Information security defense method and system for communication encryption, and storage medium

Abstract

The invention discloses an information security defense method and system for communication encryption and a storage medium, and relates to the technical field of information security, and the method comprises the following steps: at a sending end, obtaining original encrypted information to be transmitted, carrying out fragmentation processing operation on the original encrypted information, generating a plurality of information fragments with independent encryption identifiers, and sending the information fragments to a server; through information fragmentation processing and distributed transmission path planning, the anti-attack capability of communication encryption in a complex network environment is remarkably improved, an attacker is difficult to obtain complete encrypted information through a single attack point due to information fragmentation operation, original information cannot be restored even if part of paths are monitored or hijacked, and meanwhile, the anti-attack capability of the communication encryption in the complex network environment is greatly improved. The distributed transmission path planning increases the difficulty of stealing information by an attacker, the security of the information is further improved, the innovative method effectively resists attacks in a complex network environment, and a more reliable and safer communication environment is provided for both communication parties.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an information security defense method, system and storage medium for communication encryption. Background Art

[0002] In today's digital age, information communication has become one of the core elements of social operation. With the rapid development and popularization of communication technology, information security issues have become increasingly prominent, becoming a key bottleneck restricting the further development of information communication.

[0003] However, when dealing with complex and ever-changing network attack environments, existing communication encryption technologies often use a single encryption method and transmit along a fixed path. Once an attacker breaks through one of the transmission links or obtains some encrypted information fragments, the original information can be restored through analysis and cracking methods, which seriously threatens the security and integrity of information transmission. It is also impossible to switch paths in a timely and effective manner or use information fragments from other paths to ensure the security of the overall information.

[0004] To sum up, the existing communication encryption technology is difficult to meet the growing information security needs in terms of information security processing and path transmission strategy. An innovative communication encryption information security defense method, system and storage medium are urgently needed to fill this technical gap, improve the anti-attack capability of communication encryption in complex network environments, and ensure the safe and reliable transmission of information. Summary of the invention

[0005] The purpose of the present invention is to make up for the shortcomings of the prior art and to provide an information security defense method, system and storage medium for communication encryption. It can divide the original encrypted information into multiple information fragments with independent encryption identifiers by introducing a combination of fragmentation processing and multi-path transmission, and send them separately through different planned paths to ensure that the original encrypted information is complete and accurate, thereby providing users with more secure and reliable communication protection.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: On the one hand, a communication encryption information security defense method comprises the following steps:

[0007] S100, at the sending end, obtaining the original encrypted information E to be transmitted;

[0008] S200, fragmentation operation is performed on the original encrypted information E, and the data volume is L E , the number of fragments after E is fragmented is n, and the size of the i-th fragment is S i And meet Generate multiple IDs with independent encryption i The information fragment, the encrypted identification IDi The fragment is indexed by its starting position in the original information P i and the hash value Hash calculated based on the fragment content i Composition, i.e. ID i =(P i ,Hash i );

[0009] S300, determining n different transmission paths R according to the network topology and path planning strategy i (i=1,2,…,n), transmit n fragments through the corresponding transmission path R i Send to the receiving end, and record the sending time T of each fragment when sending i and path identifier R i As transfer metadata MD i =(T i ,R i );

[0010] S400, the receiving end continuously monitors each transmission path and collects received information fragments;

[0011] When the number of received fragments reaches n, according to the encrypted ID i The starting position index P in i Sort the fragments and sort them according to the hash value i Perform integrity check on the fragments;

[0012] When the verification is passed, the information fragments are reassembled based on the fragment order to obtain the original encrypted information E;

[0013] If the verification fails, the retransmission request mechanism is started, and the retransmission request contains the encrypted identification ID of the fragment that failed the verification. i and transfer metadata MD i , the sender resends the corresponding fragment according to the retransmission request.

[0014] Furthermore, the fragmentation process in S200 is an operation based on information entropy H and fragmentation safety factor k, wherein the information entropy H is calculated based on the frequency distribution of characters in the original encrypted information E, that is, Where m is the number of different characters in E, p j is the frequency of occurrence of the jth character in E, and the fragment size S is determined according to H and k. i The value range of S min ≤S i ≤S max ,in

[0015] Furthermore, the S200 hash value Hash i The hash algorithm is used to obtain the fragment content as input, and the hash algorithm includes multiple rounds of iterative operations, and the operation function involved in each round of iteration is f(x, y) and Where x is the result of the previous iteration, y is a partial data block of the fragment content, mod M represents the modulus operation, |y| represents the length of data block y, and y k is the kth byte in the data block y, N is the encryption strength constant, and through the operation function, in each round of iteration, the result x of the previous round and the current data block y are combined and modulo-operated. The specific calculation process is Hash i =f(f(…f(x0,y1)…y s-1 )y s ), where s is the number of data blocks divided by the fragment content, x0 is the initial vector, and the data block y is transformed nonlinearly This makes the final hash value random and irreversible, and attackers cannot forge or tamper with the hash value by analyzing the fragment content.

[0016] Furthermore, the network topology structure S300 is constructed based on the geographical location distribution G of the network nodes and the connection reliability C between the network nodes, wherein the connection reliability C is determined by the historical packet loss rate LPR and the average delay AD between the network nodes, that is, The path planning strategy assigns the highest calculated C value to each fragment as the transmission path R according to the connection reliability C in the network topology. i .

[0017] Furthermore, the path planning strategy G in S300 is based on the real-time bandwidth B of the transmission path. i , average delay AD and historical packet loss rate LPR determine the transmission path of each information fragment Among them B i For path R i The real-time bandwidth of path R i The average delay of path R i The historical packet loss rate of argmax represents the path corresponding to the i value that maximizes the function value.

[0018] Furthermore, in the retransmission request mechanism S400, the number of retransmissions is set to N. When the number of retransmissions reaches N and there are still fragments that fail verification, the receiving end sends a security alarm signal SA. The security alarm signal SA includes the encrypted identification ID of the fragment that failed verification. i and transfer metadata MD i And the receiving end's ID R, the identity ID R The receiving end encrypts the fragment ID i Obtained after decryption.

[0019] In a second aspect, an information security defense system for communication encryption includes a sending end module, a receiving end module, and a path management and monitoring module, wherein:

[0020] The transmitting end module includes an encrypted information fragmentation unit and a multi-path transmission control unit;

[0021] The encrypted information fragmentation unit is used to perform fragmentation processing on the original encrypted information E to be transmitted, add an encryption identifier to it, and generate information fragments and independent encryption identifiers ID i ;

[0022] The multi-path transmission control unit is connected to the encrypted information fragmentation unit and is responsible for allocating information fragments to different transmission paths for transmission according to the multi-path transmission steps, and managing and monitoring the status information during the transmission process, the status information being the transmission time and path identifier, and recording the status information as the transmission metadata MD i ;

[0023] The receiving end module includes a fragment collection unit, a reassembly and decryption unit and a retransmission processing unit;

[0024] The fragment collection unit is used to collect received information fragments;

[0025] The reassembly and decryption unit is connected to the fragment collection unit, performs integrity verification, sorting, reassembly and decryption operations on the collected information fragments, outputs the restored original encrypted information, and starts a retransmission request mechanism when the verification fails;

[0026] The retransmission processing unit receives the retransmission request from the reassembly and decryption unit and controls the sending end module to resend the corresponding fragments;

[0027] The security alarm unit performs security monitoring on the retransmission processing unit and sends a security alarm signal SA when the number of retransmissions of the retransmission processing unit reaches the upper limit and there are still fragments that fail verification;

[0028] The path management and monitoring module includes a path planning unit and a path monitoring unit;

[0029] The path planning unit is used to construct a network topology based on the geographical distribution G of network nodes and the connection reliability C, and formulate a path planning strategy based on the connection reliability C to determine the transmission paths of different information fragments;

[0030] The path monitoring unit monitors the status of each transmission path in real time, feeds back the status information to the sending and receiving modules, and adjusts the transmission strategy in time when an abnormality occurs, that is, obtains the real-time packet loss rate LPR between network nodes t and average delay AD t , update the connection reliability C to The updated connection reliability C t Feedback is given to the path planning unit to adjust the path planning strategy.

[0031] Furthermore, the integrity check process of the reassembly and decryption unit in the receiving end module further includes: encrypting the fragment ID i The starting position index P i Continuity check, when there is a discontinuous P i , the verification is directly judged to have failed and the retransmission request mechanism is started. The retransmission request contains discontinuous P i The encrypted ID of the corresponding fragment i and transfer metadata MD i .

[0032] In a third aspect, a computer-readable storage medium stores a computer program, which, when executed by a processor, implements the information security defense method for communication encryption.

[0033] Compared with the prior art, the information security defense method, system and storage medium of communication encryption have the following beneficial effects:

[0034] 1. The present invention significantly improves the anti-attack capability of communication encryption in a complex network environment through information fragmentation processing and distributed transmission path planning. The information fragmentation operation makes it difficult for attackers to obtain complete encrypted information through a single attack point. Even if part of the path is monitored or hijacked, the original information cannot be restored. At the same time, distributed transmission path planning increases the difficulty for attackers to steal information and further improves the security of information. This innovative method not only effectively resists attacks in a complex network environment, but also provides a more reliable and secure communication environment for both communicating parties.

[0035] 2. The present invention is also highly flexible and scalable. Information fragmentation processing and distributed transmission path planning can be flexibly adjusted according to different network topologies and transmission conditions to adapt to complex and changeable network environments. In addition, the retransmission request mechanism when the receiving end fails the verification, as well as the retransmission number limit and security alarm setting, can promptly detect and respond to transmission anomalies, ensure the reliable transmission of information, and build a solid information security defense line from multiple dimensions.

[0036] Other advantages, objectives and features of the present invention will be set forth in part in the following description and, in part, will be apparent to those skilled in the art based on an examination of the following or may be taught from the practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 An operation flow chart of an information security defense method for communication encryption;

[0039] Figure 2 The present invention is a schematic diagram of the structure of an information security defense system for communication encryption. DETAILED DESCRIPTION

[0040] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] Embodiment 1

[0042] This embodiment elaborates on the application of the communication encryption information security defense method against advanced persistent threats (APT). APT attacks pose a serious threat to information security due to their concealment and persistence, and traditional encryption methods are difficult to deal with effectively. The present invention uses information fragmentation, unique hash algorithms, topology structure construction and path planning based on network characteristics, and a complete retransmission and alarm mechanism to comprehensively resist APT attacks at the sending end, transmission process and receiving end, thereby ensuring the secure transmission of information in a complex network environment.

[0043] In the specific implementation, first, the original encrypted information E to be transmitted is obtained at the sending end, and its data volume is L E , based on the information entropy H and the fragmentation security factor k, the original encrypted information E is fragmented. The information entropy H is calculated according to the character frequency distribution in the original encrypted information E. The formula is: Where m is the number of different characters in E, p jis the frequency of occurrence of the jth character in E. By calculating the information entropy, we can measure the uncertainty and randomness of information, provide a basis for reasonable fragmentation, and determine the fragment size S according to H and k. i The value range of S min ≤S i ≤S max ,in The size S of each fragment is randomly determined within this range. i , so that the fragment size has a certain randomness, preventing attackers from predicting the fragment content through fixed patterns, and generating multiple fragments with independent encryption IDs i Information fragments, encrypted identification ID i The fragment is indexed by its starting position in the original information P i and the hash value Hash calculated based on the fragment content i Composition, i.e. ID i =(P i ,Hash i ), starting position index P i The starting position of the fragment in the original encrypted information is accurately recorded to facilitate subsequent reorganization. i The hash algorithm is derived by taking the fragment content as input. The hash algorithm includes multiple rounds of iterative operations. The operation function involved in each round of iteration is Where x is the result of the previous iteration, y is a partial data block of the fragment content, mod M represents the modulus operation, |y| represents the length of data block y, and y k is the kth byte in the data block y, N is the encryption strength constant. Through multiple rounds of iterative operations, the final hash value is random and irreversible. It is difficult for attackers to forge and tamper with the hash value by analyzing the fragment content, thereby ensuring the integrity and authenticity of the fragment.

[0044] Then, the network topology is constructed and the path planning strategy is determined. The network topology is constructed based on the geographical distribution G of the network nodes and the connection reliability C between the network nodes. The connection reliability C is determined by the historical packet loss rate LPR and the average delay AD between the network nodes. The formula is: By statistically analyzing the historical communication data between nodes in the network, the historical packet loss rate LPR and average delay AD between different nodes are obtained, and the connection reliability C is calculated. According to the connection reliability C, a transmission path R with a higher C value is allocated to each fragment. i At the same time, the path planning strategy is also based on the real-time bandwidth B of the transmission path. i , average delay AD and historical packet loss rate LPR determine the transmission path of each information fragment During the transmission process, the real-time bandwidth B of each path is monitored in real time.i , combined with the existing average delay AD and historical packet loss rate LPR data, the formula is used to calculate the quality of each path, and the path that maximizes the function value is selected as the transmission path of the information fragment. This ensures that during the transmission process, the optimal path is selected according to the real-time status of the network, thereby improving transmission efficiency and reliability. Each fragment is transmitted through the corresponding transmission path R i Send to the receiving end, and record the sending time T of each fragment when sending i and path identifier R i As transfer metadata MD i =(T i ,R i ), sending time T i The sending time of each fragment can be accurately recorded for subsequent analysis of the time characteristics of the transmission process to determine whether there is an abnormal delay. The path identifier R i The path that the fragments have taken is clearly defined, making it easier to check and trace the path when problems arise.

[0045] Finally, the receiving end continues to monitor each transmission path and collects the received information fragments. When the number of received fragments reaches n (the preset total number of fragments), it starts processing and sends the encrypted ID to the receiving end. i The starting position index P in i Sort the fragments to ensure that they can be reassembled in the order of the original information, and then sort them according to the hash value i The integrity check of the fragments includes the comparison of hash values, that is, the receiving end uses the same hash algorithm to recalculate the hash value of the received fragments and compares it with the hash value sent by the sending end. i Compare and verify the integrity of the fragments. i The starting position index P i Continuity check, if there is a discontinuous P i , the verification is directly judged to have failed and the retransmission request mechanism is started. The retransmission request contains discontinuous P i The encrypted ID of the corresponding fragment i and transfer metadata MD i If the received random order is set to P1 = 0, P3 = 200 (P2 is missing in the middle), the verification is determined to have failed, and a retransmission request is immediately sent to the sender, requesting the retransmission of the fragment with the starting position index P2. If the verification passes, the information fragments are reassembled based on the fragment order to obtain the original encrypted information E. The reassembly process is based on the starting position index P iThe fragments are stitched together in order to restore the format of the original encrypted information; if the verification fails, and under the retransmission request mechanism, the number of retransmissions is set to N, when the number of retransmissions reaches N and there are still fragments that fail the verification, the receiving end sends a security alarm signal SA, which contains the encrypted identification ID of the fragment that failed the verification i and transfer metadata MD i And the receiving end's ID R , the receiving end's identity ID R It can be the unique identifier of the receiving device (the device's MAC address), which is used to clearly identify the receiving device in the alarm information, making it easier for the sender and system administrator to perform troubleshooting and security response.

[0046] To sum up, in this embodiment, by applying the communication encryption information security defense method of the present invention, the advanced persistent threat (APT) is effectively resisted. The information is fragmented at the sending end, and the fragment size is reasonably divided by using information entropy and security factor. The encryption identifier is generated by a unique hash algorithm to ensure the security and identifiability of the fragments. The path planning strategy based on the network topology and real-time network parameters during the transmission process ensures that the fragments can be transmitted on a reliable path. At the same time, multi-path transmission increases the difficulty for attackers to obtain complete information. The strict verification, retransmission mechanism and security alarm at the receiving end can promptly detect and handle abnormal situations in the transmission process, thereby ensuring the integrity and accuracy of the information.

[0047] Embodiment 2

[0048] This embodiment focuses on demonstrating the specific implementation process of the communication encryption information security defense system against distributed denial of service (DDoS) attacks. DDoS attacks exhaust server resources through a large number of forged requests. Traditional encryption methods are easily ineffective under such attacks. The present invention relies on unique information fragmentation, enhanced multi-path transmission strategy (including redundant node settings) and efficient retransmission and monitoring mechanisms. It carefully processes information at the sending end, flexibly adapts to network changes during transmission, and strictly verifies and responds to anomalies at the receiving end, ensuring the stability and security of communications in DDoS attack scenarios.

[0049] First, the original encrypted information E to be transmitted and its data volume L are obtained at the sending end. E , based on information entropy H and fragmentation safety factor k, fragmentation operation is carried out, by calculating information entropy (where m is the number of different characters in E, p j is the frequency of occurrence of the jth character in E), and the fragment size S is determined based on H and k i The value range of Generate an independent encrypted ID for each fragment i =(Pi ,Hash i ), where the starting position index P i Record the starting position of the fragment in the original information, the hash value Hash i By including multiple rounds of iterative operations (each round of iterative function is Where x is the result of the previous iteration, y is a partial data block of the fragment content, mod M represents the modulus operation, |y| represents the length of data block y, and y k is the kth byte in data block y, N is the encryption strength constant) and is calculated using a hash algorithm to ensure the integrity and security of the fragment.

[0050] When building a network topology, the geographical location distribution G of network nodes and the reliability of connections between network nodes are considered comprehensively. By statistically analyzing the historical packet loss rate LPR and average delay AD between nodes, the path planning strategy is based on the real-time bandwidth B of the transmission path. i , average delay AD and historical packet loss rate LPR determine the transmission path of each information fragment On this basis, in order to enhance the ability to deal with DDoS attacks, multiple redundant nodes are set on each selected transmission path. For a main transmission path, in addition to the normal transmission nodes, two redundant nodes are deployed. These redundant nodes have the same transmission function as the main node and synchronize status information with the main node in real time. Once the main node is affected by the DDoS attack and fails, the redundant node can quickly take over the fragment transmission task to ensure that the transmission of information fragments is not interrupted. After associating the fragments with the corresponding redundant node information, they are ready to be transmitted through the determined transmission path R. i Send to the receiving end and record the sending time T of each fragment i and path identifier R i As transfer metadata MD i =(T i ,R i ), according to the planned transmission path and redundant node configuration, the information fragments are sent out. During the transmission process, the status of each transmission path is monitored in real time, including the real-time bandwidth B i , average delay AD and packet loss rate information, the path monitoring unit continuously obtains the real-time packet loss rate LPR between network nodes t and average delay AD t , and according to the formula Update connection reliability C t , according to the updated connection reliability C t,The path planning unit dynamically adjusts the path planning strategy. When it is found that the connection reliability of the path drops to the threshold, the transmission of some fragments will be switched to other more reliable paths or redundant nodes to ensure the smooth transmission of information fragments; In addition, when a DDoS attack is detected (by monitoring the characteristics of a large number of similar requests from different source addresses in the network traffic), the system automatically starts the response mechanism and finds that one of the transmission paths is blocked by a large number of invalid requests, resulting in the real-time bandwidth B of the path. i If the packet loss rate drops sharply or increases significantly, the system will quickly switch the information fragments originally transmitted on the path to other unaffected or less affected paths and redundant nodes. That is, when path A is attacked by DDos, the system will immediately transfer the fragments originally transmitted through path A to path B and its redundant nodes for continued transmission, ensuring that the transmission of information fragments is not seriously interfered with by the attack and maintaining the stability of the overall communication.

[0051] The receiving end continuously monitors each transmission path (including the main path and redundant path) and collects the received information fragments. Once the number of received fragments reaches the preset value n, it enters the subsequent processing flow and i The starting position index P in i Sort the fragments and then sort them according to the hash value i Perform integrity check, which includes accurate comparison of hash values ​​and the start position index P i If the hash value does not match or the starting position index is discontinuous, the verification is considered to have failed. At the same time, if the hash value in the received fragment is inconsistent with the hash value calculated by the sender or there is a jump in the starting position index, the retransmission request mechanism is immediately started, and the retransmission request contains the encrypted identification ID of the fragment that failed the verification. i and transfer metadata MD i If the verification is passed, the information fragments are reassembled based on the fragment order to obtain the original encrypted information E, and the reassembly is strictly based on the starting position index P i The fragments are spliced ​​together in order to restore the complete structure of the original encrypted information. Under the retransmission request mechanism, the number of retransmissions is preset to N. If the number of retransmissions reaches N and there are still fragments that fail verification, the receiving end sends a security alarm signal SA, which contains the encrypted identification ID of the fragment that failed verification. i , transfer metadata MD i And the receiving end's ID R (IP address of the receiving device), the security alarm signal SA will promptly notify the sender and the security management system so that further measures can be taken to ensure communication security.

[0052] In summary, in the process of responding to distributed denial of service (DDoS) attacks, this embodiment demonstrates a strong defense capability by comprehensively applying the communication encryption information security defense system of the present invention. The information fragmentation processing at the sending end is combined with the carefully planned multi-path and redundant node settings to provide a variety of options and reliable backup for information transmission. During the transmission process, the network status is monitored in real time and the path strategy is dynamically adjusted, which effectively avoids the damage of the DDoS attack to the transmission path. The strict verification, retransmission and alarm mechanisms at the receiving end ensure the accuracy and integrity of the received information.

[0053] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A communication encryption information security defense method, characterized in that: The method comprises the following steps: S100, at the sending end, obtaining the original encrypted information E to be transmitted; S200, fragmentation operation is performed on the original encrypted information E, and the data volume is L E , the number of fragments after E is fragmented is n, and the size of the i-th fragment is S i And meet Generate multiple IDs with independent encryption i The information fragment, the encrypted identification ID i The fragment is indexed by its starting position in the original information P i and the hash value Hash calculated based on the fragment content i Composition, i.e. ID i =(P i ,Hash i ); S300, determining n different transmission paths R according to the network topology and path planning strategy i (i=1,2,…,n), transmit n fragments through the corresponding transmission path R i Send to the receiving end, and record the sending time T of each fragment when sending i and path identifier R i As transfer metadata MD i =(T i ,R i ); S400, the receiving end continuously monitors each transmission path and collects received information fragments; When the number of received fragments reaches n, according to the encrypted ID i The starting position index P in i Sort the fragments and sort them according to the hash value i Perform integrity check on the fragments; When the verification is passed, the information fragments are reassembled based on the fragment order to obtain the original encrypted information E; If the verification fails, the retransmission request mechanism is started, and the retransmission request contains the encrypted identification ID of the fragment that failed the verification. i and transfer metadata MD i , the sender resends the corresponding fragment according to the retransmission request.

2. According to claim 1, the information security defense method of communication encryption is characterized in that: The fragmentation process in S200 is an operation based on information entropy H and fragmentation safety factor k, wherein the information entropy H is calculated based on the character frequency distribution in the original encrypted information E, that is, Where m is the number of different characters in E, p j is the frequency of occurrence of the jth character in E, and the fragment size S is determined according to H and k i The value range of S min ≤S i ≤S max ,in 3. According to the information security defense method of communication encryption as described in claim 1, it is characterized in that: The S200 hash value i The hash algorithm is used to obtain the fragment content as input, and the hash algorithm includes multiple rounds of iterative operations, and the operation function involved in each round of iteration is f(x, y) and Where x is the result of the previous iteration, y is a partial data block of the fragment content, modM represents the modulus operation, |y| represents the length of data block y, and y k is the kth byte in the data block y, N is the encryption strength constant, and through the operation function, in each round of iteration, the result x of the previous round and the current data block y are combined and modulo-operated. The specific calculation process is Hash i =f(f(…f(x0,y1)…y s-1 )y s ), where s is the number of data blocks divided by the fragment content, x0 is the initial vector, and the data block y is transformed nonlinearly This makes the final hash value random and irreversible, and attackers cannot forge or tamper with the hash value by analyzing the fragment content.

4. According to the information security defense method of communication encryption as described in claim 1, it is characterized in that: The network topology structure S300 is constructed based on the geographical location distribution G of the network nodes and the connection reliability C between the network nodes, where the connection reliability C is determined by the historical packet loss rate LPR and the average delay AD between the network nodes, that is, The path planning strategy assigns the highest calculated C value to each fragment as the transmission path R according to the connection reliability C in the network topology. i .

5. According to claim 1, the information security defense method of communication encryption is characterized in that: The path planning strategy G in S300 is based on the real-time bandwidth B of the transmission path. i , average delay AD and historical packet loss rate LPR determine the transmission path of each information fragment Among them B i For path R i The real-time bandwidth of path R i The average delay of path R i The historical packet loss rate of argmax represents the path corresponding to the i value that maximizes the function value.

6. According to claim 1, the information security defense method of communication encryption is characterized in that: In the retransmission request mechanism of S400, the number of retransmissions is set to N. When the number of retransmissions reaches N and there are still fragments that fail verification, the receiving end sends a security alarm signal SA. The security alarm signal SA contains the encrypted identification ID of the fragment that failed verification. i and transfer metadata MD i And the receiving end's ID R , the identity ID R The receiving end encrypts the fragment ID i Obtained after decryption.

7. An information security defense system for communication encryption, characterized in that: The system includes a transmitting module, a receiving module and a path management and monitoring module, wherein: The transmitting end module includes an encrypted information fragmentation unit and a multi-path transmission control unit; The encrypted information fragmentation unit is used to perform fragmentation processing on the original encrypted information E to be transmitted, add an encryption identifier to it, and generate information fragments and independent encryption identifiers ID i ; The multi-path transmission control unit is connected to the encrypted information fragmentation unit and is responsible for allocating information fragments to different transmission paths for transmission according to the multi-path transmission steps, and managing and monitoring the status information during the transmission process, the status information being the transmission time and path identifier, and recording the status information as the transmission metadata MD i ; The receiving end module includes a fragment collection unit, a reassembly and decryption unit, a security alarm unit and a retransmission processing unit; The fragment collection unit is used to collect received information fragments; The reassembly and decryption unit is connected to the fragment collection unit, performs integrity verification, sorting, reassembly and decryption operations on the collected information fragments, outputs the restored original encrypted information, and starts a retransmission request mechanism when the verification fails; The retransmission processing unit receives the retransmission request from the reassembly and decryption unit and controls the sending end module to resend the corresponding fragments; The security alarm unit performs security monitoring on the retransmission processing unit and sends a security alarm signal SA when the number of retransmissions of the retransmission processing unit reaches the upper limit and there are still fragments that fail verification; The path management and monitoring module includes a path planning unit and a path monitoring unit; The path planning unit is used to construct a network topology based on the geographical distribution G of network nodes and the connection reliability C, and formulate a path planning strategy based on the connection reliability C to determine the transmission paths of different information fragments; The path monitoring unit monitors the status of each transmission path in real time, feeds back the status information to the sending and receiving modules, and adjusts the transmission strategy in time when an abnormality occurs, that is, obtains the real-time packet loss rate LPR between network nodes t and average delay AD t , update the connection reliability C to The updated connection reliability C t Feedback is given to the path planning unit to adjust the path planning strategy.

8. The information security defense system for communication encryption according to claim 7, characterized in that: The integrity check process of the reassembly and decryption unit in the receiving end module also includes: encrypting the fragment ID i The starting position index P i Continuity check, when there is a discontinuous P i , the verification is directly judged to have failed and the retransmission request mechanism is started. The retransmission request contains discontinuous P i The encrypted ID of the corresponding fragment i and transfer metadata MD i .

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the information security defense method for communication encryption described in any one of claims 1-6 is implemented.

Images