A data-preserving encryption parallel processing transmission method

Abstract

The present application relates to the technical field of encrypted transmission, and discloses a data-preserving encryption and parallel processing transmission method, which comprises the following steps: identifying sensitive fields in the data to be encrypted and extracting the fields to be encrypted, using a data-preserving encryption algorithm combined with a data-preserving encryption factor to encrypt the fields to be encrypted; logically fragmenting the encrypted ciphertext, and sending the fragmented data with attached information to distributed nodes using a distributed scheduling strategy; and recombining, decrypting and integrity verifying the fragmented data with attached information at the receiving end. The present application identifies sensitive fields in the data to be encrypted, extracts the field boundaries and generates a data-preserving encryption factor for encryption disturbance, uses a data-preserving encryption algorithm to encrypt the sensitive fields, combines a logical fragmentation and hash check mechanism to integrity verify the fragmented data, and distributes the fragmented data in parallel to multiple distributed nodes based on a distributed scheduling strategy, thereby realizing data-preserving encryption and parallel transmission.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of encrypted transmission, and in particular to a data format-preserving encryption and parallel processing transmission method. BACKGROUND

[0002] With the rapid development of data-driven businesses, especially in data security sensitive scenarios such as finance, medicine, e-commerce, etc., privacy protection and efficient transmission have gradually become key issues in information system design. Format-preserving encryption (FPE) has been widely used in the encryption of sensitive data such as database fields, log information, and transaction records, as it can complete encryption operations while maintaining the original structure of the fields (such as length and format). However, with the continuous growth of data size and the increasing demand for real-time processing, how to support parallel encryption processing and distributed efficient transmission while ensuring the security of format-preserving encryption has become one of the key bottlenecks in current research and engineering implementation.

[0003] In recent years, scholars and engineering practitioners at home and abroad have proposed various processing schemes for the encryption and transmission of structured sensitive data. In terms of format-preserving encryption, the FF1 and FF3 algorithms proposed by NIST have become the mainstream implementation in the industry. The core of these algorithms is to maintain the format and semantic boundary of the original data based on the Feistel network, and they are widely used in the encryption protection of financial fields such as bank card numbers and identity card numbers. However, traditional format-preserving encryption algorithms mainly target static data processing and lack systematic support for multi-field format-preserving coupled encryption, structure disturbance control, and heterogeneous node collaborative scheduling transmission in large-scale concurrent scenarios. Meanwhile, existing research, such as patent CN108881257B, proposes a distributed search cluster encryption transmission method and an encryption transmission distributed search cluster. This method generates node certificates based on the attribute information of distributed cluster nodes, and realizes data encryption transmission based on node certificates, effectively improving the identity authentication and security protection capability in the distributed transmission process. However, this scheme does not conduct fine-grained analysis on the data structure, ignoring the impact of field-level differences on transmission efficiency, decryption order, and data reconstruction accuracy.

[0004] In addition, the traditional method has the following problems: it does not model and process the sensitivity differences of the field level in the data structure, making it difficult to meet the format-preserving encryption requirements under structure awareness; it does not consider the coupling mechanism between the logical structure of the encrypted ciphertext and the sharding scheduling, resulting in delays and confusion risks in the data reconstruction and consistency verification processes.

[0005] Therefore, a data conforming encryption parallel processing transmission method fusing field sensitive identification, conforming encryption, parallel scheduling transmission and integrity verification mechanism is urgently needed to enhance the structure retention, processing parallelism and transmission stability of encrypted data in a distributed environment. SUMMARY

[0006] Therefore, the present application provides a data conforming encryption parallel processing transmission method, which retains the original field format features through conforming structure analysis and encryption operation, simultaneously constructs a logical fragmentation mechanism based on position and hash and a hash digest generation mode, and sends encrypted ciphertext fragments to multiple nodes in a parallel transmission mode. The method supports fragment recombination and consistency verification, significantly enhancing the transmission efficiency and end-to-end integrity protection capability of data conforming encryption.

[0007] To achieve the above-mentioned purpose, the present application provides a data conforming encryption parallel processing transmission method, comprising the following steps:

[0008] S1: sensitive field identification is performed on the data to be encrypted to obtain the sensitive fields in the data to be encrypted, and conforming structure analysis is performed on the sensitive fields to obtain the field boundaries of the sensitive fields and conforming encryption factors;

[0009] S2: the encrypted fields corresponding to the sensitive fields are extracted based on the field boundaries, a conforming encryption algorithm combined with the conforming encryption factors is used to perform conforming encryption on the encrypted fields, and the conforming encryption results of the encrypted fields constitute the encrypted ciphertext of the data to be encrypted;

[0010] S3: the encrypted ciphertext is logically fragmented to obtain fragmented data of the encrypted ciphertext, and a hash digest and fragment verification information are attached, and the fragmented data with the attached information is sent to distributed nodes using a distributed scheduling strategy;

[0011] S4: the distributed nodes upload the fragmented data with the attached information to the receiving end, the receiving end extracts the logical fragmentation order from the fragment verification information attached to the fragmented data, recombines and decrypts the fragmented data with the attached information, and compares the hash digest to verify the data integrity and consistency.

[0012] Optionally, the sensitive field identification of the data to be encrypted comprises:

[0013] The data to be encrypted of a user is obtained, a pre-constructed field dictionary is used to identify and separate the fields in the data to be encrypted, and a field sequence of the data to be encrypted is obtained;

[0014] A rule matching mode is constructed using a rule engine and a regular expression mode, the fields in the field sequence are matched, and the fields that match successfully are extracted as candidate fields;

[0015] The context field of the candidate field is extracted to form a candidate field sequence, the fields in the candidate field sequence are encoded by using a word vector model, the sensitive field recognition module is combined to recognize the word vector encoded candidate field sequence, the probability that the candidate field in the candidate field sequence is a sensitive field is obtained, and the candidate field with a probability higher than a preset sensitive probability threshold is taken as the sensitive field.

[0016] Optionally, the sensitive field is subjected to conformal structure analysis, comprising:

[0017] The conformal structure analysis comprises field boundary identification and generation of a conformal encryption factor;

[0018] The position of the sensitive field is extracted, a boundary window containing the sensitive field is initially constructed, the information entropy of each character in the boundary window is calculated, the sensitive field boundary window score of the boundary window is calculated based on the information entropy, and the boundary window is fine-tuned until the length of the boundary window is less than a preset window length threshold, the boundary window containing the sensitive field and having the highest sensitive field boundary window score is taken as the sensitive boundary window of the sensitive field, and the positions at both ends of the sensitive boundary window are taken as the field boundaries of the sensitive field.

[0019] ;

[0020] Wherein, represents the boundary window containing the sensitive field , represents the sensitive field boundary window score of the boundary window , represents the probability that the sensitive field output by the combined lightweight sensitive field recognition module is a sensitive field, represents the information entropy of the field frequency distribution in the boundary window .

[0021] The generation formula of the conformal encryption factor of the sensitive field is:

[0022] ;

[0023] Wherein, represents the conformal encryption factor of the sensitive field y, represents the ID of the user associated with the data to be encrypted, represents the timestamp for generating the conformal encryption factor of the sensitive field y, represents splicing processing, represents hash operation.

[0024] ​​Optionally, the field to be encrypted is subjected to conformal encryption by using a conformal encryption algorithm combined with a conformal encryption factor, including:

[0025] The character sequence of the sensitive field in the corresponding sensitive boundary window is extracted as the field to be encrypted;

[0026] The word vector model is used to perform word vector encoding on the data to be encrypted, to obtain a word vector data sequence corresponding to the data to be encrypted, and the word vector encoding result of the field to be encrypted is extracted;

[0027] The word vector encoding result of the field to be encrypted is divided into a left half and a right half, and the Feistel encryption round is used to perform round encryption on the word vector encoding result. After the round encryption is completed, the left half and the right half output by the last round encryption are spliced to obtain the conformal encryption result of the field to be encrypted;

[0028] The conformal encryption result of the field to be encrypted is replaced by the word vector encoding result of the field to be encrypted in the word vector data sequence, to obtain the encrypted ciphertext corresponding to the data to be encrypted.

[0029] Optionally, the encrypted ciphertext is logically fragmented to obtain fragmented data of the encrypted ciphertext, including:

[0030] The conformal encryption result of the field to be encrypted in the encrypted ciphertext is identified, a binary fragmentation marker code, a conformal encryption result length code and a fragmentation sequence number code are added before the conformal encryption result, the character position before the fragmentation marker code and the fragmentation sequence number code is taken as a logical fragmentation position, and the encrypted ciphertext is logically fragmented to obtain the fragmented data of the encrypted ciphertext.

[0031] Optionally, the fragmented data is attached with a hash digest and fragmentation check information, including:

[0032] The hash digest of the fragmented data is obtained by performing a hash digest operation on the fragmented data;

[0033] The fragmentation marker code, the conformal encryption result length code and the fragmentation sequence number code in the fragmented data are taken as the fragmentation check information;

[0034] The hash digest is attached in front of the fragmented data to obtain the fragmented data attached with the hash digest and the fragmentation check information.

[0035] Optionally, the fragmented data attached with the information is sent to a distributed node by using a distributed scheduling strategy, including:

[0036] The fragmented data attached with the information is the fragmented data attached with the hash digest and the fragmentation check information;

[0037] The scheduling score value between the piece of data of the accompanying information and the distributed node is calculated in sequence, and the piece of data of the accompanying information is sent to the distributed node with the highest scheduling score value as the distributed scheduling strategy of the piece of data of the accompanying information, wherein the scheduling score value between the piece of data of the accompanying information data and the distributed node is:

[0038] , ;

[0039] ;

[0040] ;

[0041] ;

[0042] wherein, represents the scheduling score value between the piece of data of the accompanying information data and the distributed node , represents the nth distributed node, and N represents the total number of distributed nodes, represents the scheduling weight coefficient, represents the load factor of the distributed node , represents the space capacity proportion of the piece of data of the accompanying information data in the distributed node , represents the communication quality of the communication link between the piece of data of the accompanying information data and the distributed node ;

[0043] all represent the scheduling resource weight, represents the transmission speed of the distributed node to the receiving end, represents the preset maximum transmission speed, represents the number of pieces of data to be sent of the distributed node ;

[0044] represents the number of bits of the piece of data of the accompanying information data, represents the number of available space bits of the distributed node ;

[0045] represents the transmission delay between the piece of data of the accompanying information data and the distributed node when the scheduling score value between the piece of data of the accompanying information data and the distributed node is calculated, represents a preset maximum transmission delay.

[0046] Optionally, the receiving end extracts the logical fragment order from the fragment check information attached to the fragment data, recombines and decrypts the fragment data, and compares the hash digest to verify the data integrity and consistency, including:

[0047] The receiving end receives the fragment data with attached information, extracts the logical fragment order from the fragment check information, and sorts the fragment data with attached information according to the logical fragment order;

[0048] Extract the hash digest from the fragment data with attached information, remove the hash digest from the fragment data with attached information and the fragment check information, recalculate the hash digest of the fragment data, and if the recalculated result is consistent with the extracted hash digest, it indicates that the data integrity and consistency verification is passed, and the fragment data is decrypted.

[0049] Compared with the prior art, the present application has the following beneficial effects:

[0050] Firstly, the present application solves the core problems of poor accuracy, high missing recognition rate and insufficient semantic understanding of traditional sensitive field recognition methods in complex data environment by calculating the feature information of the candidate field in multiple dimensions.

[0051] At the same time, the distributed scheduling strategy proposed by the present application introduces a composite scoring mechanism through a scheduling scoring function, comprehensively processes the three core dimensions of computing load, storage capacity and network delay, dynamically disperses the scheduling pressure of high load nodes by using the load factor, improves the overall response speed of the system, and uses the space capacity ratio to reflect the adaptive ability of the system to the actual resource carrying capacity of the node. This design enables the fragment data to be preferentially scheduled to nodes with sufficient space resources, reduces the fragment failure rate and the secondary scheduling overhead caused by insufficient resources, and through reverse measurement of communication delay, the system is more inclined to select low-delay link nodes for scheduling, reducing transmission congestion and improving the real-time transmission guarantee capability of fragment data. It is especially suitable for scheduling tasks in time-sensitive or frequent interaction scenarios, and improves the parallelism of fragment data transmission. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 A flowchart of a data shape encryption parallel processing transmission method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0053] It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] The embodiment of the present application provides a data conformal encryption parallel processing transmission method. The execution subject of the data conformal encryption parallel processing transmission method includes but is not limited to at least one of electronic devices such as a server, a terminal and the like which can be configured to execute the method provided by the embodiment of the present application. In other words, the data conformal encryption parallel processing transmission method can be executed by software or hardware installed in a terminal device or a server device, and the software can be a blockchain platform. The server includes but is not limited to a single server, a server cluster, a cloud server or a cloud server cluster and the like.

[0055] With reference to Figure 1 The embodiment 1 of the present application is:

[0056] A data conformal encryption parallel processing transmission method includes the following steps:

[0057] S1: sensitive field identification is performed on the data to be encrypted, to obtain the sensitive field in the data to be encrypted, and a conformal structure analysis is performed on the sensitive field, to obtain the field boundary of the sensitive field and a conformal encryption factor.

[0058] Sensitive field identification is performed on the data to be encrypted, including:

[0059] Obtaining the data to be encrypted of a user, identifying and separating the fields in the data to be encrypted by using a pre-constructed field dictionary, to obtain the field sequence of the data to be encrypted;

[0060] A rule matching mode is constructed by using a rule engine and a regular expression mode, the fields in the field sequence are matched, and the fields matched successfully are extracted as candidate fields. Specifically, the rule matching mode includes multiple sets of matching rules, each set of matching rules includes a field length limit, a field type limit and a typical position, the field type includes a digital field, a Chinese character field, a special symbol character and an English character field, the fields in the field sequence are input into the rule matching mode, the matching confidence between the fields and the matching rules in the rule matching mode is calculated, and if the matching confidence is higher than a preset confidence threshold, it is indicated that the matching is successful.

[0061] The matching confidence calculation formula between the field Y and the matching rule rule is:

[0062] ;

[0063] Wherein, The matching confidence between the field Y and the matching rule rule is represented by, The field length of the field Y is represented by, The field length limit, the field type limit and the typical position of the matching rule rule are represented by, respectively, and the typical position represents the field position where the sensitive field associated with the matching rule prefers to appear. a degree of fit of field Y to a field type limit, a degree of fit of field Y to a typical position, a number of characters in field Y that satisfy a field type limit, a position number of field Y in a field sequence, represents an exponential function with a natural constant as a base.

[0064] As an embodiment of the present application, the matching rule includes an ID number matching rule, a mobile phone number matching rule, and an email address matching rule, etc., wherein the ID number matching rule is: field type: digital field + special English character (the end can be X / x), field length limit: 18 bits; the mobile phone number matching rule is: field type: digital field + starting with 1 + the second bit being 3-9, field length limit: 11 bits; and the email address matching rule is: field type: English character field + special symbol field, field length limit: ≥6 and ≤50.

[0065] Context fields of the candidate field are extracted to form a candidate field sequence, word vector coding is performed on the fields in the candidate field sequence by using a word vector model, sensitive field recognition is performed on the word vector coded candidate field sequence by combining a lightweight sensitive field recognition module, a probability that a candidate field in the candidate field sequence is a sensitive field is obtained, and a candidate field with a probability higher than a preset sensitive probability threshold is taken as a sensitive field. Specifically, the recognition formula of the sensitive field is:

[0066] ;

[0067] wherein, represents a probability that a candidate field is a sensitive field, represents a context awareness probability that a candidate field output by the lightweight sensitive field recognition module is a sensitive field, represents a regular confidence score of a candidate field , represents a context semantic similarity of a candidate field , all represent probability weights;

[0068] represents a word vector coded candidate field sequence corresponding to a candidate field , is a weight matrix parameter, is a bias parameter, ​​​​is a Sigmoid activation function, represents a ReLU activation function, i.e., a rectified linear unit;

[0069] represents a candidate field a matching confidence between the candidate field and a matching rule rule, represents a rule matching mode, max{ } represents taking the maximum value of a set, represents taking the maximum value of a set ;

[0070] represents a word vector encoding result of a context field of a candidate field ; represents a word vector encoding result of a common sensitive word;

[0071] represents a maximum cosine similarity between them, and the common sensitive word includes an ID number, a bank card, etc.

[0072] It should be noted that the context-aware probability of the present application can capture the implicit semantic connection between contexts from the candidate field sequence, and can still maintain a high recognition accuracy when the field name is missing or the field structure is ambiguous, thereby making up for the limitations of regular matching means for processing fuzzy data. The regular confidence score is not a simple judgment of whether the rule is hit, but introduces factors such as format integrity and character type compliance, quantifies the matching quality of the field and the pre-defined format, thereby supporting reasonable scoring even when the field is truncated, nested or slightly deformed. Furthermore, the typical position matching degree uses a Gaussian position window function to model the expected position of the field in the structure domain, so that the system can learn and preferentially identify the regularity that an ID number usually appears in the 2nd field, thereby significantly improving the field position sensitivity in structured or semi-structured data. The context semantic similarity extracts whether the context field contains sensitive words such as ID numbers and banks, and models the word vector similarity to further confirm the sensitivity of the field from the semantic level, thereby solving the case where the field structure is not sensitive but the context is strong.

[0073] This application systematically addresses the core problems of traditional sensitive field identification methods, such as poor accuracy, high false negative rate, and insufficient semantic understanding, by calculating the feature information of candidate fields across multiple dimensions. The sensitive field identification formula not only integrates context-based semantic probability estimation of sensitive fields but also introduces format fidelity evaluation (e.g., regular expression rule matching score, character type consistency), typical position matching confidence assessment (e.g., position window Gaussian weighted function), and semantic consistency analysis of field names and their contextual words, thereby constructing a highly robust and compatible sensitive field identification formula. The sensitive field undergoes conformal structure analysis, including:

[0074] The conformal structure analysis includes field boundary identification and generation of conformal encryption factors;

[0075] The location of the sensitive field is extracted, and an initial boundary window containing the sensitive field is constructed. The information entropy of each character within the boundary window is calculated. Based on the information entropy, the sensitive field boundary window score of the boundary window is calculated, and the boundary window is fine-tuned until a boundary window with a length less than a preset window length threshold, containing the sensitive field, and having the highest sensitive field boundary window score is obtained. This boundary window is used as the sensitive boundary window of the sensitive field. The positions at both ends of the sensitive boundary window are used as the field boundaries of the sensitive field. The formula for calculating the sensitive field boundary window score of the boundary window is as follows:

[0076] ;

[0077] in, Indicates the presence of sensitive fields The boundary window, Represents the boundary window Sensitive field boundary window score, This indicates the sensitive fields output by the lightweight sensitive field identification module. The probability of being a sensitive field. Represents the boundary window The information entropy of the frequency distribution of the inner field; specifically:

[0078] ;

[0079] in, Represents the boundary window The frequency of the c-th field in the field sequence of the data to be encrypted;

[0080] Generate a conformal encryption factor for the sensitive field, wherein the formula for generating the conformal encryption factor is:

[0081] ;

[0082] in, a shape-preserving encryption factor of a sensitive field y, an ID of a user associated with the data to be encrypted, a timestamp of generating the shape-preserving encryption factor of the sensitive field y, denotes a splicing process, denotes a hash operation; as an embodiment of the present application, the hash operation adopts a SHA-256 hash function.

[0083] It should be noted that by combining the context information entropy of the sensitive field and the sensitive field recognition probability, multi-scale adaptive perception of the field boundary is realized. This method can autonomously select the most reliable field boundary area in a fuzzy boundary scenario (such as embedded text and field nameless logs), thereby improving the accuracy and stability of boundary recognition.

[0084] The present application gradually scores and fine-tunes the initial boundary window by introducing the information entropy of the field frequency distribution, which can accurately capture the real semantic boundary of the sensitive field while keeping the window length within a certain threshold, avoiding the field truncation or misrecognition caused by traditional fixed mode or regular extraction methods. This ensures that the encryption operation is applied to the complete field semantic unit, so that the structure distribution of the original field can still be maintained after shape-preserving encryption, ensuring the consistency of the data before and after encryption. Through high-sensitivity entropy value driven optimization, the selected sensitive boundary window is highly consistent in semantics and has the characteristics of high information entropy concentration and significant changes, which helps the subsequent encryption module to accurately act on the sensitive data carrier, reduces the risk of structure drift, effectively compresses the range of the field to be encrypted to the high-sensitivity area, reduces the redundant data included in the encryption range, thereby reducing the number of subsequent round encryption executions, reducing the key expansion burden, improving the overall encryption processing speed, and facilitating system parallel deployment and real-time processing needs.

[0085] S2: Extract the sensitive field corresponding to the field boundary, and perform shape-preserving encryption on the field to be encrypted using a shape-preserving encryption algorithm combined with a shape-preserving encryption factor, and based on the shape-preserving encryption result of the field to be encrypted, form the encryption ciphertext of the data to be encrypted.

[0086] The shape-preserving encryption algorithm combined with the shape-preserving encryption factor for performing shape-preserving encryption on the field to be encrypted includes:

[0087] Extract the character sequence of the sensitive field in the corresponding sensitive boundary window as the field to be encrypted;

[0088] The word vector model is used to perform word vector encoding on the data to be encrypted to obtain a word vector data sequence corresponding to the data to be encrypted, and the word vector encoding result of the field to be encrypted is extracted; specifically, the word vector model is a bag-of-words model, and the word vector encoding result is a binary encoding.

[0089] The word vector encoding result of the field to be encrypted is divided into a left half and a right half, a Feistel encryption round is used to round encrypt the word vector encoding result, after the round encryption is completed, the left half and the right half output by the last round encryption are spliced to obtain the conformal encryption result of the field to be encrypted, and the round encryption process of each round is as follows:

[0090] The number of the current round encryption, the conformal encryption factor of the sensitive field contained in the field to be encrypted, and the current right half are spliced into an intermediate variable;

[0091] The intermediate variable is encrypted by using an AES encryption mode combined with a system encryption key to obtain a ciphertext segment corresponding to the intermediate variable;

[0092] After the ciphertext segment is taken modulo and an exclusive or operation is performed with the current left half, a new right half is generated;

[0093] The new right half and the current left half are exchanged to obtain the left half and the right half after the current round encryption.

[0094] As an embodiment of the present application, the number of rounds of the round encryption is 10;

[0095] The conformal encryption result of the field to be encrypted is replaced with the word vector encoding result of the field to be encrypted in the word vector data sequence to obtain the encryption ciphertext corresponding to the data to be encrypted.

[0096] It should be noted that the present application realizes shape-preserving encryption based on the Feistel network structure, performs multi-round encryption on the word vector encoding of the field to be encrypted, and enhances the binding of semantic and format information by introducing a shape-preserving encryption factor and an intermediate variable construction mode of the original right half. In each round of encryption, the intermediate variable is converted into a nonlinear mapping output by AES encryption, avoiding the possibility of fixed pattern matching. The advantage of the Feistel network structure is that it has strong reversibility, and the round function can be freely designed, without additional inverse operation logic for decryption. At the same time, since the word vector contains context, position and field semantics during encoding, and uses fixed-length vector representation, the entire encryption process maintains the consistency of input and output dimensions. By introducing a shape-preserving encryption factor in the round function, it is ensured that even if the word vector features of different format fields are similar, their encryption paths will be significantly different, and the final encryption result will still maintain the same dimension as the original word vector. Therefore, in the decoding or data display stage, the ciphertext field consistent with the original field structure can be directly mapped back, ensuring the shape-preserving property of the encrypted data embedded in the original data stream. In addition, the method introduces nonlinear and diffusion characteristics through alternating operations on left and right vector segments, so that the encryption result of the sensitive field depends not only on the word vector itself, but also on its semantic label, round number and structural context, thereby achieving the dual encryption goals of structure-preserving and semantic disturbance, effectively improving the security and anti-correlation of shape-preserving encryption.

[0097] S3: logically fragmenting the encrypted ciphertext to obtain fragmented data of the encrypted ciphertext, and attaching a hash digest and fragmentation check information, and sending the fragmented data with the attached information to a distributed node using a distributed scheduling strategy.

[0098] The encrypted ciphertext is logically fragmented to obtain fragmented data of the encrypted ciphertext, including:

[0099] The shape-preserving encryption result of the field to be encrypted in the encrypted ciphertext is identified, a binary fragmentation marker code, a shape-preserving encryption result length code and a fragmentation sequence number code are added before the shape-preserving encryption result, the character position before the fragmentation marker code and the fragmentation sequence number code is taken as a logical fragmentation position, and the encrypted ciphertext is logically fragmented to obtain fragmented data of the encrypted ciphertext. Specifically, the fragmentation sequence number code is the number of fragmentation marker codes that have been added.

[0100] The fragmented data is attached with a hash digest and fragmentation check information, including:

[0101] The hash digest of the fragmented data is obtained by performing a hash digest operation on the fragmented data;

[0102] The fragmentation marker code, the shape-preserving encryption result length code and the fragmentation sequence number code in the fragmented data are taken as the fragmentation check information;

[0103] The hash digest is attached to the fragmented data before the fragmented data is obtained, and the fragmented data is attached with the hash digest and the fragmented check information;

[0104] Specifically, the fragmented marker code is composed of a special and fixed fragmented positioning code and a matching rule code matched successfully by the sensitive field contained in the fragmented data, used to indicate the sensitive semantic type associated with the current fragmented data, and the sensitive semantic type includes an ID card, a mobile phone number, an email address, etc.

[0105] The hash digest operation mode of the fragmented data includes a first-level hash digest generation operation and a second-level hash digest generation operation, wherein the first-level hash digest generation operation uses a SHA-256 hash function to generate a digest of the fragmented data that does not contain the fragmented marker code and the fragmented serial number code, to obtain a first-level hash digest of the fragmented data, used for basic integrity verification, and the first-level hash digest is spliced with the fragmented serial number code in the fragmented data, and a HMAC hash function based on a system-level hash key key is used to perform hash operation on the spliced result to generate a second-level hash digest, which is used to detect whether the fragmented data is replaced or mispositioned, as the hash digest of the fragmented data.

[0106] Further, if an attacker replaces the content of the fragmented data and forges the first-level hash digest, the attacker cannot forge the second-level hash digest because the attacker does not know the system-level hash key key, and thus the second-level hash digest is used to detect whether the content is replaced; if the fragmented data is placed in a wrong position, i.e., the attacker attacks the fragmented check information, the part of the second-level hash digest that splices the fragmented serial number code will be abnormal, and the abnormality is identified and reorganized.

[0107] By introducing a sensitive semantic label embedding mechanism, an identifiable matching rule code is attached to each fragmented data, which enhances the explainability of the field in distributed processing and semantic audit, supports semantic-type fragmented reconstruction and conflict detection, and the double-layer hash check strategy (SHA-256 + HMAC) not only realizes integrity verification, but also supports fine-grained position consistency detection through structure nested check, effectively deals with multiple transmission risks such as tampering, replacement and mispositioning of fragmented data, and the overall scheme takes into account the shape-preserving, structure recognition and consistency check, which can provide a basic guarantee for high-reliability and high-security data encryption and transmission.

[0108] The fragmented data with the attached information is sent to the distributed nodes by using a distributed scheduling strategy, including:

[0109] The scheduling score value between the slice data of the accompanying information and the distributed node is calculated in sequence, and the slice data of the accompanying information is sent to the distributed node with the highest scheduling score value as the distributed scheduling strategy of the slice data of the accompanying information, wherein the scheduling score value between the slice data of the accompanying information data and the distributed node is:

[0110] , ;

[0111] ;

[0112] ;

[0113] ;

[0114] wherein, represents the scheduling score value between the slice data of the accompanying information data and the distributed node , represents the nth distributed node, and N represents the total number of distributed nodes, represents the scheduling weight coefficient, represents the load factor of the distributed node , represents the space capacity proportion of the slice data of the accompanying information data in the distributed node , represents the communication quality of the communication link between the slice data of the accompanying information data and the distributed node ;

[0115] all represent the scheduling resource weight, represents the transmission speed of the distributed node to the receiving end, represents the preset maximum transmission speed, represents the number of slice data to be sent by the distributed node ;

[0116] represents the number of bits of the slice data of the accompanying information data, represents the available space bit number of the distributed node ;

[0117] represents the transmission delay between the slice data sending end and the distributed node when the scheduling score value between the slice data of the accompanying information data and the distributed node is calculated, represents a preset maximum transmission delay.

[0118] It should be noted that the traditional scheduling function mostly focuses on single-dimensional resource indicators or fixed node distribution strategies, and it is difficult to cope with the scheduling challenges brought by dynamic load and data structure differences. The scheduling score function introduced in this application introduces a composite scoring mechanism, which comprehensively processes the three core dimensions of computing load, storage capacity and network delay. The load factor is used to dynamically disperse the scheduling pressure of high-load nodes, improve the overall response speed of the system, and the space capacity ratio reflects the adaptive ability of the system to the actual resource carrying capacity of the nodes. This design allows the shard data to be preferentially scheduled to nodes with sufficient space resources, reducing the shard failure rate and the secondary scheduling overhead caused by insufficient resources. By inversely measuring the communication delay, the system is more inclined to select low-delay link nodes for scheduling, reducing transmission congestion and improving the real-time transmission guarantee capability of shard data. It is particularly suitable for scheduling tasks in time-sensitive or frequent interaction scenarios, and improves the parallelism of shard data transmission.

[0119] S4: The distributed node uploads the shard data with the attached information to the receiving end, the receiving end extracts the logical shard order from the shard check information attached to the shard data, reorganizes and decrypts the shard data with the attached information, and compares the hash digest to verify the data integrity and consistency. It includes:

[0120] The receiving end receives the shard data with the attached information, and extracts the logical shard order from the shard check information. The shard data with the attached information is sorted according to the logical shard order. Specifically, the logical shard order is the shard number code in the shard check information;

[0121] Extract the hash digest from the shard data with the attached information, remove the hash digest and shard check information from the shard data with the attached information, and recalculate the hash digest of the shard data. If the recalculated result is consistent with the extracted hash digest, it means that the data integrity and consistency verification is passed, and the shard data is decrypted.

[0122] It should be noted that the decryption process of the present application includes extracting the shape-preserving encryption result from the shard data based on the length encoding of the shape-preserving encryption result in the shard check information, decrypting the shape-preserving encryption result using the inverse algorithm of the shape-preserving encryption algorithm to obtain the word vector encoding result corresponding to the shard data, arranging the word vector encoding result according to the order of the shard data to obtain the word vector data sequence corresponding to the encrypted data, and taking the word vector data sequence as the decryption result; the shape-preserving encryption result is in the front row of the shard data, and the position of the shape-preserving encryption result is located based on the length encoding of the shape-preserving encryption result.

[0123] It should be noted that the embodiments are only for illustration and are not limited by the structure of the patent application.

[0124] It should be noted that the above-mentioned embodiment numbers of the present application are only for description, not representing the advantages and disadvantages of the embodiments. Also, the terms "comprising", "containing" or any other variants thereof in the present text are intended to cover the non-exclusive inclusion, so that the processes, devices, articles or methods including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, devices, articles or methods. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of other identical elements in the processes, devices, articles or methods including the element.

[0125] Through the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, an optical disk) as described above, and includes a number of instructions for making a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) execute the methods described in various embodiments of the present application.

[0126] The above is only the preferred embodiment of the present application, and does not limit the patent scope of the present application, and any equivalent structure or equivalent process transformation using the content of the present application specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for conformal encryption and parallel processing and transmission of data, characterized in that, The method includes: S1: Identify sensitive fields in the data to be encrypted, obtain the sensitive fields in the data to be encrypted, and perform conformal structure analysis on the sensitive fields to obtain the field boundaries and conformal encryption factors of the sensitive fields; S2: Extract the field to be encrypted corresponding to the sensitive field based on the field boundary, and use a conformal encryption algorithm that combines a conformal encryption factor to perform conformal encryption on the field to be encrypted. The conformal encryption result of the field to be encrypted constitutes the encrypted ciphertext of the data to be encrypted. S3: Logically fragment the encrypted ciphertext to obtain fragmented data of the encrypted ciphertext, and attach hash digests and fragment verification information. Use a distributed scheduling strategy to send the fragmented data with attached information to distributed nodes. S4: Distributed nodes upload fragmented data with attached information to the receiving end. The receiving end extracts the logical fragment order from the fragment verification information attached to the fragmented data, reassembles and decrypts the fragmented data with attached information, and compares the hash digest to verify data integrity and consistency.

2. The data conformal encryption parallel processing and transmission method as described in claim 1, characterized in that, Sensitive field identification for encrypted data includes: The system obtains the user's data to be encrypted, and uses a pre-built field dictionary to identify and separate the fields in the data to be encrypted, thus obtaining the field sequence of the data to be encrypted. A rule matching pattern is constructed using a rule engine and regular expressions. Fields in the field sequence are matched, and the successfully matched fields are extracted as candidate fields. The context fields of the candidate fields are extracted to form a candidate field sequence. A word vector model is used to encode the fields in the candidate field sequence. A lightweight sensitive field identification module is used to identify sensitive fields in the word vector-encoded candidate field sequence. The probability that a candidate field in the candidate field sequence is a sensitive field is obtained, and candidate fields with a probability higher than a preset sensitive probability threshold are identified as sensitive fields.

3. The data conformal encryption parallel processing and transmission method as described in claim 2, characterized in that, Perform conformal structural analysis on the sensitive fields, including: The conformal structure analysis includes field boundary identification and generation of conformal encryption factors; The location of the sensitive field is extracted, and an initial boundary window containing the sensitive field is constructed. The information entropy of each character within the boundary window is calculated. Based on the information entropy, the sensitive field boundary window score of the boundary window is calculated, and the boundary window is fine-tuned until the boundary window length is less than a preset window length threshold. The boundary window containing the sensitive field and having the highest sensitive field boundary window score is selected as the sensitive boundary window for the sensitive field. The positions at both ends of the sensitive boundary window are used as the field boundaries of the sensitive field. The formula for calculating the sensitive field boundary window score is as follows: ； in, Indicates the presence of sensitive fields The boundary window, Represents the boundary window Sensitive field boundary window score, This indicates the sensitive fields output by the lightweight sensitive field identification module. The probability of being a sensitive field. Represents the boundary window Information entropy of internal field frequency distribution; The formula for generating the conformal encryption factor of the sensitive field is: ； in, This represents the conformal encryption factor for the sensitive field y. This represents the ID of the user associated with the data to be encrypted. This represents the timestamp used to generate the conformal encryption factor for the sensitive field y. This indicates splicing / joining. This represents a hash operation.

4. The data conformal encryption parallel processing and transmission method as described in claim 3, characterized in that, A conformal encryption algorithm incorporating conformal encryption factors is used to perform conformal encryption on the field to be encrypted, including: Extract the character sequence of the sensitive field within the corresponding sensitive boundary window, and use it as the field to be encrypted; The word vector model is used to encode the data to be encrypted to obtain the word vector data sequence corresponding to the data to be encrypted, and the word vector encoding result of the field to be encrypted is extracted; the word vector encoding result of the field to be encrypted is divided into a left half and a right half, and the word vector encoding result is encrypted by Feistel encryption wheel. After the wheel encryption is completed, the left half and the right half of the output of the last wheel encryption are concatenated to obtain the shape-preserving encryption result of the field to be encrypted. Replace the word vector encoding result of the field to be encrypted in the word vector data sequence with the shape-preserving encryption result of the field to be encrypted to obtain the encrypted ciphertext corresponding to the data to be encrypted.

5. The data conformal encryption parallel processing and transmission method as described in claim 4, characterized in that, The encrypted ciphertext is logically fragmented to obtain fragmented data of the encrypted ciphertext, including: Identify the shape-preserving encryption result of the field to be encrypted in the encrypted ciphertext, add binary fragmentation mark encoding, shape-preserving encryption result length encoding, and fragmentation sequence number encoding before the shape-preserving encryption result, use the character positions before the fragmentation mark encoding and fragmentation sequence number encoding as logical fragmentation positions, and logically fragment the encrypted ciphertext to obtain the fragmented data of the encrypted ciphertext.

6. The data conformal encryption parallel processing and transmission method as described in claim 5, characterized in that, The fragmented data includes a hash digest and fragment verification information, including: Perform a hash digest operation on the fragmented data to obtain the hash digest of the fragmented data; The fragmentation marker encoding, the shape-preserving encryption result length encoding, and the fragmentation sequence number encoding in the fragmented data are used as fragmentation verification information. The hash digest is appended to the fragment data to obtain fragment data with hash digest and fragment verification information.

7. The data conformal encryption parallel processing and transmission method as described in claim 6, characterized in that, A distributed scheduling strategy is used to send fragmented data with accompanying information to distributed nodes, including: The fragmented data with accompanying information is fragmented data with accompanying hash digest and fragmented verification information; The scheduling score between the fragmented data of the attached information and the distributed nodes is calculated sequentially. The fragmented data of the attached information is then sent to the distributed node with the highest scheduling score, which serves as the distributed scheduling strategy for the fragmented data of the attached information. The fragmented data of the attached information and the distributed nodes... The scheduling score between them is: , ； ； ； ； in, This represents the fragmented data containing accompanying information and the distributed nodes. The scheduling score between them Let N represent the nth distributed node, and N represent the total number of distributed nodes. This represents the scheduling weight coefficient. Represents distributed nodes Loading factor, The data fragments representing the accompanying information are located on the distributed nodes. The proportion of space capacity in the middle, This represents the fragmented data containing accompanying information and the distributed nodes. The communication quality of the communication link between them This indicates the preset maximum number of messages to be sent; Both represent the weight of the scheduling resources. Represents distributed nodes The transmission speed of transmitting fragmented data to the receiving end This indicates the preset maximum transmission speed. Represents distributed nodes The number of data fragments to be sent; The number of bits in the fragmented data containing accompanying information. Represents distributed nodes Number of available space bits; This represents the fragmented data (data) and distributed nodes that provide computational information. When scheduling score values, the data fragment sending end and the distributed nodes... Transmission delay between This indicates the preset maximum transmission delay.

8. The data conformal encryption parallel processing and transmission method as described in claim 1, characterized in that, The receiving end extracts the logical fragmentation order from the fragmentation verification information attached to the fragmented data, reassembles and decrypts the fragmented data, and compares the hash digests to perform data integrity and consistency verification, including: The receiving end receives the fragmented data with attached information, extracts the logical fragmentation order from the fragmentation verification information, and sorts the fragmented data with attached information according to the logical fragmentation order. Extract the hash digest from the fragmented data with accompanying information, remove the hash digest and fragment verification information from the fragmented data with accompanying information, recalculate the hash digest of the fragmented data, if the recalculated result is consistent with the extracted hash digest, it means that the data integrity and consistency verification has been passed, and the fragmented data is then decrypted.

Images