A method for encrypting network data transmission

Abstract

The present invention relates to the field of digital information transmission, and more particularly to a method for encrypting network data transmission. The method comprises: dividing all acquired transmission data into blocks to obtain multiple sub-data packets; taking all sub-data packets as input, calculating chaos control parameters and chaos initial values ​​corresponding to each sub-data packet based on the input, generating a chaotic sequence, and extracting key bits to generate a final key; the method of taking all sub-data packets as input includes characteristic intensity values, byte lengths, and position information of the sub-data packets; encrypting the sub-data packets according to the final key to generate ciphertext and authentication tags, and sending them to a receiver, thereby completing data transmission. The present invention encrypts the sub-data packets based on the final key generated by the characteristics of the sub-data packets, enabling the encryption method to better adapt to the characteristics of different data and effectively improving the security of network data transmission.

Description

Technical Field

[0001] The present invention relates to the field of digital information transmission, and more particularly to a method for encrypting network data transmission. Background Art

[0002] With the rapid development of the mobile internet era, the amount of network data is experiencing explosive growth. People frequently engage in various online activities in their daily lives, such as online shopping, online payments, social media interactions, remote work, and online learning. These activities generate massive amounts of data. This data includes users' personal information, such as names and contact information. Therefore, in the process of processing data from these many online activities, the focus on network data transmission security has never diminished and is becoming increasingly important.

[0003] Therefore, in order to meet the security requirements of network data, appropriate security measures should be adopted to protect the data. These security measures include but are not limited to encrypting the data using encryption technology to ensure that even if the data is intercepted during transmission, it cannot be easily deciphered.

[0004] Existing technologies, such as the patent application document with publication number CN117319041A, disclose a method for encrypting and transmitting network communication data. This data encryption and transmission method first divides the transmission data into sub-data packets according to a preset threshold, generates a first encryption key based on a public key, then counts the frequency and weight of the data type of each sub-data packet, calculates the eigenvalue to generate a corresponding binary number, and then derives the encryption key for subsequent sub-data packets. Finally, the sub-data packets are encrypted with each key and the ciphertext is spliced ​​for transmission.

[0005] However, the key generation in the above data encryption transmission method depends on the public key and the number of sub-data packets, which easily leads to strong key regularity and easy cracking during the generation process. Summary of the Invention

[0006] In order to solve the technical problem that the key generation of the above-mentioned data encryption transmission method depends on the public key and the number of sub-data packets, and this generation method easily makes the key regular and has the risk of being cracked, the present invention provides the following technical solution.

[0007] A method for encrypting network data transmission, comprising:

[0008] Encode and compress all network data that need to be transmitted to obtain all processed transmission data;

[0009] Divide all transmitted data into multiple sub-data packets;

[0010] Taking all sub-data packets as input, calculating the chaos control parameters and chaos initial values ​​corresponding to each sub-data packet based on the input, generating a chaotic sequence, and extracting key bits to generate a final key; taking all sub-data packets as input includes characteristic intensity values, byte lengths, and position information of the sub-data packets;

[0011] The sub-data packet is encrypted according to the final key to generate ciphertext and authentication tag, which are then sent to the receiver to complete the data transmission.

[0012] Chaotic systems are sensitive to initial conditions and parameters; even minor changes can result in completely different chaotic sequences. Therefore, keys generated based on chaotic systems are highly secure and difficult to crack, effectively protecting the confidentiality of data during transmission. In the present invention, the characteristic intensity values, byte length, and position information of sub-data packets are used as input to calculate chaotic control parameters and initial chaotic values, thereby generating a chaotic sequence and extracting key bits to form the final key. This key generation method is closely related to the data itself, resulting in a unique key for each data transmission process. This increases the randomness and unpredictability of the key, effectively protecting the confidentiality of the data.

[0013] Preferably, the blocks include:

[0014] All transmitted data is regarded as a data segment. According to the pre-defined sliding window, starting from the start position of the data segment, the sliding window moves byte by byte. Each time the sliding window moves, the characteristic strength value of the transmitted data within the window is calculated.

[0015] The right edge of the window with the largest characteristic strength value is selected as the block boundary, and the operations of sliding, calculating the characteristic strength value and determining the block boundary are repeated for the remaining unblocked transmission data until the data segment is divided into several sub-data packets.

[0016] A sliding window is used to calculate the characteristic strength of the data transmitted within it, and the right edge of the window with the highest characteristic strength value is selected as the block boundary. This block division method is not simply based on fixed lengths or fixed intervals, but is based on the characteristics of the data itself. This allows for more reasonable determination of the block location, ensuring that each sub-packet has a certain degree of independence and representativeness in terms of data characteristics. This block division operation generates sub-packets with more random and diverse characteristics, which helps to improve the security of the encryption and increase the difficulty of cracking.

[0017] Preferably, the characteristic intensity value of the sub-data packet satisfies the relationship:

[0018] Where, For the The characteristic intensity value of each sub-packet, For the The information entropy of the data type transmitted in each sub-packet is For the In the sub-packet The number of occurrences of the transport data type, For the In the sub-packet The longest continuous length of the transmission data type in this sub-packet, For the The length of the sub-packet, The number of types of data transmitted in this sub-packet.

[0019] Information entropy Reflects the complexity and uncertainty of the data type transmitted in the sub-packet. and the longest continuous length It reflects the distribution of data types, especially whether certain data types appear frequently or continuously. It serves as a normalization factor, allowing sub-packets of different lengths to be compared on the same scale; by fusing information entropy, frequency, and continuity features, it provides a multi-dimensional quantitative indicator for the sub-packet.

[0020] Preferably, the chaos control parameters satisfy the relationship:

[0021] Where, For the The chaotic parameters required when generating chaotic sequences for sub-data packets, For the The characteristic intensity value of each sub-packet, For the The length of the sub-packet, represents the normalization process, where 、 All are parameters.

[0022] Chaotic system parameters Highly sensitive, small changes can lead to significant differences in chaotic trajectories. With the characteristics of the sub-packet ( and ) association, different chaotic sequences can be generated for different data packets, enhancing the dynamics and unpredictability of the system.

[0023] Preferably, the chaotic initial value satisfies the relationship:

[0024] Where, For the The corresponding chaotic initial value when the sub-data packets generate chaotic sequences, For the The length of the sub-packet, For the The position number of each sub-packet in the data segment, Indicates byte splicing, A fast checksum algorithm.

[0025] Chaotic systems are extremely sensitive to initial values. A slight difference in initial values ​​can lead to completely different sequences. By dynamically generating initial values, attackers cannot infer the initial values ​​of other sub-packets from a known chaotic sequence, thus enhancing the anti-attack capability. and position number Different, through byte splicing ( ) to generate unique input data. The algorithm maps the input into a 32-bit check value to ensure that inputs of different sub-packets do not produce the same check result.

[0026] Preferably, generating a chaotic sequence includes:

[0027] After determining the chaos control parameters and chaos initial values ​​corresponding to the sub-packets, the chaotic sequence is iteratively generated using the Logistic mapping formula. In the initial stage of generating the chaotic sequence, the values ​​generated by the first set number of iterations are discarded, and only the values ​​generated by subsequent iterations are used.

[0028] Preferably, extracting key bits and generating a final key comprises:

[0029] Several floating-point numbers are selected from the chaotic sequence, and the specified binary bits after the decimal point of each floating-point number are extracted as the key bit source; these bits are concatenated and hashed with SHA-256 to generate the final key.

[0030] The beneficial effects of the present invention are:

[0031] The present invention first divides the transmitted data into multiple sub-data packets using a segmentation method based on a sliding window and characteristic strength values. This segmentation method does not simply divide the data into equal parts, but rather divides the data based on its own characteristics (such as its characteristic strength value). This allows each sub-data packet to better reflect the inherent characteristics of the data, providing a basis for subsequent key generation based on the sub-data packet characteristics, while also helping to improve the targetedness and security of encryption. Then, based on information such as the characteristic strength value and byte length of the sub-data packet, a specific formula is used to calculate the chaos control parameters and chaos initialization values. Different sub-data packets have different characteristics, resulting in different chaos control parameters and chaos initialization values, which in turn increases the complexity and randomness of the key. The key generation method based on the chaotic sequence makes the key highly random and unpredictable, greatly improving the security of encryption. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 This is a method flow chart of steps S1 to S4 in a method for encrypting network data transmission according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0034] Reference Figure 1 A method for encrypting network data transmission includes steps S1 to S4, which are as follows:

[0035] S1: Encode and compress all network data that need to be transmitted to obtain all processed transmission data.

[0036] In one embodiment, all generated data is first collected from network activities. This data covers various behavioral records of users during network usage, such as the web addresses visited by users, data generated during user sessions, and user browsing records (including access time, etc.).

[0037] It is important to note that the data collection process described above only collects data necessary for encrypted transmission, avoiding excessive collection. For example, when encrypting web browsing data, only the URL of the web page visited and the associated browsing time are collected, without collecting irrelevant information such as the user's device model or operating system version.

[0038] Since directly transmitting the collected data may result in problems such as large data volume and slow transmission speed, it is necessary to process the data to improve transmission efficiency.

[0039] Use Unicode to encode network data to be transmitted. Unicode is a character encoding standard that assigns a unique numerical identifier (code point) to nearly every character in the world. Unicode encoding converts various characters (including characters and symbols from different languages) into a binary form that computers can process, ensuring that data can be correctly represented and transmitted between different systems and platforms.

[0040] The encoded data is further compressed using the Lz77 compression algorithm. Lz77 is a dictionary-based lossless data compression algorithm that exploits repetitive patterns in data. It finds repeated strings and replaces them with pointers to previous occurrences and their lengths, reducing data redundancy and compressing the data. This compression reduces the size of the data, saving bandwidth and time during transmission.

[0041] After being processed by Unicode encoding and Lz77 compression algorithm, the result is processed transmission data, which can be used for subsequent transmission and analysis operations more efficiently.

[0042] It should be noted that

[0043] S2: Divide all transmitted data into blocks to obtain multiple sub-data packets.

[0044] During data transmission, data may pass through multiple network nodes, posing the risk of eavesdropping. By using packet encryption, even if an attacker intercepts the data packet, they cannot directly read the content.

[0045] Static chunking is a method that segments the transmitted data into multiple packets based on a fixed threshold. Specifically, each data segment is split based on a pre-set fixed size (for example, a packet size of 1024 bytes). This results in multiple smaller packets of the same size.

[0046] However, the above-mentioned block pattern can easily lead to uneven data distribution and a short tail block. In this case, pattern analysis attacks can be used to infer data structure, identify repeated patterns, and reduce encryption strength, thereby increasing the risk of data leakage.

[0047] In the embodiment of the present invention, a dynamic block operation is proposed to make the length of the sub-data packet variable and avoid fixed pattern attacks.

[0048] Specifically, first, define the sliding window parameters. For example, the window size is set to 100 bytes (i.e., 100-byte data segments are analyzed at a time), the window sliding step is set to 1 byte (the window moves right by 1 byte at a time), the upper block limit is set to 200 bytes, and the lower block limit is set to 100 bytes, thus obtaining a sliding window. The window size, sliding step, and upper and lower block limits can be dynamically adjusted based on the length of the data segment and the granularity of the data analysis required.

[0049] Then, all the transmission data obtained by the above S1 is taken as a data segment (wherein the transmission data is arranged according to the collected timestamp to obtain the data segment). Starting from the starting position of the data segment, the sliding window moves byte by byte. Each time the window moves, the feature strength of the data in the current sub-window is calculated to evaluate whether the current sub-window is suitable as a block boundary.

[0050] Exemplarily, the calculation process of the characteristic intensity value is as follows:

[0051] For the current window, which contains 100 bytes of transmitted data, count the number of occurrences of each transmitted data type (such as ASCII characters and binary characters) within the window, as well as the longest consecutive occurrence length of each transmitted data type within the window. The frequency and continuity of all transmitted data types are combined to reflect data complexity.

[0052] The characteristic intensity value of the data transmitted within the window is calculated by comprehensively considering the frequency and continuity of all transmitted data types, which satisfies the following relationship:

[0053]

[0054] Where, is the characteristic intensity value of the data transmitted in the current window, The information entropy of the data type transmitted in the current window (to quantify the randomness of the data), The number in the current window The number of occurrences of the transport data type, The number in the current window The longest continuous length of a transmission data type in the window, is the length of the current window, The number of types of data transmitted in the current window.

[0055] The higher the entropy, the The larger the entropy is, the more disordered the data in the window is and the higher the security is. On the contrary, the lower the entropy is, the more ordered the data is, such as continuous repeated characters, which are easy to predict. Indicates the The frequency of occurrence of a transmission data type in the current window, that is, the distribution density of this type of data in the window. Multiply them together to comprehensively measure the local aggregation of this type of data. If a certain type of data appears frequently (high frequency) and clusters continuously (long continuous segments), then its local aggregation is The contribution is significant.

[0056] Finally, the blocks are divided according to the feature intensity value, and the block division process is as follows:

[0057] Step 1: Initialization: Start from the beginning of the data segment; Step 2: Slide the window rightward by 1 byte each time and calculate the characteristic strength value of the data transmitted in the current window. ; Step 3, find The largest window uses its right edge as the block boundary; the fourth step is to continue sliding the window for the remaining data until all data blocks are completed and multiple sub-data packets are obtained.

[0058] It should be noted that after the block is completed, it is necessary to ensure that the length of each block is between 100 and 200 bytes.

[0059] S3: Taking all sub-data packets as input, calculating the chaos control parameters and chaos initial values ​​corresponding to each sub-data packet based on the input, generating a chaotic sequence, and extracting the key bits to generate the final key; the step of taking all sub-data packets as input includes the characteristic intensity value, byte length, and position information of the sub-data packet.

[0060] In order to solve the problem that key generation in the data encryption transmission method depends on the public key and the number of sub-data packets, which easily leads to the regularity of the key and is thus cracked by attackers, in an embodiment of the present invention, a chaotic sequence is used to generate a key for encrypting the sub-data packets.

[0061] The sequences generated by chaotic maps (such as the logistic chaotic map) are highly random, similar to truly random numbers. This randomness makes the key difficult to predict and crack. Even if an attacker knows part of the key or certain parameters of the chaotic map, the sensitivity and complexity of the chaotic sequence make it difficult to infer the complete key. Furthermore, chaotic maps are highly sensitive to initial values ​​and control parameters; even slight changes in these initial values ​​or parameters can result in a completely different chaotic sequence. This property ensures that the key generated for each sub-packet is unique, enhancing encryption security.

[0062] In an embodiment of the present invention, by analyzing the characteristic intensity, byte length and position information of the sub-packets, the chaos control parameters and initial values ​​are determined, the chaotic sequence is generated using the Logistic chaotic map, and the key bits are extracted from it, and finally the final key is generated through the hash algorithm.

[0063] First, the characteristic strength value of the sub-packet is calculated similarly using the calculation formula for the characteristic strength value of the data transmitted in the window in S2, that is, the relationship is satisfied:

[0064]

[0065] Where, For the The characteristic intensity value of each sub-packet, For the The information entropy of the data type transmitted in each sub-packet (to quantify the randomness of the data), For the In the sub-packet The number of occurrences of the transport data type, For the In the sub-packet The longest continuous length of the transmission data type in this sub-packet, For the The length of the sub-packet, The number of types of data transmitted in this sub-packet.

[0066] The characteristic intensity values ​​of other sub-data packets can be calculated similarly based on the above operations.

[0067] It should be noted that the formula for generating chaotic sequences using Logistic chaotic mapping is: ,in, is the chaos control parameter, These two parameters have a significant impact on the generation of chaotic sequences because they determine the system's dynamic behavior (such as whether it enters a chaotic state, the randomness and complexity of the sequence, etc.). In cryptographic applications, chaotic sequences are often used as key streams, so the choice of these parameters is directly related to the security and unpredictability of the key.

[0068] The feature strength of different sub-packets may be different, and dynamically adjusting parameters can avoid the periodicity or predictability of the sequence caused by using fixed parameters.

[0069] Therefore, based on the characteristic intensity value of the sub-packet and the length of the subpacket Calculate the chaos control parameters. For example, When a chaotic sequence is generated by a sub-data packet, the corresponding chaotic control parameter The relationship is as follows:

[0070]

[0071] Where, For the The chaotic parameters required when generating chaotic sequences for sub-data packets, For the The characteristic intensity value of each sub-packet, For the The length of the sub-packet, represents the normalization process, where 、 are parameters, and The value is 3.6, The value is 4, which means .

[0072] Chaos Control Parameters of Logistic Chaotic Mapping Limited to Because: When When it is greater than or equal to 3.6, the system completely enters the chaotic region. When it is less than or equal to 4, the output is within the domain of definition; secondly, the randomness and unpredictability of the chaotic sequence in this interval are the strongest, which is suitable for encryption.

[0073] Therefore, the above operation dynamically adjusts the chaotic parameters by combining the characteristic strength and length of the sub-packet, while ensuring that the chaotic parameters are Under the premise of being within the range, a stronger chaos effect is used for more important data or longer data packets to improve the security and robustness of the encryption system.

[0074] Furthermore, the position information of the sub-packet is used to calculate the initial value of chaos. When a sub-data packet generates a chaotic sequence, the corresponding chaotic initial value satisfies the relationship:

[0075]

[0076] Where, For the The corresponding chaotic initial value when the sub-data packets generate chaotic sequences, For the The length of the sub-packet, For the The position number of each sub-packet in the data segment, Indicates byte splicing, A fast checksum algorithm.

[0077] The above calculation formula first inputs the parameters as follows: and , then and After converting to byte stream, directly splice and calculate the spliced ​​bytes Checksum, generate a 32-bit unsigned integer, and then perform modulo ( ) and normalized ( ), and finally the initial value of chaos is between 0 and 1.

[0078] Among them, the check value calculated by the CRC32 algorithm is a 32-bit integer, and the remainder operation ( ) can extract the lower 16 bits of this 32-bit integer. These lower 16 bits typically contain more detail and variation, providing richer randomness for the chaotic initial value. Furthermore, since the result of the modulo operation ranges from 0 to 65535, dividing by 65536 yields a floating-point number between 0 and 1, which more evenly covers all possible values ​​between 0 and 1.

[0079] In getting the When a chaotic sequence is generated by a sub-data packet, the corresponding chaotic control parameter and the initial value of chaos Afterwards, from Initially, a chaotic sequence can be generated by repeatedly applying the Logistic mapping formula. However, at the beginning of the chaotic sequence generation, due to the influence of the initial value, the sequence may have a transient process, and the values ​​in this process may not be random enough. In order to eliminate this transient effect, the values ​​obtained in the first 1000 iterations are usually discarded, and only the values ​​after that are used. After discarding the first 1000 iterations, the iteration continues, and each iteration will get a new floating-point number. From the chaotic sequence obtained by continuing the iteration, eight floating-point numbers are obtained. For each floating-point number, the binary representation of the 32 bits after the decimal point is extracted. These binary bits will be used as the bit source of the key. The 32 binary bits extracted from the eight floating-point numbers are spliced ​​to form a 256-bit binary sequence. The SHA-256 hash algorithm is applied to this 256-bit binary sequence to obtain a 256-bit hash value. This hash value is the first The final key of each sub-packet.

[0080] The final keys of other sub-data packets can be obtained similarly according to the above operations.

[0081] S4: The sub-data packet is encrypted according to the final key to generate a ciphertext and an authentication tag, which are then sent to the receiver to complete the data transmission.

[0082] After obtaining the final key for all sub-data packets, AES-GCM encryption is used.

[0083] AES-GCM (Advanced Encryption Standard - Galois / Counter Mode) is an authenticated encryption algorithm that provides confidentiality (encrypting data to generate ciphertext), integrity (generating an authentication tag to prevent data tampering), and authenticity (optional source authentication).

[0084] Then perform the following operations on each sub-packet:

[0085] The first step is to encrypt the plaintext with the AES key to generate the ciphertext.

[0086] The second step is to calculate the additional authentication tag (usually 128 bits) through the GCM mode, which is used by the receiver to verify the integrity of the data.

[0087] The third step is to assemble the encrypted sub-packets (ciphertext + authentication tag) into a format suitable for network transmission (such as TCP / UDP data packets, HTTP messages, etc.), and at the same time, securely transmit the key envelope (Key Envelope).

[0088] Step 4: Send the combined data unit and key envelope to the recipient. Upon receipt, the recipient can decrypt the data unit using the key in the key envelope and verify the integrity and authenticity of the data using the authentication tag. If verification succeeds, the data has not been tampered with during transmission, and the recipient can safely use the decrypted data.

[0089] At this point, all operations for data encryption transmission are completed.

[0090] It should be noted that those skilled in the art may make various modifications and improvements without departing from the scope of the present invention, and these modifications and improvements fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be based on the appended claims.

Claims

1. A method for encrypting network data transmission, characterized in that: include: Encode and compress all network data that need to be transmitted to obtain all processed transmission data; All transmitted data is divided into multiple sub-data packets based on a sliding window. For each data type in a sub-data packet, the product of its frequency of occurrence and the longest continuous occurrence length is calculated and accumulated. The accumulated result is multiplied by the information entropy of the sub-data packet to obtain the characteristic strength value of the sub-data packet. Taking all sub-data packets as input, calculating the chaos control parameters and chaos initial values ​​corresponding to each sub-data packet based on the input, generating a chaotic sequence, and extracting key bits to generate a final key; taking all sub-data packets as input includes characteristic intensity values, byte lengths, and position information of the sub-data packets; The chaos control parameters satisfy the relationship: Where, For the The chaotic parameters required when generating chaotic sequences for sub-data packets, For the The characteristic intensity value of each sub-packet, For the The length of the sub-packet, represents the normalization process, where 、 All are parameters; The chaotic initial value satisfies the relationship: Where, For the The corresponding chaotic initial value when the sub-data packets generate chaotic sequences, For the The length of the sub-packet, For the The position sequence number of each sub-packet in the data segment, where all transmitted data is regarded as one data segment. Indicates byte splicing, It is a fast checksum algorithm; The sub-data packet is encrypted according to the final key to generate ciphertext and authentication tag, which are then sent to the receiver to complete the data transmission.

2. The method for encrypting network data transmission according to claim 1, wherein: The blocks include: According to the predefined sliding window, starting from the starting position of the data segment, the sliding window moves byte by byte, and each time the sliding window moves, the characteristic strength value of the data transmitted within the window is calculated; The right edge of the window with the largest characteristic strength value is selected as the block boundary, and the operations of sliding, calculating the characteristic strength value and determining the block boundary are repeated for the remaining unblocked transmission data until the data segment is divided into several sub-data packets.

3. The method for encrypting network data transmission according to claim 2, wherein: The generating chaotic sequence comprises: After determining the chaos control parameters and chaos initial values ​​corresponding to the sub-packets, the chaotic sequence is iteratively generated using the Logistic mapping formula. In the initial stage of generating the chaotic sequence, the values ​​generated by the first set number of iterations are discarded, and only the values ​​generated by subsequent iterations are used.

4. The method for encrypting network data transmission according to claim 3, wherein: Extracting key bits and generating a final key includes: Several floating-point numbers are selected from the chaotic sequence, and the specified binary bits after the decimal point of each floating-point number are extracted as the key bit source; these bits are concatenated and hashed with SHA-256 to generate the final key.

Images