Communication encryption method and device, equipment, storage medium and computer program product

Abstract

The invention relates to the technical field of communication security, in particular to a communication encryption method and device, equipment, a storage medium and a computer program product. The method comprises the following steps: dynamically generating a main session key between two communication parties based on a preset key negotiation protocol; dynamically generating sub-keys according to a preset time interval based on the main session key and the key sequence; performing encryption processing on each data block in the communication data stream based on the sub-key and the encryption strategy; generating a message authentication code for each encrypted data block; adding timestamp information based on the message authentication code, and introducing a random offset into the timestamp information; and the encrypted data blocks, the message authentication code and the timestamp information are packaged into the target data message, so that the transmission security of the communication data is improved.

Description

Technical Field

[0001] The present application relates to the field of communication security technology, and in particular to a communication encryption method, apparatus, device, storage medium and computer program product. Background Art

[0002] With the rapid development of information and communication technologies, network communications have become widely used in key sectors such as finance, energy, and industrial control. At the same time, security threats to communication data are becoming increasingly severe. Attack methods such as data theft, tampering, replay attacks, and traffic analysis are constantly evolving, posing significant risks to the reliability and confidentiality of communication systems. Existing communication encryption methods typically rely on static session keys for data encryption and transmission. These methods lack flexibility and dynamism, making them unable to effectively address the risk of key leakage during medium- and long-term communications, resulting in poor communication data transmission security. Therefore, improving the security of communication data transmission has become a pressing technical challenge. Summary of the Invention

[0003] The main purpose of this application is to provide a communication encryption method, device, equipment, storage medium and computer program product, aiming to solve the technical problem of how to improve the transmission security of communication data.

[0004] To achieve the above objectives, the present application provides a communication encryption method, which includes the following steps:

[0005] Based on the preset key negotiation protocol, a master session key is dynamically generated between the communicating parties;

[0006] Dynamically generate subkeys based on the master session key and the key sequence at preset time intervals;

[0007] Encrypting each data block in the communication data stream based on the subkey and encryption strategy;

[0008] Generate a message authentication code for each encrypted data block;

[0009] Based on the message authentication code, adding timestamp information, wherein a random offset is introduced into the timestamp information;

[0010] The encrypted data blocks, the message authentication code and the timestamp information are encapsulated into a target data message.

[0011] In one embodiment, before the step of encrypting each data block in the communication data stream based on the subkey and the encryption policy, the method further includes:

[0012] Obtain communication frequency, data block type, and session behavior characteristics;

[0013] Analyzing the communication frequency, the data block type, and the conversation behavior characteristics based on a communication behavior graph model;

[0014] The encryption strategy is determined according to the analysis result.

[0015] In one embodiment, before the step of analyzing the communication frequency, the data block type, and the session behavior characteristics based on the communication behavior graph model, the method further includes:

[0016] Extract communication behavior sequences based on historical communication data;

[0017] Acquire communication state information, and define a model node set and a model edge set based on the communication state information and a preset behavior transfer relationship;

[0018] Generate a model infrastructure based on the communication behavior sequence, the model node set, and the model edge set;

[0019] Acquire real-time communication information, and map the real-time communication information to corresponding graph nodes of the model infrastructure;

[0020] Based on the mapping results, the frequency weights of the model infrastructure edges are adjusted to obtain the communication behavior graph model.

[0021] In one embodiment, the method further comprises:

[0022] Introducing a pseudo-random delay to the sending time of the target data message, wherein the pseudo-random delay does not exceed a preset delay range;

[0023] If a plurality of target data messages are detected to be sent continuously, the delay amplitude of the pseudo-random delay is controlled to change dynamically within a preset amplitude range.

[0024] In one embodiment, the step of adding timestamp information based on the message authentication code and introducing a random offset into the timestamp information includes:

[0025] Based on the message authentication code, obtain the current time and use the current time as the initial value of the original timestamp;

[0026] Generate a random offset based on a pseudo-random number generation algorithm;

[0027] Determining a disturbance timestamp according to the original timestamp initial value and the random offset;

[0028] The disturbance timestamp is bound to the message authentication code.

[0029] In one embodiment, the step of dynamically generating subkeys at preset time intervals based on the master session key and the key sequence includes:

[0030] At the beginning of communication, the current time is recorded as the reference time for generating the subkey, and a preset time period counter is started;

[0031] When the preset time period counter reaches the preset time interval, based on the master session key and the key sequence, a current period number of the preset time period counter is used as an input parameter;

[0032] Based on the input parameters, the key derivation function is called to dynamically generate the subkey.

[0033] In addition, to achieve the above-mentioned purpose, the present application also proposes a communication encryption device, which includes:

[0034] A master key module is used to dynamically generate a master session key between the communicating parties based on a preset key negotiation protocol;

[0035] A subkey module, configured to dynamically generate subkeys based on the master session key and the key sequence at preset time intervals;

[0036] An encryption module, configured to encrypt each data block in the communication data stream based on the subkey and the encryption strategy;

[0037] An authentication module, used to generate a message authentication code for each encrypted data block;

[0038] A timestamp module, configured to add timestamp information based on the message authentication code, wherein a random offset is introduced into the timestamp information;

[0039] The target module is used to encapsulate the encrypted data blocks, the message authentication code and the timestamp information into a target data message.

[0040] In addition, to achieve the above-mentioned purpose, the present application also proposes a communication encryption device, which includes: a memory, a processor, and a communication encryption program stored on the memory and runnable on the processor, and the communication encryption program is configured to implement the steps of the communication encryption method described above.

[0041] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, on which a communication encryption program is stored. When the communication encryption program is executed by a processor, the steps of the communication encryption method described above are implemented.

[0042] In addition, to achieve the above-mentioned purpose, the present application also proposes a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the steps of the communication encryption method described above.

[0043] This application is based on a preset key negotiation protocol, dynamically generates a master session key between the communicating parties; based on the master session key and the key sequence, dynamically generates subkeys at preset time intervals; encrypts each data block in the communication data stream based on the subkeys and the encryption strategy; generates a message authentication code for each encrypted data block; based on the message authentication code, adds timestamp information, and introduces a random offset into the timestamp information; and encapsulates each encrypted data block, the message authentication code, and the timestamp information into a target data message. This application achieves dynamic key update during communication by dynamically generating a master session key based on a preset key negotiation protocol between the communicating parties, and generating subkeys based on the master session key and the key sequence at preset time intervals, thereby effectively reducing the risk of key leakage; encrypting each data block in the communication data stream based on the subkey and encryption strategy ensures the confidentiality of the data; generating a message authentication code for each encrypted data block, and adding timestamp information with a random offset based on the authentication code, further enhancing the data integrity verification capability and anti-replay attack capability; finally, encapsulating the encrypted data, message authentication code and timestamp information into a target data message, achieving security protection of data in the structured transmission process, and improving the transmission security of communication data. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a flow chart of the first embodiment of the communication encryption method of the present application;

[0045] Figure 2 This is a schematic diagram of a sub-flow in the second embodiment of the communication encryption method of this application;

[0046] Figure 3 This is a schematic diagram of a sub-flow in the third embodiment of the communication encryption method of this application;

[0047] Figure 4 This is a schematic diagram of the module structure of the communication encryption device according to an embodiment of the present application;

[0048] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the communication encryption method in the embodiment of the present application.

[0049] The realization of the objectives, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0050] It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application.

[0051] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0052] It's important to note that with the rapid development of information and communications technology, network communications have become widely used in key sectors such as finance, energy, and industrial control. At the same time, security threats to communication data are becoming increasingly severe. Attack methods such as data theft, tampering, replay attacks, and traffic analysis are constantly evolving, posing significant risks to the reliability and confidentiality of communication systems. Existing communication encryption methods typically rely on static session keys for data encryption and transmission. These methods lack flexibility and dynamism, making them unable to effectively address the risk of key leakage during medium- and long-term communications, resulting in suboptimal communication data transmission security. Therefore, improving the security of communication data transmission has become a pressing technical challenge.

[0053] The main solution of this application is: based on a preset key negotiation protocol, a master session key is dynamically generated between the communicating parties; based on the master session key and the key sequence, subkeys are dynamically generated at preset time intervals; based on the subkeys and the encryption strategy, each data block in the communication data stream is encrypted; a message authentication code is generated for each encrypted data block; based on the message authentication code, timestamp information is added, and a random offset is introduced into the timestamp information; and each encrypted data block, message authentication code and timestamp information are encapsulated into a target data message.

[0054] This application achieves dynamic key update during communication by dynamically generating a master session key based on a preset key negotiation protocol between the communicating parties, and generating subkeys based on the master session key and the key sequence at preset time intervals, thereby effectively reducing the risk of key leakage; encrypting each data block in the communication data stream based on the subkey and encryption strategy ensures the confidentiality of the data; generating a message authentication code for each encrypted data block, and adding timestamp information with a random offset based on the authentication code, further enhancing the data integrity verification capability and anti-replay attack capability; finally, encapsulating the encrypted data, message authentication code and timestamp information into a target data message, achieving security protection of data in the structured transmission process, and improving the transmission security of communication data.

[0055] It should be noted that the execution subject of the method of this embodiment can be a computing service device with data processing, network communication, and program execution functions, or it can be the above-mentioned communication encryption device with the same or similar functions. This embodiment and the following embodiments will be described using the communication encryption device as an example.

[0056] Based on this, the first embodiment of the communication encryption method of this application is proposed, please refer to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the communication encryption method of the present application.

[0057] In this embodiment, the communication encryption method includes the following steps:

[0058] S1: Based on the preset key negotiation protocol, a master session key is dynamically generated between the communicating parties;

[0059] It should be noted that the preset key agreement protocol refers to a pre-set encryption protocol used by the communicating parties to negotiate a shared key in an insecure channel. Commonly used protocols include Diffie-Hellman (DH) or Elliptic Curve Diffie-Hellman (ECDH). The communicating parties refer to the two entities that perform encrypted communication in the network, usually including the sender and the receiver. The master session key is the core key used in the communication process, which is used to derive other encryption keys (such as subkeys). The key is generated at the beginning of the session and is used for security operations during the entire communication session. Dynamic generation refers to the real-time generation of keys based on the current communication context or random factors, rather than pre-setting or static distribution.

[0060] Specifically, during the initial communication phase, the two communicating parties first exchange information using a pre-defined key agreement protocol. Each party generates its own key pair and sends its public key to the other party. The key agreement protocol ensures that even an attacker who can eavesdrop on the transmission cannot calculate the shared key. The two communicating parties then use their own private keys and the other party's public key to calculate the same shared secret, which is then used to generate the master session key.

[0061] Furthermore, once the master session key is generated, it serves as the foundational key source for subsequent data encryption, subkey derivation, and integrity authentication. This entire process eliminates the need for a third-party key distribution center, ensuring high flexibility and anti-eavesdropping capabilities. Furthermore, in new communication sessions, both parties renegotiate the key, ensuring each session uses a unique key, enhancing the temporary nature and secure isolation of communication sessions.

[0062] This step effectively prevents the long-term leakage risks associated with static keys by dynamically generating a master session key between the communicating parties. This ensures that the core key used in each communication session is unique and unpredictable, thereby enhancing confidentiality and attack resistance during the initial communication phase. Furthermore, the master session key negotiated using the key agreement protocol serves as the secure foundation for all encryption and authentication operations throughout the communication session, providing reliable support for subsequent subkey derivation and data protection mechanisms, further enhancing the overall security and anti-eavesdropping capabilities of the communication system.

[0063] S2: Dynamically generate subkeys based on the master session key and the key sequence at preset time intervals;

[0064] It should be noted that a key sequence is a set of parameters used in key derivation, including counter values, communication round numbers, or pseudo-random seeds, to enhance the uniqueness and unpredictability of subkeys. A preset interval is a fixed periodicity set to trigger subkey updates, such as every 100 milliseconds, to ensure the temporal dynamics of subkeys. Subkeys are short-lived keys dynamically generated from a master session key. They are often used for segmented encryption of communication data, offering enhanced security and the ability to be frequently updated.

[0065] Specifically, during the communication process, the system triggers the generation of subkeys at preset intervals based on the master session key and the current key sequence information (such as a timestamp or update counter). Whenever this interval (e.g., 100 milliseconds) is reached, the system inputs the master session key and the current key sequence parameters into predefined key derivation logic to generate a new subkey. This derivation logic can be implemented using a pseudorandom function or cryptographic hash algorithm to ensure the uniqueness and unpredictability of each subkey.

[0066] Furthermore, the generated subkey is valid only within its corresponding time period and is used to encrypt data blocks within that time period. As communication continues, this step is repeated periodically, constantly replacing the subkeys in use, forming a "rolling update" key mechanism. This mechanism not only improves the dynamic security of data but also helps reduce the security impact of a single key being compromised.

[0067] This step dynamically generates subkeys at preset intervals based on the master session key and key sequence, enabling high-frequency key updates during communications and significantly improving the security of the key system. This approach assigns a different encryption key to each segment of data. Even if an attacker intercepts part of the data, it is difficult to use the known key to derive the key content for other time periods, effectively limiting the scope of potential leaks. Furthermore, this mechanism improves the encryption system's defenses against timing attacks and key reuse attacks, thereby enhancing the overall security of the communication link during data encryption.

[0068] S3: Encrypting each data block in the communication data stream based on the subkey and encryption strategy;

[0069] S4: Generate a message authentication code for each encrypted data block;

[0070] It should be noted that the encryption strategy refers to the specific encryption method selected based on data attributes, system configuration, or security level, including encryption algorithm, encryption mode, and key length. For example, symmetric encryption algorithms such as AES, ChaCha20, or SM4 are used. A communication data stream refers to a collection of data continuously transmitted during communication, usually divided into multiple consecutive data blocks for processing based on time or logic. A data block refers to the processing units formed by dividing the communication data stream, facilitating block-by-block encryption and authentication. A message authentication code (MAC) is an integrity check mechanism used to verify whether encrypted data has been tampered with during transmission. It is generated by jointly calculating the key and the data.

[0071] Specifically, based on the dynamic updating of subkeys, the continuously received or to-be-sent communication data stream is segmented into several logically continuous data blocks. For each data block, an encryption algorithm and mode are selected based on the currently valid subkey and the preset encryption strategy, and the data block is encrypted to ensure the confidentiality of the data content.

[0072] Furthermore, after encryption is complete, a message authentication code (MAC) is calculated for each encrypted data block to ensure that the data has not been tampered with during transmission. This MAC value is calculated using the current subkey and the encrypted data, typically using an authentication algorithm based on a hash function (such as HMAC). Each data block is accompanied by a unique MAC value, allowing the recipient to verify its integrity and legitimacy upon receipt.

[0073] By encrypting each communication data block based on a subkey and encryption strategy, and calculating a message authentication code on the encrypted data, dual security protection is achieved during the transmission of communication data. On the one hand, encryption ensures the confidentiality of the data content, making it difficult to decrypt even if intercepted by a third party. On the other hand, the key-generated message authentication code provides a strong integrity verification mechanism that can effectively detect and prevent data tampering, forgery, or replay. This combined mechanism not only improves the anti-attack capability of communication data, but also enhances communication security capabilities.

[0074] S5: Adding timestamp information based on the message authentication code, wherein a random offset is introduced into the timestamp information;

[0075] It's important to note that timestamp information, typically in milliseconds or microseconds, identifies the time when data was generated or sent. This helps identify the freshness or order of data. Random offsets are pseudo-random variations introduced to the original time. These changes are used to perturb timestamps, disrupting the apparent timing characteristics of the data and preventing attackers from inferring communication patterns through timing analysis.

[0076] Specifically, after generating and appending a message authentication code (MAC), a timestamp is added to each data block. This timestamp primarily records the time when the data block was generated or encrypted, typically based on the local system time. To enhance security, a random offset is introduced to the timestamp rather than directly appending the actual time.

[0077] Furthermore, this random offset can be dynamically generated using a pseudo-random number generator, with its value range set within a certain range, such as ±500 microseconds. The timestamp with the added random offset is then encapsulated with the corresponding data block and message authentication code to form a complete data message. This timestamp not only serves as time verification for subsequent communication nodes but also introduces perturbations that disrupt the temporal regularity of the data stream, enhancing the stealth and resistance to analysis of the communication process.

[0078] By adding timestamp information with a random offset based on data verified by a message authentication code, it is not only possible to effectively mark the data transmission time and assist the receiving end in freshness verification and sequence management, but also to introduce unpredictable randomness in the time domain, significantly reducing the observability of the data stream and preventing attackers from inferring data patterns or session behaviors through time analysis, thereby further improving the concealment and anti-attack capabilities of communication data during transmission and enhancing the overall communication security.

[0079] S6: Encapsulate the encrypted data blocks, the message authentication code and the timestamp information into a target data message.

[0080] It should be noted that an encrypted data block refers to a data unit that has been encrypted based on a subkey and encryption policy. The content is encrypted and cannot be read in plain text. The target data message is the encrypted data block, authentication information, and timestamp encapsulated together to form a complete data unit that can be transmitted across a communication network. It has a standardized structure, security protection, and verifiability.

[0081] Specifically, after encryption, message authentication, and timestamp addition are completed, the data packet encapsulation phase begins. During the encapsulation process, each encrypted data block is first logically bound to the corresponding message authentication code and timestamp information to form a complete data unit.

[0082] Furthermore, the above data units are encapsulated in a standardized manner according to preset message structure rules. Encapsulation can include setting a fixed field order (e.g., encrypted data block—authentication code—timestamp) and can be appropriately formatted as needed, such as adding a length field, checksum field, or separator to ensure that the message is correctly parsed and processed between different communication nodes. After encapsulation, the target data message has encryption protection, integrity verification, and time freshness verification functions, and can be transmitted safely and reliably in untrusted network environments.

[0083] This step encapsulates the encrypted data block, the corresponding message authentication code, and the randomly offset timestamp information into a target data message. This not only achieves complete structured management of communication data, but also ensures the confidentiality, integrity, and timeliness of the data. This encapsulation method effectively prevents individual data elements from being tampered with, forged, or intercepted during transmission, while providing the receiving end with an integrated processing mechanism for decryption verification and time verification, significantly improving the overall security and anti-attack capabilities of communication data during transmission.

[0084] This embodiment dynamically generates a master session key between communicating parties based on a preset key agreement protocol; dynamically generates subkeys at preset time intervals based on the master session key and a key sequence; encrypts each data block in a communication data stream based on the subkeys and an encryption strategy; generates a message authentication code for each encrypted data block; adds timestamp information based on the message authentication code, and introduces a random offset into the timestamp information; and encapsulates each encrypted data block, the message authentication code, and the timestamp information into a target data message. This embodiment achieves dynamic key update during the communication process by dynamically generating a master session key based on a preset key negotiation protocol between the communicating parties, and generating subkeys based on the master session key and the key sequence at preset time intervals, thereby effectively reducing the risk of key leakage; encrypting each data block in the communication data stream based on the subkey and encryption strategy ensures the confidentiality of the data; generating a message authentication code for each encrypted data block, and adding timestamp information with a random offset based on the authentication code, further enhancing the data integrity verification capability and anti-replay attack capability; finally, encapsulating the encrypted data, message authentication code and timestamp information into a target data message, achieving security protection of data during structured transmission and improving the transmission security of communication data.

[0085] Based on the above first embodiment, the second embodiment of the communication encryption method of this application is proposed. Figure 2 , Figure 2 This is a schematic diagram of a sub-flow in the second embodiment of the communication encryption method of this application.

[0086] like Figure 2As shown, in this embodiment, before step S3, the following steps are further included:

[0087] S3a: Obtain communication frequency, data block type, and session behavior characteristics;

[0088] S3b: Analyzing the communication frequency, the data block type, and the conversation behavior characteristics based on a communication behavior graph model;

[0089] S3c: Determine the encryption strategy based on the analysis result.

[0090] It should be noted that communication frequency refers to the number of times communication data blocks are sent or received per unit time. It reflects the current level of communication activity and is an important basis for determining encryption strength requirements. Data block type refers to the content category of each data unit in communication data, such as control commands, business data, image streams, heartbeat packets, etc. Different types of data have different requirements for encryption security and real-time performance. Session behavior characteristics refer to the set of features that reflect the behavior patterns of users, devices, or systems during communication. They typically include communication duration, operation type distribution, data burstiness, and identity stability. The communication behavior graph model is a graph-structured behavioral modeling tool used to characterize the logical and temporal relationships between different states (such as data type, encryption method, and frequency level) during communication. It reflects the structured evolution of communication behavior through nodes and edges. Encryption strategy refers to the encryption method and parameter configuration adopted based on different data and communication characteristics. It includes the encryption algorithm used (such as AES, SM4, ChaCha20), encryption strength level, key update schedule, encryption domain selection, and other details.

[0091] Specifically, key contextual information from the current communication process is collected in real time, including communication frequency, data block type, and session behavior characteristics. Communication frequency can be determined by counting the number of data block interactions per unit time; data block type can be extracted from communication protocol fields and data content identifiers; and session behavior characteristics are analyzed by combining historical behavior graphs to determine whether the session is active, whether there are any abnormal changes, and whether it is within the warning period.

[0092] Furthermore, the three types of behavioral parameters described above are mapped into a communication behavior graph model. By comparing the current behavior with the modeled behavioral patterns in the graph, the current communication behavior's path position in the graph is identified, as well as whether it is on a high-risk evolutionary path or near an abnormal node. The behavior graph can provide feedback on inferences such as "Which encryption algorithm is typically used in this type of communication scenario?" and "Should frequency changes trigger a key update?" Ultimately, based on the analysis results, an appropriate encryption strategy is matched, such as adjusting the encryption algorithm type, enabling multiple authentication mechanisms, shortening the key rotation cycle, or switching to a higher-strength encryption domain, ensuring adaptive protection of communication behavior.

[0093] Through the above steps, dynamic encryption policy adjustments based on communication behavior characteristics are achieved, breaking away from the limitations of traditional "static encryption configuration" and enabling rapid matching of the optimal encryption scheme based on the actual communication status. On the one hand, when an increase in communication frequency or a change in data type is detected, encryption strength and update frequency can be automatically increased. On the other hand, when abnormal communication behavior is detected, high-level security policies can be triggered to enhance protection capabilities. This mechanism effectively improves the flexibility, real-time performance, and anti-attack capabilities of communication encryption, reduces the risk of performance loss or security flaws caused by mismatched encryption policies, and ensures the adaptability and robustness of the encryption system in changing network environments.

[0094] Based on the first embodiment above, in this embodiment, before step S3b, the following steps are further included:

[0095] S3ba: Extracts communication behavior sequences based on historical communication data;

[0096] S3bb: Acquire communication status information, and define a model node set and a model edge set based on the communication status information and a preset behavior transfer relationship;

[0097] S3bc: generating a model infrastructure based on the communication behavior sequence, the model node set, and the model edge set;

[0098] S3bd: Acquire real-time communication information and map the real-time communication information to a corresponding graph node of the model infrastructure;

[0099] S3be: Based on the mapping results, the frequency weights of the model infrastructure edges are adjusted to obtain the communication behavior graph model.

[0100] It should be noted that a communication behavior sequence refers to a continuous chain of behaviors during the communication process, recording communication events and their corresponding states in chronological order, such as "sending a command → receiving a response → frequency increase → identity change." Communication state information refers to identifiable characteristic states during the communication process, including data type, encryption method, frequency level, identity credibility, and communication time period. Predefined behavior transition relationships refer to the possible behavior transition paths between predefined communication states and their meanings, such as the risk increase judgment corresponding to "transitioning from a normal communication state to a high-frequency instruction state." A model node set is the basic unit of the graph structure, representing a specific communication state. A model edge set is a directed edge connecting two communication state nodes, representing the direction, intensity, and risk level of a behavior transition. The model infrastructure is the initial skeleton of the graph, consisting of a node set and an edge set, and serves as the foundation for subsequent behavior evolution and mapping. Frequency weight is one of the attributes of an edge, indicating the frequency with which transitions between two states occur during communication.

[0101] Specifically, in the initial stages of model construction, representative communication behavior sequences are first extracted from existing historical communication data. These sequences reflect typical communication paths for users, devices, or systems in real-world environments, such as transitions from low-frequency conversations to high-frequency commands, or switching from encryption algorithms to plaintext attempts. Through time-series organization and pattern classification, the evolutionary trajectory of communication behavior is captured, providing a behavioral template for the graph model. Subsequently, based on communication protocol standards and actual deployment environments, a set of communication state information is defined, such as data type (command / text / image), identity trust level, encryption algorithm type, and communication frequency level. Based on pre-defined behavioral transition relationships, a corresponding set of model nodes and edges is established. Each state corresponds to a node. If a reasonable behavioral transition is possible between two nodes, a weighted directed edge is established between them, indicating the direction and initial trustworthiness of the state transition. This constitutes the initial topology of the graph, i.e., the model infrastructure.

[0102] Furthermore, after the foundation of the model is established, the dynamic mapping phase begins. During the communication process, contextual information of the current session is collected in real time, including but not limited to the current data block type, transmission frequency, encryption strength, user identity changes, etc., and this real-time communication information is mapped to the nodes in the graph: if the state already exists, the activity count of the node is increased; if it is a new state, a new node and edge are added. Then, based on the time sequence and path of the state transition, the frequency weight of the corresponding edge is dynamically updated. Each legal state transition will increase the frequency of edge occurrence; if the state associated with the edge is in a high-risk combination, the "risk level" label of the edge can also be adjusted. Ultimately, a communication behavior graph model with historical patterns and real-time evolution characteristics is formed to support subsequent security policy decisions.

[0103] Through the above steps, not only is a structured abstraction of communication behavior achieved, but a dynamic learning and updating mechanism is also introduced, enabling the model to memorize and reason about behavioral trends. Unlike traditional static strategies, this communication behavior graph model automatically adjusts edge weights and risk assessments based on real-time changes in communication status, effectively identifying potentially anomalous behavior paths. This model provides intelligent support for subsequent encryption strategy selection, key update frequency regulation, and anomaly warnings, significantly improving the intelligent adaptability, precise protection capabilities, and evolutionary robustness of the communication security mechanism.

[0104] This embodiment dynamically generates a master session key between communicating parties based on a preset key agreement protocol; dynamically generates subkeys at preset time intervals based on the master session key and a key sequence; encrypts each data block in a communication data stream based on the subkeys and an encryption strategy; generates a message authentication code for each encrypted data block; adds timestamp information based on the message authentication code, and introduces a random offset into the timestamp information; and encapsulates each encrypted data block, the message authentication code, and the timestamp information into a target data message. This embodiment achieves dynamic key update during the communication process by dynamically generating a master session key based on a preset key negotiation protocol between the communicating parties, and generating subkeys based on the master session key and the key sequence at preset time intervals, thereby effectively reducing the risk of key leakage; encrypting each data block in the communication data stream based on the subkey and encryption strategy ensures the confidentiality of the data; generating a message authentication code for each encrypted data block, and adding timestamp information with a random offset based on the authentication code, further enhancing the data integrity verification capability and anti-replay attack capability; finally, encapsulating the encrypted data, message authentication code and timestamp information into a target data message, achieving security protection of data during structured transmission and improving the transmission security of communication data.

[0105] Based on the above second embodiment, the third embodiment of the communication encryption method of this application is proposed. Figure 3 , Figure 3 This is a schematic diagram of a sub-process in the third embodiment of the communication encryption method of this application.

[0106] In this embodiment, it also includes:

[0107] SA1: introducing a pseudo-random delay to the sending time of the target data message, wherein the pseudo-random delay does not exceed a preset delay range;

[0108] SA2: If multiple target data messages are detected to be sent continuously, the delay amplitude of the pseudo-random delay is controlled to change dynamically within a preset amplitude range.

[0109] It should be noted that pseudo-random delay refers to the time delay determined by a pseudo-random number generation algorithm. This means that each message waits a certain amount of time before being sent, increasing the uncertainty of data transmission timing. The preset delay range refers to the maximum value of the pre-set pseudo-random delay, which is used to avoid introducing excessive transmission delays that affect communication efficiency. Dynamic delay amplitude variation refers to controlling the random delay variation based on the message transmission status in continuous message transmission scenarios, so that the time disturbance fluctuates within a certain range, avoiding the formation of a clear rhythm or fixed interference pattern.

[0110] Specifically, when preparing to send a target data message, a pseudo-random delay value is first generated. This value is within a preset maximum delay range (for example, no more than 5 milliseconds). The sending module then performs the actual message sending operation after the delay time, thereby artificially introducing timing disturbances and disrupting the data message sending rhythm.

[0111] Furthermore, to further enhance the unpredictability of message transmission, if multiple target data messages are detected to be sent consecutively, the amplitude of the pseudo-random delay is controlled to vary within a dynamic range. For example, during continuous message transmission, the system can fluctuate the delay perturbation of the current message within a ±20% range, making the time interval between message transmissions appear non-constant and irregular, thus preventing the recognition of rhythmic patterns or frequency characteristics.

[0112] By introducing a pseudo-random delay before sending the target data message and dynamically adjusting the delay amplitude in continuous message scenarios, this effectively disrupts the timeline of communication data transmission, blocking possible paths for attackers to analyze traffic, identify patterns, or reconstruct communication behavior based on time characteristics. This strategy not only improves the timing concealment of the communication process, but also enhances the ability to resist side-channel attacks and timing statistical attacks, further improving the security protection system for communication data at the transmission level.

[0113] Based on the above second embodiment, in this embodiment, step S5 includes:

[0114] S51: Based on the message authentication code, obtain the current time, and use the current time as the initial value of the original timestamp;

[0115] S52: Generate a random offset based on a pseudo-random number generation algorithm;

[0116] S53: Determine a disturbance timestamp according to the original timestamp initial value and the random offset;

[0117] S54: Bind the disturbance timestamp to the message authentication code.

[0118] It should be noted that the message authentication code (MAC) is a checksum calculated based on the encryption key and the message content, and is used to verify the integrity of the message and the legitimacy of the authentication. The initial value of the original timestamp is the current system time obtained when the data block encryption or authentication is completed, which is used to mark the timing information generated by the data block. The pseudo-random number generation algorithm is a mechanism that simulates randomness through an algorithm. It can generate an unpredictable but reproducible numerical sequence according to a set range, and is used to perturb time, position, field, etc. The perturbed timestamp refers to a new timestamp formed by adding a perturbation value to the original timestamp, making the time feature appear more random to the outside world and improving the anti-analysis capability. Binding refers to the establishment of an inseparable association between two or more fields, which is achieved through hash digests, joint coding, etc., to prevent tampering and forgery.

[0119] Specifically, after encryption and authentication of a data block, the block's processing completion flag is first determined based on the generated message authentication code (MAC). At this point, the current system time is obtained and recorded as the initial value of the original timestamp corresponding to the data block. This timestamp marks the generation time of the data block and serves as an important reference for timing verification and replay judgment at the receiving end. Subsequently, a built-in pseudo-random number generation algorithm is invoked to generate a random offset within a preset perturbation range. This offset, which can be positive or negative, disrupts the sequential characteristics of the original timestamp, thereby interfering with attackers' attempts to restore the communication rhythm through time analysis. The offset can be seeded with the device ID, MAC content digest, or communication window number to ensure personalized perturbation results. Next, the original timestamp and the generated random offset are added to obtain the perturbed timestamp. To prevent tampering with the timestamp alone, the perturbed timestamp is bound to the corresponding MAC value, for example, by using a hash function to calculate the joint digest of the two or by encapsulating them as fields in the same structure. Finally, the binding result is written into the target data message and transmitted together with the encrypted data block for the receiving end to use for time freshness verification and anti-replay analysis.

[0120] By introducing a timestamp perturbation mechanism after message authentication, the transmission time pattern of encrypted data messages can be effectively disrupted, preventing attackers from inferring communication content or restoring behavioral trajectories through time intervals, time sequences, and other means. Furthermore, by binding the perturbed timestamp to the authentication code, the timestamp field's tamper-resistance is enhanced, ensuring its integrity and credibility during transmission. Overall, this design significantly improves the encrypted communication process's resistance to replay attacks and traffic analysis, providing strong support for the time domain security of communication systems.

[0121] Based on the above second embodiment, in this embodiment, step S2 includes:

[0122] S21: When communication starts, the current time is recorded as the reference time for generating the subkey, and a preset time period counter is started;

[0123] S22: When the preset time period counter reaches the preset time interval, based on the master session key and the key sequence, a current period number of the preset time period counter is used as an input parameter;

[0124] S23: Based on the input parameters, call the key derivation function to dynamically generate the subkey.

[0125] It should be noted that the base time refers to the system time recorded at the start of communication and serves as the reference point for subsequent dynamic subkey updates. The preset time period counter is a counting unit used to track communication duration and trigger subkey updates based on the time period. The cycle number refers to the Nth cycle of subkey generation during the current communication process and is used as one of the dynamic input parameters for key derivation.

[0126] Specifically, when a communication session is initialized, the current system time is first recorded as a base time, used as a time reference for subsequent subkey generation. Simultaneously, a preset time period counter is started, which increments at a fixed time step, for example, every 100 milliseconds. As communication continues, the counter accumulates time in real time. When the counter reaches a full preset time interval (e.g., every 100 milliseconds), the master session key, the preset key sequence, and the sequence number of the current time period counter are combined as input parameters to form new derived input material.

[0127] Furthermore, based on the aforementioned input parameters, a key derivation function (KDF) is called to dynamically generate a new subkey for the corresponding period. This new subkey is immediately applied to the data block encryption task for the current period. As communication continues, the subkey is automatically updated at each new time period, forming a rolling dynamic key protection mechanism.

[0128] By recording a base time and starting a time period counter during the communication initialization phase, a key derivation function is invoked to generate subkeys at each preset time interval, using the master session key, key sequence, and period number as dynamic inputs. This not only ensures the periodic update of subkeys during communication, but also ensures the independence and unpredictability of each subkey in terms of time and input parameters. This mechanism effectively strengthens the key system's protection against replay attacks, key leakage, and traffic analysis, enhancing overall data security and anti-attack capabilities during communication.

[0129] This embodiment dynamically generates a master session key between communicating parties based on a preset key agreement protocol; dynamically generates subkeys at preset time intervals based on the master session key and a key sequence; encrypts each data block in a communication data stream based on the subkeys and an encryption strategy; generates a message authentication code for each encrypted data block; adds timestamp information based on the message authentication code, and introduces a random offset into the timestamp information; and encapsulates each encrypted data block, the message authentication code, and the timestamp information into a target data message. This embodiment achieves dynamic key update during the communication process by dynamically generating a master session key based on a preset key negotiation protocol between the communicating parties, and generating subkeys based on the master session key and the key sequence at preset time intervals, thereby effectively reducing the risk of key leakage; encrypting each data block in the communication data stream based on the subkey and encryption strategy ensures the confidentiality of the data; generating a message authentication code for each encrypted data block, and adding timestamp information with a random offset based on the authentication code, further enhancing the data integrity verification capability and anti-replay attack capability; finally, encapsulating the encrypted data, message authentication code and timestamp information into a target data message, achieving security protection of data during structured transmission and improving the transmission security of communication data.

[0130] In one embodiment, after establishing a communication connection, both communicating parties first dynamically generate a master session key using a pre-defined key agreement protocol (e.g., Diffie-Hellman or Elliptic Curve Diffie-Hellman). Subsequently, based on the master session key, a key derivation function (KDF) is used to derive a key sequence.

[0131] To enhance the security of communication data, the current time is recorded as the reference time for subkey generation at the start of communication, and a preset time period counter is started. Whenever the counter reaches a preset time interval (for example, 100 milliseconds), a key derivation function is called to dynamically generate a new subkey based on the master session key, the key sequence, and the current period number as input parameters.

[0132] During the data encryption process, each data block in the communication data stream is classified according to the preset sensitivity classification strategy. Based on the classification results, the corresponding encryption strategy is determined: the AES-256 algorithm is used for the Normal level, the ChaCha20 algorithm is used for the Sensitive and Confidential levels, and the SM4 algorithm is used for the Top Secret and Core levels.

[0133] After encryption, a message authentication code (MAC) is generated for each data block, and a timestamp with a random offset is added. The encrypted data block, message authentication code, and timestamp are then encapsulated into the target data message.

[0134] The present application also provides a communication encryption device, please refer to Figure 4 , Figure 4 This is a schematic diagram of the module structure of the communication encryption device according to an embodiment of the present application, which includes:

[0135] A master key module 401 is used to dynamically generate a master session key between two communicating parties based on a preset key negotiation protocol;

[0136] A subkey module 402 is configured to dynamically generate subkeys based on the master session key and the key sequence at preset time intervals;

[0137] The encryption module 403 is used to encrypt each data block in the communication data stream based on the subkey and encryption strategy;

[0138] Authentication module 404, used to generate a message authentication code for each encrypted data block;

[0139] A timestamp module 405 is configured to add timestamp information based on the message authentication code, wherein a random offset is introduced into the timestamp information;

[0140] The target module 406 is configured to encapsulate the encrypted data blocks, the message authentication code, and the timestamp information into a target data message.

[0141] The communication encryption device provided in the embodiments of this application, employing the communication encryption method described in the above embodiments, can address the technical problem of improving the transmission security of communication data. Compared to the prior art, the communication encryption device provided in the embodiments of this application has the same beneficial effects as the communication encryption method described in the above embodiments. Other technical features of the communication encryption device are the same as those disclosed in the above embodiments and are not further elaborated here.

[0142] The present application provides a communication encryption device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the communication encryption method in the above-mentioned embodiment.

[0143] Reference below Figure 5 , Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the communication encryption method in the embodiment of the present application, which shows a schematic diagram of the structure of the communication encryption device suitable for implementing the embodiment of the present application. Figure 5 The communication encryption device shown is merely an example and should not limit the functions and scope of use of the embodiments of the present application.

[0144] like Figure 5 As shown, the communication encryption device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. RAM 1004 also stores various programs and data required for the operation of the communication encryption device. Processing device 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems may be connected to I / O interface 1006: input devices 1007, such as a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008, such as a liquid crystal display (LCD), speaker, vibrator, etc.; storage device 1003, such as a magnetic tape or hard disk; and communication device 1009. The communication device 1009 can allow the communication encryption device to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a communication encryption device with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems can be implemented or provided instead.

[0145] In particular, according to the embodiments disclosed herein, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed herein include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for executing the methods shown in the flowcharts. When the computer program is executed by the processing device 1001, the functions defined in the methods of the embodiments disclosed herein are performed.

[0146] The communication encryption device provided in this application, employing the communication encryption method described in the aforementioned embodiment, can address the technical problem of improving the transmission security of communication data. Compared to the prior art, the communication encryption device provided in this application achieves the same beneficial effects as the communication encryption method described in the aforementioned embodiment. Other technical features of the communication encryption device are the same as those disclosed in the aforementioned embodiment and are not further elaborated here.

[0147] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0148] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0149] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer program) stored thereon, and the computer-readable program instructions are used to execute the communication encryption method in the above-mentioned embodiment.

[0150] The computer-readable storage medium carries one or more programs. When executed by a communication encryption device, the communication encryption device: dynamically generates a master session key between two communicating parties based on a preset key agreement protocol; dynamically generates subkeys based on the master session key and a key sequence at preset time intervals; encrypts each data block in the communication data stream based on the subkeys and the encryption strategy; generates a message authentication code for each encrypted data block; adds timestamp information based on the message authentication code, and introduces a random offset into the timestamp information; and encapsulates each encrypted data block, message authentication code, and timestamp information into a target data message. The computer program code for performing the operations of the present application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. Where a remote computer is involved, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or it may be connected to an external computer (for example, through the Internet using an Internet service provider).

[0151] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0152] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0153] The computer-readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the aforementioned communication encryption method, thereby solving the technical problem of improving the transmission security of communication data. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the communication encryption method provided in the aforementioned embodiment, and are not further elaborated here.

[0154] An embodiment of the present application provides a computer program product, including a computer program, which implements the steps of the above-mentioned communication encryption method when executed by a processor.

[0155] The computer program product provided in this application can solve the technical problem of how to improve the transmission security of communication data. Compared with the prior art, the beneficial effects of the computer program product provided in the embodiments of this application are the same as the beneficial effects of the communication encryption method provided in the above embodiments, and will not be repeated here.

[0156] The above are only preferred embodiments of the present application and do not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent processing scope of the present application.

Claims

1. A communication encryption method, characterized in that: The method comprises: Based on the preset key negotiation protocol, a master session key is dynamically generated between the communicating parties; Dynamically generate subkeys based on the master session key and the key sequence at preset time intervals; Encrypting each data block in the communication data stream based on the subkey and encryption strategy; Generate a message authentication code for each encrypted data block; Based on the message authentication code, adding timestamp information, wherein a random offset is introduced into the timestamp information; The encrypted data blocks, the message authentication code and the timestamp information are encapsulated into a target data message.

2. The method according to claim 1, wherein Before the step of encrypting each data block in the communication data stream based on the subkey and the encryption strategy, the method further includes: Obtain communication frequency, data block type, and session behavior characteristics; Analyzing the communication frequency, the data block type, and the conversation behavior characteristics based on a communication behavior graph model; The encryption strategy is determined according to the analysis result.

3. The method according to claim 2, wherein Before the step of analyzing the communication frequency, the data block type, and the conversation behavior characteristics based on the communication behavior graph model, the method further includes: Extract communication behavior sequences based on historical communication data; Acquire communication state information, and define a model node set and a model edge set based on the communication state information and a preset behavior transfer relationship; Generate a model infrastructure based on the communication behavior sequence, the model node set, and the model edge set; Acquire real-time communication information, and map the real-time communication information to corresponding graph nodes of the model infrastructure; Based on the mapping results, the frequency weights of the model infrastructure edges are adjusted to obtain the communication behavior graph model.

4. The method according to claim 1, wherein The method further comprises: Introducing a pseudo-random delay to the sending time of the target data message, wherein the pseudo-random delay does not exceed a preset delay range; If a plurality of target data messages are detected to be sent continuously, the delay amplitude of the pseudo-random delay is controlled to change dynamically within a preset amplitude range.

5. The method according to claim 1, wherein The step of adding timestamp information based on the message authentication code and introducing a random offset into the timestamp information includes: Based on the message authentication code, obtain the current time and use the current time as the initial value of the original timestamp; Generate a random offset based on a pseudo-random number generation algorithm; Determining a disturbance timestamp according to the original timestamp initial value and the random offset; The disturbance timestamp is bound to the message authentication code.

6. The method according to claim 1, wherein The step of dynamically generating subkeys based on the master session key and the key sequence at preset time intervals includes: At the beginning of communication, the current time is recorded as the reference time for generating the subkey, and a preset time period counter is started; When the preset time period counter reaches the preset time interval, based on the master session key and the key sequence, a current period number of the preset time period counter is used as an input parameter; Based on the input parameters, the key derivation function is called to dynamically generate the subkey.

7. A communication encryption device, characterized in that: The device comprises: A master key module is used to dynamically generate a master session key between the communicating parties based on a preset key negotiation protocol; A subkey module, configured to dynamically generate subkeys based on the master session key and the key sequence at preset time intervals; An encryption module, configured to encrypt each data block in the communication data stream based on the subkey and the encryption strategy; An authentication module, used to generate a message authentication code for each encrypted data block; A timestamp module, configured to add timestamp information based on the message authentication code, wherein a random offset is introduced into the timestamp information; The target module is used to encapsulate the encrypted data blocks, the message authentication code and the timestamp information into a target data message.

8. A computer device, characterized in that: The device includes: a memory, a processor, and a communication encryption program stored in the memory and executable on the processor, wherein the communication encryption program is configured to implement the steps of the communication encryption method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium stores a communication encryption program, which, when executed by the processor, implements the steps of the communication encryption method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the communication encryption method according to any one of claims 1 to 6 are implemented.

Images