Data encryption transmission method based on zero trust architecture

Abstract

The application belongs to the technical field of information security, and relates to a data encryption transmission method based on a zero-trust architecture, which comprises the following steps: verifying the identity of a user based on an RSA encryption algorithm; combining hardware fingerprint technology to tightly bind the identity of the user with an authorized terminal device, combining a hardware fingerprint, an operating environment parameter and a certificate serial number to generate a dynamic identity token; introducing a strategy engine to analyze network environment data, a data sensitivity level and a computer secret risk assessment level; dynamically selecting a suitable encryption algorithm in combination with a low risk score threshold and a high risk score threshold; establishing an independent encryption tunnel based on a software-defined boundary, following a minimum permission principle to limit a data transmission path; and checking each data packet for a dynamic identity token, and if abnormal behavior is detected, terminating a session and starting a secondary authentication process.The application can solve the problem that a traditional encryption method is difficult to adapt to a constantly changing network environment and a data sensitivity level.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of information security, and relates to a data encryption transmission method based on a zero-trust architecture. BACKGROUND

[0002] In traditional communication encryption methods, the security of data often depends on the protection of network boundaries, that is, it is assumed that the internal network is trusted, while the external network is considered untrusted. However, with the increasing complexity of network environments and the continuous evolution of attack methods, this trust model based on network boundaries has been difficult to ensure the security of data. Once an attacker breaks through the network boundary, they can freely move within the internal network and steal or tamper with sensitive data.

[0003] Traditional encryption methods often use static encryption strategies and fixed key management methods, which makes them difficult to adapt to changing network environments and data sensitivity levels. Attackers can exploit these static characteristics by cracking encryption algorithms or stealing keys to obtain sensitive data. Traditional encryption methods also lack effective binding of user identity and terminal device, which allows attackers to launch attacks by forging user identity or using infected terminal devices.

[0004] To solve the above problems, the traditional encryption method is difficult to adapt to the changing network environment and the data sensitivity level, and the attacker can exploit these static characteristics by cracking the encryption algorithm or stealing the key to obtain the sensitive data. SUMMARY

[0005] To solve the above problems, the application provides a data encryption transmission method based on a zero-trust architecture.

[0006] The data encryption transmission method based on the zero-trust architecture includes the following steps:

[0007] S1, verifying the identity of the user based on the RSA encryption algorithm;

[0008] S2, tightly binding the user's identity with the authorized terminal device by combining hardware fingerprint technology, collecting the running environment parameters of the authorized terminal device, and combining the hardware fingerprint, running environment parameters, and certificate serial number to generate a dynamic identity token, which serves as an effective proof of the user's identity;

[0009] S3, introducing a policy engine to analyze network environment data, data sensitivity level, and computer secret risk assessment level;

[0010] S4, dynamically selecting a suitable encryption algorithm according to the analysis results of the policy engine, combining the low risk score threshold and the high risk score threshold, determining the life cycle of the key according to the actual situation, and ensuring the confidentiality and integrity of the data;

[0011] S5, establish independent encryption tunnel based on software defined boundary, follow the principle of least privilege to limit data transmission path;

[0012] S6, check each data packet with dynamic identity token, if abnormal behavior is detected, terminate the session and start secondary authentication process.

[0013] Further scheme of the application, step S1, comprises the following steps:

[0014] The pre-set client collects the identity information of the user, and the client calls the TPM2.0 security chip to generate an RSA-3072 key pair: a public key PK user , and a private key SK user , the public key PK user is uploaded to the zero trust control center, and the private key SK user is stored in the TPM2.0 security chip;

[0015] The client initiates a user identity authentication request to the zero trust control center, the zero trust control center generates a random number challenge code N once , encrypts it using the public key PK user , and sends it to the client, the client calls the private key SK user of the TPM2.0 security chip to decrypt the challenge code, then calculates the response value and returns it to the zero trust control center;

[0016] The zero trust control center verifies the response value and the deviation of the timestamp Timestamp, if the deviation is less than or equal to 3 seconds, the zero trust control center will issue a short-term identity certificate to the user, and the validity period of the short-term identity certificate is less than or equal to 5 minutes.

[0017] Further scheme of the application, step S2, comprises the following steps:

[0018] Collect the hardware features of the authorized terminal device, including CPU microcode version, firmware hash value and hard disk serial number, generate a hardware fingerprint using KMAC256 algorithm, tightly bind the user's identity with the authorized terminal device, calculate the hardware fingerprint FP, satisfy the following formula,

[0019] FP=KMAC256(H cpu ||U board ||S disk )

[0020] Wherein, H cpu represents the CPU microcode version, U board represents the firmware hash value, and S disk represents the hard disk serial number;

[0021] The operation environment parameters of the authorized terminal device are monitored, including a geofence, a network access point of the authorized terminal device, and an operating system integrity check state; a dynamic identity token Token is generated by combining a hardware fingerprint FP, a serial number CertSN of a short-term identity certificate, operation environment parameters Env of the authorized terminal device, and a hash function.

[0022] The further scheme of the application further comprises the following steps of step S3:

[0023] The network environment data is collected, including network delay, open port abnormal number, and threat intelligence matching degree; the sensitive level of the data is classified according to the GB / T35273 standard, including public L1, internal L2, confidential L3, and top secret L4;

[0024] The risk assessment formula of the computer secret is,

[0025]

[0026] Wherein, L is the network delay parameter; L Max is the maximum network delay parameter; P is the open port abnormal number; T is the threat intelligence matching degree; S is the sensitive level of the data; W1, W2, W3 and W4 are weight coefficients, which are allocated according to expert experience.

[0027] The further scheme of the application further comprises the following steps of step S4:

[0028] The low risk score threshold and the high risk score threshold are set according to the data of the historical record and the expert experience, the analysis result of the strategy engine is combined with the low risk score threshold and the high risk score threshold to dynamically select a suitable encryption algorithm;

[0029] The encryption algorithm includes an AES-128-GCM encryption algorithm, an AES-256-GCM encryption algorithm and a ChaCha20-Poly1305 encryption algorithm.

[0030] The life cycle of the key is dynamically determined according to the actual situation, including that the AES-128-GCM encryption algorithm needs to rotate the key every 24 hours, the AES-256-GCM encryption algorithm needs to rotate the key every 12 hours, and the ChaCha20-Poly1305 encryption algorithm needs to rotate the key every 1 hour.

[0031] The further scheme of the application further comprises the following steps of the strategy engine, the analysis result, and the combination of the low risk score threshold and the high risk score threshold to dynamically select a suitable encryption algorithm.

[0032] The low risk score threshold is set as R1 and the high risk score threshold is set as R2, satisfying,

[0033] R < R1, i.e. the risk assessment level is low risk, the AES-128-GCM encryption algorithm is selected and the key is rotated every 24 hours;

[0034] R1≤R<R2, i.e. the risk assessment level is medium risk, the AES-256-GCM encryption algorithm is selected and the key is rotated every 12 hours;

[0035] R≥R2, i.e. the risk assessment level is high risk, the ChaCha20-Poly1305 encryption algorithm is selected and the key is rotated every 1 hour.

[0036] Further schemes of the application, step S5, include the following steps:

[0037] The cloud-based SDP controller cluster deploys a controller architecture, the client submits a dynamic identity token Token and a session intent declaration, the controller verifies the dynamic identity token Token, if the controller verification is passed, the controller allocates a short-life temporary communication credential for the two parties of communication, and establishes a double-layer tunnel between the two parties of communication, so that the encrypted data of the two parties of communication can only flow between the authorized network nodes;

[0038] Wherein, the life cycle of the temporary communication credential t≤10min.

[0039] Further schemes of the application, the double-layer tunnel includes an inner-layer application layer tunnel and an outer-layer transport layer tunnel.

[0040] The inner-layer application layer tunnel is based on TLS1.3, uses the key exchange algorithm of elliptic curve X25519 for key exchange, and adopts a short-life temporary communication credential; the session intent declaration is first encrypted by TLS1.3 to generate a TLS record.

[0041] The outer-layer transport layer tunnel is based on the QUIC protocol to build an efficient encrypted communication pipeline, and uses the built-in header protection feature of the QUIC protocol to selectively encrypt and encode the sensitive metadata in the handshake layer packet header, i.e. the confused packet header, so as to eliminate identifiable network features and resist flow fingerprint analysis attacks; strict bidirectional mTLS verification is implemented in the QUIC handshake stage, and the short-term identity certificate of the client is bound with the dynamic identity token Token.

[0042] The TLS record of the inner-layer application layer tunnel is segmented by the QUIC protocol, the confused packet header is attached and the entire QUIC frame is encrypted, and the data transmission path is limited according to the principle of least privilege.

[0043] Further schemes of the application, step S6, include the following steps:

[0044] The abnormal degree of the flow deviating from the baseline is quantified based on Z-Score, which satisfies the following formula,

[0045]

[0046] Wherein, Z represents the deviation degree of current flow rate and historical baseline, the greater the absolute value is, the higher the abnormal probability is; X represents the current flow rate, which is calculated through the network card throughput; μ represents the historical baseline mean, that is, the flow average value in a period of time; σ represents the flow standard deviation, reflecting the stability of the baseline data.

[0047] Further scheme of the application, step S6, further comprises the following steps:

[0048] The threshold of flow mutation is set as Z', if |Z|≤Z' indicates that the flow rate is normal, and if |Z|>Z' indicates that the flow rate is abnormal and the fusing strategy is performed, and the secondary authentication process is started;

[0049] Among them, the fusing strategy is to forcibly close the encrypted tunnel and immediately terminate the session, and add the MAC address / IP of the illegal device to the temporary black list;

[0050] The secondary authentication process requires the user to complete the verification through the biological characteristics or the manual approval of the security team before restoring the access.

[0051] In summary, the application has the following beneficial technical effects:

[0052] 1. Combined with RSA encryption algorithm, hardware fingerprint technology and dynamic identity token, the strict verification of user identity and the close binding with authorized terminal device are realized; this multi-level identity verification mechanism significantly enhances the security of data transmission and reduces the risk of illegal access or tampering; the use of dynamic identity token ensures the integrity and authenticity of data by accompanying identity verification with each data transmission;

[0053] 2. The strategy engine is introduced to analyze network environment data and data sensitivity level, so as to calculate the risk assessment level of the secret. According to the risk assessment result, the system can dynamically select the appropriate encryption algorithm and key life cycle. This flexibility enables the data transmission to adaptively adjust according to the security risk level in different scenarios, ensuring the needs of high security data transmission and avoiding unnecessary resource consumption;

[0054] 3. An independent encryption tunnel based on software-defined boundary is established, which follows the principle of least privilege to limit the data transmission path. This method effectively isolates the data transmission environment of the communication parties and prevents the risk of data leakage; the design of double-layer tunnel further enhances the security of communication. BRIEF DESCRIPTION OF DRAWINGS

[0055] Figure 1A flowchart of a data encryption transmission method based on a zero trust architecture is disclosed.

[0056] Figure 2 A framework diagram of a data encryption transmission system based on a zero trust architecture is disclosed. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below with reference to the drawings of the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. All other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0058] The above and other embodiments of the present application will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings, in which: Figures 1-2 The preferred detailed description of the present application is as follows.

[0059] The preferred detailed description of the present application is as follows. Figure 1 The present application proposes a data encryption transmission method based on a zero trust architecture, comprising the following steps:

[0060] S1, verifying the identity of the user based on the RSA encryption algorithm;

[0061] S2, tightly binding the identity of the user to the authorized terminal device in combination with the hardware fingerprint technology, collecting the running environment parameters of the authorized terminal device, combining the hardware fingerprint, the running environment parameters and the certificate serial number to generate a dynamic identity token, and taking the dynamic identity token as a valid proof of the identity of the user;

[0062] S3, introducing a policy engine to analyze network environment data, data sensitivity level and computer secret risk assessment level;

[0063] S4, dynamically selecting a suitable encryption algorithm according to the analysis result of the policy engine in combination with a low risk score threshold and a high risk score threshold, determining the life cycle of the key according to the actual situation, and ensuring the confidentiality and integrity of the data;

[0064] S5, establishing an independent encryption tunnel based on software-defined boundaries, and limiting the data transmission path in accordance with the principle of least privilege;

[0065] S6, checking the dynamic identity token for each data packet, and terminating the session and starting a secondary authentication process if abnormal behavior is detected.

[0066] In one embodiment of the present application, step S1 comprises the following steps:

[0067] The pre-set client collects the identity information of the user, and the client calls a TPM2.0 security chip to generate an RSA-3072 key pair: a public key PKuser , private key SK user , public key PK user upload to the zero trust control center, private key SK user , and store in the TPM2.0 security chip;

[0068] The client initiates a user identity authentication request to the zero trust control center, and the zero trust control center generates a random number challenge code N once (128bit), and then encrypts and sends to the client using the public key PK user , the client calls the private key SK user of the TPM2.0 security chip to decrypt the challenge code, and then calculates the response value Sign(N once ||Timestamp,SK user ) and returns to the zero trust control center;

[0069] The zero trust control center verifies the response value Sign(N once ||Timestamp,SK user ) and the deviation of the timestamp Timestamp, and if the deviation is less than or equal to 3 seconds, the zero trust control center will issue a short-term identity certificate to the user, and the validity period of the short-term identity certificate is less than or equal to 5 minutes.

[0070] In one embodiment of the present application, step S2 comprises the following steps:

[0071] Collect the hardware features of the authorized terminal device, including the CPU microcode version, the firmware hash value, and the hard disk serial number, generate a hardware fingerprint using the KMAC256 algorithm, tightly bind the user's identity with the authorized terminal device, calculate the hardware fingerprint FP, and satisfy the following formula:

[0072] FP=KMAC256(H cpu ||U board ||S disk )

[0073] Wherein, H cpu represents the CPU microcode version, U board represents the firmware hash value, and S disk represents the hard disk serial number;

[0074] Monitor the running environment parameters of the authorized terminal device, including the geofence, the network access point of the authorized terminal device, and the operating system integrity verification state; combine the hardware fingerprint FP, the serial number CertSN of the short-term identity certificate, and the running environment parameters Env of the authorized terminal device with a hash function to generate a dynamic identity token Token=Sign(FP||Env||CertSN), which serves as a valid proof of the user's identity;

[0075] Dynamic identity token has a time limit and will expire after a period of time, requiring the user to log in again or perform secondary verification to obtain a new token.

[0076] For example, when a user logs in to the internal system of an authorized terminal device, the user needs to submit a dynamic identity token Token. When the zero-trust control center verifies that the dynamic identity token Token is in a valid state, the user is allowed to access the internal system of the authorized terminal device.

[0077] If the user logs in to another authorized terminal device through the dynamic identity token Token, the zero-trust control center cannot verify the validity of the dynamic identity token due to the differences in the running environment parameters and hardware fingerprints of the authorized terminal device, thereby rejecting the user's access request.

[0078] In one embodiment of the present application, step S3 includes the following steps:

[0079] Collect network environment data, including network delay, number of open port anomalies, and threat intelligence matching degree; classify the sensitivity level of the data according to GB / T35273 standard, including public L1 (sensitivity level of data is 1), internal L2 (sensitivity level of data is 2), confidential L3 (sensitivity level of data is 3), and top secret L4 (sensitivity level of data is 4);

[0080] Confidential risk assessment formula:

[0081]

[0082] Wherein, L is the network delay parameter; L Max is the maximum network delay parameter; P is the number of open port anomalies; T is the threat intelligence matching degree; S is the sensitivity level of the data; W1, W2, W3, and W4 are weight coefficients, which are allocated according to expert experience.

[0083] For example, the current delay value is 85ms obtained by ICMP speed measurement, and the set maximum network delay parameter is 100ms; compared with the baseline, 2 unauthorized ports are added, which are the database port and the debugging port; the threat intelligence system detects that the communication mode matching degree T with the Mirai botnet C2 server is 0.7; the sensitivity level of the data is confidential L3, i.e. S = 3;

[0084] According to expert experience, W1 = 0.2, W2 = 0.3, W3 = 0.3, and W4 = 0.2.

[0085] Substituting the confidential risk assessment formula, we get:

[0086]

[0087] In one of the embodiments of the present application, the step S4 comprises the following steps:

[0088] The low risk score threshold and the high risk score threshold are set according to the historical record data and the expert experience, the appropriate encryption algorithm is dynamically selected according to the analysis result of the strategy engine and in combination with the low risk score threshold and the high risk score threshold;

[0089] The encryption algorithm comprises an AES-128-GCM encryption algorithm, an AES-256-GCM encryption algorithm and a ChaCha20-Poly1305 encryption algorithm.

[0090] The life cycle of the key is dynamically determined according to the actual situation, and the AES-128-GCM encryption algorithm needs to replace the key every 24 hours, the AES-256-GCM encryption algorithm needs to replace the key every 12 hours, and the ChaCha20-Poly1305 encryption algorithm needs to replace the key every 1 hour.

[0091] In one of the embodiments of the present application, the appropriate encryption algorithm is dynamically selected according to the analysis result of the strategy engine and in combination with the low risk score threshold and the high risk score threshold, and the method comprises the following steps:

[0092] The low risk score threshold is set as R1 and the high risk score threshold is set as R2, and the following conditions are met:

[0093] R < R1, that is, the risk assessment level is low risk, the AES-128-GCM encryption algorithm is selected and the key is replaced every 24 hours;

[0094] R1≤R < R2, that is, the risk assessment level is medium risk, the AES-256-GCM encryption algorithm is selected and the key is replaced every 12 hours;

[0095] R ≥ R2, that is, the risk assessment level is high risk, the ChaCha20-Poly1305 encryption algorithm is selected and the key is replaced every 1 hour.

[0096] For example, the low risk score threshold R1 is 1.5 and the high risk score threshold R2 is 3.

[0097] 1.5 ≤ R = 1.58 < 3, which belongs to medium risk, the AES-256-GCM encryption algorithm is selected and the key is replaced every 12 hours.

[0098] In one of the embodiments of the present application, the step S5 comprises the following steps:

[0099] The cloud-based SDP controller cluster deploys a controller architecture, a client submits a dynamic identity token Token and a session intent declaration, the controller verifies the dynamic identity token Token=Sign(FP||Env||CertSN), if the controller verification is passed, the controller allocates a short-life temporary communication credential for the two parties of communication, and establishes a double-layer tunnel between the two parties of communication, so that the encrypted data of the two parties of communication can only flow between the authorized network nodes.

[0100] The life cycle of the temporary communication credential is t<=10min.

[0101] The double-layer tunnel comprises an inner application layer tunnel and an outer transport layer tunnel.

[0102] The inner application layer tunnel is based on TLS1.3, performs key exchange by using an elliptic curve X25519 key exchange algorithm, and adopts the short-life temporary communication credential; the session intent declaration is first encrypted by using TLS1.3 to generate a TLS record.

[0103] The outer transport layer tunnel constructs an efficient encrypted communication pipe based on a QUIC protocol, selectively encrypts sensitive metadata in a handshake layer packet header by using a built-in header protection feature of the QUIC protocol, that is, a confused packet header, eliminates identifiable network features, and resists flow fingerprint analysis attacks; strict bidirectional mTLS verification is implemented in the QUIC handshake stage, and a short-term identity certificate of a client is bound with the dynamic identity token Token.

[0104] The TLS record of the inner application layer tunnel is segmented by using the QUIC protocol, the confused packet header is attached and the entire QUIC frame is encrypted, a fake device is blocked from accessing, and thus the data transmission path is limited according to the least privilege principle.

[0105] In one embodiment of the application, the step S6 comprises the following steps:

[0106] The abnormal degree of the flow deviation from the baseline is quantified based on Z-Score, and the following formula is met,

[0107]

[0108] Wherein, Z represents the deviation degree of the current flow rate from the historical baseline, and the greater the absolute value is, the higher the abnormal probability is; X represents the current flow rate, which is calculated through the network card throughput; mu represents the historical baseline mean, that is, the average value of the flow in a period of time; sigma represents the flow standard deviation, reflecting the stability of the baseline data.

[0109] For example, the historical baseline mean mu of a certain server is 50MB / S, and the historical baseline standard deviation sigma is 10MB / S.

[0110] When X = 60MB / S,

[0111] When X = 90MB / S,

[0112] Set the threshold of flow mutation as Z', if |Z|≤Z' indicates that the flow rate is normal, if |Z|>Z' indicates that the flow rate is abnormal and the fuse strategy is performed, and the secondary authentication process is started;

[0113] Among them, the fuse strategy, forcibly closes the encrypted tunnel and immediately terminates the session, adds the MAC address / IP of the illegal device to the temporary black list;

[0114] The secondary authentication process requires the user to complete the verification through the biometric feature or the manual approval of the security team before restoring access.

[0115] For example, assuming that the threshold of flow mutation is Z ， = 3, it can be judged that when X = 60MB / S, it indicates that the flow rate is normal, and when X = 90MB / S, it indicates that the flow rate is abnormal and the fuse strategy is performed;

[0116] For |Z2|>Z' = 3, there are two application scenarios:

[0117] If Z2>3 is determined as a flow peak attack, the fuse strategy is performed and the secondary authentication process is started;

[0118] If Z2<-3 is determined as hidden data leakage, the connection is blocked and the account is frozen.

[0119] Referring to the accompanying Figure 2 , a data encryption transmission system based on a zero trust architecture is proposed, including a user identity verification module, a dynamic identity token generation module, a risk assessment level calculation module, an encryption algorithm selection module, an independent encryption tunnel establishment module, and a dynamic identity token verification module.

[0120] The user identity verification module is based on the RSA encryption algorithm and is used to verify the identity of the user;

[0121] The dynamic identity token generation module combines hardware fingerprint technology to tightly bind the user's identity with the authorized terminal device, collects the running environment parameters of the authorized terminal device, and generates a dynamic identity token by combining the hardware fingerprint, the running environment parameters, and the certificate serial number;

[0122] The risk assessment level calculation module introduces a policy engine to analyze network environment data and data sensitivity levels to calculate the risk assessment level of the secret;

[0123] The encryption algorithm selection module dynamically selects a suitable encryption algorithm according to the analysis result of the strategy engine, in combination with the low-risk score threshold and the high-risk score threshold, and determines the life cycle of the key according to the actual situation;

[0124] The independent encryption tunnel establishment module is used for establishing an independent encryption tunnel and limiting a data transmission path according to the principle of minimum authority;

[0125] The dynamic identity token verification module verifies a dynamic identity token for each data packet, and terminates a session and starts a secondary authentication process if an abnormal behavior is detected.

[0126] The various modules can be realized by software, hardware and a combination thereof in whole or in part, support hardware forms are embedded in or independent of a processor in a computer device, and also support software forms are stored in a memory in a computer device, so that the processor calls and executes the operations of the various modules.

[0127] It should be noted that the user information (including but not limited to user equipment information and personal information) and data (including but not limited to data for analysis, stored data and displayed data) involved in the present application are all information and data authorized by the user or authorized by all parties, and the processing of the related data needs to comply with relevant laws, regulations and standards.

[0128] The above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application is described in detail with reference to the foregoing embodiments, those skilled in the art should understand that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features can be replaced by equivalents; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be included in the protection scope of the present application.

Claims

1. A method for data encryption transmission based on a zero trust architecture, characterized in that, Comprise the following steps: S1, based on RSA encryption algorithm to verify the identity of the user; S2, combined with hardware fingerprint technology will be closely bound to the user's identity and authorized terminal device, collecting authorized terminal device running environment parameters, hardware fingerprint, running environment parameters, certificate serial number combined to generate dynamic identity token, dynamic identity token as the user's identity effective proof; S3, introduce policy engine analysis network environment data, data sensitive level, computer secret risk assessment level; S4, according to the analysis result of policy engine, combined with low risk score threshold and high risk score threshold dynamic selection of appropriate encryption algorithm, according to the actual situation to determine the life cycle of the key, ensure the confidentiality and integrity of data; S5, to establish an independent encryption tunnel based on software defined boundary, follow the principle of least privilege limit data transmission path; S6, each data packet is checked for dynamic identity token, if the abnormal behavior is detected will terminate the session and start the secondary authentication process; Step S4, comprising the following steps: Combined with historical data and expert experience, set the low risk score threshold and high risk score threshold, according to the analysis result of policy engine, and combined with low risk score threshold and high risk score threshold dynamic selection of appropriate encryption algorithm; Among them, the encryption algorithm includes AES-128-GCM encryption algorithm, AES-256-GCM encryption algorithm, ChaCha20-Poly1305 encryption algorithm; According to the actual situation to determine the life cycle of the key, including: AES-128-GCM encryption algorithm needs to be replaced every 24 hours, AES-256-GCM encryption algorithm needs to be replaced every 12 hours, ChaCha20-Poly1305 encryption algorithm needs to be replaced every 1 hour; Step S5, comprising the following steps: A cloud-native SDP controller cluster deploys a controller architecture, a client submits a dynamic identity token and a session intent declaration, the controller verifies the dynamic identity token , if the controller verification is passed, the controller allocates a short-lived temporary communication credential for both parties of the communication, establishes a double-layer tunnel between both parties of the communication, and ensures that the encrypted data of both parties of the communication can only flow between the network nodes that have been authorized; Among them, the life cycle of the temporary communication voucher t≤10min; The double tunnel includes an inner application layer tunnel and an outer transport layer tunnel; The inner application layer tunnel is based on TLS 1.3, uses the key exchange algorithm of elliptic curve X25519 for key exchange, and adopts a short life cycle of temporary communication voucher; the session intent declaration is first encrypted by TLS 1.3 to generate TLS record; Outer transport layer tunnel, based on the QUIC protocol to build an efficient encrypted communication pipeline, using the built-in header protection features of the QUIC protocol to selectively encrypt the sensitive metadata in the handshake layer packet header, that is, the obfuscated packet header, eliminating identifiable network features and resisting flow fingerprint analysis attacks; Strict two-way mTLS verification is implemented in the QUIC handshake phase, and the client's short-term identity certificate and dynamic identity token Binding; The TLS record of the inner application layer tunnel is segmented by QUIC protocol, the confused packet header is attached and the entire QUIC frame is encrypted, and the data transmission path is limited according to the principle of least privilege.

2. The data encryption transmission method based on the zero trust architecture according to claim 1, characterized in that, Step S1, comprising the following steps: The pre-set client collects the identity information of the user, the client calls the TPM2.0 security chip to generate an RSA-3072 key pair: a public key , and a private key , the public key is uploaded to the zero-trust control center, and the private key is stored in the TPM2.0 security chip; The client sends a user authentication request to the Zero Trust control center, which then generates a random challenge code. Using public key After encryption, the data is sent to the client, which then uses the private key of the TPM2.0 security chip. Decrypt the challenge code, then calculate the response value and send it back to the Zero Trust Control Center; Zero trust control center verifies the response value and the timestamp If the deviation is less than or equal to 3 seconds, the zero trust control center issues a short-term identity certificate to the user, which is valid for less than or equal to 5 minutes.

3. The method of claim 1, wherein, Step S2, comprising the following steps: The hardware features of the authorized terminal device are collected, including CPU microcode version, firmware hash value, and hard disk serial number, a hardware fingerprint is generated by using a KMAC256 algorithm, the identity of the user is tightly bound with the authorized terminal device, and the hardware fingerprint is calculated , satisfies the following formula, ； wherein, represents a CPU microcode version, represents a firmware hash value, represents a hard disk serial number; monitoring an operating environment parameter of the authorized terminal device, including a geofence, a network access point of the authorized terminal device, an operating system integrity check state; generating a dynamic identity token in combination with a hash function a serial number of a short-term identity certificate an operating environment parameter of the authorized terminal device in combination with a hash function .

4. The data encryption transmission method based on the zero trust architecture according to claim 3, characterized in that, Step S3, comprising the following steps: Collect network environment data, including network delay, open port anomaly number, threat intelligence matching degree; according to GB / T35273 standard, the sensitive level of data is classified, including public L1, internal L2, confidential L3, top secret L4; The risk assessment formula of the computer secret, ； wherein, is a network delay parameter; is a network maximum delay parameter; is an open port anomaly number; is a threat intelligence matching degree; is a sensitive level of data; , , , is a weight coefficient, which is assigned according to expert experience.

5. The method of claim 1, wherein, The analysis result of policy engine, and combined with low risk score threshold and high risk score threshold dynamic selection of appropriate encryption algorithm, comprising the following steps: Setting a low risk score threshold of , a high risk score threshold of , satisfying, i.e., for a risk assessment rating of low risk, the AES-128-GCM encryption algorithm is selected and the key is rotated every 24 hours; i.e., for a risk assessment rating of medium risk, the AES-256-GCM encryption algorithm is selected and the key is rotated every 12 hours; i.e., for a high risk level of risk assessment, the ChaCha20-Poly1305 encryption algorithm is selected and the key is rotated every 1 hour.

6. The method of claim 1, wherein the method is based on a zero trust architecture. Step S6, comprising the following steps: Based on Z-Score, the abnormal degree of traffic deviation from the baseline is quantified, which satisfies the following formula, ； Wherein, represents the degree of deviation of the current traffic rate from the historical baseline, and the larger the absolute value, the higher the probability of anomaly; represents the current traffic rate, which is calculated by the network card throughput; represents the historical baseline mean, that is, the average value of traffic in a period of time; represents the traffic standard deviation, reflecting the stability of the baseline data.

7. The data encryption transmission method based on the zero trust architecture according to claim 6, characterized in that, Step S6 further comprises the following steps: The threshold of flow rate mutation is set as , if yes , it indicates that the flow rate is normal, if yes , it indicates that the flow rate is abnormal and the fusing strategy is carried out, and the secondary authentication process is started. Among them, the fuse strategy forces to close the encryption tunnel and immediately terminates the session, and adds the MAC address / IP of the illegal device to the temporary black list; The secondary authentication process requires the user to complete the verification through biometric features or manual approval by the security team before restoring access.

Images