Data security transmission method, system, computer and storage medium

Abstract

The present invention provides a data security transmission method, system, computer, and storage medium. The method includes the following steps: generating a dynamic key seed sequence based on the network environment parameters of the transmission device; establishing a data encryption transformation matrix based on the dynamic key seed sequence to transform the slice unit data; and performing integrity and spatiotemporal continuity verification on the receiving end based on a verification hash. By dynamically generating a key seed sequence by collecting network environment parameters in real time, single-time, single-pad encryption is achieved to block replay attacks; using the transformation matrix to perform an exclusive-or transformation on the slice data, the randomness of the ciphertext is enhanced to resist traffic analysis; and constructing a spatiotemporal-correlated verification hash to achieve dual integrity and temporal continuity verification of multi-path transmission data, thereby improving transmission reliability in the highly dynamic environment of the Industrial Internet.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a data security transmission method, system, computer and storage medium. Background Art

[0002] The current data transmission solutions of the Industrial Internet generally use static keys or periodically updated keys, which are difficult to resist replay attacks and traffic analysis; at the same time, the traditional single hash verification mechanism cannot identify time and space dimension attacks such as data tampering and out-of-order injection in multi-path transmission, causing key industrial control instructions and sensor data to face confidentiality destruction, instruction deception, timing tampering and other security threats, and data transmission security is poor. Summary of the Invention

[0003] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a data security transmission method, system, computer and storage medium, aiming to solve the technical problem of poor data transmission security in the existing technology.

[0004] In order to achieve the above object, the present invention provides, in a first aspect, a method for secure data transmission, comprising the following steps:

[0005] Collect real-time performance parameters of transmission equipment and network environment parameters;

[0006] Generate a dynamic key seed sequence according to the network environment parameters of the transmission device and based on the round-trip delay jitter parameters and packet loss rate characteristics of the transmission path;

[0007] Dynamically generate a data sharding strategy based on the performance parameters of the transmission device, divide the data to be transmitted into a plurality of sharding units based on the data sharding strategy, and establish a data encryption transformation matrix based on a dynamic key seed sequence to perform transformation encryption on the sharding unit data;

[0008] Encapsulating the fragmented unit data through an encryption window, and generating a transmission path quality assessment parameter according to a mapping algorithm, so as to dynamically adjust the offset of the encryption window according to the quality assessment parameter;

[0009] A spatiotemporal verification hash is constructed based on a dynamic key seed sequence, and the encrypted shard unit data is transmitted through multiple paths. The receiving end performs integrity and spatiotemporal continuity verification based on the verification hash.

[0010] According to one aspect of the above technical solution, the step of dynamically generating a data sharding strategy based on the performance parameters of the transmission device specifically includes:

[0011] Establishing a joint perception model of device performance and network status, and dynamically sampling the performance load factor corresponding to the performance parameters of the transmission device through a sliding window mechanism;

[0012] The sharding threshold is determined based on the nonlinear mapping relationship between the characteristics of the data to be transmitted and the performance load factor:

[0013] ;

[0014] ;

[0015] Where, is the fragmentation threshold, is the total size of data to be transmitted, is the reference bandwidth value, is the current available bandwidth, is the server quality coefficient, is the performance load factor, is the equipment performance coefficient, n is the number of sampling times of the sliding window, is the processor utilization of the kth sampling, is the memory usage of the k-th sampling, is the time difference between the current time and the kth sampling time, is the average delay, The total amount of memory.

[0016] According to one aspect of the above technical solution, the calculation expression of the dynamic key seed sequence is:

[0017] ;

[0018] ;

[0019] Where, is the dynamic key seed sequence, ( ) is the HKDF derived function, is the path stability factor, H ( ) is a hash function, t is the byte sequence corresponding to the timestamp, is the fragment length, S is the byte sequence corresponding to the path characteristic entropy value of the dynamic key seed sequence, Indicates byte splicing operation, m is the number of transmission paths, is the average transmission delay, is the delay jitter of the i-th path, is the packet loss rate of the i-th path, It is a modulo operation.

[0020] According to one aspect of the above technical solution, the step of dividing the data to be transmitted into a plurality of fragment units based on the data fragmentation strategy specifically includes:

[0021] A dynamic correction factor is obtained by calculating the bandwidth fluctuation rate, and the sharding threshold is corrected based on the dynamic correction factor to obtain a corrected threshold. The calculation expression of the dynamic correction factor is:

[0022] ;

[0023] Where, is the absolute value of bandwidth fluctuation, is the average bandwidth, is the standard shard size;

[0024] The calculation expression of the transformation matrix is:

[0025] ;

[0026] Where, is the transformation matrix, is the path feature verification value, is the byte sequence corresponding to the dynamic key seed sequence, is the byte sequence corresponding to the available bandwidth, is the XOR operation, U( ) represents a circular left shift operation, Indicates the number of shifts, is the row entropy value of the transformation matrix, is the column entropy of the transformation matrix.

[0027] According to one aspect of the above technical solution, the calculation expression of the transmission path quality evaluation parameter is:

[0028] ;

[0029] Where, is the transmission path quality evaluation parameter, is the bandwidth of the i-th path, is the maximum bandwidth, is the delay normalization factor.

[0030] According to one aspect of the above technical solution, the step of dynamically adjusting the offset of the encryption window according to the quality assessment parameter specifically includes:

[0031] Calculate the difference in offset parameters between adjacent slice units, and then generate a phase offset correction factor based on the difference and the quality assessment parameter to update the offset in real time based on the phase offset correction factor. The calculation expression of the offset is:

[0032] ;

[0033] ;

[0034] ;

[0035] Where, is the current phase offset, is the phase offset of the previous cycle, G is the number of fragmentation units contained in the current encryption window, is the partial derivative of the quality assessment parameter Q with respect to the bandwidth of the g-th fragment transmission path, is the absolute value of the bandwidth fluctuation of the g-th fragment transmission path, is the bandwidth delay jitter parameter of the g-th fragment transmission path, It is the weighted average of the quality assessment parameters of the transmission paths corresponding to all the slice units in the current encryption window.

[0036] According to one aspect of the above technical solution, a spatiotemporal verification hash is constructed based on a dynamic key seed sequence, the encrypted slice unit data is transmitted through multiple paths, and the receiving end performs integrity and spatiotemporal continuity verification based on the verification hash, specifically including the following steps:

[0037] The coordinate mark is constructed based on the row and column entropy values ​​of the transformation matrix and the timestamp of the data slice unit according to the following calculation formula:

[0038] ;

[0039] Where, is the sending time offset of the fth fragment relative to the first fragment, The dynamic key corresponding to the dynamic key seed sequence;

[0040] According to the following formula, a hash value is calculated for each shard unit, and a verification hash of the spatiotemporal dimension is generated based on the hash value and the coordinate mark, so that the verification hash is used as a label to mark the shard unit:

[0041] ;

[0042] Where, is the verification hash of the f-th shard, is the ciphertext data of the f-th fragment, is the verification hash of the previous shard;

[0043] The receiving end performs integrity and spatiotemporal continuity checks based on the verification hash according to the following calculation formula:

[0044] ;

[0045] ;

[0046] Where, is the conjunction symbol, F is the number of fragments, is the verification hash of the fth shard, is the received ciphertext data, is the verified valid hash of the f-1th shard, Coordinate markers calculated for the receiving end, is the receiving timestamp of the fth fragment, is the receiving timestamp of the f-1th fragment, is the time threshold.

[0047] In a second aspect, the present invention provides a data security transmission system, comprising:

[0048] Acquisition module, collects real-time performance parameters of transmission equipment and network environment parameters;

[0049] A key module generates a dynamic key seed sequence according to the network environment parameters of the transmission device and based on the round-trip delay jitter parameters and packet loss rate characteristics of the transmission path;

[0050] a sharding module, which dynamically generates a data sharding strategy according to the performance parameters of the transmission device, divides the data to be transmitted into a plurality of sharding units based on the data sharding strategy, and establishes a data encryption transformation matrix based on a dynamic key seed sequence to perform transformation encryption on the sharding unit data;

[0051] An encryption module encapsulates the slice unit data through an encryption window and generates a transmission path quality evaluation parameter according to a mapping algorithm to dynamically adjust the offset of the encryption window according to the quality evaluation parameter;

[0052] The verification module is used to construct a spatiotemporal associated verification hash based on the dynamic key seed sequence, transmit the encrypted shard unit data through multiple paths, and the receiving end performs integrity and spatiotemporal continuity verification based on the verification hash.

[0053] According to one aspect of the above technical solution, the sharding module is specifically configured to:

[0054] Establishing a joint perception model of device performance and network status, and dynamically sampling the performance load factor corresponding to the performance parameters of the transmission device through a sliding window mechanism;

[0055] The sharding threshold is determined based on the nonlinear mapping relationship between the characteristics of the data to be transmitted and the performance load factor:

[0056] ;

[0057] ;

[0058] Where, is the fragmentation threshold, is the total size of data to be transmitted, is the reference bandwidth value, is the current available bandwidth, is the server quality coefficient, is the performance load factor, is the equipment performance coefficient, n is the number of sampling times of the sliding window, is the processor utilization of the kth sampling, is the memory usage of the k-th sampling, is the time difference between the current time and the kth sampling time, is the average delay, The total amount of memory.

[0059] According to one aspect of the above technical solution, the sharding module is further configured to:

[0060] A dynamic correction factor is obtained by calculating the bandwidth fluctuation rate, and the sharding threshold is corrected based on the dynamic correction factor to obtain a corrected threshold. The calculation expression of the dynamic correction factor is:

[0061] ;

[0062] Where, is the absolute value of bandwidth fluctuation, is the average bandwidth, is the standard shard size;

[0063] The calculation expression of the transformation matrix is:

[0064] ;

[0065] Where, is the transformation matrix, is the path feature verification value, is the byte sequence corresponding to the dynamic key seed sequence, is the byte sequence corresponding to the available bandwidth, is the XOR operation, U( ) represents a circular left shift operation, Indicates the number of shifts, is the row entropy value of the transformation matrix, is the column entropy of the transformation matrix.

[0066] According to one aspect of the above technical solution, the encryption module is specifically used for:

[0067] Calculate the difference in offset parameters between adjacent slice units, and then generate a phase offset correction factor based on the difference and the quality assessment parameter to update the offset in real time based on the phase offset correction factor. The calculation expression of the offset is:

[0068] ;

[0069] ;

[0070] ;

[0071] Where, is the current phase offset, is the phase offset of the previous cycle, G is the number of fragmentation units contained in the current encryption window, is the partial derivative of the quality assessment parameter Q with respect to the bandwidth of the g-th fragment transmission path, is the absolute value of the bandwidth fluctuation of the g-th fragment transmission path, is the bandwidth delay jitter parameter of the g-th fragment transmission path, It is the weighted average of the quality assessment parameters of the transmission paths corresponding to all the slice units in the current encryption window.

[0072] According to one aspect of the above technical solution, the verification module is specifically used to:

[0073] The coordinate mark is constructed based on the row and column entropy values ​​of the transformation matrix and the timestamp of the data slice unit according to the following calculation formula:

[0074] ;

[0075] Where, is the sending time offset of the fth fragment relative to the first fragment, The dynamic key corresponding to the dynamic key seed sequence;

[0076] According to the following formula, a hash value is calculated for each shard unit, and a verification hash of the spatiotemporal dimension is generated based on the hash value and the coordinate mark, so that the verification hash is used as a label to mark the shard unit:

[0077] ;

[0078] Where, is the verification hash of the f-th shard, is the ciphertext data of the f-th fragment, is the verification hash of the previous shard;

[0079] The receiving end performs integrity and spatiotemporal continuity checks based on the verification hash according to the following calculation formula:

[0080] ;

[0081] ;

[0082] Where, is the conjunction symbol, F is the number of fragments, is the verification hash of the fth shard, is the received ciphertext data, is the verified valid hash of the f-1th shard, Coordinate markers calculated for the receiving end, is the receiving timestamp of the fth fragment, is the receiving timestamp of the f-1th fragment, is the time threshold.

[0083] Compared with the existing technology, the beneficial effects of the present invention are: one-time encryption is achieved by dynamically generating a key seed sequence through real-time collection of network environment parameters to block replay attacks; the data sharding strategy is dynamically adjusted based on device performance parameters to reduce the retransmission rate; the sharded data is subjected to XOR transformation using a transformation matrix to enhance the randomness of the ciphertext to resist traffic analysis; the offset of the encryption window is adjusted in real time through the transmission path quality assessment parameters to improve the high-jitter network throughput while ensuring security; and finally a time-space-related verification hash is constructed to achieve dual verification of the integrity and time sequence continuity of multi-path transmission data, thereby improving the transmission reliability in the high-dynamic environment of the industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 Schematic diagram of the process of secure data transmission method in the first embodiment of the present invention;

[0085] Figure 2 This is a structural block diagram of a data security transmission system in a second embodiment of the present invention;

[0086] Figure 3 1 is a schematic diagram of the hardware structure of a computer in a third embodiment of the present invention;

[0087] The following specific embodiments will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0088] To facilitate understanding of the present invention, the present invention will be described more fully below with reference to the accompanying drawings. The drawings illustrate several embodiments of the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and comprehensive understanding of the present invention.

[0089] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be an intermediate element. When an element is referred to as being "connected to" another element, it may be directly connected to the other element or there may be an intermediate element. The terms "vertical," "horizontal," "left," "right," and similar expressions used herein are for illustrative purposes only.

[0090] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one skilled in the art to which this invention pertains. The terms used in this specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0091] Example 1

[0092] See also Figure 1 , which is a flow chart of a data security transmission method according to a first embodiment of the present invention. As shown in the figure, the method includes the following steps:

[0093] Step S100: Collect real-time performance parameters and network environment parameters of the transmission device. Specifically, in this embodiment, the real-time performance parameters include memory usage and processor utilization, and the network environment parameters include path delay jitter, path packet loss rate, and available bandwidth.

[0094] Step S200: Generate a dynamic key seed sequence according to the network environment parameters of the transmission device, based on the round-trip delay jitter parameters and packet loss rate characteristics of the transmission path.

[0095] Preferably, in this embodiment, the calculation expression of the dynamic key seed sequence is:

[0096] ;

[0097] ;

[0098] Where, is the dynamic key seed sequence, ( ) is the HKDF derived function, is the path stability factor, H ( ) is a hash function, t is the byte sequence corresponding to the timestamp, is the fragment length, S is the byte sequence corresponding to the path characteristic entropy value of the dynamic key seed sequence, Indicates byte splicing operation, m is the number of transmission paths, is the average transmission delay, is the delay jitter of the i-th path, is the packet loss rate of the i-th path, It is a modulo operation.

[0099] Specifically, Used to quantify the relative strength of path jitter, Used to nonlinearly amplify the packet loss rate, Used to generate a 32-bit entropy value S, compatible with the AES-256 key length. In some application scenarios of this embodiment, when an AGV transmits data via both 5G (path 1) and Wi-Fi (path 2), there are differences in latency and packet loss rate.

[0100] Step S300, dynamically generate a data sharding strategy according to the performance parameters of the transmission device, divide the data to be transmitted into several sharding units based on the data sharding strategy, and establish a data encryption transformation matrix based on a dynamic key seed sequence to transform and encrypt the sharding unit data.

[0101] Specifically, in this embodiment, the step of dynamically generating a data sharding strategy based on the performance parameters of the transmission device specifically includes:

[0102] Establishing a joint perception model of device performance and network status, and dynamically sampling the performance load factor corresponding to the performance parameters of the transmission device through a sliding window mechanism;

[0103] The sharding threshold is determined based on the nonlinear mapping relationship between the characteristics of the data to be transmitted and the performance load factor:

[0104] ;

[0105] ;

[0106] Where, is the fragmentation threshold, is the total size of data to be transmitted, is the reference bandwidth value, is the current available bandwidth, is the server quality coefficient, is the performance load factor, is the equipment performance coefficient, n is the number of sampling times of the sliding window, is the processor utilization of the kth sampling, is the memory usage of the k-th sampling, is the time difference between the current time and the kth sampling time, is the average delay, The total memory capacity. Specifically, when the load is high, the shards are automatically reduced to reduce the pressure on the device.

[0107] Furthermore, the step of dividing the data to be transmitted into a plurality of fragment units based on the data fragmentation strategy specifically includes:

[0108] A dynamic correction factor is obtained by calculating the bandwidth fluctuation rate, and the sharding threshold is corrected based on the dynamic correction factor to obtain a corrected threshold. The calculation expression of the dynamic correction factor is:

[0109] ;

[0110] Where, is the absolute value of bandwidth fluctuation, is the average bandwidth, Specifically, when bandwidth fluctuates, the fragment size is further reduced to reduce the probability of retransmission.

[0111] The calculation expression of the transformation matrix is:

[0112] ;

[0113] Where, is the transformation matrix, is the path feature verification value, is the byte sequence corresponding to the dynamic key seed sequence, is the byte sequence corresponding to the available bandwidth, is the XOR operation, U( ) represents a circular left shift operation, Indicates the number of shifts, is the row entropy value of the transformation matrix, is the column entropy of the transformation matrix. In this step, H ( ) uses the SHA3-256 hash security function.

[0114] Furthermore, in this embodiment, the transformation encryption of the slice unit data adopts the AES algorithm, which specifically includes: first, the hexadecimal bytes corresponding to the slice unit data are used as the plaintext matrix, and then the elements in the transformation matrix are extracted in sequence to generate the hexadecimal key, and then multiple rounds of XOR transformations of byte replacement, row shift, and column confusion are performed in sequence to obtain the ciphertext matrix.

[0115] Step S400 : Encapsulating the slice unit data through an encryption window, and generating a transmission path quality evaluation parameter according to a mapping algorithm, so as to dynamically adjust the offset of the encryption window according to the quality evaluation parameter.

[0116] Specifically, in this embodiment, the calculation expression of the transmission path quality evaluation parameter is:

[0117] ;

[0118] Where, is the transmission path quality evaluation parameter, is the bandwidth of the i-th path, is the maximum bandwidth, is the delay normalization factor.

[0119] Furthermore, the step of dynamically adjusting the offset of the encryption window according to the quality assessment parameter specifically includes:

[0120] Calculate the difference in offset parameters between adjacent slice units, and then generate a phase offset correction factor based on the difference and the quality assessment parameter to update the offset in real time based on the phase offset correction factor. The calculation expression of the offset is:

[0121] ;

[0122] ;

[0123] ;

[0124] Where, is the current phase offset, is the phase offset of the previous cycle, G is the number of fragmentation units contained in the current encryption window, is the partial derivative of the quality assessment parameter Q with respect to the bandwidth of the g-th fragment transmission path, is the absolute value of the bandwidth fluctuation of the g-th fragment transmission path, is the bandwidth delay jitter parameter of the g-th fragment transmission path, It is the weighted average of the quality assessment parameters of the transmission paths corresponding to all the slice units in the current encryption window.

[0125] Specifically, the encryption window is used to load data slice units on demand and then adjusted by the current phase offset. represents the degree of mixing difference, The phase offset correction factor is used to encapsulate the same data differently on different paths to defend against traffic analysis and replay attacks.

[0126] Step S500: construct a spatiotemporal associated verification hash based on the dynamic key seed sequence, transmit the encrypted slice unit data through multiple paths, and the receiving end performs integrity and spatiotemporal continuity verification based on the verification hash.

[0127] Preferably, in this embodiment, a spatiotemporal verification hash is constructed based on a dynamic key seed sequence, the encrypted slice unit data is transmitted through multiple paths, and the receiving end performs integrity and spatiotemporal continuity verification based on the verification hash. Specifically, the steps include:

[0128] The coordinate mark is constructed based on the row and column entropy values ​​of the transformation matrix and the timestamp of the data slice unit according to the following calculation formula:

[0129] ;

[0130] Where, is the sending time offset of the fth fragment relative to the first fragment, is the dynamic key corresponding to the dynamic key seed sequence, H ( )use Hash security functions;

[0131] According to the following formula, a hash value is calculated for each shard unit, and a verification hash of the spatiotemporal dimension is generated based on the hash value and the coordinate mark, so that the verification hash is used as a label to mark the shard unit:

[0132] ;

[0133] Where, is the verification hash of the f-th shard, is the ciphertext data of the f-th fragment, is the verification hash of the previous shard, H ( )use Hash security functions;

[0134] The receiving end performs integrity and spatiotemporal continuity checks based on the verification hash according to the following calculation formula:

[0135] ;

[0136] ;

[0137] Where, is the conjunction symbol, F is the number of fragments, is the verification hash of the fth shard, is the received ciphertext data, is the verified valid hash of the f-1th shard, Coordinate markers calculated for the receiving end, is the receiving timestamp of the fth fragment, is the receiving timestamp of the f-1th fragment, is the time threshold, H ( )use Hash security function. Specifically, It means that for all shards from f=1 to F, the equality condition is satisfied. It indicates that the received hash value is consistent with the locally calculated hash value. If they are consistent, the data integrity check is passed. The coordinate mark calculated by the receiving end can refer to the coordinate mark calculation of the sending end. The row and column entropy values ​​of the transformation matrix and the sending time offset are attached to the data packet and sent. The dynamic key is synchronized by the key distribution center.

[0138] Indicates that the maximum absolute value of the difference in time offsets of all adjacent shards is less than the time threshold. Even if the shards arrive out of order, after being sorted by sequence number, the arrival time difference of shards with adjacent sequence numbers should be within the time threshold to ensure temporal continuity.

[0139] In summary, the data security transmission method in the above embodiments of the present invention realizes one-time encryption by dynamically generating a key seed sequence through real-time collection of network environment parameters to block replay attacks; dynamically adjusts the data sharding strategy based on device performance parameters to reduce the retransmission rate; uses the transformation matrix to perform XOR transformation on the sharded data to enhance the randomness of the ciphertext to resist traffic analysis; adjusts the offset of the encryption window in real time through the transmission path quality assessment parameters to improve the high-jitter network throughput while ensuring security; and finally constructs a spatiotemporal correlation verification hash to realize dual verification of the integrity and time sequence continuity of multi-path transmission data, thereby improving the transmission reliability in the high-dynamic environment of the industrial Internet.

[0140] Example 2

[0141] A second embodiment of the present application further provides a data security transmission system, which is used to implement the embodiments and preferred embodiments, and will not be repeated hereafter. As used below, the terms "module," "unit," "subunit," etc. may refer to a combination of software and / or hardware that implements a predetermined function. Although the systems described in the following embodiments are preferably implemented in software, implementations using hardware, or a combination of software and hardware, are also possible and contemplated.

[0142] like Figure 2 As shown, the system includes: a collection module 100, a key module 200, a sharding module 300, an encryption module 400 and a verification module 500.

[0143] The acquisition module 100 is used to collect real-time performance parameters of the transmission equipment and network environment parameters;

[0144] The key module 200 is used to generate a dynamic key seed sequence based on the network environment parameters of the transmission device, the round-trip delay jitter parameters and the packet loss rate characteristics of the transmission path;

[0145] The sharding module 300 is used to dynamically generate a data sharding strategy based on the performance parameters of the transmission device, to divide the data to be transmitted into a number of sharding units based on the data sharding strategy, and to establish a data encryption transformation matrix based on the dynamic key seed sequence to transform the sharding unit data;

[0146] The encryption module 400 is used to encapsulate the slice unit data through the encryption window and generate a transmission path quality assessment parameter according to the mapping algorithm to dynamically adjust the offset of the encryption window according to the quality assessment parameter;

[0147] The verification module 500 is used to construct a spatiotemporal associated verification hash based on a dynamic key seed sequence, transmit the encrypted slice unit data through multiple paths, and the receiving end performs integrity and spatiotemporal continuity verification based on the verification hash.

[0148] Preferably, in this embodiment, the sharding module 300 is specifically used to:

[0149] Establishing a joint perception model of device performance and network status, and dynamically sampling the performance load factor corresponding to the performance parameters of the transmission device through a sliding window mechanism;

[0150] The sharding threshold is determined based on the nonlinear mapping relationship between the characteristics of the data to be transmitted and the performance load factor:

[0151] ;

[0152] ;

[0153] Where, is the fragmentation threshold, is the total size of data to be transmitted, is the reference bandwidth value, is the current available bandwidth, is the server quality coefficient, is the performance load factor, is the equipment performance coefficient, n is the number of sampling times of the sliding window, is the processor utilization of the kth sampling, is the memory usage of the k-th sampling, is the time difference between the current time and the kth sampling time, is the average delay, The total amount of memory.

[0154] Preferably, in this embodiment, the sharding module 300 is further configured to:

[0155] A dynamic correction factor is obtained by calculating the bandwidth fluctuation rate, and the sharding threshold is corrected based on the dynamic correction factor to obtain a corrected threshold. The calculation expression of the dynamic correction factor is:

[0156] ;

[0157] Where, is the absolute value of bandwidth fluctuation, is the average bandwidth, is the standard shard size;

[0158] The calculation expression of the transformation matrix is:

[0159] ;

[0160] Where, is the transformation matrix, is the path feature verification value, is the byte sequence corresponding to the dynamic key seed sequence, is the byte sequence corresponding to the available bandwidth, is the XOR operation, U( ) represents a circular left shift operation, Indicates the number of shifts, is the row entropy value of the transformation matrix, is the column entropy of the transformation matrix.

[0161] Preferably, in this embodiment, the encryption module 400 is specifically used for:

[0162] Calculate the difference in offset parameters between adjacent slice units, and then generate a phase offset correction factor based on the difference and the quality assessment parameter to update the offset in real time based on the phase offset correction factor. The calculation expression of the offset is:

[0163] ;

[0164] ;

[0165] ;

[0166] Where, is the current phase offset, is the phase offset of the previous cycle, G is the number of fragmentation units contained in the current encryption window, is the partial derivative of the quality assessment parameter Q with respect to the bandwidth of the g-th fragment transmission path, is the absolute value of the bandwidth fluctuation of the g-th fragment transmission path, is the bandwidth delay jitter parameter of the g-th fragment transmission path, It is the weighted average of the quality assessment parameters of the transmission paths corresponding to all the slice units in the current encryption window.

[0167] Preferably, in this embodiment, the verification module 500 is specifically used to:

[0168] The coordinate mark is constructed based on the row and column entropy values ​​of the transformation matrix and the timestamp of the data slice unit according to the following calculation formula:

[0169] ;

[0170] Where, is the sending time offset of the fth fragment relative to the first fragment, The dynamic key corresponding to the dynamic key seed sequence;

[0171] According to the following formula, a hash value is calculated for each shard unit, and a verification hash of the spatiotemporal dimension is generated based on the hash value and the coordinate mark, so that the verification hash is used as a label to mark the shard unit:

[0172] ;

[0173] Where, is the verification hash of the f-th shard, is the ciphertext data of the f-th fragment, is the verification hash of the previous shard;

[0174] The receiving end performs integrity and spatiotemporal continuity checks based on the verification hash according to the following calculation formula:

[0175] ;

[0176] ;

[0177] Where, is the conjunction symbol, F is the number of fragments, is the verification hash of the fth shard, is the received ciphertext data, is the verified valid hash of the f-1th shard, Coordinate markers calculated for the receiving end, is the receiving timestamp of the fth fragment, is the receiving timestamp of the f-1th fragment, is the time threshold.

[0178] It should be noted that each module can be a functional module or a program module, and can be implemented by software or hardware. For modules implemented by hardware, each module can be located in the same processor; or each module can be located in different processors in any combination.

[0179] Example 3

[0180] A third embodiment of the present application provides a computer, which may include a processor 81 and a memory 82 storing computer program commands.

[0181] Specifically, the processor 81 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0182] Memory 82 may include a large-capacity memory for data or commands. By way of example, and not limitation, memory 82 may include a hard disk drive (HDD), a floppy disk drive, a solid-state drive (SSD), flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 82 may include removable or non-removable (or fixed) media. Where appropriate, memory 82 may be internal or external to the data processing device. In certain embodiments, memory 82 is non-volatile memory. In certain embodiments, memory 82 includes read-only memory (ROM) and random access memory (RAM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically alterable ROM (EAROM) or a flash memory (FLASH), or a combination of two or more of these. Under appropriate circumstances, the RAM can be a static random access memory (SRAM) or a dynamic random access memory (DRAM), where the DRAM can be a fast page mode dynamic random access memory (FPMDRAM), an extended data out dynamic random access memory (EDODRAM), a synchronous dynamic random access memory (SDRAM), etc.

[0183] The memory 82 may be used to store or cache various data files that need to be processed and / or used for communication, as well as possible computer program commands executed by the processor 81 .

[0184] The processor 81 implements any one of the data security transmission methods in the above embodiments by reading and executing computer program commands stored in the memory 82.

[0185] In some embodiments, the computer may further include a communication interface 83 and a bus 80. Figure 3 As shown, the processor 81, the memory 82, and the communication interface 83 are connected via a bus 80 and communicate with each other.

[0186] The communication interface 83 is used to implement communication between the various modules, devices, units, and / or devices in the embodiments of the present application. The communication interface 83 can also implement data communication with other components such as: external devices, image / data acquisition equipment, databases, external storage, and image / data processing workstations.

[0187] The bus 80 includes hardware, software, or both, and couples computer components together. The bus 80 includes, but is not limited to, at least one of the following: a data bus, an address bus, a control bus, an expansion bus, and a local bus. By way of example and not limitation, bus 80 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Bus 80 may include one or more buses, where appropriate. Although embodiments herein describe and illustrate a particular bus, this application contemplates any suitable bus or interconnect.

[0188] Example 4

[0189] A fourth embodiment of the present application provides a readable storage medium having computer program commands stored thereon; when the computer program commands are executed by a processor, any one of the data security transmission methods in the above embodiments is implemented.

[0190] The technical features of the above-described embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0191] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A data security transmission method, characterized in that: The following steps are involved: Collect real-time performance parameters of transmission equipment and network environment parameters; Generate a dynamic key seed sequence according to the network environment parameters of the transmission device and based on the round-trip delay jitter parameters and packet loss rate characteristics of the transmission path; Dynamically generate a data sharding strategy based on the performance parameters of the transmission device, divide the data to be transmitted into a plurality of sharding units based on the data sharding strategy, and establish a data encryption transformation matrix based on a dynamic key seed sequence to perform transformation encryption on the sharding unit data; Encapsulating the fragmented unit data through an encryption window, and generating a transmission path quality assessment parameter according to a mapping algorithm, so as to dynamically adjust the offset of the encryption window according to the quality assessment parameter; A spatiotemporal verification hash is constructed based on a dynamic key seed sequence. The encrypted shard unit data is transmitted through multiple paths. The receiving end performs integrity and spatiotemporal continuity verification based on the verification hash. The step of dynamically generating a data sharding strategy based on the performance parameters of the transmission device specifically includes: Establishing a joint perception model of device performance and network status, and dynamically sampling the performance load factor corresponding to the performance parameters of the transmission device through a sliding window mechanism; The sharding threshold is determined based on the nonlinear mapping relationship between the characteristics of the data to be transmitted and the performance load factor: ； ； Where, is the fragmentation threshold, is the total size of data to be transmitted, is the reference bandwidth value, is the current available bandwidth, is the server quality coefficient, is the performance load factor, is the equipment performance coefficient, n is the number of sampling times of the sliding window, is the processor utilization of the kth sampling, is the memory usage of the k-th sampling, is the time difference between the current time and the kth sampling time, is the average delay, is the total memory; The calculation expression of the dynamic key seed sequence is: ； ； Where, is the dynamic key seed sequence, ( ) is the HKDF derived function, is the path stability factor, H ( ) is a hash function, t is the byte sequence corresponding to the timestamp, is the fragment length, S is the byte sequence corresponding to the path characteristic entropy value of the dynamic key seed sequence, Indicates byte splicing operation, m is the number of transmission paths, is the average transmission delay, is the delay jitter of the i-th path, is the packet loss rate of the i-th path, is the modulo operation; The steps of dividing the data to be transmitted into a plurality of fragment units based on the data fragmentation strategy specifically include: A dynamic correction factor is obtained by calculating the bandwidth fluctuation rate, and the sharding threshold is corrected based on the dynamic correction factor to obtain a corrected threshold. The calculation expression of the dynamic correction factor is: ； Where, is the absolute value of bandwidth fluctuation, is the average bandwidth, is the standard shard size; The calculation expression of the transformation matrix is: ； Where, is the transformation matrix, is the path feature verification value, is the byte sequence corresponding to the dynamic key seed sequence, is the byte sequence corresponding to the available bandwidth, is the XOR operation, U( ) represents a circular left shift operation, Indicates the number of shifts, is the row entropy value of the transformation matrix, is the column entropy of the transformation matrix; The calculation expression of the transmission path quality evaluation parameter is: ； Where, is the transmission path quality evaluation parameter, is the bandwidth of the i-th path, is the maximum bandwidth, is the delay normalization factor; The steps of dynamically adjusting the offset of the encryption window according to the quality assessment parameter specifically include: Calculate the difference in offset parameters between adjacent slice units, and then generate a phase offset correction factor based on the difference and the quality assessment parameter to update the offset in real time based on the phase offset correction factor. The calculation expression of the offset is: ； ； ； Where, is the current phase offset, is the phase offset of the previous cycle, G is the number of fragmentation units contained in the current encryption window, is the partial derivative of the quality assessment parameter Q with respect to the bandwidth of the g-th fragment transmission path, is the absolute value of the bandwidth fluctuation of the g-th fragment transmission path, is the bandwidth delay jitter parameter of the g-th fragment transmission path, The weighted average of the quality assessment parameters of the transmission paths corresponding to all the slice units in the current encryption window; The steps of constructing a spatiotemporal verification hash based on a dynamic key seed sequence, transmitting the encrypted shard unit data through multiple paths, and performing integrity and spatiotemporal continuity verification on the receiving end based on the verification hash include: The coordinate mark is constructed based on the row and column entropy values ​​of the transformation matrix and the timestamp of the data slice unit according to the following calculation formula: ； Where, is the sending time offset of the fth fragment relative to the first fragment, The dynamic key corresponding to the dynamic key seed sequence; According to the following formula, a hash value is calculated for each shard unit, and a verification hash of the spatiotemporal dimension is generated based on the hash value and the coordinate mark, so that the verification hash is used as a label to mark the shard unit: ； Where, is the verification hash of the f-th shard, is the ciphertext data of the f-th fragment, is the verification hash of the previous shard; The receiving end performs integrity and spatiotemporal continuity checks based on the verification hash according to the following calculation formula: ； ； Where, is the conjunction symbol, F is the number of fragments, is the verification hash of the fth shard, is the received ciphertext data, is the verified valid hash of the f-1th shard, Coordinate markers calculated for the receiving end, is the receiving timestamp of the fth fragment, is the receiving timestamp of the f-1th fragment, is the time threshold.

2. A data security transmission system for implementing the method according to claim 1, characterized in that: include: Acquisition module, collects real-time performance parameters of transmission equipment and network environment parameters; A key module generates a dynamic key seed sequence according to the network environment parameters of the transmission device and based on the round-trip delay jitter parameters and packet loss rate characteristics of the transmission path; a sharding module, which dynamically generates a data sharding strategy according to the performance parameters of the transmission device, divides the data to be transmitted into a plurality of sharding units based on the data sharding strategy, and establishes a data encryption transformation matrix based on a dynamic key seed sequence to perform transformation encryption on the sharding unit data; An encryption module encapsulates the slice unit data through an encryption window and generates a transmission path quality evaluation parameter according to a mapping algorithm to dynamically adjust the offset of the encryption window according to the quality evaluation parameter; The verification module is used to construct a spatiotemporal associated verification hash based on the dynamic key seed sequence, transmit the encrypted shard unit data through multiple paths, and the receiving end performs integrity and spatiotemporal continuity verification based on the verification hash.

3. A computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the data security transmission method according to claim 1 is implemented.

4. A storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data security transmission method according to claim 1 is implemented.

Images