Message data security improvement method and device, equipment, storage medium and computer program product

Abstract

The invention relates to the technical field of information security, in particular to a message data security improvement method and device, equipment, a storage medium and a computer program product. The method comprises the following steps: in a transmission process of message data, dynamically generating a sub-key based on a session security parameter and a preset time interval, and carrying out preliminary encryption on the message data based on the sub-key to obtain preliminary encrypted message data; acquiring context information of the message data, and performing security level division on the message data based on the context information; determining a re-encryption strategy based on the division result, and re-encrypting the preliminarily encrypted message data based on the re-encryption strategy; and performing structure confusion processing on the re-encrypted message data to obtain the target encrypted message data, thereby improving the security protection effect of the message data.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular, to a method, device, equipment, storage medium, and computer program product for enhancing the security of message data. Background Art

[0002] With the rapid development of Internet technology and communication networks, the security issues of data during transmission have become increasingly prominent. To ensure the confidentiality and integrity of data during transmission, most traditional encryption schemes use fixed keys or static session keys for data encryption. The key update period is long, and it usually relies on manual configuration or timed refresh. As a result, when there is a risk of key exposure, the system cannot respond in a timely manner, which easily leads to security risks. Secondly, existing encryption mechanisms mostly adopt a unified encryption strategy, treating all transmitted data equally for encryption processing, resulting in low resource utilization efficiency. In addition, during the transmission of encrypted messages in the prior art, relatively regular message structure features are usually retained, such as fixed field order, length pattern, and timestamp features, enabling attackers to infer communication content or attack targets through means such as traffic analysis and pattern recognition, thereby weakening the actual protection effect of encryption measures and resulting in poor security protection for message data. Therefore, how to improve the security protection effect of message data has become an urgent technical problem to be solved. Summary of the Invention

[0003] The main purpose of this application is to provide a method, device, equipment, storage medium, and computer program product for enhancing the security of message data, aiming to solve the technical problem of how to improve the security protection effect of message data.

[0004] To achieve the above objective, this application provides a method for enhancing the security of message data, and the method includes the following steps:

[0005] During the transmission of message data, generate a sub-key dynamically based on session security parameters and a preset time interval, and perform preliminary encryption on the message data based on the sub-key to obtain preliminarily encrypted message data;

[0006] Obtain the context information of the message data, and based on the context information, divide the security level of the message data;

[0007] Based on the division result, determine a re-encryption strategy, and perform re-encryption on the preliminarily encrypted message data based on the re-encryption strategy;

[0008] Perform structure obfuscation processing on the re-encrypted message data to obtain target encrypted message data.

[0009] In one embodiment, before the step of dynamically generating a sub-key based on a preset time interval during the transmission of the message data and preliminarily encrypting the message data based on the sub-key to obtain preliminarily encrypted message data, the method further includes:

[0010] Generating a key pair based on the elliptic curve key exchange algorithm and performing public key exchange;

[0011] Determining a shared key material according to the key pair and the public key exchange result, and generating a session key based on the shared key material;

[0012] Initializing the session security parameters based on the session key, where the session security parameters include an encryption algorithm, an encryption mode, and a sub-key derivation rule.

[0013] In one embodiment, after the step of performing structure confusion processing on the re-encrypted message data to obtain target encrypted message data, the method further includes:

[0014] Verifying the message integrity of each node of the target encrypted message data based on a distributed checksum mechanism;

[0015] Performing identity authentication between the sender and the receiver based on a zero-knowledge proof protocol;

[0016] If both the message integrity verification and the identity authentication pass, sending the target encrypted message data to the receiver.

[0017] In one embodiment, the step of performing structure confusion processing on the re-encrypted message data to obtain target encrypted message data includes:

[0018] Inserting a random padding field with a preset length range into the re-encrypted message data to obtain padded message data;

[0019] Recombining the field order of the padded message data based on a pseudo-random number to obtain recombined message data;

[0020] Adding a preset jitter value to the message timestamp of the recombined message data to obtain the target encrypted message data.

[0021] In one embodiment, the step of obtaining the context information of the message data and performing a security level division on the message data based on the context information includes:

[0022] Obtaining the context information of the message data, where the context information includes a field type, a field content, a data source, and a service identifier;

[0023] Analyzing the context information based on a preset sensitivity evaluation rule to obtain a sensitivity score;

[0024] Based on the sensitivity score, in combination with a preset security level division strategy, perform a security level division on the message data.

[0025] In one embodiment, the step of determining a re-encryption strategy based on the division result and re-encrypting the preliminarily encrypted message data based on the re-encryption strategy includes:

[0026] Based on the division result, in combination with a preset mapping relationship set between security levels and encryption algorithms, determine a target encryption algorithm and encryption parameters, where the target encryption algorithm includes one or more of AES-256, ChaCha20, SM4, or SM9;

[0027] Generate the re-encryption strategy based on the target encryption algorithm and encryption parameters;

[0028] Re-encrypt the preliminarily encrypted message data based on the re-encryption strategy.

[0029] In addition, to achieve the above object, the present application also proposes a device for improving the security of message data, where the device for improving the security of message data includes:

[0030] A preliminary encryption module, configured to dynamically generate a sub-key based on session security parameters and a preset time interval during the transmission of message data, and perform preliminary encryption on the message data based on the sub-key to obtain preliminarily encrypted message data;

[0031] A level division module, configured to obtain context information of the message data, and perform a security level division on the message data based on the context information;

[0032] A re-encryption module, configured to determine a re-encryption strategy based on the division result, and re-encrypt the preliminarily encrypted message data based on the re-encryption strategy;

[0033] A target module, configured to perform structure obfuscation processing on the re-encrypted message data to obtain target encrypted message data.

[0034] In addition, to achieve the above object, the present application also proposes a device for improving the security of message data, where the device includes: a memory, a processor, and a message data security improvement program stored on the memory and executable on the processor, and the message data security improvement program is configured to implement the steps of the message data security improvement method as described above.

[0035] In addition, to achieve the above object, the present application further provides a storage medium, on which a program for enhancing the security of message data is stored. When the program for enhancing the security of message data is executed by a processor, the steps of the method for enhancing the security of message data as described above are implemented.

[0036] In addition, to achieve the above object, the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps of the method for enhancing the security of message data as described above are implemented.

[0037] During the transmission process of the message data in the present application, a sub-key is dynamically generated based on the session security parameter and the preset time interval, and the message data is preliminarily encrypted based on the sub-key to obtain preliminarily encrypted message data; the context information of the message data is obtained, and based on the context information, the security level of the message data is divided; based on the division result, a re-encryption strategy is determined, and the preliminarily encrypted message data is re-encrypted based on the re-encryption strategy; the structure of the re-encrypted message data is obfuscated to obtain the target encrypted message data. By dynamically generating a sub-key based on the preset time interval and performing preliminary encryption during the transmission process of the message data in the present application, the risk of key exposure is reduced, and the confidentiality of data transmission is improved; by obtaining the context information of the message data and dividing the security level, differential protection of the data is achieved; based on the division result, a re-encryption strategy is determined and re-encryption processing is performed, further enhancing the security protection of sensitive data; by obfuscating the structure of the re-encrypted message data, attack means such as traffic analysis are effectively resisted, and the security protection effect of the message data is improved. Description of the Drawings

[0038] Figure 1 It is a schematic flowchart of the first embodiment of the method for enhancing the security of message data in the present application;

[0039] Figure 2 It is a schematic flowchart of a sub-process in the second embodiment of the method for enhancing the security of message data in the present application;

[0040] Figure 3 It is a schematic flowchart of a sub-process in the third embodiment of the method for enhancing the security of message data in the present application;

[0041] Figure 4 It is a schematic diagram of the module structure of the device for enhancing the security of message data in the embodiment of the present application;

[0042] Figure 5 It is a schematic diagram of the device structure of the hardware operating environment involved in the method for enhancing the security of message data in the embodiment of the present application.

[0043] The realization, functional features and advantages of the object of the present application will be further described with reference to the embodiments and the accompanying drawings. Detailed implementation manners

[0044] It should be understood that the specific embodiments described herein are only used to explain this application and are not used to limit this application.

[0045] In order to better understand the technical solution of this application, the following will be described in detail in combination with the specification drawings and specific implementation manners.

[0046] It should be noted that with the rapid development of Internet technology and communication networks, the security problem of data during transmission has become increasingly prominent. To ensure the confidentiality and integrity of data during transmission, most traditional encryption schemes use fixed keys or static session keys for data encryption, with a long key update cycle, usually relying on manual configuration or timed refresh. As a result, when there is a risk of key exposure, the system cannot respond in a timely manner, easily leading to security hazards. Secondly, most existing encryption mechanisms adopt a unified encryption strategy, treating all transmitted data equally for encryption processing, resulting in low resource utilization efficiency. In addition, in the process of transmitting encrypted packets in the prior art, relatively regular packet structure features are usually retained, such as fixed field order, length pattern, and timestamp features, enabling attackers to infer communication content or attack targets through means such as traffic analysis and pattern recognition, thereby weakening the actual protection effect of encryption measures and resulting in poor security protection for packet data. Therefore, how to improve the security protection effect of packet data has become an urgent technical problem to be solved.

[0047] The main solution of this application is: during the transmission of packet data, generate sub-keys dynamically based on session security parameters and a preset time interval, and perform preliminary encryption on the packet data based on the sub-keys to obtain preliminarily encrypted packet data; obtain the context information of the packet data, and based on the context information, perform a security level division on the packet data; based on the division result, determine a re-encryption strategy, and perform re-encryption on the preliminarily encrypted packet data based on the re-encryption strategy; perform structure obfuscation processing on the re-encrypted packet data to obtain target encrypted packet data.

[0048] This application generates sub-keys dynamically based on session security parameters and a preset time interval during the transmission of packet data and performs preliminary encryption, reducing the risk of key exposure and enhancing the confidentiality of data transmission; by obtaining the context information of the packet data and performing a security level division, it realizes differential protection of data; based on the division result, determines a re-encryption strategy and performs re-encryption processing, further enhancing the security protection of sensitive data; by performing structure obfuscation on the re-encrypted packet data, it effectively resists attack means such as traffic analysis and improves the security protection effect of packet data.

[0049] It should be noted that the execution subject of the method in this embodiment can be a computing service device with data processing, network communication, and program running functions, or the above-mentioned message data security enhancement device with the same or similar functions. This embodiment and the following embodiments will be described by taking the message data security enhancement device as an example.

[0050] Based on this, the first embodiment of the message data security enhancement method of this application is proposed. Please refer to Figure 1 , Figure 1 which is the flowchart of the first embodiment of the message data security enhancement method of this application.

[0051] In this embodiment, the message data security enhancement method includes the following steps:

[0052] S1: During the transmission of message data, a sub-key is dynamically generated based on the session security parameter and the preset time interval, and the message data is preliminarily encrypted based on the sub-key to obtain preliminarily encrypted message data;

[0053] It should be noted that the message data security enhancement device in this embodiment can be respectively connected to the sending end and the receiving end. The sending end is used to send message data to the message data security enhancement device, and the message data security enhancement device then transmits the encrypted message data (i.e., the target encrypted message data described below) to the receiving end.

[0054] As another implementation, the message data security enhancement device in this embodiment can also be used as the sending end, that is, the message data security enhancement device can encrypt its own message data and then transmit it to the receiving end.

[0055] However, for the convenience of subsequent understanding, in this embodiment, the above-mentioned message data security enhancement device can also be used as the receiving end, that is, the message data security enhancement device can receive message data from the sending end.

[0056] It should also be noted that message data refers to the data unit transmitted in the network, usually including header information and payload data, and is used to realize data communication between devices. The preset time interval refers to the fixed or adjustable time period preset during system design, which is used to control the frequency of specific operations (such as key update), for example, updating once every 100 milliseconds. The sub-key refers to the short-term use key derived from the main key or independently generated, which is usually used to protect data within a short time period to enhance the dynamicity and security of the encryption system. Preliminary encryption refers to the first-round encryption process of the original message data based on the generated sub-key during the data transmission process to prevent the data from being illegally intercepted or tampered with midway.

[0057] Specifically, during the transmission of message data, based on the initialized session security parameters, which include encryption algorithms, encryption modes, and sub-key derivation rules, the generation operation of sub-keys is triggered at regular intervals. This time interval can be flexibly set according to system requirements, such as every 100 milliseconds or a shorter period. Every time a new time period arrives, a new sub-key is dynamically generated by the key generation module. The generation of sub-keys can be based on the master session key and completed through a certain random number algorithm or key derivation function, thus ensuring that even if an attacker obtains the sub-key at a certain moment, they cannot infer the sub-keys at other moments, achieving rapid key updates and high unpredictability of the keys.

[0058] Furthermore, after the new sub-key is generated, the message data to be transmitted is immediately encrypted using the current sub-key. Symmetric encryption algorithms such as AES or SM4 can be used for encryption to ensure that the data is encrypted into ciphertext before leaving the station. The sub-keys used for each batch of data during transmission are independent, that is, even if the data stream is continuous, subsequent data blocks have different encryption protections due to different sub-keys, thus effectively reducing the risk of large-scale data leakage caused by single-point key leakage. After encryption, the preliminarily encrypted message data is output and enters the subsequent hierarchical re-encryption and confusion processing flow.

[0059] By dynamically generating sub-keys at regular intervals during the transmission of message data and performing preliminary encryption of the message data based on the sub-keys, it is possible to make the data transmitted within each time segment correspond to different encryption keys, significantly enhancing the dynamicity and anti-cracking ability of the encryption system and reducing the security risks caused by long-term use of keys. At the same time, even if an attacker intercepts the data within a certain time segment, the key obtained through brute force cracking or other means is only valid for that segment and cannot threaten the data security of other time periods, thus greatly enhancing the confidentiality and protection intensity of the overall message data during transmission.

[0060] S2: Obtain the context information of the message data, and based on the context information, classify the security level of the message data;

[0061] It should be noted that the context information refers to the auxiliary information related to the message data itself, such as data type, field name, field content, service label, transmission source, destination, data timestamp, etc., which are metadata that can reflect data semantics, importance, or application scenarios. The security level classification refers to the process of classifying the message data into different security protection levels according to its sensitivity. Common security levels include ordinary, sensitive, confidential, top-secret, core, etc., and different levels correspond to different encryption strategies and access permission controls.

[0062] Specifically, when transmitting message data, the message itself and its attached context information are first extracted. The acquisition of context information can be based on means such as protocol field parsing, service identifier recognition, source / destination address analysis, and data format judgment. By collecting multi-dimensional information such as data type, content summary, application domain identifier, access priority, etc., the application background, usage scenario, and possible sensitivity of the message data can be initially identified. The richness of the context information directly affects the accuracy and fineness of the subsequent sensitivity assessment.

[0063] Furthermore, after extracting sufficient context information, the message data is classified according to preset security level classification rules. The classification rules can be based on criteria such as keyword recognition (such as keywords related to user privacy, financial data, business secrets, etc.), data source credibility, data usage frequency, or manual annotation. According to the context characteristics, the corresponding security level is matched. For example, ordinary business logs are classified as "ordinary level", data containing personal identity information is classified as "sensitive level", important business instructions are classified as "confidential level", and so on. Through this context-aware classification method, different message data can obtain protection levels that match their sensitivities.

[0064] By obtaining the context information of the message data during the transmission process and performing security level classification based on the context information, the accurate identification and hierarchical management of data with different sensitivities can be achieved, enabling the system to flexibly formulate subsequent encryption and protection strategies according to the importance of the data, avoiding a one-size-fits-all encryption process for all data, enhancing the protection of high-sensitivity data, optimizing the use efficiency of system resources, and effectively enhancing the data security and protection effect in the overall communication process.

[0065] S3: Based on the classification result, determine the re-encryption strategy, and re-encrypt the initially encrypted message data based on the re-encryption strategy;

[0066] It should be noted that the classification result refers to the security level assigned to the message data after analyzing the context information, such as ordinary, sensitive, confidential, top-secret, or core level. The re-encryption strategy refers to the encryption scheme selected from the preset encryption algorithms and encryption parameter configurations according to the security level of the message data, including the encryption algorithm used, key length, encryption mode, etc., and is used to re-encrypt the already encrypted data to enhance security. The initially encrypted message data refers to the message data that has undergone the first round of encryption (encrypted based on dynamically generated sub-keys) and has not yet been re-encrypted according to the security level. Re-encryption refers to the process of performing a second round of encryption on the data according to different security level requirements based on the initial encryption to achieve hierarchical data protection.

[0067] Specifically, after completing the security level classification of the message data, according to the security level corresponding to each piece of message data, query the preset encryption policy mapping table to determine the re-encryption policy that matches this security level. The re-encryption policy usually includes selected encryption algorithms (such as AES-256, ChaCha20, SM4, SM9, etc.), key length settings, encryption modes (such as GCM, CBC, etc.), and related encryption parameters. For example, for data classified as "ordinary level", AES-128 can be used for fast re-encryption, while for "core level" data, the national encryption algorithm SM9 can be used with more stringent encryption parameters for enhanced protection. Through this matching process, it is ensured that data with different sensitivities obtains an encryption intensity suitable for its importance.

[0068] Furthermore, after determining the specific re-encryption policy, perform re-encryption processing on the preliminarily encrypted message data based on this policy. During the re-encryption process, double-layer symmetric encryption can be used, or a combination of symmetric encryption and asynchronous encryption can be used to further enhance the data protection intensity. During the encryption operation process, a new key or key derivation mechanism is used to ensure that the re-encryption key is independent of the sub-key of the preliminary encryption, preventing security risks brought by key reuse. After re-encryption is completed, the generated message data has double encryption protection and enters the subsequent structure obfuscation processing link, thereby effectively enhancing the overall security in the data transmission link.

[0069] By determining the re-encryption policy based on the security level classification result of the message data and re-encrypting the preliminarily encrypted message data according to the re-encryption policy, it is possible to flexibly match the encryption intensity according to the sensitivity of the data, achieve differential protection, thereby enhancing the protection effect on highly sensitive data while ensuring the transmission efficiency; at the same time, the re-encryption step forms a multi-layer encryption link. Even if a certain encryption layer is cracked, it is difficult for attackers to directly obtain the original data, greatly improving the overall anti-cracking ability and security protection level of the communication data.

[0070] S4: Perform structure obfuscation processing on the re-encrypted message data to obtain the target encrypted message data.

[0071] It should be noted that the re-encrypted message data refers to the message data that has completed preliminary encryption and re-encryption processing based on the security level, and has a high encryption intensity but still maintains the original structural characteristics. Structure obfuscation processing refers to the process of disturbing, reorganizing, or randomizing the internal field order, field length, time characteristics, etc. of the message data, making the overall structural characteristics of the message unpredictable and difficult to crack through traffic analysis or feature recognition. The target encrypted message data refers to the final ciphertext message after structure obfuscation processing, which has high confidentiality and anti-traffic analysis capabilities and can be directly used for network transmission.

[0072] Specifically, after re-encryption is completed, the system performs a structure obfuscation operation on the encrypted message data. First, for the information of each field inside the message, the system determines a new field arrangement order based on a pseudo-random number generator, thereby disrupting the originally fixed field order characteristics of the message. Subsequently, according to the original length of the message, a certain number of padding data is randomly inserted into each message, causing the total length of the message to have a random fluctuation within a certain percentage range (such as ±20%) based on the original length. In addition, to further enhance the anti-analysis ability, a slight perturbation can also be introduced to the timestamp field in the message, such as a random jitter of ±500 microseconds, thereby destroying the consistency of the time characteristics.

[0073] Furthermore, after field reorganization, length perturbation, and timestamp jitter are completed, the generated new message is the target encrypted message data. This target encrypted message no longer retains the original order rule, length pattern, and time characteristics in terms of structure. Even if the content of the message itself has been encrypted, it is difficult for an attacker to infer the data type, data flow rule, or launch traffic replay and traffic correlation attacks by observing the message structure characteristics. Through this layer of obfuscation processing, the target encrypted message data can effectively improve its concealment and anti-analysis ability during transmission, further strengthening the overall communication security.

[0074] By performing structure obfuscation processing on the re-encrypted message data, it is possible to effectively disrupt the field order, length characteristics, and time characteristics of the message data, destroy the recognizable pattern formed during data transmission, and thus significantly improve the anti-traffic analysis ability and anti-attack ability of the data during transmission; even if an attacker can intercept the encrypted message data, it is difficult to crack or infer through analyzing the data structure or transmission rule, effectively enhancing the concealment and overall security of the communication data in a complex network environment.

[0075] In this embodiment, during the transmission process of the message data, a sub-key is dynamically generated based on the session security parameter and the preset time interval, and the message data is preliminarily encrypted based on the sub-key to obtain the preliminarily encrypted message data; the context information of the message data is obtained, and based on the context information, the message data is classified according to the security level; based on the classification result, a re-encryption strategy is determined, and the preliminarily encrypted message data is re-encrypted based on the re-encryption strategy; a structure obfuscation process is performed on the re-encrypted message data to obtain the target encrypted message data. In this embodiment, by dynamically generating a sub-key based on the preset time interval and performing preliminary encryption during the transmission process of the message data, the risk of key exposure is reduced, and the confidentiality of data transmission is improved; by obtaining the context information of the message data and classifying it according to the security level, differential protection of the data is achieved; based on the classification result, a re-encryption strategy is determined and re-encryption processing is performed, further enhancing the security protection of sensitive data; by performing structure obfuscation on the re-encrypted message data, attack means such as traffic analysis are effectively resisted, and the security protection effect of the message data is improved.

[0076] Based on the above first embodiment, a second embodiment of the method for improving the security of message data in this application is proposed. Please refer to Figure 2 , Figure 2 which is a schematic diagram of a sub-process in the second embodiment of the method for improving the security of message data in this application.

[0077] As Figure 2 shown, in this embodiment, after step S4, it further includes:

[0078] S4a: Verifying the integrity of the message of each node of the target encrypted message data based on a distributed checksum mechanism;

[0079] S4b: Performing identity authentication between the sender and the receiver based on a zero-knowledge proof protocol;

[0080] S4c: If both the message integrity verification and the identity authentication pass, sending the target encrypted message data to the receiver.

[0081] It should be noted that the distributed checksum mechanism refers to a mechanism for generating, storing, and verifying checksum codes on multiple transmission nodes, which is used to ensure the integrity of message data during multi-node transmission, that is, it can detect whether the data has been tampered with or lost during transmission. The target encrypted message data refers to the final ciphertext data after preliminary encryption, re-encryption, and structure confusion processing, which has high confidentiality and anti-analysis properties. The zero-knowledge proof protocol is a cryptographic protocol that allows one party (the prover) to prove to another party (the verifier) that a certain statement is correct without revealing any information other than the fact that "the statement is correct", which is used to achieve high-security identity authentication. Identity authentication is the process of verifying the authenticity of the identities of both communication parties in a communication system to ensure that both the data sender and the receiver are legitimate entities and prevent identity theft or man-in-the-middle attacks.

[0082] Specifically, during the transmission of the target encrypted message data, based on the distributed checksum mechanism, the integrity of the message is verified for each network node passed through. Specifically, when the data is generated or leaves the sender, a unique checksum code (such as a digest value generated based on a hash algorithm) is generated for the message data, and this checksum code is synchronously stored on multiple relay nodes. When the message reaches any node, the node recalculates the checksum code of the received message data according to a preset rule and compares it with the stored correct checksum code. If the two are the same, it is confirmed that the data has not been tampered with during the transmission process before this node; if they are different, an exception handling is immediately triggered to prevent the tampered data from continuing to spread. By performing verification at the multi-node level, the problem of data tampering or loss can be discovered and located in a timely manner, improving the reliability of the overall transmission process.

[0083] Furthermore, to ensure the legitimacy of the identities of both communication parties and the security of data exchange, an identity authentication mechanism based on zero-knowledge proof is established between the sender and the receiver. Before establishing a connection for data transmission, the sender proves to the receiver that it holds a legitimate identity credential through a zero-knowledge proof protocol without exposing the specific content of the credential during the authentication process. The receiver confirms the validity of the sender's identity through the verification process without receiving specific sensitive information. After successful identity authentication, the two parties officially establish a secure communication link. If the integrity check also passes, the target encrypted message data is sent to the receiver; if the verification fails, the data interaction is rejected. By adopting the zero-knowledge proof protocol, not only is the security of identity authentication guaranteed, but also the potential attack risks caused by credential leakage are avoided, further strengthening the security protection ability of the communication system. It should be noted that the execution subject of this embodiment receives data from the sender and then sends the target message data to the receiver.

[0084] This step performs integrity verification on the target encrypted message data at each node through a distributed checksum mechanism, which can detect and prevent data tampering and loss in real time during the transmission process, ensuring the consistency and reliability of data in a complex network environment; by performing identity authentication between the sender and the receiver based on the zero-knowledge proof protocol, high-security authentication of both communication parties is achieved without exposing sensitive identity information, effectively resisting man-in-the-middle attacks and identity theft attacks, thereby further enhancing the overall security and credibility during the transmission process of the message data.

[0085] Based on the above first embodiment, in this embodiment, before step S1, it further includes:

[0086] S1a: Generate a key pair based on the elliptic curve key exchange algorithm and perform public key exchange;

[0087] S1b: Determine the shared key material according to the key pair and the public key exchange result, and generate a session key based on the shared key material;

[0088] S1c: Initialize the session security parameters based on the session key, where the session security parameters include encryption algorithms, encryption modes, and sub-key derivation rules.

[0089] It should be noted that the elliptic curve key exchange algorithm is a key exchange method based on elliptic curve cryptography (ECC), such as ECDH (Elliptic Curve Diffie-Hellman), which has high security and a small key length. A key pair refers to a set of keys consisting of a private key and the corresponding public key, where the private key is kept secret and the public key can be publicly transmitted. Public key exchange refers to the process in which two communicating parties exchange their respective public keys, which serves as the basis for subsequent calculation of the shared key material. The shared key material refers to the intermediate key data generated through elliptic curve point operations based on the local private key and the other party's public key, and is used to derive the session key. The session key refers to the key generated from the shared key material and is only temporarily used in a single communication session for encrypting and protecting the data transmission of that session. The session security parameters refer to the encryption configurations used in conjunction with the session key, including the type of encryption algorithm, encryption mode (such as GCM, CBC), and sub-key derivation rules, etc., which are used to guide the entire encrypted communication process.

[0090] Specifically, in the communication initialization phase, first, operations based on the elliptic curve key exchange algorithm are performed, including generating a local key pair and conducting public key exchange. Specifically, each party generates a pair of private and public keys and exchanges their respective public keys through a secure channel. After the public key exchange is completed, based on the local private key and the received public key, the shared key material is calculated through elliptic curve mathematical operations. Subsequently, based on this shared key material and in combination with a preset key derivation function, a dedicated session key for this communication session is generated.

[0091] Furthermore, after successfully generating the session key, the initialization settings of the session security parameters are further completed based on the session key. The session security parameters include the selected encryption algorithms (such as AES-256, ChaCha20, SM4, etc.), encryption modes (such as the GCM mode to achieve integration of encryption and authentication), and sub-key derivation rules (such as deriving new sub-keys every 100 ms). The initialization of these parameters provides a standardized secure configuration environment for dynamically generating sub-keys based on time intervals and encrypting message data subsequently, ensuring that the data transmission during the session has unified, reliable, and high-strength encryption protection.

[0092] By generating a key pair through the elliptic curve key exchange algorithm and conducting public key exchange, calculating the shared key material by combining the local private key and the other party's public key, and generating the session key based on the shared key material, secure and efficient key negotiation can be achieved in the communication initialization phase; further, by initializing the session security parameters based on the session key, including the encryption algorithm, encryption mode, and sub-key derivation rules, a unified and trustworthy secure configuration is provided for subsequent data encryption, key dynamic update, and data integrity protection, thus significantly enhancing the confidentiality, integrity, and anti-attack ability of the communication data transmission.

[0093] In the process of transmitting message data in this embodiment, a sub-key is dynamically generated based on session security parameters and a preset time interval, and the message data is preliminarily encrypted based on the sub-key to obtain preliminarily encrypted message data; the context information of the message data is obtained, and based on the context information, the security level of the message data is divided; based on the division result, a re-encryption strategy is determined, and the preliminarily encrypted message data is re-encrypted based on the re-encryption strategy; the re-encrypted message data is subjected to structure obfuscation processing to obtain target encrypted message data. In this embodiment, by dynamically generating a sub-key based on a preset time interval and performing preliminary encryption during the transmission of message data, the risk of key exposure is reduced, and the confidentiality of data transmission is improved; by obtaining the context information of the message data and performing security level division, differential protection of data is achieved; based on the division result, a re-encryption strategy is determined and re-encryption processing is performed, further enhancing the security protection of sensitive data; by performing structure obfuscation on the re-encrypted message data, attack means such as traffic analysis are effectively resisted, and the security protection effect of the message data is improved.

[0094] Based on the above second embodiment, a third embodiment of the method for improving the security of message data in this application is proposed. Please refer to Figure 3 , Figure 3 which is a schematic diagram of a sub-process in the third embodiment of the method for improving the security of message data in this application.

[0095] In this embodiment, step S4 includes:

[0096] S41: Insert a random padding field with a preset length range into the re-encrypted message data to obtain padded message data;

[0097] S42: Recombine the field order of the padded message data based on a pseudo-random number to obtain recombined message data;

[0098] S43: Add a preset jitter value to the message timestamp of the recombined message data to obtain the target encrypted message data.

[0099] It should be noted that random padding fields refer to data segments artificially inserted into message data, with randomly generated content and lengths varying within a preset range, having no actual business meaning, and are used to disrupt the length characteristics of messages and increase uncertainty. Pseudo-random numbers refer to approximately random number sequences generated by algorithms, which have randomness in a statistical sense but can be generated by specific seed values, are controllable and reproducible, and are used for encryption and data perturbation operations. Field order rearrangement refers to the operation of rearranging the internal fields of a message based on pseudo-random numbers, disrupting the original logical arrangement and enhancing the anti-inference and anti-traffic analysis capabilities. The timestamp jitter value refers to a randomly perturbed amount within a certain range added to the original timestamp, used to destroy the time regularity characteristics of data transmission and increase traffic concealment. The target encrypted message data refers to the final message data after a series of structure obfuscation processes such as padding, rearrangement, and timestamp perturbation, having higher concealment and anti-attack capabilities.

[0100] Specifically, in the re-encrypted message data, a certain amount of padding fields are randomly generated according to a preset length range (such as ±20% of the total length). These padding fields can be random data blocks inserted at different positions in the message, aiming to increase the uncertainty of the overall length of the message and make the size distribution among messages lose regularity. Subsequently, based on a set of random number sequences generated by a pseudo-random number generator, the internal fields of the padded message data are rearranged, that is, the field order is rearranged. By disrupting the originally fixed field order, the structural characteristics of the message become unpredictable, making it difficult for traditional traffic analysis techniques based on field recognition to effectively infer data content and service types.

[0101] Furthermore, after the field rearrangement is completed, a jitter value within a preset range is introduced to the timestamp field of each rearranged message data. For example, on the basis of the original timestamp, a randomly selected small time offset (such as ±500 microseconds) is added, making the sending time of the message show a certain degree of randomness. This small but unpredictable time perturbation can effectively destroy the time series characteristics of data transmission and increase the difficulty for traffic analysts to infer data patterns through time correlation. After completing the above steps, the generated is the target encrypted message data, whose structure, length, and time characteristics are all disrupted, having a high degree of concealment and anti-attack capabilities.

[0102] By inserting random padding fields into the re-encrypted message data, rearranging the field order based on pseudo-random numbers, and adding a jitter value to the timestamp, it can effectively destroy the length characteristics, structural regularity, and time characteristics of the message, greatly enhancing the concealment and unpredictability of the message during transmission, making traditional traffic analysis, feature matching, and time correlation attack methods ineffective, thus significantly enhancing the anti-attack capabilities of the data transmission link and the overall communication security level.

[0103] Based on the above-mentioned second embodiment, in this embodiment, step S2 includes:

[0104] S21: Obtain the context information of the message data, where the context information includes field type, field content, data source, and service identifier;

[0105] S22: Analyze the context information based on a preset sensitivity evaluation rule to obtain a sensitivity score;

[0106] S23: Based on the sensitivity score, combine with a preset security level classification strategy to classify the security level of the message data.

[0107] It should be noted that the field type refers to the types of each data field in the message data, such as text field, numerical field, encrypted field, control field, etc., which are used to describe the data characteristics of the field itself. The field content refers to the information actually carried in the message data field, such as specific data like username, password, transaction amount, etc. The data source refers to the information of the device, system, service, or network node that generates or sends the message data, which is used to judge the credibility and sensitivity of the data. The service identifier refers to the identifier information that can reflect the service type or scenario to which the message data belongs, such as login authentication, payment transaction, configuration update, etc., which is used to assist in evaluating the importance of the data. The preset sensitivity evaluation rule refers to a set of rules formulated in advance for analyzing the sensitivity of message data based on context information, including criteria such as field feature recognition, content feature detection, and source credibility judgment. The sensitivity score refers to the quantitative or grading evaluation result of the sensitivity obtained by analyzing the message data based on the sensitivity evaluation rule. The preset security level classification strategy refers to the strategy and standard system preset for classifying the message data into different security levels (such as ordinary, sensitive, confidential, top-secret, core) based on the sensitivity score.

[0108] Specifically, during the message data processing process, first extract the context information related to the message data, including but not limited to field type (such as whether it contains an authentication field), field content (such as whether it involves personal privacy or financial data), data source (such as whether it comes from a trusted internal network), and service identifier (such as whether it belongs to a high-risk transaction service). Based on the obtained context information, apply the preset sensitivity evaluation rule to analyze and evaluate each message data. During the evaluation process, a comprehensive score can be given according to factors such as the presence or absence of specific fields, matching of field content with sensitive keywords, and the trusted level of the data source, so as to obtain the corresponding sensitivity score for quantifying the potential sensitivity of the data.

[0109] Further, after obtaining the sensitivity score, the security level of the message data is further classified according to a preset security level classification strategy. The classification strategy usually defines the security levels corresponding to different sensitivity score ranges. For example, sensitivity scores from 0 to 20 are classified as "ordinary level", 21 to 40 are classified as "sensitive level", 41 to 60 are classified as "confidential level", etc. Each piece of message data is automatically assigned to the corresponding security level based on the score, providing a basis for subsequent encryption processing, access control, and security policy matching, and achieving the goal of precisely protecting data according to its sensitivity.

[0110] By obtaining the context information of the message data and analyzing it based on the preset sensitivity evaluation rules to obtain the sensitivity score, and then combining the preset security level classification strategy to classify the security level of the message data, it is possible to realize the automatic identification and fine classification of data sensitivity, so that data with different sensitivities can adopt differential protection measures according to their importance, thereby avoiding resource waste or insufficient protection caused by uniformly encrypting all data, and effectively improving the data security and transmission protection level of the overall system.

[0111] Based on the above second embodiment, in this embodiment, step S3 includes:

[0112] S31: Based on the classification result, in combination with a preset mapping relationship set between security levels and encryption algorithms, determine the target encryption algorithm and encryption parameters, where the target encryption algorithm includes one or more of AES-256, ChaCha20, SM4, or SM9;

[0113] S32: Generate the re-encryption strategy based on the target encryption algorithm and encryption parameters;

[0114] S33: Re-encrypt the initially encrypted message data based on the re-encryption strategy.

[0115] It should be noted that the preset mapping relationship set between encryption algorithms refers to a preset relationship table that maps different security levels to the corresponding encryption algorithms and parameters, and is used to guide the selection of encryption algorithms and parameters. The target encryption algorithm is the encryption algorithm selected according to the security level and the mapping relationship, including one or more of AES-256, ChaCha20, SM4, or SM9. Encryption parameters refer to the specific configuration parameters used in conjunction with the encryption algorithm, such as key length, encryption mode (such as GCM, CBC), initialization vector (IV) generation method, etc. The re-encryption strategy refers to a secondary encryption execution plan formulated by integrating the target encryption algorithm and encryption parameters, and is used to further encrypt the initially encrypted message data. The initially encrypted message data refers to the message data that has completed the first encryption process based on the dynamic sub-key.

[0116] Specifically, after completing the security level classification of the message data, based on the preset mapping relationship set between the security level and the encryption algorithm, the target encryption algorithm corresponding to the current data security level and the required encryption parameters are retrieved. For example, for "sensitive" data, the AES-256 algorithm can be selected, and a 256-bit key length and the GCM encryption mode can be set; for "core" data, the national cipher SM9 algorithm can be selected, and a specific key exchange and signature mechanism can be adopted. After determining the target encryption algorithm and encryption parameters, a re-encryption policy is generated based on this information, clarifying the specific encryption process, key management method, and execution details, providing a standardized guide for subsequent re-encryption operations.

[0117] Further, according to the generated re-encryption policy, the initially encrypted message data is re-encrypted. The re-encryption process uses the target encryption algorithm and the supporting encryption parameters to ensure that the encryption process meets the set strength and security requirements. Re-encryption not only forms a double-layer protection structure but also adopts an adaptive encryption policy according to the data sensitivity, applying a stronger encryption algorithm and complex parameter settings for highly sensitive data, thereby further enhancing the confidentiality and anti-attack ability of the data during transmission. After re-encryption, the data will enter the subsequent structure obfuscation processing stage to further improve the overall security protection effect.

[0118] By classifying the security level of the message data, determining the target encryption algorithm and encryption parameters in combination with the preset mapping relationship set between the security level and the encryption algorithm, and generating a re-encryption policy based on the target encryption algorithm and parameters to re-encrypt the initially encrypted message data, it is possible to flexibly match different encryption intensities and protection measures according to the data sensitivity, realize a differentiated and higher-security data protection mechanism, thereby significantly enhancing the protection ability of the overall communication system for sensitive data, effectively resisting various attack threats, and improving the confidentiality and integrity of data transmission.

[0119] In this embodiment, during the transmission process of message data, a sub-key is dynamically generated based on session security parameters and a preset time interval, and the message data is preliminarily encrypted based on the sub-key to obtain preliminarily encrypted message data; the context information of the message data is obtained, and based on the context information, the security level of the message data is divided; based on the division result, a re-encryption strategy is determined, and the preliminarily encrypted message data is re-encrypted based on the re-encryption strategy; the structure of the re-encrypted message data is obfuscated to obtain target encrypted message data. By dynamically generating a sub-key based on a preset time interval and performing preliminary encryption during the transmission process of message data in this embodiment, the risk of key exposure is reduced, and the confidentiality of data transmission is improved; by obtaining the context information of the message data and dividing the security level, differential protection of data is achieved; based on the division result, a re-encryption strategy is determined and re-encryption processing is performed, further enhancing the security protection of sensitive data; by obfuscating the structure of the re-encrypted message data, attacks such as traffic analysis are effectively resisted, and the security protection effect of the message data is improved.

[0120] In one embodiment, in order to further improve the security protection ability of message data in a complex network environment, based on the basic principle of this application, this embodiment proposes an improved method for improving the security of message data. On the basis of the original dynamic sub-key encryption, hierarchical re-encryption and structure obfuscation processing, a chained re-encryption protection mechanism and a context dynamic weight adjustment mechanism are further introduced to achieve a higher-strength security protection effect.

[0121] First, when establishing a communication connection, the sender and the receiver dynamically negotiate and generate a session key based on the elliptic curve key exchange algorithm and initialize the session security parameters. Subsequently, during the transmission process of message data, a sub-key is dynamically generated at a fixed time interval, and the message data is preliminarily encrypted based on the current sub-key.

[0122] When extracting context information and evaluating sensitivity, this embodiment introduces a dynamic weight adjustment mechanism, that is, the sensitivity weights of different context information items are dynamically adjusted according to changes in the network environment, changes in the service type, or attack risk assessment. For example, in a high-risk detection environment, the weight of personal privacy information involved in the field content is increased, while in an internal trusted network environment, the weight of the source information is correspondingly reduced, so as to achieve a more flexible and accurate sensitivity score and improve the classification accuracy.

[0123] Based on the sensitivity score and the security level division strategy, determine the target encryption algorithm and encryption parameters, and generate a re-encryption strategy. On the basis of preliminary encryption, perform chained re-encryption processing using the target encryption algorithm: for the same message data, use at least two different encryption algorithms according to the security level to form a multi-layer encryption link. For example, first use AES-256 for the first round of encryption, and then use SM9 for the second round of encryption, ensuring that even if some encryption layers are damaged by attackers, the message content is still in a protected state, greatly enhancing the ability to resist multi-round cracking attacks.

[0124] After completing the chained re-encryption, perform structure obfuscation processing based on a pseudo-random number generator, specifically including: inserting random-length padding fields into the message data, shuffling the field order, and introducing a jitter value within a preset range into the timestamp field to destroy the structural characteristics, length characteristics, and time characteristics of the message data, and improve the ability to resist traffic analysis and traffic replay attacks.

[0125] In addition, during the transmission of the message data, introduce integrity verification based on the distributed checksum mechanism to ensure that each hop node can detect the data tampering risk in real time, and implement secure identity authentication between the sender and the receiver through the zero-knowledge proof protocol, effectively preventing man-in-the-middle attacks and forged identity attacks.

[0126] Through the above implementation manners, the present invention can synergistically improve the overall security protection ability of data transmission at multiple levels such as dynamic key protection, context sensitivity recognition, hierarchical chained encryption, message structure perturbation, and full-link integrity verification and identity authentication, and is applicable to communication scenarios with high requirements for data security.

[0127] The embodiment of the present application also provides a device for improving the security of message data. Please refer to Figure 4 , Figure 4 which is a schematic diagram of the module structure of the device for improving the security of message data in the embodiment of the present application. The device for improving the security of message data includes:

[0128] A preliminary encryption module 401, configured to dynamically generate a sub-key based on the session security parameter and a preset time interval during the transmission of the message data, and perform preliminary encryption on the message data based on the sub-key to obtain preliminary encrypted message data;

[0129] A level division module 402, configured to obtain the context information of the message data, and perform security level division on the message data based on the context information;

[0130] A re-encryption module 403, configured to determine a re-encryption strategy based on the division result, and perform re-encryption on the preliminary encrypted message data based on the re-encryption strategy;

[0131] The target module 404 is used to perform structure obfuscation processing on the re-encrypted message data to obtain the target encrypted message data.

[0132] The message data security enhancement device provided by the embodiment of the present application adopts the message data security enhancement method in the above embodiment, and can solve the technical problem of how to improve the security protection effect of message data. Compared with the prior art, the beneficial effects of the message data security enhancement device provided by the embodiment of the present application are the same as those of the message data security enhancement method provided by the above embodiment, and other technical features in the message data security enhancement device are the same as the features disclosed in the method of the above embodiment, which will not be elaborated here.

[0133] The present application provides a message data security enhancement device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the message data security enhancement method in the above embodiment.

[0134] Next, refer to Figure 5 , Figure 5 FIG. is a schematic structural diagram of a device for the hardware operating environment related to the message data security enhancement method in the embodiment of the present application, which shows a schematic structural diagram of a device suitable for implementing the message data security enhancement device in the embodiment of the present application. Figure 5 The shown message data security enhancement device is only an example, and should not bring any limitation to the functions and usage scope of the embodiment of the present application.

[0135] Such as Figure 5As shown, the device for enhancing the security of message data may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM: Read Only Memory) 1002 or the program loaded from the storage device 1003 into the random access memory (RAM: Random Access Memory) 1004. In the RAM 1004, various programs and data required for the operation of the device for enhancing the security of message data are also stored. The processing device 1001, the ROM 1002, and the RAM 1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems may be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the device for enhancing the security of message data to communicate with other devices wirelessly or wiredly to exchange data. Although the figure shows a device for enhancing the security of message data with various systems, it should be understood that it is not required to implement or have all the shown systems. More or fewer systems may be implemented or had alternatively.

[0136] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program codes for executing the methods shown in the flowcharts. When the computer program is executed by the processing device 1001, the above functions defined in the methods of the embodiments disclosed in the present application are executed.

[0137] The device for enhancing the security of message data provided by the present application adopts the method for enhancing the security of message data in the above embodiments, and can solve the technical problem of how to improve the security protection effect of message data. Compared with the prior art, the beneficial effects of the device for enhancing the security of message data provided by the present application are the same as those of the method for enhancing the security of message data provided by the above embodiments, and the other technical features in the device for enhancing the security of message data are the same as the features disclosed in the method of the previous embodiment, and will not be elaborated here.

[0138] It should be understood that each part disclosed in this application can be implemented by hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in a suitable manner in any one or more embodiments or examples.

[0139] As described above, the above is only the specific implementation manner of this application, but the protection scope of this application is not limited thereto. Any person skilled in the art within the technical scope disclosed in this application can easily think of changes or substitutions, which should all be covered by the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

[0140] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., computer programs) stored thereon, and the computer-readable program instructions are used to execute the method for improving the security of message data in the above embodiments.

[0141] The above computer-readable storage medium carries one or more programs. When the above one or more programs are executed by a message data security improvement device, the message data security improvement device: during the transmission process of message data, dynamically generate a sub-key based on a preset time interval, and perform preliminary encryption on the message data based on the sub-key to obtain preliminary encrypted message data; obtain the context information of the message data, and based on the context information, perform a security level division on the message data; based on the division result, determine a re-encryption strategy, and perform re-encryption on the preliminary encrypted message data based on the re-encryption strategy; perform a structure obfuscation process on the re-encrypted message data to obtain target encrypted message data. Computer program code for performing the operations of this application can be written in one or more programming languages or combinations thereof. The above programming languages include object-oriented programming languages - such as Java, Smalltalk, C++, and also include conventional procedural programming languages - such as the "C" language or similar programming languages. The program code can be executed completely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network - including a local area network (LAN: Local Area Network) or a wide area network (WAN: Wide Area Network), or can be connected to an external computer (for example, by using an Internet service provider to connect through the Internet).

[0142] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a segment of a program, or a part of code that contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than that marked in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as combinations of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer instructions.

[0143] The modules described in the embodiments of the present application can be implemented in software or in hardware. In some cases, the name of the module does not constitute a limitation on the unit itself.

[0144] The readable storage medium provided by the present application is a computer-readable storage medium that stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned method for enhancing the security of message data, and can solve the technical problem of how to improve the security protection effect of message data. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as those of the method for enhancing the security of message data provided by the above embodiments, and will not be elaborated here.

[0145] An embodiment of the present application provides a computer program product, including a computer program, and when the computer program is executed by a processor, it implements the steps of the method for enhancing the security of message data as described above.

[0146] The computer program product provided by the present application can solve the technical problem of how to improve the security protection effect of message data. Compared with the prior art, the beneficial effects of the computer program product provided by the embodiments of the present application are the same as those of the method for enhancing the security of message data provided by the above embodiments, and will not be elaborated here.

[0147] The above are only the preferred embodiments of the present application, and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the specifications and drawings of the present application, or directly or indirectly applied to other related technical fields, shall be included in the patent scope of the present application by the same token.

Claims

1. A method for enhancing the security of message data, characterized in that, The method includes: During the transmission of the message data, a sub-key is dynamically generated based on the session security parameters and a preset time interval, and the message data is preliminarily encrypted based on the sub-key to obtain preliminarily encrypted message data; Obtain the context information of the message data, and based on the context information, perform a security level division on the message data; Based on the division result, determine a re-encryption policy, and re-encrypt the preliminarily encrypted message data based on the re-encryption policy; Perform a structure obfuscation process on the re-encrypted message data to obtain target encrypted message data.

2. The method according to claim 1, characterized in that Before the step of dynamically generating a sub-key based on the session security parameters and a preset time interval during the transmission of the message data, and preliminarily encrypting the message data based on the sub-key to obtain preliminarily encrypted message data, it further includes: Generate a key pair based on the elliptic curve key exchange algorithm and perform public key exchange; According to the key pair and the public key exchange result, determine the shared key material, and generate a session key based on the shared key material; Based on the session key, initialize the session security parameters, where the session security parameters include an encryption algorithm, an encryption mode, and a sub-key derivation rule.

3. The method according to claim 1, wherein After the step of performing a structure obfuscation process on the re-encrypted message data to obtain target encrypted message data, it further includes: Verify the message integrity of each node of the target encrypted message data based on the distributed checksum mechanism; Perform identity authentication between the sender and the receiver based on the zero-knowledge proof protocol; If both the message integrity verification and the identity authentication pass, send the target encrypted message data to the receiver.

4. The method according to claim 1, wherein The step of performing a structure obfuscation process on the re-encrypted message data to obtain target encrypted message data includes: Insert a random padding field with a preset length range into the re-encrypted message data to obtain padded message data; Recombine the field order of the padded message data based on a pseudo-random number to obtain recombined message data; Add a preset jitter value to the message timestamp of the recombined message data to obtain target encrypted message data.

5. The method according to claim 1, characterized in that, The step of obtaining the context information of the message data, and based on the context information, performing a security level division on the message data includes: Obtain the context information of the message data, where the context information includes field type, field content, data source, and service identifier; Analyze the context information based on a preset sensitivity evaluation rule to obtain a sensitivity score; Based on the sensitivity score, in combination with a preset security level division policy, perform a security level division on the message data.

6. The method according to claim 1, wherein The step of based on the division result, determine a re-encryption policy, and re-encrypt the preliminarily encrypted message data based on the re-encryption policy includes: Based on the division result, in combination with a preset security level and encryption algorithm mapping relationship set, determine a target encryption algorithm and encryption parameters, where the target encryption algorithm includes one or more of AES-256, ChaCha20, SM4, or SM9; Based on the target encryption algorithm and encryption parameters, generate the re-encryption policy; Re-encrypt the preliminary encrypted message data based on the re-encryption policy.

7. A device for enhancing the security of message data, characterized in that The device includes: A preliminary encryption module, configured to dynamically generate a sub-key based on session security parameters and a preset time interval during the transmission of message data, and perform preliminary encryption on the message data based on the sub-key to obtain preliminary encrypted message data; A level classification module, configured to obtain context information of the message data, and perform security level classification on the message data based on the context information; A re-encryption module, configured to determine a re-encryption policy based on the classification result, and re-encrypt the preliminary encrypted message data based on the re-encryption policy; A target module, configured to perform structure obfuscation processing on the re-encrypted message data to obtain target encrypted message data.

8. A computer device, characterized in that, The device includes: a memory, a processor, and a message data security improvement program stored on the memory and executable on the processor, the message data security improvement program being configured to implement the steps of the message data security improvement method according to any one of claims 1 to 6.

9. A storage medium, characterized in that, A message data security improvement program is stored on the storage medium, and when the message data security improvement program is executed by a processor, it implements the steps of the message data security improvement method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a computer program, and when the computer program is executed by a processor, it implements the steps of the message data security improvement method according to any one of claims 1 to 6.

Images