A method and system for adaptive classification of data streams

Abstract

The application provides a kind of self-adapting classification method and system of data stream, it is related to data processing technical field, the method includes sending key through data chain to each self-adapting encryption / decryption equipment, and the switching and replacement of various keys are managed;When power on, the key in the storage medium of itself is read as the key of self-adapting encryption / decryption equipment;When normal work, the new key received through data link is decrypted, and the decrypted new key is obtained, and the original key is discarded, and the new key is used as the key of self-adapting encryption / decryption equipment;Or for after power on, all communication ports are closed by default, only use the private key of asymmetric encryption to decrypt the data on the port, until the data after decryption of a port corresponds to the port number, then the data sent by the port is adaptively encrypted.The application solves the problem of time-consuming and laborious data classification, can accurately classify data and improve the security of data.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of data processing, and particularly relates to a self-adaptive classification method and system of data flow. BACKGROUND

[0002] Data classification technology is a key technology in data management and analysis, aiming to divide data into different categories according to its attributes and characteristics, so as to more efficiently manage and use data. With the explosive growth of data volume and the diversification of data types, the complexity of these data scale and types poses a severe challenge to traditional data classification technology, making high efficiency and high accuracy the focus of data classification technology.

[0003] The differences in length and type of data make the original data classification method not flexible enough when facing diversified data. Traditional classification methods are usually based on fixed data structures and assumptions, which are difficult to adapt to different types and lengths of data. For example, text data, image data, time series data, etc. have significantly different characteristics and structures, and traditional methods often need to design models and algorithms separately when processing these data, resulting in various classification methods being relatively independent and lacking a unified framework. This limitation not only increases the complexity of model design and maintenance, but also limits the generalization ability and adaptability of the model in practical applications.

[0004] Currently, artificial classification technology and existing classification technology have many problems when dealing with more flexible data, including but not limited to low efficiency, low accuracy, etc. SUMMARY

[0005] The present application provides a self-adaptive classification method and system of data flow, which can segment data flow, reduce the size of data, improve computing efficiency and reduce resource usage. The characteristics of the segmented data are calculated using algorithms to accurately classify the data, thereby improving the efficiency of data classification. The present application can accurately classify data while improving data security.

[0006] To achieve the above purpose, the technical scheme adopted by the present application is as follows: a self-adaptive classification method of data flow, comprising:

[0007] S1, control host: send the key to each adaptive encryption / decryption device through the data chain, and manage the switching and replacement of various keys. If the key needs to be replaced, use an asymmetric encryption algorithm to encrypt the key that needs to be replaced, and send it to the adaptive encryption / decryption device to complete the replacement of the key. The control host stores the symmetric key of the adaptive encryption device and the asymmetric key used to encrypt the symmetric key.

[0008] S2, the adaptive encryption / decryption device: when powered on, read the key in the storage medium as the key of the adaptive encryption / decryption device; in normal operation, the new key received through the data link is decrypted to obtain the decrypted new key, and the original key is discarded, and the new key is used as the key of the adaptive encryption / decryption device, wherein when receiving the new key from the data link, the data is operated, the data characteristics of the operation result are taken as the characteristic value of the data, and the characteristic value is taken as the basis to realize the adaptive encryption of different data according to the different data check value characteristics; or

[0009] For the data on the port, only the private key of the asymmetric encryption is used for decryption until the decrypted data of a port corresponds to the port number, and then the data sent by the port is adaptively encrypted.

[0010] The beneficial effects of the present application are: the present application first segments the data, sums the first and second bits of the segmented data, and classifies according to different remainders to improve the efficiency of data classification and accurately classify the data; in a multi-encryption system, the present application applies this technology in practice, uses different encryption means according to data characteristics, and improves the security of data encryption.

[0011] Further, the key to be replaced is encrypted using an asymmetric encryption algorithm and sent to the adaptive encryption / decryption device, which is specifically:

[0012] After power-on initialization, the address pointer of the control host related to the key is set to a default value, wherein the control host can read the key written in the corresponding address in the storage medium of the written key group through the key address, and the key in the storage medium only contains the symmetric key of the adaptive / decryption device after asymmetric encryption;

[0013] The timing time of replacing the key is set, and when the timing time is met, the key address is replaced and the key is read to obtain a new key, and the new key is sent to the adaptive encryption / decryption device to complete the replacement of the key.

[0014] The beneficial effects of the above further scheme are: the asymmetric encryption algorithm has the characteristics of high security, and the transmission of the symmetric key using the asymmetric encryption algorithm can effectively prevent the leakage of the key; at the same time, the timing of replacing the key can be determined by the system to determine the timing of replacing the key, which greatly reduces the risk of key leakage.

[0015] Further, in normal operation, the new key received through the data link is decrypted to obtain the decrypted new key, which is specifically:

[0016] After power on, the new key is received by data link;

[0017] The received key data is sequentially buffered, grouped and decrypted;

[0018] It is judged whether the decrypted data conforms to the basic characteristics of the required key, if yes, the decrypted data is the required key, otherwise, the next key data is waited for;

[0019] The adaptive encryption / decryption device starts to work normally, encrypts / decrypts the new key received through the data link, and buffers and groups the received key, and performs asymmetric decryption when the length reaches a fixed length;

[0020] If the decrypted data length meets the key length requirement, the new key is obtained.

[0021] The above further scheme has the beneficial effect that the verification of the new key can effectively detect errors in the transmission process.

[0022] Further, after power on, all communication ports are closed by default, and only the private key of asymmetric encryption is used to decrypt the data on the port until the decrypted data of a port corresponds to the port number, and the data sent by the port is adaptively encrypted, which is specifically:

[0023] After power on, all communication ports are closed by default;

[0024] The encapsulated key is a data frame, which is sent to the adaptive encryption / decryption device through each communication interface;

[0025] After retrieving the data frame, the data frame is decrypted asymmetrically;

[0026] After decryption, the data is searched in the pre-embedded port list, if the port list has a vector corresponding to the data, the port is opened after confirming that the data has a corresponding property with the physical port, and the data of the port is encrypted / decrypted accordingly; otherwise, the port will not perform encryption / decryption function, and the above process will be repeated until the decrypted data of a port corresponds to the port number.

[0027] The above further scheme has the beneficial effect that the random use of communication ports greatly reduces the risk of network attacks; at the same time, the use of different communication ports according to different keys can also improve the security of the system.

[0028] Further, the adaptive encryption / decryption device has a public key of asymmetric encryption algorithm and a port list pre-set in its storage medium before power on.

[0029] The beneficial effect of the further scheme is that according to the characteristics of the non-encryption algorithm, the leakage of the public key does not cause any threat to the asymmetric encryption algorithm, and the preset port list and the public key are stored in the storage medium of the adaptive encryption / decryption device, so that the key replacement and the selection of the data transmission port can be performed.

[0030] Further, when receiving the new key from the data chain, the data is operated, and the data characteristics of the operation result are taken as the characteristic value of the data segment.

[0031] When receiving the new key from the data chain, the key data is segmented.

[0032] According to the summation and remainder processing of the first bit and the last bit of the key data segment, the remainder value is taken as the characteristic value of the data segment.

[0033] The beneficial effect of the further scheme is that the summation and remainder processing of the first bit and the last bit can effectively reduce the operation resources of the system, and the data is classified according to different characteristic values so as to select different encryption algorithms.

[0034] The application provides an adaptive classification system of data flow, which is used for performing the adaptive classification method, and comprises:

[0035] A control host is used for sending the key to each adaptive encryption / decryption device through a data chain, and managing the switching and replacement of various keys, if the key needs to be replaced, the key to be replaced is encrypted by using an asymmetric encryption algorithm, and is sent to the adaptive encryption / decryption device, so as to complete the replacement of the key, wherein the control host stores the symmetric key of the adaptive encryption device and the asymmetric key used for encrypting the symmetric key.

[0036] The adaptive encryption / decryption device is used for reading the key in the storage medium of the adaptive encryption / decryption device as the key of the adaptive encryption / decryption device when being powered on, and decrypting the new key received through the data link to obtain the decrypted new key and discard the original key when working normally, wherein when receiving the new key from the data chain, the data is operated, the data characteristics of the operation result are taken as the characteristic value of the data segment, and the characteristic value is taken as the basis to realize the adaptive encryption of different data according to the different data check value characteristics.

[0037] The adaptive encryption / decryption device is used for closing all communication ports by default after being powered on, and only using the private key of the asymmetric encryption to decrypt the data on the port until the decrypted data of a port corresponds to the port number, so that the data sent by the port is adaptively encrypted.

[0038] The beneficial effects of the present application are: the present application first segments data, reduces the length of data, and accelerates the speed of subsequent processing; the first bit and the second bit of the segmented data are summed and taken modulo, and are classified according to different remainders, so as to facilitate the selection of appropriate encryption methods for data; the use of asymmetric encryption algorithm to transmit the key can effectively improve the security of the key and reduce the risk of leakage; the key check can effectively prevent errors in the key transmission process; at the same time, for the system without a control host, different ports can be used to transmit data according to the port information implied in the key, thereby reducing network attacks. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 is a method flowchart of the present application.

[0040] Figure 2 is a schematic flowchart of the normal operation of the control host part of the present application.

[0041] Figure 3(a) is a schematic flowchart of the key management process of the present application.

[0042] Figure 3(b) is a schematic flowchart of an alternative key management scheme of the present application.

[0043] Figure 4 is a schematic flowchart of the normal operation of the encryption / decryption device part of the present application.

[0044] Figure 5 is a system structure diagram of an embodiment of the present application.

[0045] Figure 6 is a schematic structure diagram of the system of the present application. DETAILED DESCRIPTION

[0046] The specific embodiments of the present application are described below to facilitate understanding of the present application by those skilled in the art, but it should be clear that the present application is not limited to the scope of the specific embodiments, and for those skilled in the art, any changes that are obvious within the spirit and scope of the present application as defined and determined by the appended claims are obvious, and all inventions utilizing the concept of the present application are within the scope of protection.

[0047] Example 1

[0048] As shown in Figure 1 , the present application provides a self-adaptive classification method for data stream, the implementation method of which is as follows:

[0049] S1, the control host end: send the key to each adaptive encryption / decryption device through the data chain, and manage the switching and replacement of various keys; if the key needs to be replaced, use an asymmetric encryption algorithm to encrypt the key that needs to be replaced and send it to the adaptive encryption / decryption device to complete the replacement of the key, wherein the control host stores the symmetric key of the adaptive encryption device and the asymmetric key used to encrypt the symmetric key;

[0050] S2, the adaptive encryption / decryption device end: when powered on, read the key in the storage medium as the key of the adaptive encryption / decryption device; in normal operation, decrypt the new key received through the data link to obtain the decrypted new key, and discard the original key, and use the new key as the key of the adaptive encryption / decryption device, wherein when receiving the new key from the data chain, the data is operated, the data characteristics of the operation result are taken as the characteristic value of the data, and the characteristic value is taken as the basis to realize adaptive encryption of different data according to the different characteristics of different data check values; or

[0051] for defaulting to close all communication ports after power-on, only using the private key of asymmetric encryption to decrypt the data on the port until the decrypted data of a port corresponds to the port number, then adaptively encrypting the data sent by the port.

[0052] In this embodiment, the key that needs to be replaced is encrypted using an asymmetric encryption algorithm and sent to the adaptive encryption / decryption device, which is specifically:

[0053] After power-on initialization, set the address pointer of the key in the control host to a default value, wherein the control host can read the key written in the corresponding address in the storage medium of the key group through the key address, and the key in the storage medium only contains the symmetric key of the adaptive / decryption device after asymmetric encryption;

[0054] Set the timing time for replacing the key, and replace the key address and read the key to obtain a new key when the timing time is met, and send the new key to the adaptive encryption / decryption device to complete the replacement of the key.

[0055] In this embodiment, in normal operation, the new key received through the data link is decrypted to obtain the decrypted new key, which is specifically:

[0056] After power-on, use the data link to receive a new key;

[0057] The received key data is sequentially buffered, grouped, and decrypted;

[0058] Judge whether the decrypted data is in accordance with the basic characteristics of the required key, if yes, the decrypted data is the required key, otherwise, wait for the next key data;

[0059] The adaptive encryption / decryption device starts to work normally, encrypts / decrypts the new key received through the data link, and at the same time, the adaptive encryption / decryption device buffers and groups the received key, and when the fixed length is reached, performs asymmetric decryption;

[0060] If the data decryption length meets the key length requirement, the new key is obtained.

[0061] In this embodiment, after power-on, all communication ports are closed by default, and only the private key of asymmetric encryption is used to decrypt the data on the port until the decrypted data of a certain port corresponds to the port number, and then the data sent by the port is adaptively encrypted, which is specifically:

[0062] After power-on, all communication ports are closed by default;

[0063] The encapsulated key is a data frame, which is sent to the adaptive encryption / decryption device through each communication interface;

[0064] After retrieving the data frame, the data frame is decrypted asymmetrically;

[0065] After decryption, the data is searched in the pre-embedded port list, if the port list has a vector corresponding to the data, the port is opened after confirming that the data has a corresponding property with the physical port, and the data of the port is encrypted / decrypted accordingly; otherwise, the port will not perform encryption / decryption function, and the above process will be repeated until the decrypted data of a certain port corresponds to the port number.

[0066] In this embodiment, the adaptive encryption / decryption device is pre-provided with the public key of the asymmetric encryption algorithm and the port list in the storage medium before power-on.

[0067] In this embodiment, when receiving the new key from the data chain, the data is operated, and the data characteristics of the operation result are taken as the characteristic value of the data, which is specifically:

[0068] When receiving the new key from the data chain, the key data is segmented;

[0069] The first bit and the last bit of the key data are summed and taken as the remainder value, which is taken as the characteristic value of the data.

[0070] In this embodiment, the proposed adaptive classification technology is applied in a multi-encryption system to produce an adaptive encryption system, which mainly includes a control host, an adaptive encryption device and an adaptive decryption device.

[0071] The control host part includes a key management module for managing the switching and replacement of various keys.

[0072] The encryption device and the decryption device include various interfaces for information exchange with the data chain, mainly full-duplex interfaces such as RS422 and Ethernet; a key management module for securely saving or updating the keys, which has the following main functions: upon power-on, the key management module reads the key in the storage medium as the key of the adaptive encryption / decryption algorithm module; during normal operation, if a new key is received through the data link, the key management module first decrypts the encrypted key, obtains the decrypted new key, discards the original key, and uses the new key as the key of the adaptive encryption / decryption algorithm; an adaptive encryption / decryption module for performing the encryption / decryption algorithm, which, after receiving the data from the data chain, first performs a specific operation on the data, and some numerical features of the operation result are used as the characteristic value of the data segment, and the subsequent adaptive encryption / decryption process is based on the characteristic value of the data segment.

[0073] In the key management method according to the present application, the control host saves the symmetric keys of the encryption devices in the entire system and the asymmetric keys used for encrypting the symmetric keys.

[0074] In the key management method according to the present application, the encryption / decryption device does not need to hold the key of the adaptive encryption / decryption algorithm, but only needs to hold the asymmetric key of the control host used for encrypting the adaptive encryption / decryption algorithm, and the disclosure of the key does not affect the security of the encryption system.

[0075] The key management mode according to the present application can realize the integration of one encryption / decryption device with all the data chains on one combat weapon, and can realize the management of the keys of the encryption / decryption devices on multiple combat weapons by one control host through the existing data chain as a medium.

[0076] The communication interface part of the present application mainly adopts full-duplex communication interfaces.

[0077] In the adaptive encryption algorithm of the present application, mainly includes: information check algorithm, a variety of symmetric encryption / decryption algorithm. In the information check algorithm, the data to be encrypted / decrypted is input to the algorithm, the data is segmented first, and the sum of the first bit and the last bit of the segment is taken as the remainder, and the remainder value is taken as the characteristic value of the segment data. The characteristics are used as the basis for adaptive encryption algorithm, that is, different data can be adaptively encrypted according to the different characteristics of the data check value. The encryption / decryption algorithm mainly selects a symmetric encryption algorithm suitable for high-speed hardware. When there are two or more symmetric encryption / decryption algorithms in the system, the existing encryption / decryption algorithm can be selected according to the different results of the information check algorithm to encrypt / decrypt the information.

[0078] Alternatively, in the present application, the symmetric encryption / decryption algorithm and the private key of the asymmetric encryption algorithm can be directly loaded into the encryption / decryption device without using the control host to assign the key according to the situation, and then the communication ports of the access device are numbered in turn. Taking the encryption device as an example: after power-on, all communication ports are closed by default, and only the private key of asymmetric encryption is used to decrypt the data on the port until the decrypted data of a certain port corresponds to the port number of the port, and the port is considered to be opened, and the data sent to the port is adaptively encrypted. In addition to the adaptive decryption operation after the port is opened, the rest of the process is the same as that of the encryption device.

[0079] The encryption machine is a secure encryption device, which usually includes an encryption module for implementing encryption algorithms and securely storing keys. Since it works as a separate computer (e.g. as a server) in communication with the client, its hardware components include CPU, motherboard or hard disk, etc. In addition, according to an embodiment of the present application, the control host part can also include a storage medium which is written with various keys in advance and is convenient for manual replacement.

[0080] For example, the control host reserves a USB, SDIO, etc. pluggable storage medium interface, which is regularly replaced by a person in charge of storing the key.

[0081] According to an alternative embodiment of the present application, the storage medium can exist in the encryption / decryption device.

[0082] For example, a simple serial interface is reserved on the encryption / decryption device, and a specific format of data frame is input through the serial interface to replace the key.

[0083] The above description of key storage / management of the encryption / decryption device is only illustrative and not limiting.

[0084] Figure 6 is a schematic structural diagram of a certain example system of the present application.Figure 6 The arrow points to the data flow direction. See Figure 6 The system level of the present application mainly consists of the following parts:

[0085] In this schematic structure diagram, there is one control host and four encryption / decryption devices communicating through the access data chain. The control host sends the system key to each encryption / decryption device through the data chain, theoretically only requiring a simplex communication interface; the encryption / decryption device obtains the key sent by the control host and the data in the data chain that needs to be encrypted, using a full-duplex communication interface. In this schematic structure diagram, the number of encryption / decryption devices is not limited to four, and can be changed according to the actual conditions such as the capacity and bandwidth of the data chain.

[0086] Figure 2 This is a schematic flowchart of the normal operation of the control host part of an example of the present application. After power-on initialization, the address pointer of the control host with respect to the key should be a default value. Through this address, the control host can read the key written in the corresponding address in the storage medium that has written the key group.

[0087] In this example, the key in the storage medium should only contain the symmetric key of the encryption / decryption device after asymmetric encryption. In another example, the storage medium should also contain the private key of asymmetric encryption and the asymmetric encryption module to encrypt the symmetrically encrypted key.

[0088] In this example, a key replacement timing module is provided. For example, the encryption system needs to replace the key every hour for security considerations, so in this example, the key replacement timing module will set the timing time to one hour. When one hour is counted, the key replacement timing module will control the behavior of replacing the key address and reading the key, and after obtaining the new key, the control host will again publish the key to the data chain in the same way as the power-on initialization.

[0089] In this example, the key release can be conditionally triggered, such as the key address or the key replacement timing module counting, executing the process of reading the key to publishing the key to the data chain once; or it can be cyclic, that is, reading the key according to the current address every certain time and publishing it to the data chain.

[0090] Figure 3(a) is a schematic flowchart of a key management process of the present application. This example mainly describes the key management mechanism of the encryption / decryption device.

[0091] In this example, the encryption / decryption device does not need to hold the symmetric encryption key when it is just powered on, but only needs to hold the public key of the asymmetric encryption used by the system. By continuously receiving data from the data link, the data is cached, grouped, decrypted, and then judged according to the basic characteristics of the key to determine whether it is likely to be a key.

[0092] For example, the length of the data encrypted by RSA is 2048 bits, while the length of many symmetric encryption keys does not reach this length. After a piece of data is decrypted, if the length does not conform to the length of the symmetric encryption key used by the system, it is considered that the piece of data is not an encrypted key; otherwise, it is considered that the piece of data decrypted is the required key.

[0093] After the key is decrypted, the encryption / decryption device starts to work normally and encrypts / decrypts the data in the data link. At the same time, in order to be able to receive the new key for replacement in time, the encryption / decryption device also caches and groups the received data, and then performs corresponding asymmetric decryption after the length reaches a certain length. Similarly, in this example, after a piece of data is decrypted, if the length of the data conforms to the length of the key, it is considered to be a new key.

[0094] In this example, after the first key is obtained, the encryption / decryption device starts to encrypt / decrypt all the data uploaded from the data link, even if the piece of data is likely to be a key that needs to be replaced.

[0095] For this example, the application also provides another solution.

[0096] The control host encapsulates the key that needs to be replaced into a data frame in a specific format and then sends it into the data link, and the encryption / decryption device only needs to detect in real time whether the data contains this specific frame. If it does, the piece of encapsulated data is decrypted asymmetrically, and if it does not, it is not processed. The application can also ensure that the encryption / decryption device can correctly receive the key required for normal work after being powered on.

[0097] FIG. 3(b) is a schematic flowchart of an example of an alternative key management solution of the application. In this example, the encryption / decryption device should pre-embed the public key of the asymmetric encryption algorithm in the storage medium before being powered on. In addition, a port list should also be pre-embedded therein to control the opening and closing of each port.

[0098] In this example, the control host in the previous example is no longer necessary; the key or key data frame sent by the control host will be sent by each port. The function of the control host is replaced by the authentication between the data source and the encryption / decryption device.

[0099] In this example, the key is encapsulated into a data frame and sent to the encryption / decryption device via various communication interfaces. Upon retrieval, in this example, asymmetric decryption is performed on the data frame. Once decryption is complete, the data is retrieved from a pre-stored port list. If a vector corresponding to the data segment exists in the port list, the port is opened after confirming that the data segment corresponds to a physical port, and the data on that port is encrypted / decrypted accordingly. Otherwise, no encryption / decryption is performed on the port. This process repeats until the conditions for opening the port are met.

[0100] Figure 4 This is a schematic flow chart of the normal operation of an example of the encryption / decryption device part of the present invention. This example adopts the control host solution. Figure 4 As can be seen, this example mainly consists of three parts: control host, data link, encryption / decryption device. The data link part is not involved in this invention and adopts the existing data link structure.

[0101] Control the host part, according to Figure 2 The process described above sends the key to the data chain. This diagram mainly describes the encryption / decryption device process.

[0102] In this example, after the encryption / decryption device is powered on, it obtains the key according to the process shown in Figure 3(a). In this example, the encryption / decryption device is connected to the data link via a full-duplex communication interface. Data received or sent passes through a buffer to match the communication rate between the encryption / decryption and data link. Once in normal operation, the encryption / decryption device first submits the encrypted data to a verification algorithm to determine the characteristic value and verify the correctness of the data. In this example, two encryption algorithms are used to implement adaptive encryption, and correspondingly, the characteristic values ​​must have two different conditions. Here, we use 1 and 0 as an example: if the characteristic value of a data segment of length n is 1 after the verification algorithm, the data segment is submitted to encryption / decryption algorithm 1 for encryption / decryption; if it is 0, the data segment is submitted to encryption / decryption algorithm 2 for encryption / decryption.

[0103] Based on the distinctiveness and uniqueness of the characteristic values ​​of each segment of data, the received data will be randomly and discretely sent to encryption / decryption algorithm 1 and encryption / decryption algorithm 2 respectively; and because the data is input into the verification algorithm sequentially, the encrypted / decrypted data is sent to the buffer in sequence, which is the encryption / decryption result of the data segment.

[0104] In this example, the directions indicated by the arrows represent the possible flows of data. Figure 5 It is a system structure diagram of an embodiment of the present invention.

[0105] This embodiment is an encryption device embodiment.

[0106] This embodiment uses the Xilinx ZYNQ series chip as the system core. The encryption device in this embodiment consists of three main functional components: an interface component that uses RS422 and Ethernet interfaces to access the data link, implementing basic data exchange functions; a storage component that uses DDR3 and ZYNQ's internal RAM. The DDR3 acts as a buffer between the ZYNQ interface and the data link, primarily targeting high-speed, large-scale, real-time data. The RAM primarily serves as the ZYNQ's internal computational cache and rate matching between modules; and a computational module that primarily includes the CRC32 cyclic redundancy check algorithm, RSA decryption algorithm, AES encryption algorithm, and 3DES encryption algorithm.

[0107] In the calculation module of this embodiment, CRC32 is used to verify the integrity and correctness of received data. The checksum obtained from the CRC32 and its parity can be used to determine the characteristic values ​​of 1 and 0, respectively. The RSA decryption algorithm is used to asymmetric decrypt the detected key frame. This algorithm belongs to a public key system, and the required key does not need to be kept confidential. It can be published within the data link or pre-embedded in the encryption / decryption device. This embodiment uses the pre-embedded solution.

[0108] The adaptive encryption core part of this embodiment is based on the AES and 3DES encryption algorithms.

[0109] In this embodiment, the parity of the check value obtained by CRC32 is used to select whether to encrypt the data segment using AES or 3DES. The two algorithms have similar encryption efficiency and similar key lengths. In this embodiment, the two algorithms share a common key.

[0110] According to the characteristics of the probability distribution of the parity probability of the check value, in this embodiment, according to the Figure 5 The structural block diagram, Figure 3(a) and Figure 4 The flowchart shown can well implement irregular ASE and 3DES cross-encryption of data in the data link; by also following this process in the decryption device and based on this characteristic, adaptive decryption with low bit error rate can be achieved.

[0111] Example 2

[0112] like Figure 6 As shown, the present invention is an adaptive classification system for data streams, and the adaptive classification system is used to perform the adaptive classification method described in Example 1, including:

[0113] The control host is used to send keys to each adaptive encryption / decryption device through the data link and manage the switching and replacement of various keys. If a key needs to be replaced, the key to be replaced is encrypted using an asymmetric encryption algorithm and sent to the adaptive encryption / decryption device to complete the key replacement. The control host stores the symmetric key of the adaptive encryption device and the asymmetric key used to encrypt the symmetric key;

[0114] An adaptive encryption / decryption device is configured to, upon power-up, read a key from its own storage medium as the key of the adaptive encryption / decryption device; and during normal operation, decrypt a new key received via a data link to obtain a new decrypted key, discard the original key, and use the new key as the key of the adaptive encryption / decryption device, wherein upon receiving the new key from the data link, perform an operation on the data, use a data feature of the operation result as a feature value of the data segment, and use the feature value as a basis to implement adaptive encryption of different data based on different features of different data check values; or

[0115] It is used to close all communication ports by default after power-on, and decrypt the data on the port using only the asymmetric encryption private key until the decrypted data of a certain port corresponds to the port number, then the data sent by the port is adaptively encrypted.

[0116] like Figure 6 The adaptive classification system provided by the illustrated embodiment can execute the technical solution shown in the adaptive classification method of the above method embodiment. Its implementation principle and beneficial effects are similar and will not be repeated here.

[0117] In this example, the present application can divide the functional units according to the adaptive classification method. For example, each function can be divided into various functional units, or two or more functions can be integrated into one processing unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the present invention is schematic and is only a logical division. In actual implementation, there may be other division methods.

[0118] In this example, in order to realize the principles and beneficial effects of the adaptive classification method, the adaptive classification system includes hardware structures and / or software modules that perform the corresponding functions. Those skilled in the art should easily realize that, in combination with the various schematic units and algorithm steps described in the embodiments disclosed in the present invention, the present invention can be implemented in the form of hardware and / or a combination of hardware and computer software. Whether a function is executed in a hardware or computer software driven manner depends on the specific application and design constraints of the technical solution. Different methods can be used for each specific application to implement the described function, but such implementation should not be considered to be beyond the scope of this application.

[0119] The present application has at least the following advantages: segmenting data reduces the required resources of the system and the computational complexity; and classifying the segmented data according to different characteristic values of each segment improves the efficiency of the system in using data.

Claims

1. A system for adaptive classification of data streams, characterized by, The application relates to a key management method for adaptive encryption / decryption equipment. The control host end sends keys to respective adaptive encryption / decryption equipment through a data chain, and manages the switching and replacement of various keys; if the keys need to be replaced, the keys needing to be replaced are encrypted by using an asymmetric encryption algorithm, and are sent to the adaptive encryption / decryption equipment to complete the replacement of the keys, wherein the control host stores the symmetric keys of the adaptive encryption equipment and the asymmetric keys used for encrypting the symmetric keys; The adaptive encryption / decryption equipment end reads the keys in a storage medium as the keys of the adaptive encryption / decryption equipment when being powered on; in normal work, the adaptive encryption / decryption equipment decrypts the new keys received through the data chain to obtain decrypted new keys, and discards the original keys, and uses the new keys as the keys of the adaptive encryption / decryption equipment, wherein when receiving the new keys from the data chain, the adaptive encryption / decryption equipment performs operation on the new key data, takes the data features of the operation results as feature values of the data, and uses the feature values as the basis to realize adaptive encryption of different data according to different data features. The adaptive encryption / decryption equipment end is used for closing all communication ports by default after being powered on, and only decrypting the data on the ports by using the private key of asymmetric encryption until the decrypted data of a port corresponds to the port number of the port, and then performing adaptive encryption on the data sent by the port, which is specifically as follows: After being powered on, all communication ports are closed by default. The keys are packaged as data frames and are sent to the adaptive encryption / decryption equipment through various communication interfaces. After the data frames are retrieved, the data frames are decrypted by using asymmetric encryption to obtain decrypted data. After decryption, the data is retrieved in a pre-embedded port list, if the port list has a vector corresponding to the data, the port is opened after confirming that the data has corresponding properties with the physical port, and the data of the port is encrypted / decrypted correspondingly; otherwise, the port will not perform the encryption / decryption function, and the above process will be repeated until the decrypted data of a port corresponds to the port number of the port. When receiving the new keys from the data chain, the adaptive encryption / decryption equipment performs operation on the new key data, takes the data features of the operation results as feature values of the data, which is specifically as follows: When receiving the new keys from the data chain, the key data is segmented. The first bit and the last bit of each segment of the key data are summed and the remainder is taken as the feature value of the segment of the key data.

2. The system for adaptive classification of data streams of claim 1, wherein, After being powered on and initialized, the address pointer of the control host for the keys is set as a default value, wherein the control host can read the keys written in the corresponding address in the storage medium of the written key group through the key address, and the keys in the storage medium only include the symmetric keys of the adaptive / decryption equipment after being encrypted by using an asymmetric encryption algorithm. The timing time for replacing the keys is set, the key address is replaced and the keys are read to obtain new keys, and the new keys are sent to the adaptive encryption / decryption equipment to complete the replacement of the keys. ​ 3. The system for adaptive classification of data streams of claim 1, wherein, In normal operation, the received new key through the data link is decrypted to obtain a decrypted new key, which is specifically: After power-on, the new key is received through the data link; The received key data is sequentially buffered, grouped and decrypted; It is judged whether the decrypted data conforms to the basic characteristics of the required key, if yes, the decrypted data is the required key, otherwise, the next key data is waited for; The adaptive encryption / decryption device starts normal operation, encrypts / decrypts the received new key through the data link, buffers and groups the received key, and performs asymmetric decryption when the length reaches a fixed length; If the decrypted data length meets the key length requirement, the new key is obtained.

4. The system for adaptive classification of data streams of claim 1, wherein, The adaptive encryption / decryption device is provided with a public key of an asymmetric encryption algorithm and a port list in the storage medium before power-on.

Images