Optimization method for performing double encryption on hardware data through TLS encryption algorithm

Abstract

The invention provides an optimization method for performing double encryption on hardware data through a TLS encryption algorithm, and the method comprises the steps: building an independent configuration module of a TLS encryption link and an SDK digital signature according to an extracted parameter and an encryption result of the hardware data, and storing a certificate trust chain, key management information and encrypted hardware data; respectively verifying the integrity and authenticity of communication data and hardware data in a TLS encryption link, SDK digital signature and hardware data encryption decoupling state by adopting a dual-channel verification mechanism; and according to the verification result, judging whether the TLS encryption link, the SDK digital signature and the decoupling state of hardware data encryption influence the communication security and the data credibility, if so, triggering a security alarm, and analyzing the performance of hardware data encryption.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to an optimization method for performing double encryption on hardware data using a TLS encryption algorithm. Background Art

[0002] While pursuing high security, mobile applications are faced with the difficult problem of balancing device performance and user experience. Traditional single encryption methods can no longer meet the increasingly stringent security requirements, and simply superimposing multiple encryptions will significantly increase the computing burden, resulting in slow device response and increased power consumption. How to achieve higher-intensity data protection under limited hardware resources, especially in scenarios involving hardware data, to ensure both the dual security of the communication link and the data itself, and the real-time response capability of the device. In the secure communication scenario of mobile applications, the dual encryption mechanism of TLS link encryption and SDK digital signature faces a technical contradiction: how to achieve the logical separation of the encrypted link and the digital signature while ensuring communication security, so that the connection between the two can be safely disconnected under certain circumstances. The core of this problem is that although TLS link encryption and SDK digital signature are both for ensuring communication security, they are essentially different in technical implementation and trust model. TLS link encryption relies on the certificate trust chain under the PKI system, while SDK digital signature relies on the key management and distribution mechanism of the application itself. If the two are simply bundled together, it may be difficult to flexibly control and manage different levels of secure communication in some scenarios. For example, when the key of the SDK digital signature needs to be replaced, if the encryption link and the digital signature logic are too tightly coupled, the TLS certificate may have to be replaced at the same time, which not only increases the complexity of the operation, but also may affect the stability of the entire PKI trust chain. Therefore, how to achieve the decoupling of the encryption link and the digital signature through clever technical design based on the double encryption mechanism, and safely disconnect the two when necessary, has become a technical problem that needs to be solved urgently. Summary of the invention

[0003] The present invention provides an optimization method for performing double encryption of hardware data using a TLS encryption algorithm, which mainly includes: Obtain the communication data flow of the mobile application, extract the relevant parameters of the TLS encryption link and SDK digital signature, including certificate information, key identification and signature algorithm, collect hardware data at the same time, and perform double encryption on the hardware data; According to the extracted parameters and encryption results of hardware data, independent configuration modules for TLS encryption link and SDK digital signature are established to store certificate trust chain, key management information and encrypted hardware data respectively; Design a decoupling interface at the communication protocol layer, and distinguish the data processing path of the TLS encrypted link and the SDK digital signature through the preset protocol field. If a request to change the SDK digital signature key is detected, the TLS encrypted link is isolated through the decoupling interface, and only the key management module of the SDK digital signature is updated; A dual-channel verification mechanism is used to verify the integrity and authenticity of communication data and hardware data respectively under the decoupling state of TLS encrypted link, SDK digital signature and hardware data encryption; Based on the verification results, determine whether the decoupling status of the TLS encrypted link, SDK digital signature, and hardware data encryption affects communication security and data credibility. If so, trigger a security alarm and analyze the performance of hardware data encryption. Monitor the decoupling time of TLS encrypted link, SDK digital signature and hardware data encryption. If the decoupling time exceeds the threshold, the logical connection between the three will be automatically restored. After the logical connection is restored, the collaborative working status of TLS encrypted link and SDK digital signature will be re-verified. Monitor the status of TLS handshake and communication link. If an abnormal interruption is detected, record the cause of the interruption and try to re-establish the connection. Based on the monitoring data, generate a decoupled log of the TLS encryption link and SDK digital signature to optimize the process of double encryption of hardware data based on the TLS encryption algorithm.

[0004] The technical solution provided by the embodiment of the present invention may have the following beneficial effects: The present invention discloses an optimization method for double encryption of hardware data based on TLS encryption algorithm. The method extracts relevant parameters of TLS encryption link and SDK digital signature, collects hardware data for double encryption, and establishes an independent configuration module. A decoupling interface is designed at the communication protocol layer to separate the data processing paths of TLS encryption link and SDK digital signature. A dual-channel verification mechanism is adopted to verify the integrity, authenticity and consistency of communication data and hardware data respectively. Whether the decoupling state affects communication security is judged according to the verification result, and a corresponding security alarm is triggered. At the same time, the present invention also monitors the performance of TLS encryption link status, SDK digital signature and hardware data encryption, and optimizes the device-side responsiveness and battery life by adjusting the operating frequency or reducing the encryption strength. This method effectively improves the communication security of mobile applications, while ensuring the balance between device performance and user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Figure 1 The present invention is a flowchart of an optimization method for performing double encryption on hardware data using a TLS encryption algorithm. DETAILED DESCRIPTION

[0006] In order to further understand the content of the present invention, the present invention is described in detail in conjunction with the accompanying drawings and embodiments. The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are only used to explain the relevant inventions, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0007] like Figure 1 In this embodiment, an optimization method for performing double encryption of hardware data using a TLS encryption algorithm may specifically include: S101. Obtain the communication data stream of the mobile application, extract the relevant parameters of the TLS encryption link and the SDK digital signature, including certificate information, key identification and signature algorithm, collect hardware data at the same time, and perform double encryption processing on the hardware data.

[0008] A data stream is obtained from a mobile application communication interface, and the data stream is analyzed in layers according to a preset sampling period to obtain an application layer data packet sequence; certificate information and signature algorithm parameters are extracted from the data packet sequence, and the signature algorithm parameters are normalized to obtain a standard signature vector set; SDK call features are extracted according to the standard signature vector set, and the features are segmented into time windows to obtain an SDK behavior sequence; an encryption operation is performed on the SDK behavior sequence using a first symmetric key to generate an intermediate ciphertext data block, and if the integrity check of the intermediate ciphertext data block passes, the intermediate ciphertext data block is re-encrypted using a second symmetric key to obtain an encrypted data packet.

[0009] Exemplarily, a data stream is obtained from a mobile application communication interface, and the communication data stream is hierarchically parsed according to a preset sampling period to generate an application layer data packet sequence, and the data packets are classified and numbered according to the communication protocol standard. Certificate information, key identification, and signature algorithm parameters are extracted from the numbered data packets, and the signature algorithm parameters are normalized to generate a standard signature vector set. SDK call features are extracted according to the signature vector set, and the feature data is segmented into time windows to generate SDK behavior sequences, and the identity recognition algorithm is used to verify the legitimacy of the SDK call. The processor occupancy rate, the amount of running memory, and the storage capacity values ​​are obtained from the hardware resource monitoring interface, and a timestamp is added to the collected hardware data to generate a resource state vector. Correlation analysis is performed on the resource state vector and the SDK behavior sequence, and a correlation feature matrix is ​​generated using a preset mapping rule, and the feature matrix is ​​normalized. The first symmetric key is used to perform encryption operations on the normalized feature matrix, an intermediate ciphertext data block is generated, and the integrity check value of the ciphertext data block is calculated. The integrity of the intermediate ciphertext data block is judged according to the integrity check value. If the check passes, the intermediate ciphertext data block is re-encrypted using the second symmetric key to generate an encrypted data packet. In the communication data flow collection stage, through the hierarchical analysis of the mobile application port communication data flow, the data packets are classified and numbered based on the application layer protocol. If a mobile application uses port number 9086 for communication, the data packets are obtained at a sampling interval of every 100 milliseconds, and the data packets are continuously numbered to generate a data packet sequence. For the data packets with number marks, three types of security parameters including certificate information, key identification, and signature algorithm are extracted from the data packets. The signature algorithm parameters include hash function type, key length, and signature scheme. The redundant information is removed through normalization processing, and a standard signature vector is constructed. For example, the RSA signature algorithm parameter vector includes the algorithm identifier 0x06, the key length 2048 bits, and the hash function SHA256. The SDK call characteristics are analyzed based on the signature vector set, the number and order of SDK function calls are counted in each 500 millisecond time window, the SDK call behavior is recorded, and the legality of the SDK call is verified by rule-based matching. When illegal call behavior is detected, an SDK abnormal call record is generated. Obtain resource usage data from the hardware resource monitoring interface, record hardware status parameters such as processor occupancy rate of 75%, memory usage of 4096 megabytes, and remaining storage space of 8192 megabytes, and add a collection timestamp to the collected data. Perform correlation analysis on the resource state vector and SDK behavior sequence, and establish a mapping relationship between the two based on the time window. For example, when the processor occupancy rate exceeds 90%, the SDK function call frequency increases significantly, or when the memory usage suddenly increases, there are abnormal SDK calls and other related features.The first symmetric key algorithm Advanced Encryption Standard is used to encrypt the associated feature matrix, generate a 128-byte encrypted data block, and calculate the SHA256 hash value of the data block as the integrity check value. When the integrity check passes, the second symmetric key algorithm Data Encryption Standard is used to perform secondary encryption on the intermediate ciphertext data block, using a 56-bit key length to generate a ciphertext data packet. The double encryption mechanism not only ensures the secure transmission of data, but also enhances data protection strength through two encryptions with different algorithms, effectively preventing attacks against a single encryption algorithm. In actual application scenarios, such as when a mobile payment application performs user authentication, hardware fingerprint information and SDK call behavior characteristics are collected, and a mobile application secure communication link is built in combination with a double encryption protection mechanism.

[0010] S102: According to the extracted parameters and the encryption result of the hardware data, an independent configuration module for the TLS encryption link and the SDK digital signature is established to store the certificate trust chain, the key management information and the encrypted hardware data respectively.

[0011] The certificate trust chain is processed by block storage, and the certificate trust chain is verified step by step to obtain a certificate identification sequence and a certificate verification record; a TLS encryption link configuration table is established according to the certificate identification sequence, and the TLS encryption link configuration table generates a TLS communication key and a configuration index identifier through a partitioned storage method; the TLS communication key is used to perform encryption operation on hardware data, and a data block identifier and an integrity check code are obtained through the encryption operation; a data access control table is established for the data block identifier and the integrity check code, and the data access control table generates a data access verification key through a hierarchical authorization operation.

[0012] Exemplarily, the input certificate information is stored hierarchically according to the certificate chain verification module, the certificate trust chain is verified step by step using a block storage method, and a certificate identification sequence and a certificate verification record are generated for the certificate information that has passed the verification. A TLS encryption link configuration table is established for the certificate identification sequence, and the TLS configuration parameters are stored in blocks using a partition storage method, and a TLS communication key and a configuration index identifier are generated. The hardware data is encrypted using the TLS communication key, and a data block identifier and an integrity check code are generated for the encrypted data. The data storage location is determined according to the configuration index identifier. An independent storage partition is established for the data block identifier, and the encrypted hardware data is stored in blocks using a decentralized storage method, and access permission tags are added to the data blocks. A data access control table is established based on the data block identifier and the integrity check code, and a hierarchical authorization method is used to manage data access permissions, and a data access verification key is generated. The data access verification key is used to decrypt the stored data, and the integrity check value is calculated for the decrypted data, and the data integrity is judged based on the verification result. An independent configuration table is established for the SDK digital signature, and a signature verification rule is generated using a certificate verification record, and the data access process is digitally signed. In the process of secure communication of mobile applications, the hierarchical storage of the certificate trust chain involves three levels: root certificate, intermediate certificate and terminal certificate. Each certificate contains fields such as issuer information, validity period, and public key. Certificates of different levels are stored in independent storage areas through block storage. For example, the root certificate is stored in the 4096-byte space starting at address 0x1000, and the intermediate certificate is stored in the 8192-byte space starting at address 0x2000. Chain verification is performed on each certificate. After verification, a 32-byte certificate identification sequence is generated, and information such as certificate verification status and verification timestamp is recorded at the same time. The TLS configuration table is constructed based on the certificate identification sequence, and parameters such as TLS version number, cipher suite, and compression method are block-encoded. For example, the TLS1.3 version parameters are stored in the 512-byte space at the head of the configuration table, and the cipher suite parameters are stored in the subsequent 1024-byte space. The TLS session key is generated through the configuration table, and the key length is 256 bits. The key is used to encrypt the hardware data, and the SHA256 hash value of the data is calculated as the integrity check code. Create an independent partition in the storage system to store encrypted hardware data, divide the data into 1024-byte blocks, and each data block has a unique 16-byte identifier. Manage data access permissions through a hierarchical authorization mechanism, set three levels of read permission, write permission, and execute permission, and generate a 64-byte access control table to record the permission information of each data block. When an application requests access to data, find the corresponding access permission based on the data block identifier, calculate the data integrity check value and compare it with the original checksum. For SDK digital signature configuration, use the certificate verification record to build a signature rule table, which includes parameters such as signature algorithm type, hash function selection, and key length.For example, the elliptic curve digital signature algorithm is used, SHA256 is selected as the hash function, and the key length is 256 bits. During the data access process, the data block is signed to generate a 64-byte digital signature value. By combining hierarchical storage with access control, the secure storage of certificate management, TLS configuration and hardware data is achieved. In the mobile payment scenario, sensitive data such as user identity information and transaction records can be reliably protected. For example, during the online payment process, the user's payment credentials are encrypted and stored in an independent partition, and multi-level access control is used to ensure data access security, and data integrity is verified through digital signatures.

[0013] S103, design a decoupling interface at the communication protocol layer, and distinguish the data processing path of the TLS encrypted link and the SDK digital signature through the preset protocol field. If a SDK digital signature key replacement request is detected, the TLS encrypted link is isolated through the decoupling interface, and only the key management module of the SDK digital signature is updated.

[0014] A field mapping table is used to standardize the data packet type, and an encrypted link data packet identification bit and a signature data packet identification bit are set to obtain a data packet type definition table; the received data packet is parsed according to the data packet type definition table, and a buffer queue is used to separate and store the encrypted link data stream and the signature data stream; a polling method is used to detect a key change request for the signature data stream, and if a key change request is detected, a key request tag is generated; the signature key is updated according to the key request tag, and a channel recovery method is used to release the encrypted link channel freeze state to obtain a link confirmation tag.

[0015] Exemplarily, according to the preset field structure of the communication protocol layer, a preset field mapping table is used to standardize the data packet type, set the encrypted link data packet identification bit and the signature data packet identification bit, and generate a protocol field mapping table. A data packet parser is established for the protocol field mapping table, and the data packet header is parsed by using a message classification method, and the data packet is divided into an encrypted link data stream and a signature data stream according to the identification bit. An independent processing channel is created according to the data stream type, and a buffer queue is used to separate and store the encrypted link data stream and the signature data stream, and a channel identifier is generated for the data stream. A listening queue is established for the channel identifier, and a polling method is used to detect the signature key replacement request, and a key request mark is generated for the detection data. The channel switching mechanism is started according to the key request mark, and the encrypted link channel is temporarily frozen by using a data stream cutting method to generate a channel status mark. A signature key update channel is established for the channel status mark, and a key replacement method is used to update the signature key, and a key version number is generated. The encrypted link channel freeze state is released according to the key version number, and the channel recovery method is used to restart data transmission, and a link confirmation mark is generated for the recovery state. In the design of the communication protocol, the protocol field mapping table defines the identification rules for different types of data packets. For example, 16 bits are reserved in the data packet header for type identification, where bits 0-7 represent encrypted link data packets and bits 8-15 represent signature data packets. Different business scenarios are distinguished by bit value combinations. In the mobile payment scenario, the identification bit of the payment request data packet is set to 0x01, indicating that the data packet belongs to the encrypted link data stream; and the identification bit of the key update request packet is set to 0x81, indicating that the data packet belongs to the signature data stream. The data packet parser classifies and processes the data packets according to the identification bit. When a payment request data packet with an identification bit of 0x01 is received, it is routed to the encrypted link processing channel; when a key update request packet with an identification bit of 0x81 is detected, it is forwarded to the signature processing channel. Independent buffer queues are used to store different types of data streams. The buffer size of the encrypted link data stream is 1024 bytes, and the buffer size of the signature data stream is 512 bytes, and each is assigned a unique channel identifier. In the key update scenario, the listening queue polls at intervals of 100 milliseconds to detect signature key replacement requests, and generates a 32-byte request tag when an update request is detected. After receiving the request tag, the channel switching mechanism suspends data transmission on the encrypted link channel and sets the channel status tag to the "frozen" state. At this time, the signature key update channel is started to replace the existing key, and the version number of the new key is increased by 1 based on the original version. Taking the bank transfer business as an example, when the user initiates a transfer operation, the application generates an encrypted link data packet to send a transfer request. If it is detected that the signature key needs to be updated at this time, the channel switching mechanism will suspend the processing of the transfer request and give priority to completing the key update operation. After the new key is generated, the channel status returns to "normal" and continues to process the previously suspended transfer request.This decoupling design based on protocol fields realizes the independent operation of encryption links and signature processing, which can effectively protect the data security and reliability of key management during user transactions in mobile payment applications such as Alipay and WeChat Pay. Different data streams are distinguished by preset protocol fields, and business isolation during key updates is achieved in combination with the channel switching mechanism, ensuring the security and continuity of mobile applications in key update scenarios.

[0016] S104. A dual-channel verification mechanism is used to verify the integrity and authenticity of communication data and hardware data respectively in the decoupled state of TLS encrypted link, SDK digital signature and hardware data encryption.

[0017] Acquire data packets and group and mark them through a data packet classifier, the data packet classifier uses a hash algorithm to calculate a digital summary of the data packet to obtain a data verification fingerprint; establish a TLS encryption link based on the data verification fingerprint, the TLS encryption link uses a certificate verifier to verify the integrity of the encrypted data stream to obtain an encryption verification record; establish a signature verification channel based on the encryption verification record, the signature verification channel uses a digital signature algorithm to verify the authenticity of the signature data stream to obtain a signature verification record; use a feature extractor to perform standardization processing on the signature verification record, the feature extractor processes the data feature sequence to obtain a feature vector set; if the feature vector set matches the preset feature vector, a verification completion mark is generated.

[0018] Exemplarily, the data stream is read according to the communication data verification channel, the data packet is grouped and marked by a data packet classifier, the digital summary of the data packet is calculated by a hash algorithm, and a data verification fingerprint is generated for the digital summary. A first verification channel is established for the TLS encrypted link, and a certificate verifier is used to verify the integrity of the encrypted data stream, and an encrypted verification record is generated for the verified data. A second verification channel is established according to the encrypted verification record, and a digital signature algorithm is used to verify the authenticity of the signature data stream, and a signature verification record is generated for the verified data. For the hardware data through the third verification channel, a verification function is used to verify the integrity of the hardware data, and a hardware verification record is generated for the verification-passed data. A data feature sequence is generated according to the verification record, and a feature extractor is used to standardize the data feature sequence to generate a feature vector set. A verification association table is established for the feature vector set, and an association matcher is used to compare the feature vectors for consistency, and a verification matching result is generated. A verification status table is established according to the verification matching result, and a status recorder is used to classify and store the verification results, and a verification completion mark is generated if the verification passes. In the dual-channel verification mechanism, the data stream is grouped and processed by the packet classifier. For example, the data packet with port number 443 is classified as TLS encrypted data stream, and the data packet with port number 8443 is classified as SDK signature data stream. The SHA256 hash algorithm is used to calculate the digital summary of the data packet to generate a 32-byte data verification fingerprint. The verification fingerprint contains three fields: data packet type, timestamp, and checksum. During the TLS encrypted link verification process, the certificate verifier first checks the integrity of the certificate chain, including the root certificate, intermediate certificate, and terminal certificate, and verifies the certificate serial number, validity period, and signature algorithm. For example, the certificate serial number is detected to be 0x1234ABCD, valid until December 31, 2025, and uses the RSA2048-bit signature algorithm. After the verification is passed, an encrypted verification record is generated, which contains the certificate verification status, verification time, and certificate fingerprint. For SDK digital signature verification, the ECDSA algorithm is used to verify the authenticity of the signature data. The verification process includes calculating the signature data hash value, recovering the signature public key, and verifying the validity of the signature. For example, the signature data uses the secp256k1 curve parameters, the hash algorithm uses SHA256, and the verification result includes the signature verification status and timestamp information. At the same time, the hardware data verification channel uses the CRC32 checksum function to calculate the data checksum value and compares it with the original checksum to verify the data integrity. The feature extractor extracts key features from the verification record, including certificate fingerprint, signature parameters, and hardware feature values, to generate a standardized feature vector. In the mobile payment scenario, the feature vector contains fields such as device identifier, certificate serial number, and signature algorithm type. The association matcher compares the feature vector for consistency and calculates the feature similarity score. When the similarity exceeds the preset threshold of 0.95, the verification is considered to be successful.Taking mobile banking applications as an example, when a user performs a transfer operation, the application simultaneously starts three verification channels: the TLS channel verifies the server certificate to prevent man-in-the-middle attacks, the SDK channel verifies the transaction signature to prevent data tampering, and the hardware channel verifies the device environment to prevent the device from being hijacked. The verification status recorder records the verification results of each channel in real time, and the transaction is allowed to continue only when all verifications pass. Through the multi-channel parallel verification mechanism, the verification efficiency is improved while ensuring the comprehensiveness of the verification, and the verification completion time is shortened from 500 milliseconds for a single channel to 200 milliseconds.

[0019] S105. According to the verification result, determine whether the decoupling state of the TLS encryption link, SDK digital signature, and hardware data encryption affects communication security and data credibility. If so, trigger a security alarm and analyze the performance of the hardware data encryption.

[0020] A state evaluator is used to detect communication security parameters to obtain a communication risk index; based on the communication risk index, the integrity of the decoupled data is verified through a credibility calculator to obtain a credibility score, and the credibility score is recorded in a data credibility table; a threshold comparator is used to perform a graded judgment on the credibility score, and if the credibility score is lower than a preset threshold, an alarm trigger mark is generated; based on the alarm trigger mark, an alarm classifier is used to classify the alarm information into levels to obtain an alarm level identifier, and the alarm level identifier is pushed through an alarm broadcaster.

[0021] Exemplarily, the decoupling state table is read according to the verification result, the communication security parameters are detected by the state evaluator, the communication risk index in the current decoupling state is calculated by the risk identification function, and a security impact assessment mark is generated for the risk index. A data credibility table is established for the security impact assessment mark, and a credibility calculator is used to verify the integrity of the decoupled data, and a credibility score is generated for the verified data. A risk threshold table is established according to the credibility score, and a threshold comparator is used to grade the score data. If the score is lower than the preset threshold, an alarm trigger mark is generated. The alarm classification module is started for the alarm trigger mark, and the alarm classifier is used to classify the alarm information from low to high into yellow alarm, orange alarm, and red alarm. An alarm transmission channel is established according to the alarm level, and an alarm broadcaster is used to push the alarm information in a targeted manner, and an alarm feedback mark is generated for the push record. A performance monitoring table is established for the hardware encryption data, and a processor occupancy calculator is used to count the encryption operation load, and a resource consumption record is generated for the statistical data. A performance evaluation table is established according to the resource consumption record, and a performance calculator is used to analyze the encryption efficiency data, and a performance evaluation report is generated for the analysis results. In the mobile payment scenario, the state evaluator performs communication security assessment by monitoring various indicators in the decoupled state table, including the three dimensions of TLS link status, SDK signature status and hardware encryption status. The risk identification function calculates the risk index based on the monitoring data. For example, when the TLS link certificate is detected to be abnormal, the risk index increases by 0.3, when the SDK signature verification fails, it increases by 0.4, and when the hardware encryption is abnormal, it increases by 0.3. The final risk index is used to generate a security impact assessment mark. The credibility calculator verifies the integrity of the decoupled data, including the integrity of the data packet, the validity of the signature, and the encryption strength. During the verification process, the hash value of the data packet is calculated and compared with the original hash value to verify the validity period of the signature certificate and the correctness of the signature algorithm, and at the same time check whether the length of the encryption key meets the security requirements. A credibility score is generated based on the verification results, ranging from 0 to 100. The threshold comparer judges the scoring data according to the preset risk level threshold. When the credibility score is lower than 60 points, a yellow alarm is triggered, when it is lower than 40 points, an orange alarm is triggered, and when it is lower than 20 points, a red alarm is triggered. In actual applications, for example, if the TLS certificate of a mobile payment application is about to expire, the credibility score will drop to 55 points, triggering a yellow alarm to prompt the certificate to be updated; when it is detected that the SDK signature key has been illegally replaced, the score will drop to 35 points, triggering an orange alarm and suspending business processing. The alarm classifier formulates response strategies based on different levels of alarms. Yellow alarms are sent to the mailbox of operation and maintenance personnel, orange alarms are also pushed SMS notifications, and red alarms trigger automated emergency responses. In terms of hardware performance monitoring, the processor utilization calculator counts the resource consumption of encryption operations and records indicators such as processor utilization, memory usage, and encryption and decryption delays.For example, in a large-scale concurrent transaction scenario, encryption operations cause the processor utilization rate to reach 85%, the memory occupancy rate to exceed 75%, and the average delay of a single encryption and decryption operation reaches 200 milliseconds. The performance calculator analyzes encryption performance based on resource consumption data and generates a performance evaluation report that includes throughput, response time, and resource utilization. In a financial transaction scenario, when 1,000 transactions are completed per unit time, the average response time is controlled within 100 milliseconds, and the resource utilization rate remains within a reasonable range, the evaluation report shows that the encryption performance is in good condition.

[0022] Based on the status information of the TLS encrypted link on the device side, determine whether there is an abnormality. If there is an abnormality, trigger an alarm and record the abnormality log. At the same time, obtain the status information of the SDK digital signature and hardware data encryption module to determine whether it exceeds the preset threshold. If so, optimize the encryption and decryption delay and energy consumption performance.

[0023] Read the handshake success rate value and the encryption protocol version number in the handshake record table on the device side, use an anomaly detector to analyze the handshake record, and generate anomaly marking data if the handshake success rate is lower than the preset handshake threshold; obtain the SDK digital signature module status information according to the anomaly marking data, use the status detector to verify the status information, and obtain the signature verification result data; read the hardware encryption module operating parameters according to the signature verification result data, use the performance collector to record the delay value and power consumption value in the operating parameters, and obtain the performance measurement record; establish a performance verification table according to the performance measurement record, use the performance evaluator to analyze the performance verification table, and obtain the performance evaluation data.

[0024] Exemplarily, the handshake success rate value and the encryption protocol version number are read from the handshake record table on the device side, and the anomaly detector is used to identify the anomaly of the handshake record. If the handshake success rate is lower than the preset threshold or the protocol version is too low, an anomaly mark is generated. The alarm trigger is started for the anomaly mark, and the anomaly record is stored in an alarm classification manner. The log recording module generates an abnormal event record for the complete communication abnormal data. The SDK digital signature module status is obtained according to the abnormal event record, and the signature verification result is recorded by the status detector, and a signature detection report is generated for the signature status information. The operation data is read from the hardware data encryption module interface, and the encryption and decryption delay value and power consumption data are recorded by the performance collector to generate a performance measurement record. A delay optimization table is established according to the performance measurement record, and the encryption and decryption operation is optimized by the delay compensation algorithm to generate an optimized parameter set. An energy consumption control table is established for the optimized parameter set, and an energy consumption regulator is used to optimize the computing resource allocation to generate an energy consumption optimization configuration. A performance verification table is established according to the optimized configuration parameters, and a performance evaluator is used to verify the optimization results, and a performance evaluation report is generated for the verification data. In the mobile payment scenario, the handshake record table on the device side records the key data of the TLS handshake process, including the handshake success rate and the protocol version number. For example, under normal circumstances, the handshake success rate should be maintained above 95%, and the encryption protocol version should be TLS1.3. When the anomaly detector detects that the handshake success rate drops to 85% or the lower version TLS1.0 protocol is used through comparison, an anomaly mark is generated and an alarm is triggered. The alarm trigger divides the alarm level according to the degree of anomaly. For example, a handshake success rate between 80%-90% is a mild alarm, between 70%-80% is a moderate alarm, and below 70% is a severe alarm. The abnormal event record includes the alarm time, abnormality type and impact range. During the payment transaction process, the transaction environment and communication status when the abnormality occurs are recorded. When an abnormality is detected, the status detector will simultaneously obtain the running status of the SDK digital signature module, record the signature verification result and the verification time. In actual applications, the normal signature verification time should be controlled within 50 milliseconds. If it exceeds 100 milliseconds, there may be a performance bottleneck. The performance collector monitors the operating status of the hardware encryption module and records the latency and energy consumption data of encryption and decryption operations. For example, the average latency of a single encryption operation is 20 milliseconds and the CPU occupancy rate is 40%. Based on the collected performance data, the latency compensation method optimizes processing performance by adjusting the parallelism of encryption operations. In high-concurrency scenarios, the encryption task is divided into multiple subtasks for parallel processing, reducing the processing latency from the original 20 milliseconds to 12 milliseconds. The energy regulator balances performance and power consumption by dynamically adjusting the processor frequency and voltage. When the CPU temperature is detected to be rising, the operating frequency is appropriately reduced to maintain power consumption within a reasonable range. The performance evaluator comprehensively considers the changes in various indicators before and after optimization, including the degree of latency improvement, the proportion of throughput improvement, and the degree of energy saving.In actual transaction scenarios, the optimized encryption module can process transaction requests per second from 800 to 1,200, while reducing CPU power consumption from 4 watts to 3 watts, thereby improving encryption processing efficiency while ensuring security, allowing mobile applications to maintain stable operation under various load conditions.

[0025] Obtain data on the real-time response capability and battery life of the device to determine whether the preset requirements are met. If not, adjust the operating frequency of the hardware data encryption module or reduce the encryption strength.

[0026] The real-time response time and battery life are obtained from the device-side monitoring interface, and the real-time response time and battery life are recorded by a performance collector to obtain a performance status record; a threshold comparison table is established according to the performance status record, and the performance status record is compared with a preset threshold, and an adjustment trigger mark is generated if the performance status record is lower than the preset threshold; the hardware encryption module parameters are read according to the adjustment trigger mark, and the processor frequency of the hardware encryption module parameters is adjusted by a working frequency regulator to obtain frequency configuration parameters; an encryption parameter table is established for the frequency configuration parameters, and a key manager is used to grade the key length of the frequency configuration parameters to obtain encryption strength configuration.

[0027] Exemplarily, the hardware operation data is read according to the device-side monitoring interface, the real-time response time and battery life are recorded by the performance collector, and the performance status record is generated for the collected data. A threshold comparison table is established for the performance status record, and a threshold judge is used to compare the response time and the battery life with the preset requirements. If the indicator data is lower than the preset threshold, an adjustment trigger mark is generated. The hardware encryption module parameters are read according to the adjustment trigger mark, and the processor frequency is dynamically adjusted by the working frequency regulator to generate the frequency configuration parameters. An encryption parameter table is established for the frequency configuration parameters, and the key length is adjusted in stages by the key manager to generate the encryption strength configuration. An operation monitoring table is established according to the encryption strength configuration, and the processor occupancy rate and memory usage are recorded by the resource monitor to generate a resource occupancy report. A performance evaluation table is established for the resource occupancy report, and the optimized response time and battery life are verified by the performance calculator to generate a performance optimization record. The parameter curing module is started according to the performance optimization record, and the frequency configuration and encryption configuration are persistently recorded by the parameter storage to generate a parameter storage mark. In the mobile device, the performance collector obtains key operation data from the hardware monitoring interface, including two dimensions: user operation response time and battery life. The response time records the time interval from when the user clicks the payment button to when the payment result is displayed. Under normal circumstances, it should be controlled within 300 milliseconds. The battery life monitors the power consumption rate of the device when the payment application is continuously running. Under standard conditions, the power consumption per hour should not exceed 3%. The threshold judge compares the collected performance data in real time and sets two levels of warning thresholds. When the response time exceeds 500 milliseconds or the battery consumption rate exceeds 4%, a yellow warning is triggered; when the response time exceeds 800 milliseconds or the battery consumption rate exceeds 5%, a red warning is triggered. After the warning is triggered, the operating frequency regulator will dynamically adjust the processor operating frequency. For example, when a high power consumption state is detected, the processor main frequency is reduced from 2.4GHz to 1.8GHz. The key manager adjusts the encryption parameters according to the change of processor frequency, adopts a hierarchical encryption mechanism, uses a 256-bit key length in normal performance mode, and reduces it to a 192-bit key length when entering energy-saving mode. The resource monitor tracks the optimized system resource usage in real time, recording that the processor usage rate has been reduced from the original 85% to 65%, and the memory usage has been reduced from 1.2GB to 900MB. Taking the mobile banking application scenario as an example, when users make large transfers, the device needs to ensure both transaction security and operation response speed. By dynamically adjusting encryption parameters, the payment response time is controlled within 400 milliseconds while maintaining basic security strength. The performance calculator quantitatively evaluates the optimization effect and records the various indicators after optimization. The average response time is reduced by 35% and the battery life is extended by 25%.The parameter memory solidifies the optimized configuration scheme into the device storage area, including key parameters such as processor operating frequency and encryption key length. These parameters remain valid after the device is restarted, without the need to repeat the optimization process. By establishing a dynamic balance mechanism between battery life and encryption strength, the user experience of mobile devices is improved while ensuring payment security, allowing users to have a smooth operation experience when making mobile payments without consuming device power too quickly.

[0028] S106. Monitor the decoupling time of the TLS encryption link, SDK digital signature, and hardware data encryption. If the decoupling time exceeds the threshold, automatically restore the logical connection between the three. After restoring the logical connection, re-verify the collaborative working status of the TLS encryption link and SDK digital signature.

[0029] The module decoupling time data read by the decoupling monitor is obtained, and the time difference from the start of decoupling to the present is calculated by a time counter. If the time difference exceeds a preset time threshold, a recovery trigger mark is generated; the connection recovery module is started according to the recovery trigger mark, and the connection controller is used to reconnect the encrypted link channel to obtain a channel record; a digital signature recovery table is established for the channel record, and a signature synchronizer is used to reload the state of the signature module to obtain a synchronization mark; the hardware encryption recovery module is started according to the synchronization mark, and the data synchronizer is used to recover the encryption parameters to obtain an encryption state record.

[0030] Exemplarily, the decoupling time data of the three modules are read according to the decoupling monitor, and the time difference from the start of decoupling to the current time is calculated by the time counter. If the monitoring time exceeds the preset threshold, a recovery trigger mark is generated. The connection recovery module is started for the recovery trigger mark, and the connection controller is used to reconnect the encrypted link channel, and a channel record is generated for the reconnection state. A digital signature recovery table is established according to the channel record, and a signature synchronizer is used to reload the state of the signature module, and a synchronization mark is generated for the reloaded data. The hardware encryption recovery module is started for the synchronization mark, and the encryption parameters are restored by the data synchronizer to generate an encryption state record. A certificate verification table is established according to the encryption state record, and a certificate verifier is used to perform integrity verification on the root certificate, intermediate certificate and terminal certificate, and a certificate chain verification report is generated. The handshake module is started for the certificate chain verification report, and the handshake controller is used to perform collaborative verification on the three modules. If the verification passes, a handshake mark is generated. A state synchronization table is established according to the handshake mark, and the state monitor is used to monitor the operation status of the three modules, and an operation status report is generated. In the mobile payment scenario, the decoupling monitor monitors the decoupling status of the three modules of TLS encrypted link, SDK digital signature and hardware data encryption in real time. The decoupling duration is recorded by the time counter. Under normal circumstances, the decoupling time should be controlled within 300 milliseconds. When the decoupling time is detected to exceed 500 milliseconds, the automatic recovery mechanism is triggered. The connection controller is responsible for rebuilding the encrypted link channel. First, it restores the TLS handshake connection and renegotiates the encryption suite and key parameters. In the online banking application, the encryption suite uses AES-256-GCM with a key length of 256 bits. The key data in the reconnection process is recorded through the connection status, including the handshake timestamp, protocol version number and encryption parameters. The signature synchronizer reloads the state of the SDK digital signature module and updates the signature key and certificate information. For example, in the payment scenario, the ECDSA signature algorithm parameters are reloaded, and a new signature key pair is generated using the secp256k1 curve. At the same time, the signature verification rules and certificate chain relationship are restored. The data synchronizer then restores the parameters of the hardware encryption module, including the encryption algorithm type, operation frequency and key update cycle. The certificate verification process adopts a multi-level verification mechanism, starting from the root certificate and verifying step by step. The root certificate is usually issued by an authority and is valid for 10 years; the intermediate certificate is issued by the root certificate and is valid for 5 years; the terminal certificate is issued by the intermediate certificate and is valid for 1 year. The verifier checks the certificate serial number, signature algorithm, key usage and other fields, and generates a verification report containing the integrity verification results. After the certificate verification is passed, the handshake controller coordinates the three modules for collaborative verification. The encryption link module verifies the TLS session parameters to ensure that the encryption strength meets the requirements; the signature module verifies the validity of the certificate signature; the hardware encryption module verifies the encryption operation environment. After all verifications are passed, a handshake completion mark is generated.The status monitor continuously tracks the operating status of the three modules and records key indicators: the connection stability of the encrypted link, with no more than 0.01 disconnections per second; the verification success rate of the signature module, which remains above 99.9%; and the resource usage of the hardware encryption module, which is controlled within 70%. Through real-time monitoring and automatic recovery mechanisms, the security and reliability of the mobile payment process are still maintained in the module decoupling state.

[0031] S107. Monitor the status of TLS handshake and communication link. If an abnormal interruption is detected, record the cause of the interruption and try to re-establish the connection. Based on the monitoring data, generate a decoupling log of the TLS encryption link and SDK digital signature to optimize the process of double encryption of hardware data based on the TLS encryption algorithm.

[0032] The link status data is obtained through a communication monitor, and the link status data is judged by an interruption detector to obtain a communication link abnormality mark; the connection recovery module is started according to the communication link abnormality mark, and the connection recovery module uses a link reconnector to establish a communication link, and generates a reconnection verification record through a connection verifier; for the reconnection verification record, a log recorder is used to record the encryption link and digital signature module status data to obtain a log identification record; according to the log identification record, a parameter optimizer is used to adjust the parameters of the first heavy encryption algorithm and the second heavy encryption algorithm, and if the measurement result of the encryption performance monitor meets the performance requirements, a final encryption configuration plan is generated.

[0033] Exemplarily, the link status data is read according to the communication monitor, the state detector is used to monitor the handshake process in real time, the interruption detector is used to determine the abnormal cause of the communication link, and an abnormal mark is generated for the interruption data. The connection recovery module is started for the abnormal mark, the link reconnector is used to re-establish the communication link, the reconnection process is verified by the connection verifier, and a verification record is generated for the reconnection state. A monitoring log table is constructed according to the verification record, and a log recorder is used to classify and record the encryption link and digital signature module status data, and a log identifier is generated for the record data. A hardware encryption optimization table is established for the log identifier, and a parameter optimizer is used to adjust the key length and the number of encryption rounds of the first encryption algorithm to generate a first encryption configuration. A double encryption table is established according to the first encryption configuration, and an encryption parameter adjuster is used to adjust the operation frequency and encryption mode of the second encryption algorithm to generate a second encryption configuration. An encryption performance table is established for the double encryption configuration, and a performance monitor is used to measure the performance of the double encryption process to generate an encryption performance report. The parameter optimization module is started according to the encryption performance report, and a feedback optimizer is used to cyclically tune the encryption parameters, and a final configuration scheme is generated for the optimization results. In mobile payment security communication, the communication monitor monitors the TLS handshake and link status in real time, and records key indicators including link delay, handshake completion rate and connection stability. When the handshake delay is detected to exceed 200 milliseconds or the number of disconnections exceeds the preset threshold, the interruption detector identifies the cause of the abnormality, such as handshake timeout caused by network instability or connection interruption caused by certificate verification failure. The link reconnector immediately starts the reconnection mechanism after detecting the abnormality and re-negotiates the TLS handshake. In financial transaction scenarios, the reconnection process includes re-verifying the certificate chain, negotiating the encryption suite and generating session keys. The connection verifier monitors the reconnection process throughout, records indicators such as handshake time and key exchange success rate, and generates a verification record containing the reconnection timestamp and connection status when the verification is passed. The logger continuously records the operating status of the encryption link and digital signature module, including the handshake success rate, encryption strength changes and signature verification results. In the mobile banking application, the record shows that the single-day handshake success rate remains above 99.5%, the encryption algorithm remains at the AES-256 level, and the signature verification accuracy rate reaches 99.9%. The parameter optimizer is responsible for adjusting the first encryption configuration, mainly for the key length and number of encryption rounds of the AES algorithm. In standard mode, a 256-bit key length and 12 rounds of encryption operations are used. When device performance pressure is detected, it can be dynamically adjusted to a 192-bit key length and 10 rounds of encryption operations. The second encryption uses the ChaCha20 algorithm, and the operation frequency is controlled by the encryption parameter regulator to find a balance between performance and security. The performance monitor measures the double encryption process in all aspects, recording encryption latency, CPU occupancy, and memory usage.The measured data shows that the latency of a single encryption operation is controlled within 15 milliseconds under the standard configuration, and the peak CPU usage does not exceed 60%. The feedback optimizer dynamically adjusts the encryption parameters based on the performance report, reducing the encryption strength when the CPU temperature rises, and increasing the encryption strength after the temperature recovers. Through this adaptive optimization mechanism, good encryption performance can be maintained under different load conditions, making the mobile payment process both safe and smooth.

[0034] It should also be noted that the various specific technical features described in the above specific embodiments can be combined in any suitable manner without contradiction. In order to avoid unnecessary repetition, the present invention will not further describe various possible combinations. In addition, the various different embodiments of the present invention can also be combined arbitrarily, as long as they do not violate the concept of the present invention, they should also be regarded as the contents disclosed by the present invention.

Claims

1. An optimization method for double encryption of hardware data by TLS encryption algorithm, characterized in that: The method comprises: Obtain the communication data flow of the mobile application, extract the relevant parameters of the TLS encryption link and SDK digital signature, including certificate information, key identification and signature algorithm, collect hardware data at the same time, and perform double encryption on the hardware data; According to the extracted parameters and encryption results of hardware data, independent configuration modules for TLS encryption link and SDK digital signature are established to store certificate trust chain, key management information and encrypted hardware data respectively; Design a decoupling interface at the communication protocol layer, and distinguish the data processing path of the TLS encrypted link and the SDK digital signature through the preset protocol field. If a request to change the SDK digital signature key is detected, the TLS encrypted link is isolated through the decoupling interface, and only the key management module of the SDK digital signature is updated; A dual-channel verification mechanism is used to verify the integrity and authenticity of communication data and hardware data respectively under the decoupling state of TLS encrypted link, SDK digital signature and hardware data encryption; Based on the verification results, determine whether the decoupling status of the TLS encrypted link, SDK digital signature, and hardware data encryption affects communication security and data credibility. If so, trigger a security alarm and analyze the performance of hardware data encryption. Monitor the decoupling time of TLS encrypted link, SDK digital signature and hardware data encryption. If the decoupling time exceeds the threshold, the logical connection between the three will be automatically restored. After the logical connection is restored, the collaborative working status of TLS encrypted link and SDK digital signature will be re-verified. Monitor the status of TLS handshake and communication link. If an abnormal interruption is detected, record the cause of the interruption and try to re-establish the connection. Based on the monitoring data, generate a decoupled log of the TLS encryption link and SDK digital signature to optimize the process of double encryption of hardware data based on the TLS encryption algorithm.

2. The method according to claim 1, characterized in that: The method of obtaining the communication data flow of the mobile application, extracting the relevant parameters of the TLS encryption link and the SDK digital signature, including certificate information, key identification and signature algorithm, collecting hardware data at the same time, and performing double encryption processing on the hardware data, includes: Acquire a data stream from a mobile application communication interface, and perform hierarchical analysis on the data stream according to a preset sampling period to obtain an application layer data packet sequence; Extracting certificate information and signature algorithm parameters from the data packet sequence, and normalizing the signature algorithm parameters to obtain a set of standard signature vectors; Extract SDK call features according to the standard signature vector set, perform time window segmentation processing on the features, and obtain an SDK behavior sequence; The first symmetric key is used to perform encryption operation on the SDK behavior sequence to generate an intermediate ciphertext data block. If the integrity check of the intermediate ciphertext data block passes, the second symmetric key is used to perform secondary encryption on the intermediate ciphertext data block to obtain an encrypted data packet.

3. The method according to claim 1, characterized in that According to the extracted parameters and the encryption results of the hardware data, an independent configuration module for establishing the TLS encryption link and the SDK digital signature is established, and the certificate trust chain, key management information and the encrypted hardware data are stored respectively, including: The certificate trust chain is processed by block storage, and the certificate trust chain is verified level by level to obtain a certificate identification sequence and a certificate verification record; Establishing a TLS encryption link configuration table according to the certificate identification sequence, wherein the TLS encryption link configuration table generates a TLS communication key and a configuration index identifier by partition storage; The TLS communication key is used to perform encryption operation on the hardware data, and a data block identifier and an integrity check code are obtained through the encryption operation; A data access control table is established for the data block identifier and the integrity check code, and the data access control table generates a data access verification key through a hierarchical authorization operation.

4. The method according to claim 1, characterized in that: The decoupling interface is designed at the communication protocol layer, and the data processing path of the TLS encrypted link and the SDK digital signature is distinguished through a preset protocol field. If a SDK digital signature key replacement request is detected, the TLS encrypted link is isolated through the decoupling interface, and only the key management module of the SDK digital signature is updated, including: A field mapping table is used to standardize the data packet type, and an encrypted link data packet identification bit and a signature data packet identification bit are set to obtain a data packet type definition table; Parsing the received data packet according to the data packet type definition table, and using a buffer queue to separate and store the encrypted link data stream and the signature data stream; Detecting a key change request in a polling manner for the signature data stream, and generating a key request tag if a key change request is detected; The signature key is updated according to the key request mark, the encryption link channel freezing state is released by using the channel recovery method, and the link confirmation mark is obtained.

5. The method according to claim 1, characterized in that The dual-channel verification mechanism is used to verify the integrity and authenticity of communication data and hardware data respectively in the decoupled state of TLS encrypted link, SDK digital signature and hardware data encryption, including: Acquire data packets and group and mark the data packets through a data packet classifier, wherein the data packet classifier uses a hash algorithm to calculate a digital summary of the data packet to obtain a data verification fingerprint; Establishing a TLS encryption link according to the data verification fingerprint, wherein the TLS encryption link uses a certificate verifier to perform integrity verification on the encrypted data stream to obtain an encryption verification record; Establishing a signature verification channel according to the encrypted verification record, wherein the signature verification channel uses a digital signature algorithm to verify the authenticity of the signature data stream to obtain a signature verification record; A feature extractor is used to perform standardization processing on the signature verification record, and the feature extractor processes the data feature sequence to obtain a feature vector set; If the feature vector set matches the preset feature vector, a verification completion mark is generated.

6. The method according to claim 1, characterized in that According to the verification results, it is determined whether the decoupling state of the TLS encryption link, SDK digital signature, and hardware data encryption affects communication security and data credibility. If so, a security alarm is triggered, and the performance of hardware data encryption is analyzed, including: The state evaluator is used to detect the communication security parameters and obtain the communication risk index; Performing integrity verification on the decoupled data through a credibility calculator according to the communication risk index to obtain a credibility score, and recording the credibility score in a data credibility table; A threshold comparator is used to perform a graded judgment on the credibility score, and if the credibility score is lower than a preset threshold, an alarm trigger mark is generated; Using an alarm classifier to classify the alarm information according to the alarm trigger mark to obtain an alarm level identifier, and the alarm level identifier is pushed through an alarm broadcaster; It also includes: judging whether there is an abnormality based on the status information of the TLS encrypted link on the device side. If there is an abnormality, an alarm is triggered and an abnormality log is recorded. At the same time, the status information of the SDK digital signature and the hardware data encryption module is obtained to judge whether it exceeds the preset threshold. If it exceeds, the encryption and decryption delay and energy consumption performance are optimized; Obtain data on the real-time response capability and battery life of the device to determine whether the preset requirements are met. If not, adjust the operating frequency of the hardware data encryption module or reduce the encryption strength.

7. The method according to claim 6, characterized in that According to the status information of the TLS encrypted link on the device side, it is determined whether there is an abnormal situation. If there is an abnormality, an alarm is triggered and an abnormal log is recorded. At the same time, the status information of the SDK digital signature and the hardware data encryption module is obtained to determine whether it exceeds the preset threshold. If it exceeds, the encryption and decryption delay and energy consumption performance are optimized, including: Read the handshake success rate value and encryption protocol version number in the handshake record table on the device side, use an anomaly detector to analyze the handshake record, and generate anomaly mark data if the handshake success rate is lower than the preset handshake threshold; Acquire SDK digital signature module status information according to the abnormal mark data, and verify the status information using a status detector to obtain signature verification result data; Reading the hardware encryption module operating parameters according to the signature verification result data, using a performance collector to record the delay value and the power consumption value in the operating parameters, and obtaining a performance measurement record; A performance verification table is established according to the performance measurement record, and a performance evaluator is used to analyze the performance verification table to obtain performance evaluation data.

8. The method according to claim 6, characterized in that The obtaining of data on the real-time response capability and battery life of the device end, and determining whether the preset requirements are met, and if not, adjusting the operating frequency of the hardware data encryption module or reducing the encryption strength, includes: Acquire the real-time response time and battery life of the device-side monitoring interface, and use a performance collector to record the real-time response time and battery life to obtain a performance status record; Establish a threshold comparison table according to the performance status record, compare the performance status record with a preset threshold, and generate an adjustment trigger mark if the performance status record is lower than the preset threshold; Reading hardware encryption module parameters according to the adjustment trigger mark, and using a working frequency regulator to perform processor frequency adjustment on the hardware encryption module parameters to obtain frequency configuration parameters; An encryption parameter table is established for the frequency configuration parameters, and a key manager is used to perform hierarchical adjustment of key lengths on the frequency configuration parameters to obtain encryption strength configuration.

9. The method according to claim 1, characterized in that: The monitoring of the decoupling time of the TLS encryption link, the SDK digital signature, and the hardware data encryption, if exceeding the threshold, automatically restores the logical connection of the three, and after restoring the logical connection, re-verifies the collaborative working status of the TLS encryption link and the SDK digital signature, including: Obtain module decoupling time data read by the decoupling monitor, calculate the time difference from the start of decoupling to the current time through the time statistics device, and generate a recovery trigger mark if the time difference exceeds a preset time threshold; The connection recovery module is started according to the recovery trigger mark, and the connection controller is used to reconnect the encrypted link channel to obtain a channel record; A digital signature recovery table is established for the channel record, and a signature synchronizer is used to reload the state of the signature module to obtain a synchronization identifier; The hardware encryption recovery module is started according to the synchronization identifier, and the encryption parameters are recovered by using a data synchronizer to obtain an encryption status record.

10. The method according to claim 1, characterized in that The monitoring of the status of the TLS handshake and communication link, if an abnormal interruption is detected, the interruption reason is recorded and an attempt is made to re-establish the connection, and a decoupling log of the TLS encryption link and the SDK digital signature is generated based on the monitoring data to optimize the process of double encryption of hardware data based on the TLS encryption algorithm, including: Acquiring link status data through a communication monitor, wherein the link status data is judged by an interruption detector to obtain a communication link abnormality mark; A connection recovery module is started according to the communication link abnormality mark, the connection recovery module uses a link reconnector to establish a communication link, and generates a reconnection verification record through a connection verifier; For the reconnection verification record, a logger is used to record the encrypted link and digital signature module status data to obtain a log identification record; According to the log identification record, a parameter optimizer is used to adjust the parameters of the first encryption algorithm and the second encryption algorithm. If the measurement result of the encryption performance monitor meets the performance requirement, a final encryption configuration plan is generated.

Images