors and estimate the error rate of the first measurement result and the second measurement result through the data communication line, and generate a homomorphic symmetric key.

3. The data security transmission method based on the data encryption algorithm according to claim 2 is characterized in that: The swarm intelligence optimization algorithm is the IFWA algorithm; The communication attack detection model is constructed based on the RF-DANN-Elman algorithm, and the communication attack detection model includes a feature extraction module constructed based on the RF algorithm, a domain adversarial training module constructed based on the DANN algorithm, and a feature classifier constructed based on the Elman algorithm. The domain adversarial training module includes a gradient reversal layer and a domain classifier connected in sequence, and the feature extraction module is connected to the gradient reversal layer and the feature classifier respectively; The encryption update strategy generation model is constructed based on the MPO-DQN algorithm, and the encryption update strategy generation model includes a meta-strategy optimization module constructed based on the MPO algorithm and a reinforcement learning module constructed based on the DQN algorithm. The reinforcement learning module is provided with an intelligent agent, a deep Q network and an experience replay pool. The intelligent agent is respectively connected to the deep Q network, the experience replay pool and the meta-strategy optimization module, and the meta-strategy optimization module is connected to the experience replay pool.

4. The data security transmission method based on the data encryption algorithm according to claim 3 is characterized in that: Using the swarm intelligence optimization algorithm, the quantum repeater configuration of the quantum communication line is carried out to obtain the optimal quantum repeater configuration scheme, including the following steps: Taking minimizing quantum transmission cost as the optimization goal, setting boundary conditions, and setting individual encoding vector format and algorithm parameters according to the quantum repeater configuration format The optimization objective is used as the fitness function, and according to the fitness function, boundary conditions, individual encoding vector format and algorithm parameters, a swarm intelligence optimization algorithm is used to iteratively search for the best and retain the best individual. If the number of iterations reaches the maximum number of iterations or the fitness value of the optimal individual meets the requirements, the individual encoding vector of the optimal individual is decoded to obtain the optimal quantum repeater configuration scheme.

5. The data security transmission method based on data encryption algorithm according to claim 3 is characterized in that: The method for constructing and deploying the communication attack detection model comprises the following steps: A third-party organization collects some historical communication traffic data and uses the RF-DANN-Elman algorithm to build an initial communication attack detection model based on the data format of the historical communication traffic data; Dividing a number of historical communication traffic data into a pre-training set without setting true labels, and a training set and a test set with true labels; Input a pre-training set to pre-train the initial communication attack detection model, and obtain a pre-trained communication attack detection model; Input the training set, optimize the pre-trained communication attack detection model, obtain the optimized communication attack detection model, and generate several historical key features; Input the test set to test the optimized communication attack detection model and obtain the test accuracy. If the test accuracy is greater than the accuracy threshold, the final communication attack detection model is output and several historical attack detection results are generated. Otherwise, the optimization training continues. Extracting first model metadata of the final communication attack detection model, and sending the first model metadata to all data transmission devices connected to the third-party organization; The data transmission device reconstructs the model according to the first model metadata to obtain a reconstructed communication attack detection model.

6. A data security transmission method based on a data encryption algorithm according to claim 5, characterized in that: The method for constructing and deploying the encryption update strategy generation model comprises the following steps: A third-party organization collects several historical attack detection results and corresponding historical key features, and uses the MPO-DQN algorithm to build an initial encryption update strategy generation model; Input several historical attack detection results and several historical key features, optimize and train the initial encryption update strategy generation model, and obtain the final encryption update strategy generation model; Extracting the second model metadata of the final encryption update strategy generation model, and sending the second model metadata to all data transmission devices connected to the third-party organization; The data transmission device reconstructs the model according to the second model metadata to obtain a reconstructed encryption update strategy generation model.

7. The data security transmission method based on data encryption algorithm according to claim 5 is characterized in that: The first data transmission device collects real-time communication flow data of the data communication line, and performs communication attack detection based on the real-time communication flow data using a pre-trained communication attack detection model to obtain a real-time attack detection result, including the following steps: A first data transmission device collects real-time communication flow data of a data communication line and performs preprocessing to obtain preprocessed real-time communication flow data; Input the preprocessed real-time communication traffic data into a pre-trained communication attack detection model, and use the communication attack detection model to extract corresponding real-time key features; According to the real-time key features, communication attack detection is performed to obtain real-time attack detection results.

8. The data security transmission method based on data encryption algorithm according to claim 7 is characterized in that: The first data transmission device, if the real-time attack detection result is that an attack exists, uses a pre-trained encryption update strategy generation model according to the real-time attack detection result to encrypt and update the public-private key pair and the symmetric key of the first data transmission device and the second data transmission device, and returns to the communication attack detection step, including the following steps: The first data transmission device, if the real-time attack detection result is that an attack exists, then proceeds to the next step, otherwise, proceeds to the data encryption step; According to the real-time attack detection results and real-time key features, a pre-trained encryption update strategy generation model is used to generate an encryption update strategy to obtain a real-time encryption update strategy; According to the real-time encryption update strategy, a third party organization is called to encrypt and update the public-private key pair of the data transmission device to obtain an updated public-private key pair of the data transmission device; According to the real-time encryption update strategy, the symmetric key interaction is performed again between the first data transmission device and the second data transmission device to obtain an updated symmetric key, and then the communication attack detection step is returned.

9. The data security transmission method based on data encryption algorithm according to claim 1 is characterized in that: The second data transmission device performs identity authentication on the real-time signature data. After the identity authentication is passed, the real-time transmission data after the double-layer encryption is asymmetrically decrypted according to the public key of the first data transmission device, and the single-layer decrypted real-time transmission data is symmetrically decrypted according to the symmetric key to obtain the completely decrypted real-time transmission data, including the following steps: The second data transmission device calls a third party organization to perform identity authentication on the real-time signature data. If the identity authentication is passed, the next step is entered; otherwise, the data transmission is terminated; Extracting the public key of the first data transmission device stored by the third-party organization, and asymmetrically decrypting the double-layer encrypted real-time transmission data according to the public key to obtain the single-layer decrypted real-time transmission data; The obtained single-layer decrypted real-time transmission data is symmetrically decrypted according to the symmetric key to obtain the completely decrypted real-time transmission data.

10. A data security transmission system based on a data encryption algorithm, used to implement the data security transmission method according to any one of claims 1 to 9, characterized in that: The system includes a third-party organization and a plurality of data transmission devices, wherein the third-party organization is respectively connected to the plurality of data transmission devices for communication; The data transmission device includes a first data transmission device as a sender and a second data transmission device as a receiver. The first data transmission device is communicatively connected to the second data transmission device, and the first data transmission device is provided with a symmetric key interaction unit, a communication attack detection unit, an encryption update strategy generation unit and a double-layer encryption unit, and the second data transmission device is provided with an identity authentication unit and a complete decryption unit.

Images