Network communication dynamic encryption method, encryption and decryption system, equipment, media and products

Abstract

The present invention discloses a network communication dynamic encryption method, encryption and decryption system, device, medium, and product, relating to the field of communication technology. The method comprises: obtaining a dynamic factor through a Berkeley packet filter function, and generating a key based on the dynamic factor. The key generated based on the dynamic factor is highly random and unpredictable, thereby avoiding the problem of traditional encryption methods using fixed keys that make the key easily crackable. Furthermore, by utilizing the Berkeley packet filter function in the kernel execution environment, the risk of the key being stolen during transmission and storage is reduced, and the impact on network communication performance is minimal, thereby improving the network communication encryption efficiency and network communication security. Furthermore, by utilizing the network communication information itself as the basis for key generation, no additional key distribution and storage management processes are required, and no complex key exchange and certificate management mechanisms are required, thereby simplifying the key management process and reducing system operation and maintenance costs.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a network communication dynamic encryption method, encryption and decryption system, equipment, medium and product. Background Art

[0002] With the development of network communication technology, the security of data transmission has become crucial. Related encrypted communication methods (such as encryption schemes based on the SSL (Secure Sockets Layer) / TLS (Transport Layer Security) protocols and encryption schemes based on the IPSec (Internet Protocol Security) protocol) often use encryption algorithms and keys with fixed long-term or fixed rotation cycles, making them easy for attackers to analyze and crack. Furthermore, they require complex key exchange and certificate management mechanisms, and the additional overhead of negotiating keys is also significant. This can cause network delays, especially in scenarios with high-frequency short connections and small data packet transmission scenarios with high network transmission speed requirements. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a method, device, equipment and storage medium for dynamic encryption of network communications, which can improve the efficiency and security of network communication encryption and reduce operation and maintenance costs. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses a network communication dynamic encryption method, applied to a sending end, comprising:

[0005] Obtaining a key generation policy sent by a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm;

[0006] Utilize the Berkeley packet filter function pre-added in the kernel to intercept the data to be sent, and obtain a dynamic factor set according to the dynamic factor type;

[0007] Based on the dynamic factor set and the key generation algorithm, dynamically generating a target key through the Berkeley packet filter function, and encrypting the data to be sent using the target key to obtain encrypted data;

[0008] The encrypted data is sent to a receiving end; the receiving end pre-receives the same key generation policy as that of the sending end sent by the policy configuration server, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

[0009] In another aspect, the present application discloses a method for dynamic decryption of network communication, applied to a receiving end, comprising:

[0010] Obtaining a key generation policy sent by a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm;

[0011] The encrypted data sent by the sending end is intercepted by using a Berkeley packet filter function pre-added in the kernel, and a dynamic factor set is obtained according to the dynamic factor type; the sending end pre-receives a key generation policy identical to that of the receiving end and sent by the policy configuration server, so as to generate the same target key according to the key generation policy and encrypt the data to obtain the encrypted data;

[0012] Based on the dynamic factor set and the key generation algorithm, a target key is dynamically generated through the Berkeley packet filter function, and the encrypted data is decrypted using the target key to obtain decrypted data.

[0013] In another aspect, the present application discloses a network communication dynamic encryption and decryption system, comprising the aforementioned sending end, a policy configuration server, and a receiving end;

[0014] The policy configuration server is used to issue a key generation policy to the sending end and the receiving end;

[0015] The sending end encrypts the data to be sent by using the Berkeley packet filter function, and sends the encrypted data to the receiving end; the receiving end decrypts the encrypted data by using the Berkeley packet filter function.

[0016] In another aspect, the present application discloses an electronic device, comprising:

[0017] Memory, used to store computer programs;

[0018] The processor is used to execute the computer program to implement the aforementioned network communication dynamic encryption method or network communication dynamic decryption method.

[0019] On the other hand, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned network communication dynamic encryption method, or network communication dynamic decryption method.

[0020] In the present application, a key generation policy sent by a policy configuration server is obtained; the key generation policy includes a dynamic factor type and a key generation algorithm; the Berkeley packet filter function pre-added in the kernel is used to intercept the data to be sent, and a dynamic factor set is obtained according to the dynamic factor type; based on the dynamic factor set and the key generation algorithm, a target key is dynamically generated by the Berkeley packet filter function, and the target key is used to encrypt the data to be sent to obtain encrypted data; the encrypted data is sent to a receiving end; the receiving end pre-receives the same key generation policy as the sending end sent by the policy configuration server, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

[0021] The present invention has the following beneficial effects: a dynamic factor is obtained through a Berkeley packet filter function, and a key is generated based on the dynamic factor. This key generation based on the dynamic factor is highly random and unpredictable, thus avoiding the problem of traditional encryption methods using fixed keys that make the key easily crackable. Furthermore, by utilizing the Berkeley packet filter function's kernel-mode execution environment, the risk of key theft during transmission and storage is reduced, while minimizing the impact on network communication performance, thereby improving network communication encryption efficiency and security. Furthermore, a policy configuration server uniformly sends key generation policies, utilizing network communication information itself as the basis for key generation. This eliminates the need for additional key distribution and storage management processes, and eliminates the need for complex key exchange and certificate management mechanisms, thereby simplifying the key management process and reducing system operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0023] Figure 1 A flow chart of a network communication dynamic encryption method provided by this application;

[0024] Figure 2 A schematic diagram of Berkeley packet filter function mounting provided by this application;

[0025] Figure 3 A flow chart of a network communication dynamic decryption method provided by this application;

[0026] Figure 4 A schematic diagram of the structure of a specific network communication dynamic encryption and decryption system provided by this application;

[0027] Figure 5 This is a flowchart of a specific network communication dynamic encryption and decryption method provided by this application. DETAILED DESCRIPTION

[0028] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0029] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0030] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0031] In conjunction with the specific application environment architecture or specific hardware architecture on which the execution of the network communication dynamic encryption method depends, the specific application environment architecture or specific hardware architecture is described here.

[0032] In related technologies, key generation in the SSL / TLS protocol scheme relies on complex key exchange protocols and certificate management mechanisms, such as public key distribution and certificate verification processes. This not only increases system overhead but also complicates key management, making key leakage and management difficult. Frequent handshake negotiations in high-frequency, short-term connection scenarios introduce additional overhead. Furthermore, the encryption algorithm is relatively fixed. Once the encryption algorithm is negotiated and determined, it is difficult to dynamically adjust the encryption algorithm and key according to actual needs during the communication process, making it impossible to flexibly adapt to different security levels and performance requirements. In IPSec-based encryption schemes, key updates rely on periodic protocol negotiations, and attackers can deduce the encryption mode through long-term traffic analysis.

[0033] The present application discloses a method for dynamic encryption of network communication, which is applied to the sending end. Figure 1 As shown, the method may include the following steps:

[0034] Step S11: Acquire the key generation policy sent by the policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm.

[0035] The sender obtains the key generation policy issued by the policy configuration server. The key generation policy includes a dynamic factor type and a key generation algorithm. The dynamic factor type contains specific parameter types, such as a quintuple and a timestamp. The sender then extracts the quintuple and timestamp information based on the dynamic factor type. Key generation algorithms are used to generate keys and include, but are not limited to, multi-factor hashing, hierarchical hashing, chaotic mapping (such as logistic chaotic mapping), and time window dynamic key algorithms. This embodiment does not limit the key generation algorithm; any algorithm that can achieve key generation can be used.

[0036] Obtaining the key generation policy includes: obtaining the key generation policy through a user-mode program; and saving the key generation policy to the shared memory space of the kernel's packet filter function; the shared memory space supports both kernel and user modes. User mode runs in a restricted environment, requesting kernel services through system calls to implement user applications; kernel mode runs in the operating system kernel space, has full access rights, and implements the system's core functions. The sender first obtains the key generation policy from the policy configuration server through a user-mode program, and then saves the key generation policy to the kernel, specifically to the shared memory space (eBPF Map) of the packet filter function; the shared memory space supports both kernel and user modes. It is understood that since subsequent key generation and data encryption are performed by the packet filter function in kernel mode, the key generation policy needs to be provided to the kernel.

[0037] The aforementioned dynamic factor types may further include, but are not limited to, network-layer factors, system-layer factors, and hardware-layer factors. This refers to a multi-dimensional dynamic factor fusion, combining factors from each layer. For example, network-layer factors include source / destination IP (Internet Protocol) and port numbers, protocol types (TCP (Transmission Control Protocol) / UDP (User Datagram Protocol)), etc.; system-layer factors include process PID (Process ID), thread CPU (Central Processing Unit) affinity, memory address characteristics, etc.; and hardware-layer factors include CPU serial numbers, etc. This multi-factor fusion mechanism enables context-aware key generation, enabling the same communication flow to generate completely different keys on different physical devices or operating environments.

[0038] Step S12: using the Berkeley packet filter function pre-added in the kernel to intercept the data to be sent, and obtaining a dynamic factor set according to the dynamic factor type.

[0039] The sending kernel pre-installed the Extended Berkeley Packet Filter (eBPF) function. eBPF is a powerful kernel technology that allows programs to run in kernel space, enabling efficient monitoring of network, storage, and system calls. With eBPF, developers can dynamically load and execute programs into the Linux kernel without modifying the kernel source code. eBPF provides security guarantees, ensuring that loaded code does not compromise system stability. This is achieved through the kernel's "verifier," which verifies the code for security before execution. As a result, eBPF operations are widely used in performance monitoring, network analysis, security, and other fields. Specifically, an eBPF program can be written using the eBPF toolchain. An eBPF function is defined to concatenate data, obtain dynamic factors, generate keys, and encrypt network packets before transmission.

[0040] The Berkeley packet filter function intercepts data to be sent, and when the data is intercepted, a dynamic factor set is obtained based on the dynamic factor type. It is understood that these dynamic factors can change over time or with changes in the terminal, so they are not static. The key generated from them is only used for this communication, and even if the key is leaked, it will not pose a threat to other communications. For example, the dynamic factor set can include any one or more of the following: network quintuple, process information (such as process context), timestamp, and hardware identification (such as hardware fingerprint). Furthermore, these dynamic factors are obtained in kernel mode and are related to network communication. This means that information about the network communication itself is used as the basis for key generation, eliminating the need for additional key distribution and storage management.

[0041] For example, network quintuple extraction involves extracting information from network packets, including the source IP address, destination IP address, source port, destination port, and protocol type, as a dynamic factor in key generation. This information is inherent in network communications, easily accessible, and unique. Process information is obtained through eBPF helper functions (such as bpf_get_current_pid_tgid), such as the current process's PID and thread ID (identity document), as another dynamic factor in key generation, increasing key complexity and unpredictability. The current timestamp is obtained and incorporated into the key generation process. The timestamp is a constantly changing value, providing strong support for key dynamics. Hardware identification can read hardware identification information, such as the CPU's unique identifier and MAC (Media Access Control Address). This information is highly unique and stable, further enhancing key security.

[0042] In this embodiment, before obtaining the key generation policy, the process further includes: mounting a Berkeley packet filter function into the kernel on the sending end. For example, the Berkeley packet filter function is mounted into the kernel's system call entry for sending network packets. Specifically, the Berkeley packet filter function and the mount point can be sent to a user-mode engine on the sending end, which then automatically mounts the function.

[0043] Step S13: Based on the dynamic factor set and the key generation algorithm, dynamically generate a target key through the Berkeley packet filter function, and use the target key to encrypt the data to be sent to obtain encrypted data.

[0044] After obtaining the dynamic factor set, the target key that meets the current communication is generated in combination with the key generation algorithm. After the key is generated, the Berkeley packet filter function will use the key to encrypt the data to be sent, obtain the encrypted data, and then send the encrypted data to the receiving end.

[0045] The following example illustrates a hierarchical hashing key generation algorithm based on timestamps and hardware features. To enhance key dynamics, a hierarchical hashing approach is used to generate the key using the network quintuple, timestamp, and hardware signature as input factors. For example, the sender obtains the network quintuple from the struct sk_buff structure (socket data buffer), concatenates the quintuple, and hashes it to produce hash value A. The hardware signature and timestamp are concatenated and hashed to produce hash value B. Hash values ​​A and B are then XORed to produce the final key, which changes over time. This way, even if the network quintuple and process information of the communicating parties remain unchanged for a short period of time, the key will be continuously updated due to changes in the timestamp, enhancing key security. That is, the dynamic factor set is obtained: def generate_key(five_tuple,pid,timestamp,hw_id); the first layer, the network five-tuple hash: layer1_hash=sha256(five_tuple); the second layer, the hardware identification + timestamp hash: layer2_hash=sha256(hw_id+currentTime); the final key, double hash XOR: returnbytes(layer1_hash^layer2_hash).

[0046] Key generation algorithms can be based on the combination and transformation of dynamic factors. These dynamic factors are combined, hashed, and XORed to generate an initial key. Chaotic mapping algorithms, such as logistic mapping, can use dynamic factors as initial conditions or control parameters to generate a key sequence with chaotic properties. Chaotic mapping is sensitive to initial values, exhibits good randomness, and exhibits strong ergodicity, thus enhancing the security and complexity of keys.

[0047] Step S14: sending the encrypted data to the receiving end; the receiving end pre-receives the same key generation policy as that of the sending end sent by the policy configuration server, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

[0048] When the policy configuration server sends the key generation policy to the sender, it also sends the key generation policy to the receiver. That is, the sender and the receiver have the same dynamic factor type and key generation algorithm so that the receiver can generate the above target key for decryption.

[0049] In a specific embodiment, after obtaining a dynamic factor set according to the dynamic factor type, the method further includes: grouping the dynamic factors in the dynamic factor set into general parameters and specific parameters; the general parameters are the same parameters at both the sending and receiving ends, and the specific parameters are different parameters at both the sending and receiving ends; adding identifiers to the specific parameters, and saving the dynamic factor set to the shared storage space of the packet filter function. Sending the encrypted data to the receiving end includes: sending the specific parameters in the dynamic factor set and the encrypted data to the receiving end; the specific parameters are different parameters at both the sending and receiving ends.

[0050] It's understandable that some dynamic factors are identical between the sender and receiver, such as the quintuple information. These factors are considered universal parameters. However, factors such as timestamp information are unique to the sender and receiver, and are considered special parameters. If these special parameters are included in the dynamic factors, they must also be sent to the receiver so that it can generate the target key.

[0051] This application uses the eBPF program to directly implement key generation and encryption and decryption operations at the bottom layer of the operating system kernel protocol stack, bypassing the performance bottleneck of traditional user-mode encryption libraries. This design shortens the key lifecycle and automatically rotates it. Even if the key is cracked, it cannot be used for subsequent data decryption, achieving forward security. Compared with the static trust model of the traditional TLS protocol that relies on a fixed certificate chain, this solution generates keys through a real-time dynamic factor combination, solving the long-term security risks caused by key fixation. In addition, the sender and receiver can generate the same key based on the preset key generation strategy, without the need for TLS-style handshake negotiation, reducing the connection establishment delay to 0.

[0052] The dynamic network communication encryption method disclosed in this application offers the following advantages: 1. High dynamism. It can dynamically generate keys based on the specific circumstances of each network communication (network quintuple, process information, etc.), avoiding the vulnerability of traditional encryption methods to fixed keys that are easily cracked. 2. Improved communication security. Dynamically generated keys are highly random and unpredictable. Combined with the kernel-mode execution environment of eBPF, this reduces the risk of key theft during transmission and storage. Furthermore, due to the dynamic nature of encryption algorithms and keys, attackers are less likely to conduct long-term attacks targeting specific encryption algorithms or keys, effectively improving the security of network communications. 3. Reduced key management complexity. Compared to the complex key exchange and certificate management mechanisms used in traditional encryption technologies, this method utilizes network communication information as the basis for key generation, eliminating the need for additional key distribution and storage management, simplifying the key management process and reducing system operation and maintenance costs. 4. High efficiency. eBPF technology processes network packets directly in kernel mode, avoiding frequent data copying and context switching between user and kernel modes. This improves encryption and decryption efficiency, minimizes the impact on network communication performance, and meets the real-time communication requirements of high-speed network environments.

[0053] As can be seen from the above, in this embodiment, the key generation policy sent by the policy configuration server is obtained; the key generation policy includes a dynamic factor type and a key generation algorithm; the Berkeley packet filter function pre-added in the kernel is used to intercept the data to be sent, and a dynamic factor set is obtained according to the dynamic factor type; based on the dynamic factor set and the key generation algorithm, a target key is dynamically generated through the Berkeley packet filter function, and the target key is used to encrypt the data to be sent to obtain encrypted data; the encrypted data is sent to the receiving end; the receiving end pre-receives the key generation policy sent by the policy configuration server that is the same as that of the sending end, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

[0054] As can be seen, the dynamic factor obtained through the Berkeley Packet Filter function is used to generate a key based on the dynamic factor. The key generated based on the dynamic factor is highly random and unpredictable, which can avoid the problem of traditional encryption methods using fixed keys that make the key easy to crack. In addition, the use of the Berkeley Packet Filter function in the kernel execution environment reduces the risk of key theft during transmission and storage, and has a minimal impact on network communication performance, thereby improving encryption efficiency and network communication security. In addition, the key generation policy is uniformly sent by the policy configuration server, and the information of the network communication itself is used as the basis for key generation. This eliminates the need for additional key distribution and storage management processes, and eliminates the need for complex key exchange and certificate management mechanisms. This simplifies the key management process and reduces system operation and maintenance costs.

[0055] In some embodiments, the sending end obtains a new key generation policy sent by a policy configuration server, and uses the new key generation policy to generate a new target key. The new key generation policy may include a new dynamic factor type and / or a new key generation algorithm. The new dynamic factor type may be configured by an administrator. Note that changing the dynamic factor type may require adjusting the mount point of the Berkeley Packet Filter function. The new key generation algorithm may be newly selected by the policy configuration server from all existing key generation algorithms, or may be newly added by the administrator.

[0056] In some embodiments, the sending end obtains a new key generation algorithm sent by the policy configuration server. The new key generation algorithm is selected by the policy configuration server from a plurality of key generation algorithms pre-stored in the policy configuration server according to the system type of the current transmission system and / or the security level requirements of this communication; the current transmission system is a system composed of the sending end and the receiving end. It can be understood that the key generation algorithm is selected by the policy configuration server from a plurality of key generation algorithms pre-stored in the policy configuration server according to the system type of the current transmission system and / or the security level requirements of this communication; the current transmission system is a system composed of the sending end and the receiving end. System types include file transmission systems, video transmission systems, etc. In related technologies, such as encryption schemes based on the IPSec protocol, encryption rules rely on manual pre-definition and cannot be adjusted dynamically in real time. In this application, the security level requirements required by different system types are different, for example, the security level of the file transmission system is different from the security level of the video transmission system. Different data communications require different security levels. This level can be determined based on traffic characteristics (such as protocol type and payload length). For example, short control messages can be automatically switched to a lightweight key generation algorithm (such as Chacha20) to avoid wasting computing resources. Therefore, by dynamically adjusting the key generation algorithm based on the type of communication data and security requirements, refined management and flexible customization of encryption strategies are achieved to adapt to various complex network communication scenarios. Therefore, during the key generation process, dynamic factors are used to ensure the randomness and security of the keys, avoiding predictable patterns or repeated keys. Through the appropriate selection of key generation algorithms, the security of network communications is further guaranteed.

[0057] In some embodiments, before obtaining the key generation strategy, the method further includes: mounting a Berkeley packet filter function to a mount point corresponding to the first target layer in the seven-layer network structure of the kernel of the sending end; and using the Berkeley packet filter function pre-added in the kernel to intercept data to be sent, including: when the data to be sent passes through the mount point, intercepting the data to be sent by the Berkeley packet filter function, and obtaining a dynamic factor set according to the dynamic factor type by using the Berkeley packet filter function. For example Figure 2 As shown in the figure, the seven-layer network structure is organized from low to high as follows: Physical Layer, Data Link Layer, Network Layer, Transport Layer, Session Layer, Presentation Layer, and Application Layer. In related technologies, IPsec only operates at the IP layer and cannot perceive application layer protocols (such as HTTP headers), resulting in a disconnect between encryption strategies and business logic. For example, it is impossible to implement high-strength encryption for sensitive paths (such as / api / payment) in REST APIs (application programming interfaces in the REST architecture). However, by mounting functions at the network layer, application layer, etc., this application can obtain more dynamic factors and achieve high-strength encryption.

[0058] The target layer is determined based on the network communication encryption strength and performance requirements. The higher the network communication encryption strength requirement, the higher the first target layer level; the higher the network communication performance requirement, the lower the first target layer level. It is understood that higher layers contain more data information and capture richer dynamic factors. Conversely, lower layers have less impact on system performance due to encryption and transmission at lower levels, resulting in higher efficiency. Therefore, the policy configuration server can flexibly adjust the function mount point based on actual application scenarios. Specifically, when the first target layer is the application layer, the mount point can be the system call entry point (sock_sendmsg / sock_recvmsg) for sending data packets; when the first target layer is the network layer, the mount point can be the network stack protocol entry / exit (ingress / egress); and when the first target layer is the data link layer, the mount point can be the network card driver receive function (netif_receive_skb). Of course, you can also mount it at the socket layer, the TC (Traffic Control) module, the XDP (eXpress Data Path Module) module, the dynamic debugging tool kprobe, the security framework LSM, and other modules to capture network packets and perform encryption and decryption. Different mount points are suitable for different application scenarios and performance requirements.

[0059] The present application discloses a method for dynamic decryption of network communication, which is applied to the receiving end. Figure 3 As shown, the method may include the following steps:

[0060] Step S21: Acquire the key generation policy sent by the policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm.

[0061] Before obtaining the key generation strategy, it also includes: mounting the Berkeley packet filter function to the second target layer in the seven-layer network structure of the receiving end kernel; the Berkeley packet filter function is mounted on the first target layer in the seven-layer network structure of the sending end kernel; the level of the first target layer is greater than or equal to the level of the second target layer, that is, in order to ensure that the receiving end can obtain the dynamic factor required to be used, it is necessary to meet the requirement that the level of the first target layer is greater than or equal to the level of the second target layer.

[0062] A specific receiver-side mounting process involves writing the corresponding eBPF program and defining an eBPF function for data decryption; identifying the system call entry point for receiving network packets, such as the sock_recvmsg function; and mounting the function to the sock_recvmsg system call. When the receiver receives a network packet and calls the sock_recvmsg function, the eBPF function is triggered. The function first extracts the network five-tuple and process information from the packet, then generates a key using the same key generation algorithm as the sender. It then decrypts the encrypted data using a known encryption algorithm, recovering the original data and continuing with the subsequent receiving process.

[0063] Step S22: Utilize the Berkeley packet filter function pre-added in the kernel to intercept the encrypted data sent by the sender, and obtain a dynamic factor set according to the dynamic factor type; the sender pre-receives the key generation policy identical to that of the receiving end sent by the policy configuration server, so as to generate the same target key according to the key generation policy to encrypt the data and obtain the encrypted data.

[0064] Step S23: Based on the dynamic factor set and the key generation algorithm, dynamically generate a target key through the Berkeley packet filter function, and use the target key to decrypt the encrypted data to obtain decrypted data.

[0065] For the specific process of the above method, please refer to the corresponding content disclosed in the above embodiment, which will not be repeated here.

[0066] As can be seen above, the dynamic factor obtained through the Berkeley Packet Filter function is used to generate a key based on the dynamic factor. This key generation based on the dynamic factor is highly random and unpredictable, avoiding the problem of traditional encryption methods using fixed keys that make the key easily crackable. Furthermore, by utilizing the Berkeley Packet Filter function's kernel-mode execution environment, the risk of key theft during transmission and storage is reduced, and the impact on network communication performance is minimal, thereby improving encryption efficiency and network communication security. Furthermore, by using network communication information as the basis for key generation, there is no need for additional key distribution and storage management processes, nor does it require complex key exchange and certificate management mechanisms. This simplifies the key management process and reduces system operation and maintenance costs.

[0067] Correspondingly, an embodiment of the present application also discloses a network communication dynamic encryption and decryption system, including the above-mentioned sending end, policy configuration server and receiving end; wherein, the policy configuration server is used to issue a key generation policy to the sending end and the receiving end; the sending end uses the Berkeley packet filter function to encrypt the data to be sent, and sends the encrypted data to the receiving end; the receiving end uses the Berkeley packet filter function to decrypt the encrypted data.

[0068] For example Figure 4 The following diagram shows a specific architecture of a dynamic encryption and decryption system for network communications, comprising a policy configuration server, a client (sender), and a server (receiver). Both the client and server include policy generation engines: the client includes an eBPF encryption module (client), and the server includes an eBPF decryption module. The policy configuration server configures key generation policies by specifying dynamic factor types (source address, source port, destination address, destination port, protocol, timestamp, random number, process name, process ID, CPU ID, etc.) and key generation methods (multi-factor hashing, hierarchical hashing, logistic chaotic mapping, time window dynamic keying, etc.). The configured policies are then distributed to the policy generation engines on both the client and server.

[0069] The policy generation engine (client) is responsible for mounting the client-side encrypted eBPF function to the data transmission system call entry point (such as the sock_sendmsg function) as needed. The kernel code function that implements eBPF functionality is responsible for loading, verifying, and executing the eBPF program. It also receives parameters such as the dynamic factor type and key generation method sent by the policy configuration server. It performs preliminary identification of the dynamic factor, such as obtaining hardware signatures, and tags specific factors to be sent to the server (such as hardware signatures, timestamps, and process information). It then pushes the parameters to the kernel-state eBPF function and saves the parameter information to the eBPFMap. The policy generation engine (server) is responsible for mounting the server-side decrypted eBPF function to the data reception system call entry point (such as the sock_recvmsg function). It also receives parameters such as the dynamic factor type and key generation method sent by the policy configuration server. It then pushes the parameters to the kernel-state eBPF function and saves the parameter information to the eBPFMap.

[0070] The eBPF encryption module (client) generates a key based on a pre-set dynamic factor and key generation method upon receiving data. After encrypting the data, it combines the encrypted data with the dynamic factor to be sent to the server as a packet for transmission. The eBPF decryption module (server) generates a key based on a pre-set dynamic factor, the dynamic factor sent by the client, and the key generation method upon receiving data, and decrypts the data sent by the client.

[0071] As can be seen, by utilizing eBPF technology and attaching eBPF functions to the sending and receiving system calls of network communications, keys are dynamically generated based on network quintuples, process information, timestamps, hardware identifiers, and other information, and encryption algorithms are dynamically matched. Because encryption keys are dynamically changing and have a short validity period, even if encrypted transmissions are intercepted and cracked, the encryption keys for different quintuples at different times will be different, and the cracked keys will not be able to decrypt subsequent transmissions. This effectively overcomes the shortcomings of existing related technologies, such as fixed encryption methods, complex key generation and management, and the inability to dynamically adjust according to communication scenarios, thereby improving the security and flexibility of network communications.

[0072] For example Figure 5 As shown, the administrator defines the dynamic factor type and various key generation algorithms through the policy configuration server. The policy configuration server then issues a key generation policy for the current communication to the client and server policy generation engines. The key generation policy includes the dynamic factor type and a key generation algorithm. The client policy generation engine saves the key generation policy to the kernel's packet filter function shared memory space (eBPFMap), and the server does the same. The client kernel intercepts the data to be transmitted, generates a key, encrypts the data, and sends it to the server. The server kernel then generates a key and decrypts it, completing the communication.

[0073] By designing dynamic encryption and decryption network communications based on eBPF, eBPF functions are mounted on the sender and receiver of network communications. The eBPF function can support multiple key generation methods. The policy engine system pushes and informs the sender and receiver's eBPF functions which key generation method to use. The eBPF function generates keys based on the generation method and parameters obtained in real time as dynamic factors, which improves the encryption efficiency and security of network communications and reduces system operation and maintenance costs.

[0074] Accordingly, an embodiment of the present application further discloses a network communication dynamic encryption device, which is applied to a sending end and includes:

[0075] A policy acquisition module is used to acquire a key generation policy sent by a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm;

[0076] A dynamic factor acquisition module is used to intercept the data to be sent by using the Berkeley packet filter function pre-added in the kernel, and obtain a dynamic factor set according to the dynamic factor type;

[0077] a key generation module, configured to dynamically generate a target key based on the dynamic factor set and the key generation algorithm through the Berkeley packet filter function, and encrypt the data to be sent using the target key to obtain encrypted data;

[0078] The encryption data module is used to send the encrypted data to the receiving end; the receiving end pre-receives the key generation policy sent by the policy configuration server and the same as that of the sending end, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

[0079] In this embodiment, a key generation policy is obtained from a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm. A Berkeley packet filter function pre-installed in the kernel intercepts data to be transmitted and obtains a dynamic factor set based on the dynamic factor type. Based on the dynamic factor set and the key generation algorithm, the Berkeley packet filter function dynamically generates a target key, and the data to be transmitted is encrypted using the target key to obtain encrypted data. The encrypted data is then transmitted to a receiving end. The receiving end pre-receives the same key generation policy as the sending end, sent by the policy configuration server, so that the receiving end generates the same target key based on the key generation policy to decrypt the encrypted data. As can be seen, obtaining the dynamic factor through the Berkeley packet filter function and generating a key based on the dynamic factor is highly random and unpredictable, avoiding the vulnerability of traditional encryption methods to fixed keys that make them easily crackable. Furthermore, utilizing the kernel-mode execution environment of the Berkeley packet filter function reduces the risk of key theft during transmission and storage, minimizes the impact on network communication performance, and improves encryption efficiency and network communication security. In addition, the information of network communication itself is used as the basis for key generation, which eliminates the need for additional key distribution and storage management processes, and eliminates the need for complex key exchange and certificate management mechanisms. This simplifies the key management process and reduces system operation and maintenance costs.

[0080] Accordingly, an embodiment of the present application further discloses a network communication dynamic encryption device, which is applied to a receiving end and includes:

[0081] A policy acquisition module is used to acquire a key generation policy sent by a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm;

[0082] a dynamic factor acquisition module, configured to intercept encrypted data sent by a sending end using a Berkeley packet filter function pre-added in the kernel, and acquire a dynamic factor set according to the dynamic factor type; the sending end pre-receives a key generation policy identical to that of the receiving end, sent by the policy configuration server, so as to generate the same target key according to the key generation policy and encrypt the data to obtain the encrypted data;

[0083] The decryption module is used to dynamically generate a target key through the Berkeley packet filter function based on the dynamic factor set and the key generation algorithm, and use the target key to decrypt the encrypted data to obtain decrypted data.

[0084] In this embodiment, a key generation policy is obtained from a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm. A Berkeley packet filter function pre-installed in the kernel intercepts encrypted data sent by a sender and obtains a dynamic factor set based on the dynamic factor type. The sender pre-receives the same key generation policy as the receiving end, sent by the policy configuration server, so that the sender generates the same target key according to the key generation policy to encrypt data to obtain the encrypted data. Based on the dynamic factor set and the key generation algorithm, the Berkeley packet filter function dynamically generates a target key, and the encrypted data is decrypted using the target key to obtain decrypted data. As can be seen, obtaining the dynamic factor through the Berkeley packet filter function and generating a key based on the dynamic factor is highly random and unpredictable, avoiding the vulnerability of traditional encryption methods to fixed keys that make them easily crackable. Furthermore, utilizing the kernel-mode execution environment of the Berkeley packet filter function reduces the risk of key theft during transmission and storage, minimizes the impact on network communication performance, and improves encryption efficiency and network communication security. In addition, the information of network communication itself is used as the basis for key generation, which eliminates the need for additional key distribution and storage management processes, and eliminates the need for complex key exchange and certificate management mechanisms. This simplifies the key management process and reduces system operation and maintenance costs.

[0085] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0086] An embodiment of the present application also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute any of the above-mentioned network communication dynamic encryption methods or the steps in the network communication dynamic decryption method embodiments.

[0087] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program, wherein the computer program is configured to execute any of the above-mentioned network communication dynamic encryption method or network communication dynamic decryption method embodiments when running.

[0088] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0089] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps in any of the above-mentioned network communication dynamic encryption methods or network communication dynamic decryption method embodiments.

[0090] An embodiment of the present application also provides another computer program product, including a non-volatile computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements any of the above-mentioned network communication dynamic encryption methods or the steps in the network communication dynamic decryption method embodiments.

[0091] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0092] The above describes in detail a method for dynamic encryption and decryption of network communications provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only intended to help understand the method and core concept of the present application. It should be noted that, for those skilled in the art, without departing from the principles of the present application, several improvements and modifications may be made to the present application, and these improvements and modifications also fall within the scope of protection of the present application.

Claims

1. A dynamic encryption method for network communication, characterized in that: Applied to the sending end, including: Obtaining a key generation policy sent by a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm; the dynamic factor type includes a network layer factor, a system layer factor, and / or a hardware layer factor, and the system layer factor includes a process identifier; Utilize the Berkeley packet filter function pre-added in the kernel to intercept the data to be sent, and obtain a dynamic factor set according to the dynamic factor type; Based on the dynamic factor set and the key generation algorithm, dynamically generating a target key through the Berkeley packet filter function, and encrypting the data to be sent using the target key to obtain encrypted data; The encrypted data is sent to a receiving end; the receiving end pre-receives the same key generation policy as that of the sending end sent by the policy configuration server, so as to generate the same target key according to the key generation policy to decrypt the encrypted data; Obtaining the key generation strategy includes: Obtain the key generation strategy through the user-mode program; The key generation strategy is saved in the shared storage space of the packet filter function of the kernel; the shared storage space supports kernel state and user state sharing.

2. The network communication dynamic encryption method according to claim 1, characterized in that: Before obtaining the key generation strategy, it also includes: Mount the Berkeley packet filter function to the mount point corresponding to the first target layer in the seven-layer network structure of the sending kernel; Utilize the pre-added Berkeley packet filter function in the kernel to intercept the data to be sent, including: When the data to be sent passes through the mount point, the data to be sent is intercepted by the Berkeley packet filter function, and the Berkeley packet filter function is used to obtain a dynamic factor set according to the dynamic factor type.

3. The network communication dynamic encryption method according to claim 2, characterized in that: The first target layer is determined based on the network communication encryption strength requirement and the network communication performance requirement; wherein, the higher the network communication encryption strength requirement, the higher the level of the first target layer, and the higher the network communication performance requirement, the lower the level of the first target layer.

4. The network communication dynamic encryption method according to claim 2, characterized in that: When the first target layer is an application layer, the mount point is a system call entry for sending data packets; When the first target layer is a network layer, the mount point is a network stack protocol entry / exit; When the first target layer is a data link layer, the mount point is a network card driver receiving function.

5. The network communication dynamic encryption method according to claim 1, characterized in that: Sending the encrypted data to a receiving end includes: The specific parameters in the dynamic factor set and the encrypted data are sent to the receiving end; the specific parameters are parameters that are different between the sending end and the receiving end.

6. The network communication dynamic encryption method according to claim 5, characterized in that: After obtaining the dynamic factor set according to the dynamic factor type, the following steps are also included: Grouping the dynamic factors in the dynamic factor set into general parameters and specific parameters; the general parameters are the same parameters at both the sending end and the receiving end, and the specific parameters are different parameters at the sending end and the receiving end; A tag is added to the specific parameter, and the dynamic factor set is saved to the shared storage space of the packet filter function.

7. The network communication dynamic encryption method according to any one of claims 1 to 6, characterized in that: Also includes: A new key generation policy sent by a policy configuration server is obtained, so as to generate a new target key by using the new key generation policy.

8. A method for dynamic decryption of network communication, characterized in that: Applied to the receiving end, including: Obtaining a key generation policy sent by a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm; the dynamic factor type includes a network layer factor, a system layer factor, and / or a hardware layer factor, and the system layer factor includes a process identifier; The encrypted data sent by the sending end is intercepted by using a Berkeley packet filter function pre-added in the kernel, and a dynamic factor set is obtained according to the dynamic factor type; the sending end pre-receives a key generation policy identical to that of the receiving end and sent by the policy configuration server, so as to generate the same target key according to the key generation policy and encrypt the data to obtain the encrypted data; Based on the dynamic factor set and the key generation algorithm, dynamically generating a target key through the Berkeley packet filter function, and decrypting the encrypted data using the target key to obtain decrypted data; Obtaining the key generation strategy includes: Obtain the key generation strategy through the user-mode program; The key generation strategy is saved in the shared storage space of the packet filter function of the kernel; the shared storage space supports kernel state and user state sharing.

9. The method for dynamic decryption of network communication according to claim 8, characterized in that: Before obtaining the key generation strategy, it also includes: Mount the Berkeley packet filter function to the second target layer in the seven-layer network structure of the receiving kernel; The Berkeley packet filter function is mounted on the first target layer in the seven-layer network structure of the kernel of the sending end; the first target layer and the second target layer are the same layer.

10. A network communication dynamic encryption and decryption system, characterized in that: comprising the sending end according to any one of claims 1 to 7, the policy configuration server, and the receiving end according to claim 8 or 9; The policy configuration server is used to issue a key generation policy to the sending end and the receiving end; The sending end encrypts the data to be sent by using the Berkeley packet filter function, and sends the encrypted data to the receiving end; the receiving end decrypts the encrypted data by using the Berkeley packet filter function.

11. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the network communication dynamic encryption method according to any one of claims 1 to 7, or the network communication dynamic decryption method according to claim 8 or 9.

12. A computer-readable storage medium, characterized in that Used to store computer programs; wherein when the computer program is executed by the processor, it implements the network communication dynamic encryption method according to any one of claims 1 to 7, or the network communication dynamic decryption method according to claim 8 or 9.

13. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the network communication dynamic encryption method according to any one of claims 1 to 7, or the network communication dynamic decryption method according to claim 8 or 9.

Images