Encryption method and system of SD-WAN communication system

Abstract

The invention discloses an encryption method and system for an SD-WAN communication system, and the method guarantees the complete coverage of important information through the collection of flow data in a preset time period, calculates the sensitive degree of each piece of data, provides a differential strategy for encryption, converts the data into a three-dimensional point, achieves the visual presentation and is convenient to process, and achieves the encryption of the SD-WAN communication system based on the sensitivity and local offset degree. The data is layered and encrypted, the security is guaranteed, the flexibility is improved, the encrypted data is complex and difficult to crack, the network attack is effectively resisted, the encrypted data is transmitted by adopting the I Psec VPN technology, the transmission security is enhanced, eavesdropping, tampering or counterfeiting is prevented, the protection level of the data is comprehensively improved, and the security and worry-free of the enterprise network and the data are ensured.

Description

Technical Field

[0001] The present invention relates to the field of communication encryption technology, and in particular to an encryption method and system for a SD-WAN communication system. Background Art

[0002] With the globalization of corporate business and the acceleration of digital transformation, wide area network (WAN) communications have become an indispensable part of daily corporate operations. However, traditional WAN architecture is unable to cope with modern network challenges, especially in terms of network performance, flexibility and security. In order to overcome these limitations, software-defined wide area network (SD-WAN) technology came into being. It realizes intelligent scheduling and optimization of network resources through software definition, significantly improving network performance and flexibility.

[0003] However, with the widespread application of SD-WAN technology, the security of data transmission in the wide area network has become an urgent problem to be solved. Although traditional encryption methods can provide a certain degree of data protection, they often have performance bottlenecks, high management complexity, and difficulty in adapting to dynamic network environments. Especially when processing large amounts of diverse traffic data, how to ensure encryption while maintaining efficient network operation has become an important challenge facing SD-WAN communication system encryption technology. Summary of the invention

[0004] In view of this, the present invention proposes an encryption method and system for an SD-WAN communication system, which can solve the defects of the prior art, such as performance bottleneck, high management complexity and difficulty in adapting to dynamic network environments.

[0005] The technical solution of the present invention is achieved in this way:

[0006] An encryption method for an SD-WAN communication system, specifically comprising:

[0007] Collect traffic data of several accesses within a preset period of time;

[0008] Calculate the sensitivity of each access traffic data and obtain the sensitivity value;

[0009] Convert each accessed traffic data into a three-dimensional data point in a three-dimensional coordinate system, and arbitrarily select a three-dimensional data point as a starting data point;

[0010] Calculate the local deviation of the starting data point within the initial neighborhood value;

[0011] The three-dimensional data points are divided into multiple layers according to the sensitivity value and the local offset, and each three-dimensional data point in each layer is subjected to data offset to obtain encrypted data;

[0012] IPsec VPN technology is used to transmit encrypted data.

[0013] As a further optional scheme of the encryption method of the SD-WAN communication system, the sensitivity of each accessed traffic data is calculated to obtain a sensitivity value, specifically including:

[0014] Extract features from each access traffic data to obtain network traffic features and behavior features;

[0015] Combined with the context information of the traffic data, the sensitivity of the traffic data is evaluated to obtain a sensitivity evaluation result;

[0016] Construct risk indicators based on network traffic characteristics, behavioral characteristics, and sensitivity assessment results;

[0017] Build a real-time risk assessment model based on risk indicators;

[0018] The real-time traffic data of each access is input into the real-time risk assessment model to obtain the sensitive value of the traffic data.

[0019] As a further optional scheme of the encryption method of the SD-WAN communication system, converting each accessed traffic data into a three-dimensional data point in a three-dimensional coordinate system and arbitrarily selecting a three-dimensional data point as a starting data point specifically includes:

[0020] Three representative features are selected from each accessed traffic data as the coordinate axes of the three-dimensional coordinate system;

[0021] For each piece of traffic data, convert it into a three-dimensional data point in a three-dimensional coordinate system according to its read data volume, read time and access number;

[0022] In the converted three-dimensional data point set, a random number generator is used to select a three-dimensional data point as a starting data point.

[0023] As a further optional scheme of the encryption method of the SD-WAN communication system, the calculating of the local deviation of the starting data point within the initial neighborhood value specifically includes:

[0024] Determine the neighborhood size of the starting data point;

[0025] According to the defined neighborhood size, all data points that are in the neighborhood of the starting data point are selected from the dataset;

[0026] For the starting data point and each data point in its neighborhood, calculate the distance between them;

[0027] The distances between the starting data point and all the data points in the neighborhood are aggregated to obtain the local deviation.

[0028] As a further optional scheme of the encryption method of the SD-WAN communication system, the distance between the starting data point and all the data points in the neighborhood is aggregated to obtain the local deviation, which is specifically adopted by the following formula:

[0029]

[0030] Among them, text is the local deviation, N is the number of data points in the neighborhood, P0 is the starting data point, and P i is the i-th data point in the neighborhood, dist(P0, P i ) is P0 and P i The distance between.

[0031] As a further optional scheme of the encryption method of the SD-WAN communication system, the three-dimensional data points are divided into multiple layers according to the sensitivity value and the local deviation, and each three-dimensional data point in each layer is subjected to data deviation to obtain encrypted data, specifically including:

[0032] Set multiple thresholds and assign data points to corresponding levels according to their sensitivity and local deviation.

[0033] Designing an offset strategy for each layer, wherein the offset strategy is formulated based on the location, direction, and distance factors of the data points;

[0034] For each 3D data point in each layer, the corresponding offset is calculated according to the offset strategy of the layer it belongs to, and it is applied to the original coordinates of the data point to obtain the encrypted data.

[0035] As a further optional scheme of the encryption method of the SD-WAN communication system, the encrypted data is transmitted using IPsec VPN technology, specifically including:

[0036] Configure security proposals, security policies, I KE policies, and security associations for IPsec VPN gateways;

[0037] The encrypted data is transmitted based on the configured IPsec VPN gateway.

[0038] An encryption system for a SD-WAN communication system, comprising:

[0039] A data collection module is used to collect traffic data of several accesses within a preset period of time;

[0040] A sensitivity calculation module is used to calculate the sensitivity of each accessed traffic data and obtain a sensitivity value;

[0041] A data conversion module is used to convert each accessed flow data into a three-dimensional data point in a three-dimensional coordinate system, and arbitrarily select a three-dimensional data point as a starting data point;

[0042] The deviation calculation module is used to calculate the local deviation of the starting data point within the initial neighborhood value;

[0043] A data encryption module is used to divide the three-dimensional data points into multiple layers according to the sensitivity value and the local offset, and to perform data offset on each three-dimensional data point in each layer to obtain encrypted data;

[0044] The encrypted transmission module is used to transmit encrypted data using IPsec VPN technology.

[0045] A computing device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the encryption method of the SD-WAN communication system when executing the computer program.

[0046] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the encryption method of the above-mentioned SD-WAN communication system.

[0047] The beneficial effects of the present invention are as follows: by collecting a number of access traffic data within a preset time period, the method can cover all important traffic information within the time period, provide a comprehensive data basis for subsequent encryption processing, calculate the sensitivity of each access traffic data, and obtain a sensitivity value. This step helps to distinguish the importance and confidentiality requirements of different data, and provide a differentiated processing strategy for subsequent data encryption. Each access traffic data is converted into a three-dimensional data point in a three-dimensional coordinate system. This conversion method makes the originally abstract data intuitively visible, which is convenient for subsequent data processing and analysis. The three-dimensional data points are divided into multiple layers according to the sensitivity value and the local offset, and each three-dimensional data point in each layer is Data points are offset to obtain encrypted data. This layered encryption method can implement different degrees of encryption measures according to the sensitivity of the data, which not only ensures the security of the data, but also improves the flexibility of encryption. By offsetting the three-dimensional data points, this method makes the encrypted data not present data characteristics of range periodicity, increases the complexity and difficulty of data cracking, and at the same time, adjusts and changes the data with similar sensitivity characteristics within a certain range, further improving the concealment of the data. Since the encrypted data is highly complex and concealed, this method can effectively resist various network attacks and data theft, protect the security of enterprise networks and data, and use IPsec VPN technology to transmit the encrypted data to ensure the security of the data during transmission. IPsecVPN technology provides a powerful encryption and authentication mechanism to prevent data from being eavesdropped, tampered with or forged during transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 A schematic diagram of a flow chart of an encryption method for an SD-WAN communication system of the present invention;

[0050] Figure 2 This is a schematic diagram of the composition of an encryption system of an SD-WAN communication system of the present invention. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] refer to Figure 1 to Figure 2 , an encryption method for a SD-WAN communication system, specifically comprising:

[0053] Collect traffic data of several accesses within a preset period of time;

[0054] Calculate the sensitivity of each access traffic data and obtain the sensitivity value;

[0055] Convert each accessed traffic data into a three-dimensional data point in a three-dimensional coordinate system, and arbitrarily select a three-dimensional data point as a starting data point;

[0056] Calculate the local deviation of the starting data point within the initial neighborhood value;

[0057] The three-dimensional data points are divided into multiple layers according to the sensitivity value and the local offset, and each three-dimensional data point in each layer is subjected to data offset to obtain encrypted data;

[0058] IPsec VPN technology is used to transmit encrypted data.

[0059] In this embodiment, by collecting traffic data of several accesses within a preset time period, the method can cover all important traffic information within the time period, provide a comprehensive data basis for subsequent encryption processing, calculate the sensitivity of each access traffic data, and obtain the sensitivity value. This step helps to distinguish the importance and confidentiality requirements of different data, and provide a differentiated processing strategy for subsequent data encryption. Each access traffic data is converted into a three-dimensional data point in a three-dimensional coordinate system. This conversion method makes the originally abstract data intuitive and visible, which is convenient for subsequent data processing and analysis. The three-dimensional data points are divided into multiple layers according to the sensitivity value and the local offset, and each three-dimensional data point in each layer is encrypted. The data is offset based on the data point to obtain the encrypted data. This layered encryption method can implement different degrees of encryption measures according to the sensitivity of the data, which not only ensures the security of the data, but also improves the flexibility of encryption. By offsetting the three-dimensional data points, this method makes the encrypted data not present range periodic data characteristics, increases the complexity and difficulty of cracking the data, and at the same time, adjusts and changes the data with similar sensitivity characteristics within a certain range, further improving the concealment of the data. Since the encrypted data is highly complex and concealed, this method can effectively resist various network attacks and data theft, protect the security of enterprise networks and data, and use IPsec VPN technology to transmit the encrypted data to ensure the security of the data during transmission. IPsec VPN technology provides a powerful encryption and authentication mechanism to prevent data from being eavesdropped, tampered with or forged during transmission.

[0060] Preferably, calculating the sensitivity of each access traffic data to obtain a sensitivity value specifically includes:

[0061] Extract features from each access traffic data to obtain network traffic features and behavior features;

[0062] Combined with the context information of the traffic data, the sensitivity of the traffic data is evaluated to obtain a sensitivity evaluation result;

[0063] Construct risk indicators based on network traffic characteristics, behavioral characteristics, and sensitivity assessment results;

[0064] Build a real-time risk assessment model based on risk indicators;

[0065] The real-time traffic data of each access is input into the real-time risk assessment model to obtain the sensitive value of the traffic data.

[0066] In this embodiment, when extracting features from each access traffic data, not only network traffic features (such as packet size, transmission protocol, port number, etc.) are considered, but also behavioral features (such as access frequency, access time, access path, etc.) are combined. This multi-dimensional feature extraction method can more comprehensively reflect the characteristics and behavioral patterns of traffic data. Comprehensive feature extraction provides a rich data basis for subsequent sensitivity assessments, helps to more accurately identify sensitive information in traffic data, and improves the accuracy of assessments. Sensitivity assessments are performed in combination with the contextual information of traffic data (such as user identity, device information, geographic location, etc.), so that the assessment results are closer to the actual situation. This situation-aware assessment method can better reflect the sensitivity of traffic data in different scenarios. By integrating contextual information, targeted sensitivity assessments can be performed on different types of traffic data, thereby better meeting the needs of the application. The real-time risk assessment model can meet the actual needs of enterprise network security; the risk indicators constructed based on network traffic characteristics, behavioral characteristics and sensitivity assessment results are scientific and reasonable. These indicators can objectively reflect the sensitivity and potential risks of traffic data. The construction of risk indicators enables the sensitivity assessment to be quantified, which is convenient for comparison and ranking between different traffic data. This helps enterprises to more clearly understand which traffic data is more sensitive and requires more stringent encryption and protection measures; the construction and application of real-time risk assessment models can realize real-time analysis and evaluation of traffic data, which helps enterprises to promptly discover and respond to potential security threats and ensure the safe and stable operation of enterprise networks. Through real-time risk assessment models, enterprises can make intelligent decisions based on the sensitivity value of traffic data, such as adjusting encryption strategies, optimizing network configurations, etc., which helps to improve the network security protection capabilities and emergency response speed of enterprises.

[0067] Preferably, the step of converting each accessed traffic data into a three-dimensional data point in a three-dimensional coordinate system and arbitrarily selecting a three-dimensional data point as a starting data point specifically includes:

[0068] Three representative features are selected from each accessed traffic data as the coordinate axes of the three-dimensional coordinate system;

[0069] For each piece of traffic data, convert it into a three-dimensional data point in a three-dimensional coordinate system according to its read data volume, read time and access number;

[0070] In the converted three-dimensional data point set, a random number generator is used to select a three-dimensional data point as a starting data point.

[0071] In this embodiment, three representative features are selected from each accessed traffic data as the coordinate axes of the three-dimensional coordinate system. This selection method can ensure that the converted three-dimensional data points can fully reflect the main characteristics and behavior patterns of the original traffic data. Selecting the three most representative features from the numerous traffic data features can effectively avoid the dimensional disaster problem that may be encountered when processing data in a high-dimensional space, and improve the efficiency of data processing and analysis; each traffic data is converted into a three-dimensional data point in the three-dimensional coordinate system based on key indicators such as the amount of data read, the reading time, and the number of accesses. This conversion method makes the originally abstract data intuitive and visible, which is convenient for subsequent data processing and analysis. The three selected features (data volume, reading time, and number of accesses) are all key indicators for evaluating the sensitivity and importance of traffic data. By using them as coordinate values, it can be ensured that the converted three-dimensional data points can retain the key information of the original traffic data; a random number generator is used to select a three-dimensional data point as the starting data point. This method can ensure the randomness and fairness of the selection process and avoid the influence of human factors or fixed patterns on subsequent data processing and analysis results. Randomly selecting the starting data point means that each time the data is processed, it can start from a different angle and starting point, which helps to improve the flexibility and diversity of data processing, and may thus discover more valuable information and patterns.

[0072] It should be noted that three representative features are selected from each flow data as the coordinate axes of the three-dimensional coordinate system. For example, you can choose:

[0073] X-axis: represents the amount of data read (the unit can be bytes, KB, etc.);

[0074] Y-axis: indicates the reading time (which can be converted into relative time from the starting point of the preset period, in units of seconds, minutes, etc.);

[0075] Z axis: indicates the number of visits by the user IP in the preset period (this is a count value);

[0076] For each flow data, it is converted into a three-dimensional data point in the three-dimensional coordinate system according to its read data volume, reading time and number of accesses, that is, the three eigenvalues ​​are respectively used as the X, Y, and Z coordinates of the data point in the three-dimensional coordinate system.

[0077] Preferably, the calculating of the local deviation of the starting data point within the initial neighborhood value specifically includes:

[0078] Determine the neighborhood size of the starting data point;

[0079] According to the defined neighborhood size, all data points that are in the neighborhood of the starting data point are selected from the dataset;

[0080] For the starting data point and each data point in its neighborhood, calculate the distance between them;

[0081] The distances between the starting data point and all the data points in the neighborhood are aggregated to obtain the local deviation.

[0082] Preferably, the distances between the starting data point and all the data points in the neighborhood are aggregated to obtain the local deviation, specifically using the following formula:

[0083]

[0084] Among them, text is the local deviation, N is the number of data points in the neighborhood, P0 is the starting data point, and P i is the i-th data point in the neighborhood, dist(P0, P i ) is P0 and P i The distance between.

[0085] In this embodiment, by determining the neighborhood size of the starting data point, the technical solution can flexibly cope with data sets of different sizes and distribution characteristics. A larger neighborhood can cover more data points and is suitable for sparse data sets, while a smaller neighborhood can more finely capture the local relationship between data points and is suitable for dense data sets. Reasonable selection of the neighborhood size helps to find a balance between calculation accuracy and calculation efficiency. Although a smaller neighborhood can reduce the amount of calculation, it may ignore some important local relationships. Although a larger neighborhood can capture more information, it will also increase the calculation complexity and time cost. By calculating the distance between the starting data point and each data point in its neighborhood, the technical solution can accurately capture the local relationship between data points. This local relationship is very important for understanding the distribution characteristics of the data and identifying Tasks such as outlier and cluster analysis are crucial; the local deviation obtained by aggregating the distance between the starting data point and all the data points in the neighborhood can intuitively reflect the degree of deviation of the starting data point in the local space. This indicator is of great significance for evaluating the stability of the data and the effectiveness of the clustering structure; since the local deviation is calculated based on the distance between multiple data points, it can reduce the impact of the noise of a single data point on the result to a certain extent. This robustness makes the technical solution more reliable when processing data sets containing noise or outliers; when the data set changes dynamically (such as the addition of new data points or the deletion of old data points), the technical solution can recalculate the local deviation to reflect the new data distribution characteristics. This adaptability enables the technical solution to continue to play a role in practical applications.

[0086] It should be noted that the size of the neighborhood of the starting data point is determined, which can be achieved by setting a fixed distance threshold (radius in three-dimensional space) or using a density-based method (such as the ε neighborhood in DBSCAN); for the starting data point and each data point in its neighborhood, the distance between them is calculated, which usually involves calculating some form of distance between their coordinates in a three-dimensional coordinate system.

[0087] Preferably, the three-dimensional data points are divided into multiple layers according to the sensitivity value and the local offset, and each three-dimensional data point in each layer is subjected to data offset to obtain encrypted data, which specifically includes:

[0088] Set multiple thresholds and assign data points to corresponding levels according to their sensitivity and local deviation.

[0089] Designing an offset strategy for each layer, wherein the offset strategy is formulated based on the location, direction, and distance factors of the data points;

[0090] For each 3D data point in each layer, the corresponding offset is calculated according to the offset strategy of the layer it belongs to, and it is applied to the original coordinates of the data point to obtain the encrypted data.

[0091] In this embodiment, by setting multiple thresholds, data points are allocated to different levels according to their sensitivity values ​​and local offsets, thereby achieving differentiated processing of data points of different sensitivities and importances. This processing method can ensure that highly sensitive data points receive stronger encryption protection, while low-sensitivity data points can be appropriately optimized while ensuring security. Multi-level encryption strategies can adapt to different security needs and scenarios. For example, in an enterprise network that requires a high degree of protection of sensitive data, more levels and stricter encryption strategies can be set. In scenarios with relatively low security requirements, the levels can be reduced and the encryption strategies can be simplified to reduce costs and complexity. The offset strategy is formulated based on the location, direction, and distance factors of the data points. This comprehensive consideration of multiple factors can ensure that the calculation of the offset is more accurate and reasonable. The location factor reflects the distance of the data point in the air. The specific location of the data point in the space, the direction factor indicates the possible change trend of the data point, and the distance factor determines the size and range of the offset; by designing a unique offset strategy for each layer and calculating the offset according to the specific attributes of the data point, the technical solution can achieve accurate encryption of the data point. This encryption method can not only change the original coordinates of the data point, but also destroy the original relationship between the data points, thereby increasing the difficulty of data cracking; through the application of multi-level encryption and precise offset strategies, the technical solution can significantly improve the security of encrypted data. Even if the attacker can obtain the encrypted data, it is difficult to restore the original data through simple analysis or calculation, thereby effectively protecting the confidentiality and integrity of the data; for data points containing personal privacy information, the technical solution can hide their true location and attribute information through encryption processing, thereby enhancing the protection of personal privacy. This protection method helps prevent problems such as personal information leakage and abuse.

[0092] It should be noted that multiple thresholds are set to assign data points to different layers according to their sensitivity values ​​and local offsets. For example, data points with high sensitivity values ​​and large local offsets can be assigned to the highest layer, while data points with low sensitivity values ​​and small local offsets can be assigned to the lowest layer. Clustering algorithms (such as K-means) or classification algorithms (such as decision trees) can be used to assist in stratification, but the algorithm parameters need to be adjusted according to actual conditions to adapt to the characteristics of three-dimensional data; a unique offset strategy is designed for each layer. This strategy can be formulated based on factors such as the location, direction, and distance of the data points. For example, a random offset vector can be added to the data points of each layer, and the direction and size of the vector vary depending on the layer; in order to be able to decrypt the data later, the offset vector or offset strategy parameters of each data point can be recorded, and this information needs to be stored securely to prevent access by unauthorized personnel.

[0093] Preferably, the use of IPsec VPN technology to transmit the encrypted data specifically includes:

[0094] Configure security proposals, security policies, I KE policies, and security associations for IPsec VPN gateways;

[0095] The encrypted data is transmitted based on the configured IPsec VPN gateway.

[0096] In this embodiment, the security proposal defines the encryption algorithm, authentication algorithm, key length and other security parameters used in IPsec VPN communication. By configuring the appropriate security proposal, the confidentiality, integrity and authentication of the transmitted data can be ensured, and the data can be prevented from being eavesdropped, tampered or forged during the transmission process. The security policy defines which traffic needs to be protected by IPsec and how to protect these traffic. The policy includes matching conditions such as source address, destination address, protocol type, and corresponding security proposals. By accurately configuring the security policy, it can be ensured that only traffic that meets specific conditions will be encrypted and transmitted, avoiding unnecessary encryption overhead and improving the security and efficiency of the system. The IKE policy is used to negotiate and manage the keys and algorithms in IPsec communication, including parameters such as IKE version, encryption algorithm, and authentication method. The configuration of the IKE policy enables the two parties of IPsec VPN to exchange key and algorithm information securely on an insecure network, providing the necessary key materials for subsequent encrypted communication. SA is a set of security parameters and keys negotiated by the two parties of IPsec communication, which is used to encrypt and decrypt transmitted data packets. The SA successfully established through the IKE protocol provides the necessary encryption and authentication mechanism for IPsec VPN communication, ensuring the security and reliability of data during transmission. When the encrypted data needs to be transmitted through IPsec When VPN is transmitting, the IPsec VPN gateway will encrypt the data packet according to the configured security policy and security proposal, and perform encrypted communication through the SA established by the I KE protocol. After receiving the encrypted data packet, the receiver will use the corresponding key and algorithm to decrypt it and restore the original data. IPsec VPN technology ensures the confidentiality, integrity and authentication of transmitted data through encryption and authentication mechanisms, and effectively prevents security risks such as data leakage and tampering. IPsec VPN supports a variety of encryption algorithms and authentication methods, which can be flexibly configured according to actual needs to meet security requirements in different scenarios.

[0097] An encryption system for a SD-WAN communication system, comprising:

[0098] A data collection module is used to collect traffic data of several accesses within a preset period of time;

[0099] A sensitivity calculation module is used to calculate the sensitivity of each accessed traffic data and obtain a sensitivity value;

[0100] A data conversion module is used to convert each accessed flow data into a three-dimensional data point in a three-dimensional coordinate system, and arbitrarily select a three-dimensional data point as a starting data point;

[0101] The deviation calculation module is used to calculate the local deviation of the starting data point within the initial neighborhood value;

[0102] A data encryption module is used to divide the three-dimensional data points into multiple layers according to the sensitivity value and the local offset, and to perform data offset on each three-dimensional data point in each layer to obtain encrypted data;

[0103] The encrypted transmission module is used to transmit encrypted data using IPsec VPN technology.

[0104] A computing device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the encryption method of the SD-WAN communication system when executing the computer program.

[0105] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of the encryption method of the above-mentioned SD-WAN communication system.

[0106] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An encryption method for a SD-WAN communication system, characterized in that: Specifically include: Collect traffic data of several accesses within a preset period of time; Calculate the sensitivity of each access traffic data and obtain the sensitivity value; Convert each accessed traffic data into a three-dimensional data point in a three-dimensional coordinate system, and arbitrarily select a three-dimensional data point as a starting data point; Calculate the local deviation of the starting data point within the initial neighborhood value; The three-dimensional data points are divided into multiple layers according to the sensitivity value and the local offset, and each three-dimensional data point in each layer is subjected to data offset to obtain encrypted data; IPsec VPN technology is used to transmit encrypted data.

2. The encryption method of the SD-WAN communication system according to claim 1, characterized in that: The step of calculating the sensitivity of each access traffic data to obtain a sensitivity value specifically includes: Extract features from each access traffic data to obtain network traffic features and behavior features; Combined with the context information of the traffic data, the sensitivity of the traffic data is evaluated to obtain a sensitivity evaluation result; Construct risk indicators based on network traffic characteristics, behavioral characteristics, and sensitivity assessment results; Build a real-time risk assessment model based on risk indicators; The real-time traffic data of each access is input into the real-time risk assessment model to obtain the sensitive value of the traffic data.

3. The encryption method of the SD-WAN communication system according to claim 2, characterized in that: The step of converting each accessed traffic data into a three-dimensional data point in a three-dimensional coordinate system and arbitrarily selecting a three-dimensional data point as a starting data point specifically includes: Three representative features are selected from each accessed traffic data as the coordinate axes of the three-dimensional coordinate system; For each piece of traffic data, convert it into a three-dimensional data point in a three-dimensional coordinate system according to its read data volume, read time and access number; In the converted three-dimensional data point set, a random number generator is used to select a three-dimensional data point as a starting data point.

4. The encryption method of the SD-WAN communication system according to claim 3, characterized in that: The calculating of the local deviation of the starting data point within the initial neighborhood value specifically includes: Determine the neighborhood size of the starting data point; According to the defined neighborhood size, all data points that are within the neighborhood of the starting data point are selected from the dataset; For the starting data point and each data point in its neighborhood, calculate the distance between them; The distances between the starting data point and all the data points in the neighborhood are aggregated to obtain the local deviation.

5. The encryption method of the SD-WAN communication system according to claim 4, characterized in that: The distances between the starting data point and all the data points in the neighborhood are aggregated to obtain the local deviation, which is specifically formulated as follows: Among them, text is the local deviation, N is the number of data points in the neighborhood, P0 is the starting data point, and P i is the i-th data point in the neighborhood, dist(P0, P i ) is P0 and P i The distance between.

6. The encryption method of the SD-WAN communication system according to claim 5, characterized in that: The three-dimensional data points are divided into multiple layers according to the sensitivity value and the local offset, and each three-dimensional data point in each layer is subjected to data offset to obtain encrypted data, specifically including: Set multiple thresholds and assign data points to corresponding levels according to their sensitivity and local deviation. Designing an offset strategy for each layer, wherein the offset strategy is formulated based on the location, direction, and distance factors of the data points; For each 3D data point in each layer, the corresponding offset is calculated according to the offset strategy of the layer it belongs to, and it is applied to the original coordinates of the data point to obtain the encrypted data.

7. The encryption method of the SD-WAN communication system according to claim 6, characterized in that: The encrypted data is transmitted by using IPsec VPN technology, specifically including: Configure security proposals, security policies, IKE policies, and security associations for IPsec VPN gateways; The encrypted data is transmitted based on the configured IPsec VPN gateway.

8. An encryption system for a SD-WAN communication system, characterized in that: include: A data collection module is used to collect traffic data of several accesses within a preset period of time; A sensitivity calculation module is used to calculate the sensitivity of each accessed traffic data and obtain a sensitivity value; A data conversion module is used to convert each accessed flow data into a three-dimensional data point in a three-dimensional coordinate system, and arbitrarily select a three-dimensional data point as a starting data point; The deviation calculation module is used to calculate the local deviation of the starting data point within the initial neighborhood value; A data encryption module is used to divide the three-dimensional data points into multiple layers according to the sensitivity value and the local offset, and to perform data offset on each three-dimensional data point in each layer to obtain encrypted data; The encrypted transmission module is used to transmit encrypted data using IPsec VPN technology.

9. A computing device, characterized in that It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the encryption method of the SD-WAN communication system described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the encryption method of the SD-WAN communication system described in any one of claims 1 to 7.

Images