A High-Security Instant Messaging Method and System

Abstract

This invention discloses a highly secure instant messaging method and system, relating to the field of instant messaging technology. It establishes a defense-in-depth system through four collaborative steps: Step 1 lays a decentralized foundation to resist topology analysis; Step 2 ensures session confidentiality, achieving forward secrecy; Step 3 destroys metadata value to defend against correlation attacks; and Step 4 disrupts traffic characteristics to completely hide communication patterns. The overall solution of this invention achieves reliable standards in terms of efficiency, security, and robustness. It not only ensures high availability and censorship resistance in a decentralized network environment but also provides end-to-end privacy and security protection across multiple dimensions, including the application layer, key layer, metadata layer, and traffic layer, accurately corresponding to and implementing a highly secure instant messaging method.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of instant messaging technology, in particular to a high-security instant messaging method and system. BACKGROUND

[0002] Instant messaging (IM) is a synchronous communication method based on the network, allowing two or more people to exchange text, voice, video and file multimedia information with extremely low delay. Its core value lies in real-time and interactivity, which not only changes people's communication habits, but also deeply affects personal socialization, enterprise collaboration, secure communication and emergency response in many aspects. From the initial text chat to the current integrated platform of voice call, video conference, file sharing and encryption protection, instant messaging has become an indispensable infrastructure and productivity tool in modern society.

[0003] Even if the communication messages of the existing instant messaging are encrypted, the metadata of the communication parties (such as the identities of the communication parties, the communication time, the frequency, the data packet size, etc.) can still be collected by network service providers, push services or intermediaries, and sensitive information such as user social graphs and activity habits can be inferred through traffic analysis. Many studies have shown that existing secure communication tools do not provide comprehensive protection for metadata (for example, by analyzing communication frequency and time, close relationships or business cooperation networks can be accurately located, and only 200 pieces of metadata of messages can accurately predict the personality traits of users); Therefore, in view of the metadata leakage and traffic analysis risks existing in the existing instant messaging, a high-security instant messaging method and system are provided. SUMMARY

[0004] The main purpose of the present application is to provide a high-security instant messaging method and system to overcome the problems mentioned in the background art.

[0005] To achieve the above-mentioned purpose, according to one aspect of the present application, a high-security instant messaging method is provided, comprising the following methods:

[0006] Step one, when initiating communication, a probe packet is sent to the node in the online state to measure the round-trip delay of the node, and if the round-trip delay is lower than a preset threshold, the node is marked as an available node; The performance parameters of the available node are obtained, including round-trip delay, available bandwidth, packet loss rate and observation coefficient; The performance parameters are comprehensively calculated and analyzed to obtain a node performance value, and if the node performance value is greater than a preset performance threshold, it is recorded as a candidate node, and each candidate node is screened out to form a peer-to-peer connection pool;

[0007] Step two, before the communication parties exchange information formally, an end-to-end temporary key negotiation is performed on the communication parties;

[0008] Step three, encapsulate the metadata as a transmission data block, adaptively generate the number of fragments n and the recovery threshold k for the transmission data block, and fragment the transmission data block to obtain n fragments according to the number of fragments n and the recovery threshold k; then intelligently select storage nodes, and each storage node stores a fragment;

[0009] Step four, monitor the traffic state in the communication process of the two communication parties, and determine whether there is a traffic analysis threat, if there is, execute the enhanced disturbance mode; otherwise, execute the basic disturbance mode.

[0010] Further, the process of determining whether there is a traffic analysis threat in the communication process is:

[0011] At the communication end, the instant initiator / receiver records the byte length sequence U of m outgoing / incoming packets, U={u1, u2, u3... u m}, i=1, 2, 3..., i is an index, u i is the byte length of the i-th outgoing / incoming packet; calculate the Shannon entropy of the packet size and the packet interval variance; if the Shannon entropy is less than the preset entropy or the packet interval variance is less than the preset variance, it is determined that there is a traffic analysis threat; if the Shannon entropy is greater than or equal to the preset entropy and the packet interval variance is greater than or equal to the preset variance, it is determined that there is no traffic analysis threat.

[0012] The basic disturbance mode is to randomly select an empty packet with a length of u i according to the preset initial parameters, and perform traffic disturbance, and the specific initial parameters include the empty packet rate p0, the Poisson rate λ0, and the time slot length T0.

[0013] Further, the enhanced disturbance mode is:

[0014] 1-6, parameter amplification and time slot adjustment:

[0015] Set the amplification coefficient of the empty packet rate, the amplification coefficient of the Poisson rate, the amplification coefficient of the time slot length, and the minimum time slot threshold, and according to the amplification coefficient of the empty packet rate, the amplification coefficient of the Poisson rate, the amplification coefficient of the time slot length, and the minimum time slot threshold, the empty packet rate p0 and the Poisson rate λ0 in the basic disturbance mode are amplified to obtain the multiplied empty packet rate p dummy , the multiplied Poisson rate λ dummy , and the shortened time slot length T solt , and the multiplied empty packet rate p dummy , the multiplied Poisson rate λ dummy , and the shortened time slot length T solt are recorded as enhanced parameters;

[0016] 1-7, empty packet size diversification:

[0017] The number of real messages is counted in real time. After a fixed number of real messages, a range empty packet is sent. The size of the range empty packet is the difference between the maximum and minimum byte lengths in the byte length sequence U. The sizes of the remaining empty packets are adopted according to a distribution. A byte length is randomly selected from the byte length sequence U, and a jitter of ±30% is randomly added to the planned empty packet size each time.

[0018] 1-8, Enhanced timing of delivery:

[0019] shortening the time slot length T solt Inside, the empty packet rate p is doubled. dummy Make a judgment, randomly select a byte length for each time slot to create an empty packet and send it, and shorten the time slot length T. solt Internally, a random delay is applied; if the actual message interval exceeds a preset threshold, there is no need to wait for the next time slot, and the process directly enters the Poisson perturbation; if no actual traffic is detected for a fixed number of consecutive times within any time slot length, the Poisson rate λ is temporarily doubled. dummy Then multiply by the Poisson rate amplification factor to initiate a burst of empty packets;

[0020] 1-9, Monitoring the effects of disturbances:

[0021] In the enhanced mode, the Shannon entropy of the packet length and the variance of the packet interval are continuously calculated until both are restored to a state that does not trigger the enhanced perturbation mode, and then the mode is downgraded back to the basic perturbation mode.

[0022] 1-10, Constraints:

[0023] If the detected latency between the two parties exceeds the preset latency or the packet loss rate exceeds the preset packet loss rate, the amplification factor will be automatically reduced and the time T will be extended according to the preset degradation rate δ. solt Empty messages shall not exceed 20% of the total bandwidth.

[0024] Furthermore, the process of comprehensively calculating and analyzing the performance parameters is as follows:

[0025] Extract the performance parameters of available nodes. The specific performance parameters include round-trip time, available bandwidth, packet loss rate and observation coefficient, and denote them as RTT, BW, L and G, respectively.

[0026] Round-trip time, available bandwidth, and packet loss rate are normalized separately using the following normalization formula: RTT max BW max and L max These are the maximum allowable round-trip time set by the technicians, the peak bandwidth under available network conditions, and the maximum allowable packet loss rate; then the normalized round-trip time S... RTT Available broadband S BW and packet loss rate SL The value obtained by the weighted fusion calculation is multiplied by the observation coefficient to obtain the node performance value.

[0027] Further, the key agreement process is:

[0028] 5-1: Before communication, each of the communication parties generates and long-term holds a pair of ECC identity keys, the receiving end additionally generates a pair of signed pre-keys and a set of one-time pre-keys, and the initiator generates a one-time temporary key after obtaining the public key of the other party;

[0029] 5-2: During communication, the initiator sends a negotiation request to the receiving end and constructs a negotiation request package, and sends it to the receiving end through secure transmission; the receiving end verifies after the request, and sends an empty package to the initiator or directly enters the local key calculation stage after successful verification, without additional return delay;

[0030] 5-3: Both communication parties generate a session key based on the same operation, and immediately destroy the session key after communication is completed to ensure forward secrecy.

[0031] Further, the ECC identity key generation process is:

[0032] Before exchanging any information formally, the initiator generates and long-term holds an ECC key pair Among them The private key is used for signature and DH operation, The public key is used for public identity authentication; the receiving end generates and holds an ECC key pair in the same way The receiving end generates a pair of ECC keys for one-time use but with a certain life cycle And sign with the long-term private key as: The receiving end uploads And the signature σ to the decentralized storage; the receiving end generates a number of pairs of extremely short period ECC keys in batches i=1, 2, 3…, i is the index; each pair is used only once, and after use, it is directly removed from the list to prevent replay.

[0033] Further, the metadata encapsulation and adaptive fragmentation process is:

[0034] The IDs of the communication parties, message timestamp, message length, message type and other fields are collectively referred to as metadata, and are encapsulated as a binary string M; the session key K sess is extracted, an initialization vector N is randomly generated, and a plaintext field is randomly selected in the metadata as additional authentication data AD; a standard AES-GCM encryption function is called, and ciphertext C and authentication tag T GCM are output; specifically:

[0035] Wherein C is the encryption output equal to M in length, T GCM is the message authentication tag, used to verify that the ciphertext and additional authentication data have not been tampered with; (N, C, T GCM ) are concatenated into a transmission data block E, E = N‖‖C‖‖T GCM ;

[0036] Extract the transmission data block length l, set the minimum slice density α min and the maximum slice density α max and the minimum recovery threshold β min and the maximum recovery threshold β max , according to the formula Calculate the number of slices n, where σ(l) is a normalization function for the transmission data block length l, specifically: Lmax represents the maximum reference data length, which has the same unit as l, in bytes; then according to the formula The recovery threshold k is calculated;

[0037] Randomly select coefficients a1, a2, a3...a k-1 , construct a polynomial in a large prime field: f(x) = E + a1x + a2x 2 +a3x 3 ...+a j x j ...a k-1 x k-1 , calculate according to the number of slices n (j, f(j)), get n slices, where j is the index of any slice.

[0038] Further, the intelligent selection of nodes for the storage process is:

[0039] Real-time extraction of the logs of each node, and extraction of the number of received slice requests, the number of successful slice writes, and the single storage delay of each storage, the number of provided slices, the number of successful slice reconstructions, and the single response delay of each reconstruction from the logs; divide the number of successful slice writes by the number of received slice requests and multiply by 100 to get the storage success rate, and divide the number of successful slice reconstructions by the number of provided slices to get the reconstruction success rate;

[0040] Use box analysis method to analyze single storage delay and single reconstruction delay to get storage delay value and reconstruction delay value;

[0041] Calculate the observation coefficient G of each node by normalizing and weighted fusion according to the formula The storage success rate h1, the reconstruction success rate h2, the storage delay value Y1, and the reconstruction delay value Y2 are updated to step one in real time;

[0042] Sort all online nodes according to their observation coefficients from large to small, and remove the online nodes less than the minimum observation threshold, keep the top fixed number of online nodes as the preferred nodes for shard storage, set the observation interval; the preferred nodes greater than the upper limit of the observation interval are classified into the storage main pool, the preferred nodes within the observation interval are classified into the storage secondary pool, and the preferred nodes less than the lower limit of the observation interval are classified into the storage reserve pool; set the storage main pool to store the shards of b1, the storage secondary pool to store the shards of b2, and the storage reserve pool to store the shards of b3, wherein b1>b2>b3>0, and b1+b2+b3=1; allocate shards in the same level storage pool in random order, each node only saves the shard (j, f(j)) allocated to it, and encrypts the disk locally again with a session key, and when restoring, only needs to pull the fragment from any node layer, and the total of k parts can be obtained;

[0043] When each node receives a received shard request, the number of received shard requests is increased by one, if successfully written, the number of shard successful writing is increased by one, and the single storage delay is recorded; at the same time, if a provided shard request is received, the number of provided shards is increased by one, if the reconstruction is successful, the number of shard reconstruction success is increased by one, and the single reconstruction delay is recorded; the logs of each node are updated according to the shard storage and reconstruction operations of each node.

[0044] Further, the box plot analysis method is:

[0045] Extract the single storage delay of each shard write operation, and sort the single storage delays in order from small to large, ensure that the format is a one-dimensional numerical sequence, and find the value at the 25% position as the lower quartile Q1, find the value at the 50% position as the median Q2, and find the value at the 75% position as the upper quartile Q3. The IOR is obtained by subtracting the lower quartile from the upper quartile. The minimum value greater than or equal to (Q1-1.5xIOR) in all sorted values is taken as the lower whisker, and the maximum value less than or equal to (Q3+1.5xIOR) in all sorted values is taken as the upper whisker, i.e. the whisker top, and the points outside the range of the upper whisker and the lower whisker are regarded as outliers;

[0046] Input the single storage delay of each shard write operation into the "box plot" function, and set the parameters to display outliers and horizontal or vertical directions. The box automatically draws a box plot with Q1, Q2, Q3, upper whisker and lower whisker positions, and separately marks the outliers. A thick line is drawn at the median position and labeled Q2, Q1 and Q3 are marked at the edge of the box, and IQR and whisker top values are displayed outside the box.

[0047] The storage time delay value is calculated by weighting and fusing Q2, Q3 and the upper horn.

[0048] To achieve the above object, according to another aspect of the present application, a high-security instant messaging system is provided, comprising:

[0049] A client, wherein the client comprises an initiating end and a receiving end, the client is built-in with a key management module and a communication disturbance module, the key management module manages the end-to-end temporary key negotiation of the client before formal communication of the client; the communication disturbance module monitors the traffic state of the client in the communication process and judges whether there is a traffic analysis threat, if there is, a strengthened disturbance mode is executed; otherwise, a basic disturbance mode is executed;

[0050] The decentralized network is built-in with a connection pool management module and a sharded storage module; when the client initiates communication, the connection pool management module sends a probe packet to the node in an online state to measure the round-trip time of the node, if the round-trip time is lower than a preset threshold, the node is marked as an available node; the performance parameters of the available node are acquired, the performance parameters include round-trip time, available bandwidth, packet loss rate and observation coefficient; the performance parameters are comprehensively calculated and analyzed to obtain a node performance value, if the node performance value is greater than a preset performance threshold, the node is recorded as a candidate node, and the candidate nodes are filtered to form a peer-to-peer connection pool; the sharded storage module encapsulates the metadata as a transmission data block, adaptively generates a number of shards n and a recovery threshold k for the transmission data block, and accordingly shards the transmission data block to obtain n segments; then intelligently selects a storage node, each storage node obtains a segment for storage; only at least k shards are obtained at the same time can the transmission data block be recovered.

[0051] The beneficial effects of the present application are:

[0052] The present application constructs a peer-to-peer connection pool by querying, detecting and filtering online nodes with RTT less than a threshold in the mDNS or DHT system when the client starts, completely eliminates the dependence on a single central server, eliminates the risk of single point failure or centralized traffic leakage of the network, not only dynamically eliminates nodes with high delay, low bandwidth or high packet loss rate, but also ensures that only nodes with quality meeting the preset threshold participate in communication and sharded storage through the normalization weighting of node performance and historical observation coefficient, this distributed and performance-aware node selection method not only improves the fault tolerance and availability of the entire system, but also greatly weakens the possibility of monitoring, statistics or examination of single point traffic by an adversary through operators or intermediaries - the traffic is evenly dispersed to multiple nodes, and any node being monitored cannot reorganize complete metadata or communication mode, thereby greatly improving the privacy protection and anti-examination ability of metadata from the bottom-up architecture.

[0053] The application realizes "perfect forward secrecy" by negotiating a one-time session key according to the Diffie-Hellman operation in the Signal X3DH style before the two parties formally exchange any application layer data, and destroying all intermediate secrets and temporary keys immediately after the end of the session, so that even if an attacker obtains the long-term private key of any party in the future, the session key of the ended session cannot be calculated, and the risk of "decryption after collection" is fundamentally eliminated; at the same time, the long-term identity key is only used for signature and identity authentication, the signature pre-key is used for intermediate anti-replay protection, and the one-time pre-key further enhances the forward secrecy, forming a multi-layer and multi-frequency trust building and fast key agreement system, and with the cross-verification of the public key and the signature by the decentralized storage, the entire key exchange process does not rely on a centralized server and does not leak any metadata to the relay or observer, so that the communication efficiency is guaranteed while the incomparable security strength is realized.

[0054] The application realizes "perfect forward secrecy" by negotiating a one-time session key according to the Diffie-Hellman operation in the Signal X3DH style before the two parties formally exchange any application layer data, and destroying all intermediate secrets and temporary keys immediately after the end of the session, so that even if an attacker obtains the long-term private key of any party in the future, the session key of the ended session cannot be calculated, and the risk of "decryption after collection" is fundamentally eliminated; at the same time, the long-term identity key is only used for signature and identity authentication, the signature pre-key is used for intermediate anti-replay protection, and the one-time pre-key further enhances the forward secrecy, forming a multi-layer and multi-frequency trust building and fast key agreement system, and with the cross-verification of the public key and the signature by the decentralized storage, the entire key exchange process does not rely on a centralized server and does not leak any metadata to the relay or observer, so that the communication efficiency is guaranteed while the incomparable security strength is realized.

[0055] The present application automatically judges the traffic analysis threat by monitoring the Shannon entropy of packet size and the variance of packet interval in real time at the traffic level, and immediately enters the enhanced disturbance mode once the packet length is excessively concentrated or the timing is excessively regular: according to the preset amplification factor, the empty packet sending rate is multiplied by the Poisson generation rate, the time slot length is shortened, the "extreme difference empty packet" is forced to be injected, and the distributed sampling empty packet is added with ±30% jitter, and the Poisson disturbance and "explosion" mode are triggered in the silent period, so as to greatly enrich the uncertainty of packet length and sending timing; when the security index recovers, it automatically returns to the basic disturbance mode, and when the network congestion or delay rises, the disturbance intensity is dynamically converged at the degradation rate, and the time slot is lengthened to avoid performance degradation. The adaptive disturbance closed loop can not only maintain the minimum overhead in normal times, but also quickly switch to the strongest mode when the risk is high, which not only completely disrupts the traffic characteristics from the size and timing dimensions, but also ensures that the additional bandwidth consumption does not exceed the acceptable range, and takes into account privacy protection and communication quality, so that the opponent cannot infer any useful social graph or behavior pattern through packet length statistics, time analysis or activity level even if he monitors all day long. BRIEF DESCRIPTION OF DRAWINGS

[0056] The accompanying drawings, which form a part of the present application, are intended to provide further understanding of the present application, and are used to interpret the present application together with the description of the illustrative embodiments of the present application. In the drawings:

[0057] Figure 1 is a schematic diagram of the method flow of the present application;

[0058] Figure 2 is a schematic diagram of the system module connection of the present application;

[0059] Figure 3 is a schematic diagram of the communication disturbance flow of the present application. DETAILED DESCRIPTION

[0060] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0061] In order for those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0062] It should be noted that the terms "first", "second", and the like in the description and claims of the application and the above drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances to implement the embodiments of the application described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0063] In order to make the purposes and advantages of the present application more clear, the present application is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present application, and do not limit the present application.

[0064] According to the embodiments of the present application, as shown in Figure 1 , a high-security instant messaging method is provided, comprising the following steps:

[0065] Step one, build a Peer-to-Peer connection pool, decentralized, avoid single point of failure and traffic leakage risk:

[0066] When the client starts, send a probe packet to the node in the online state on the network, and return the valid address / endpoint in the mDNS or DHT query (i.e. the node can respond to the connection request of the client), to measure the round-trip time of the node, if the round-trip time is lower than the preset threshold (for example, the technician sets it to 500ms), mark the node as available node, thus the available node set can be obtained;

[0067] Get the performance parameters of the available node, the specific performance parameters include round-trip time, available bandwidth, packet loss rate and observation coefficient, and are respectively marked as RTT, BW, L and G;

[0068] The round-trip time, available bandwidth and packet loss rate are normalized respectively, and the normalization formula is Where RTT max , BW max and L max are the maximum allowed round-trip time, the peak bandwidth under the available network, and the maximum allowed packet loss rate set by the technician respectively; then the normalized round-trip time S RTT , available bandwidth S BW and packet loss rate S LThe value obtained by the weighted fusion calculation is multiplied by the observation coefficient to obtain the node performance value; if the node performance value is greater than the preset performance threshold, the node is recorded as a candidate node, and each candidate node is screened to form a peer-to-peer connection pool;

[0069] The peer-to-peer connection pool is constructed by querying, detecting and screening online nodes with RTT less than a threshold in the mDNS or DHT system when the client is started, which completely eliminates the dependence on a single central server, eliminates the risk of single point failure or concentrated traffic leakage, dynamically eliminates nodes with high delay, low bandwidth or high packet loss rate, and ensures that only nodes meeting the preset threshold in quality participate in communication and shard storage through normalized weighting of node performance and historical observation coefficient. This distributed and performance-aware node selection method not only improves the fault tolerance and availability of the entire system, but also greatly weakens the possibility of monitoring, statistics or examination of single-point traffic by an adversary through operators or intermediaries - the traffic is evenly distributed to multiple nodes, and any monitored node cannot reorganize the complete metadata or communication mode, thereby greatly improving the privacy protection and anti-examination ability of metadata from the bottom-up architecture.

[0070] Step two, end-to-end temporary key negotiation:

[0071] Before exchanging any information formally, the initiator generates and holds an ECC key pair Among them for signature and DH operation private key, for public identity authentication; the receiver generates and holds an ECC key pair in the same way The receiver generates a pair of one-time-use but with a certain life cycle ECC key pair and signs it with the long-term private key as: The receiver uploads and signature σ to a decentralized storage (such as a blockchain or a public server for the initiator to verify); the receiver can generate several pairs of extremely short period ECC keys in batches i = 1, 2, 3…, i is the index; each pair is used only once, and after use, it is directly removed from the list to prevent replay;

[0072] During communication, the initiator sends a negotiation request to the receiver, and the initiator obtains the receiver's long-term public key from the public storage signature pre-key and signature σ, and uses to verify the signature; the initiator generates a one-time ECC key locally and constructs a negotiation request package, which is sent to the receiver through secure transmission;

[0073] The receiving end verifies the initiating end after receiving the request and whether in the identity document of the initiating end and checks the OPK index validity, and sends an empty packet to the initiating end or directly enters the local secret key calculation stage after successful verification, without additional return delay;

[0074] The initiating end and the receiving end each perform the same Diffie-Hellman calculation locally, generate a shared secret based on the same curve, and concatenate all shared secrets of the communication parties, input to the HKDF-SHA256 derivation function, to generate the final session key K sess After the session ends, both parties immediately destroy the session key K sess , ensuring forward secrecy; even if the attacker obtains the long-term private key of the communication parties in the future, he cannot calculate the past session key, meeting the "post-collection decryption" protection and complete forward secrecy;

[0075] By performing the Diffie-Hellman operation according to the Signal X3DH style before exchanging any application layer data, a one-time session key is negotiated, and all intermediate secrets and temporary keys are destroyed immediately after the session ends. This design achieves "perfect forward secrecy": even if the attacker obtains the long-term private key of any party in the future, he cannot calculate the session key of the ended session, fundamentally eliminating the "post-collection decryption" risk. At the same time, using the long-term identity key only for signature and identity authentication, the signature pre-key for intermediate anti-replay protection, and the one-time pre-key for further enhancing forward secrecy, a multi-layer and multi-frequency trust building and fast key agreement system is formed. By cross-verifying the public key and signature with decentralized storage, the entire key exchange process does not rely on centralized servers and does not leak any metadata to relays or observers, thereby ensuring communication efficiency while achieving unparalleled security strength.

[0076] Step three, metadata encryption and sharded storage:

[0077] The IDs of the communication parties, message timestamps, message lengths (message sizes), message types (text, pictures, files, etc.), and other optional fields (reading receipt flags, etc.) are collectively referred to as metadata and are encapsulated as a binary string M (serialized according to the agreed protocol, such as Protocol Buffers or custom TLV); extract the session key K sess , randomly generate an initialization vector N, and select part of the plaintext fields in the metadata as additional authentication data AD to prevent these fields from being tampered with; call the standard AES-GCM encryption function to output the ciphertext C and the authentication tag T GCM ; specifically:

[0078] where C is the encryption output equal in length to M, T GCM is the message authentication tag, used to verify that the ciphertext and the additional authentication data have not been tampered with; (N, C, T GCM ) are concatenated into a transmission data block E, E = N‖‖C‖‖T GCM ;

[0079] In order to balance the security strength and storage / recovery overhead of the sharding storage, the present application adaptively generates storage parameters according to the length l of the transmission data block, the storage parameters including the number of sharding n and the recovery threshold k (k represents the minimum number of participants, when at least k shards are collected, the original transmission data block can be reconstructed by Lagrange interpolation), and the specific adaptive generation process is: the skilled in the art sets the minimum sharding density α min (0.1 pieces / KB, for example) and the maximum sharding density α max (0.5 pieces / KB, for example) and the minimum recovery threshold β min (0.5, for example) and the maximum recovery threshold β max (0.8, for example), calculates the number of sharding n according to the formula , where σ(l) is a normalization function for the length l of the transmission data block, and specifically: Lmax represents the maximum reference data length, which has the same unit as l, in bytes; it should be noted that as the number of transmission data blocks increases, n increases smoothly from α min ×l to α max ×l; then the recovery threshold k is calculated according to the formula ; as the data volume increases, the recovery threshold k gradually increases from β min ×l to β max ×l, enhancing the robustness against sharding hijacking; the coefficients a1, a2, a3...a k-1 are randomly selected, and a polynomial f(x) = E + a1x + a2x 2 + a3x 3 ... + a j x j ... a k-1 x k-1 is constructed in a large prime number field, calculated according to the number of sharding n (j, f(j)), to obtain n shards, where j is the index of any piece;

[0080] Real-time extraction of the logs of each node, and extraction of the number of received shard requests, the number of successful shard writes, and the single storage delay of each storage, the number of provided shards, the number of successful shard reconstructions, and the single response delay of each reconstruction from the logs; the storage success rate h1 is obtained by dividing the number of successful shard writes by the number of received shard requests and multiplying by 100%, and the reconstruction success rate h2 is obtained by dividing the number of successful shard reconstructions by the number of provided shards.

[0081] Box plot analysis: extract the single storage latency of each slice write operation, and sort the single storage latency in ascending order, ensure the format is a one-dimensional numerical sequence, and find the value at the 25% position as the lower quartile Q1, find the value at the 50% (middle) position as the median Q2, find the value at the 75% position as the upper quartile Q3, subtract the lower quartile from the upper quartile (Q3-Q1) to get IOR, take the minimum value greater than or equal to (Q1-1.5xIOR) among all sorted values as the lower whisker, and take the maximum value less than or equal to (Q3+1.5xIOR) among all sorted values as the upper whisker, i.e. the whisker top, points outside the range of the upper whisker and the lower whisker are considered outliers; input the single storage latency of each slice write operation into the "box plot" function and set the parameters to display outliers and horizontal or vertical direction, the box body is automatically drawn with Q1, Q2, Q3, upper whisker and lower whisker positions, and outliers are separately marked and drawn; draw a thick line at the median position and label Q2, use scales or annotations to mark Q1 and Q3 at the edge of the box, and optionally display IQR and whisker top values outside the box; calculate the weighted fusion of Q2, Q3 and upper whisker to obtain the storage latency value Y1; similarly, the above box plot analysis is performed on the reconstruction single latency of each reconstruction to output the reconstruction latency value Y2;

[0082] The storage success rate h1, the reconstruction success rate h2, the storage latency value Y1 and the reconstruction latency value Y2 are normalized and weighted fusion calculated according to the formula to obtain the observation coefficient G of each node, and the observation coefficient G is updated to step one in real time; wherein T s,max is the acceptable maximum storage latency threshold and T r,max is the acceptable maximum reconstruction latency threshold,

[0083] Sort all online nodes according to their observation coefficients from large to small, and remove the online nodes less than the minimum observation threshold, keep the top fixed number of online nodes as the preferred nodes for shard storage, set the observation interval [W1, W2], where W1 is the lower limit of the observation interval, greater than the observation threshold; the preferred nodes greater than the upper limit of the observation interval [W1, W2] are classified into the storage main pool, the preferred nodes within the observation interval [W1, W2] are classified into the storage secondary pool, and the preferred nodes less than the lower limit of the observation interval [W1, W2] are classified into the storage reserve pool; set the storage main pool to store the shards of b1, the storage secondary pool to store the shards of b2, and the storage reserve pool to store the shards of b3, where b1>b2>b3>0, and b1+b2+b3=1, for example, the technician sets them to 50%, 30% and 20% respectively; allocate shards in the same level storage pool in random order to prevent shards from concentrating in a few nodes, each node only saves the shards (j, f(j)) it allocates, and encrypts the disk locally again with a session key, when recovering, only one node layer needs to be pulled to get a piece, and k pieces are needed to get the original data; when each node receives a shard request, the number of received shard requests increases by one, if it is successfully written, the number of shard successful writes increases by one, and the single storage delay is recorded; at the same time, if a shard providing request is received, the number of shard providing requests increases by one, if the reconstruction is successful, the number of shard reconstruction successes increases by one, and the single reconstruction delay is recorded; update the log of each node according to the above operation;

[0084] By encrypting the communication metadata, then adaptively calculating the number of shards and the recovery threshold according to the size of the transmission data block, and storing each shard in the nodes of different level pools, only when at least k shards are obtained can the original metadata be recovered. This mechanism combines the information theory security of Shamir secret sharing and the multiple protection of symmetric encryption, and realizes that even if a large number of nodes are attacked, the metadata cannot be leaked at a single point. At the same time, the adaptive n / k strategy avoids excessive fragmentation of small messages and performance bottlenecks of large messages while ensuring high security, so that the storage and recovery overheads are balanced between security and efficiency. As for the attacker, unless more than threshold number of decentralized nodes are attacked at the same time, no communication metadata can be pieced together, greatly enhancing the anti-censorship and anti-data leakage capabilities.

[0085] Step four, traffic disturbance in the communication process:

[0086] Record the byte length sequence U of m outgoing / incoming packets at the communication end (initiating end and receiving end), U={u1, u2, u3... u m},u i= the byte length of the ith out / in packet; calculate the Shannon entropy of packet size and the variance of packet interval; if the Shannon entropy < preset entropy (indicating that the packets are too concentrated) or the variance of packet interval < preset variance (indicating that the packets are too regular), it is determined that there is a traffic analysis threat between the two parties of communication, and the enhanced disturbance mode is executed; otherwise, the basic disturbance mode is executed, and the specific basic disturbance mode is to perform traffic disturbance by randomly selecting an empty packet with a length according to preset initial parameters, and the specific initial parameters include an empty packet rate p0, a Poisson rate λ0, and a time slot length T0; i

[0087] As shown in FIG. 1, the enhanced disturbance mode specifically includes: Figure 3

[0088] 1-1, parameter amplification and time slot adjustment:

[0089] According to the formula p dummy = min (γ p × p0, 1), the empty packet rate p0 (empty packet sending probability) in the basic disturbance mode is amplified in proportion, γ p is an amplification coefficient of the empty packet rate, and γ p > 1 (for example, 2x or 3x), to ensure that the number of disturbance packets is significantly increased;

[0090] According to the formula λ dummy = γ λ × λ0, the Poisson rate λ0 (average generation rate) in the basic disturbance mode is also amplified, γ λ is an amplification coefficient of the Poisson rate, and γ λ > 1, to accelerate the generation of empty packets;

[0091] On the time slot length T0 in the basic disturbance mode, according to the formula T solt = max (T0γ T , T min ), the time slot is shortened, γ T is an amplification coefficient of the time slot length, and T min is the minimum time slot threshold to prevent excessive fragmentation;

[0092] Thus, the enhanced parameters in the enhanced disturbance mode are obtained, and the specific enhanced parameters include the multiplied empty packet rate p dummy , the multiplied Poisson rate λ dummy , and the shortened time slot length T solt ;

[0093] 1-2, empty packet size diversification:

[0094] ​​Real-time statistics of the number of real messages, whenever a fixed number of real messages, forced to send a very poor empty packet, the size of the byte length sequence U in the maximum byte length and the minimum byte length difference; The size of the remaining empty packet is subject to distribution, randomly select a byte length in the byte length sequence U, and randomly add ± 30% jitter to each proposed empty packet size;

[0095] 1-3, send timing reinforcement:

[0096] In the shortened time slot length T solt , the empty packet rate p dummy is multiplied by the increase in the empty packet rate p solt ; If the real message interval exceeds the preset interval threshold, it does not need to wait for the next time slot and directly enters the Poisson disturbance; If the real traffic is not detected for multiple times (3 time slot lengths) in any time slot length, the Poisson rate λ dummy is temporarily multiplied by the Poisson rate amplification coefficient to initiate a round of empty packet burst, and multiple empty packets are sent to fill the silent window;

[0097] 1-4, monitor the disturbance effect:

[0098] In the reinforcement mode, the Shannon entropy of the packet length and the packet interval variance are continuously calculated until both of them are restored to the safety threshold (i.e. Shannon entropy ≥ preset entropy and packet interval variance ≥ preset variance), and then it is degraded back to the "basic disturbance mode";

[0099] 1-5, constraint conditions:

[0100] (1) If the communication end delay is greater than the preset delay or the packet loss rate is greater than the preset packet loss rate, the amplification coefficient (the amplification coefficient of the empty packet rate and the amplification coefficient of the Poisson rate are divided by the degradation rate δ) and T solt (T solt is multiplied by the degradation rate δ) is automatically reduced according to the preset degradation rate δ to avoid network congestion caused by excessive disturbance;

[0101] (2) The maximum empty message does not exceed 20% of the total bandwidth;

[0102] At the traffic level, the traffic analysis threat is automatically determined by real-time monitoring of the Shannon entropy of the packet size and the variance of the packet interval, and once the packet length is excessively concentrated or the timing is excessively regular, the enhanced disturbance mode is entered: according to the preset amplification coefficient, the empty packet sending rate is multiplied by the Poisson generation rate, the time slot length is shortened, the "extreme difference empty packet" is forcibly injected, and the distribution sampling empty packet is added ± 30% jitter, and the Poisson disturbance and "explosion" mode are triggered in the silent period, so as to greatly enrich the uncertainty of the packet length and the sending timing; when the security index recovers, it is automatically returned to the basic disturbance mode, and when the network congestion or delay rises, the disturbance intensity is dynamically converged at a degradation rate, and the time slot is lengthened to avoid performance degradation. The adaptive disturbance closed loop can not only maintain the minimum overhead in normal times, but also quickly switch to the strongest mode when the risk is high, which not only completely disrupts the traffic characteristics from the size and timing dimensions, but also ensures that the additional bandwidth consumption does not exceed the acceptable range, and balances privacy protection and communication quality, so that the opponent cannot infer any useful social graph or behavior pattern through packet length statistics, time analysis or activity level even if it monitors all day long.

[0103] According to the embodiments of the present application, as shown in Figure 2 The present application also provides a high-security instant messaging system, comprising:

[0104] A client, wherein the client includes a sending end and a receiving end, the client is built-in with a key management module and a communication disturbance module, the key management module performs end-to-end temporary key negotiation management on the client before formal communication of the client; the communication disturbance module monitors the traffic state of the client in the communication process and judges whether there is a traffic analysis threat, and if there is, an enhanced disturbance mode is executed; otherwise, a basic disturbance mode is executed.

[0105] The decentralized network is built-in with a connection pool management module and a sharded storage module; when the client initiates communication, the connection pool management module sends a probe packet to the node in the online state to measure the round-trip time of the node, and if the round-trip time is lower than a preset threshold, the node is marked as an available node; the performance parameters of the available node are obtained, including the round-trip time, the available bandwidth, the packet loss rate and the observation coefficient; the performance parameters are comprehensively calculated and analyzed to obtain a node performance value, and if the node performance value is greater than a preset performance threshold, the node is marked as a candidate node, and each candidate node is screened to form a peer-to-peer connection pool; the sharded storage module encapsulates the metadata into a transmission data block, adaptively generates a number of shards n and a recovery threshold k for the transmission data block, and accordingly shards the transmission data block to obtain n segments; then, the storage nodes are intelligently selected, and each storage node stores a segment; only when at least k shards are obtained at the same time can the transmission data block be recovered.

[0106] The above merely illustrates the embodiments of the present application, and is not intended to limit the present application. For those skilled in the art, the present application can have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. within the spirit and principles of the present application should be included in the scope of the claims of the present application.

Claims

1. A high-security instant messaging method, characterized in that, The method comprises the following steps: Step 1: When initiating communication, a probe packet is sent to a node in an online state to measure the round-trip time of the node, and if the round-trip time is lower than a preset threshold, the node is marked as an available node; Obtain the performance parameters of the available nodes, including round-trip time, available bandwidth, packet loss rate and observation coefficient; Comprehensive calculation and analysis of the performance parameters obtain node performance value, if the node performance value is greater than a preset performance threshold, it is recorded as a candidate node, and each candidate node is screened out to form a peer-to-peer connection pool; Step 2: Before the communication parties exchange information formally, a temporary key negotiation is conducted between the end-to-end communication parties; Step 3: The metadata is encapsulated into a transmission data block, the number of fragments n and the recovery threshold k are adaptively generated for the transmission data block, and the transmission data block is fragmented to obtain n fragments based on the number of fragments n and the recovery threshold k; Intelligently select storage nodes, each storage node stores a fragment; Only when at least k fragments are obtained at the same time can the transmission data block be recovered; 2. The high-security instant messaging method of claim 1, wherein, Step 4: Monitor the traffic state in the communication process of the communication parties, and judge whether there is a traffic analysis threat, if there is, execute the enhanced disturbance mode; otherwise, execute the basic disturbance mode. At the communication end, record the byte length sequence U of m outgoing / incoming packets at the originating / receiving end, , i = 1, 2, 3, …, i is an index, = byte length of the ith outgoing / incoming packet; calculate the Shannon entropy of packet size and packet interval variance; if the Shannon entropy < preset entropy or the packet interval variance < preset variance, determine that there is a traffic analysis threat; if the Shannon entropy ≥ preset entropy and the packet interval variance ≥ preset variance, determine that there is no traffic analysis threat; The basic disturbance mode is to randomly select any one Length of empty packet flow disturbance, the specific initial parameters include empty packet rate , Poisson rate , time slot length .

3. The high-security instant messaging method of claim 2, wherein, The process of judging whether there is a traffic analysis threat in the communication process is: The enhanced disturbance mode is: Set amplification factors for the empty packet rate, Poisson rate, time slot length, and minimum time slot threshold, and accordingly adjust the empty packet rate under the basic perturbation mode. And Poisson rate The increased empty packet rate is obtained by scaling up proportionally. doubling Poisson rate At the same time, the time slot length in the basic perturbation mode will be... Shortening is performed to obtain the shortened time slot length. And will double the empty package rate doubling Poisson rate and shortening the time slot length Let this be the enhancement parameter; 1-1, parameter amplification and time slot adjustment: 1-2, empty packet size diversification: Real-time statistics of the number of real messages, after a fixed number of real messages, a poor empty packet is forced to be sent, the size of the poor empty packet is the difference between the maximum byte length and the minimum byte length in the byte length sequence U; the size of the remaining empty packet is subject to distribution, a byte length is randomly selected from the byte length sequence U, and a ±30% jitter is randomly added to each proposed empty packet size; In shortening the time slot length The packet rate is multiplied The length of the bytes is randomly selected in each time slot to send the empty packet, and the time slot length is shortened The random delay is made again inside; if the real message interval exceeds the preset interval threshold, it directly enters the Poisson disturbance without waiting for the next time slot; if the real traffic is not detected for a fixed number of times continuously in any time slot length, the Poisson rate is temporarily multiplied The multiplication is multiplied by the Poisson rate amplification coefficient to initiate a round of empty packet burst 1-3, send timing enhancement: 1-4, monitor the disturbance effect: In the enhanced mode, the Shannon entropy of the packet length and the interval variance are continuously calculated until both are restored to the state that does not trigger the enhanced disturbance mode, and the basic disturbance mode is degraded; If the time delay of both sides is greater than the preset time delay or the packet loss rate is greater than the preset packet loss rate, then the amplification coefficient is automatically reduced and the time delay is automatically extended according to the preset degradation rate δ ; the maximum of the empty message is not more than 20% of the total bandwidth.

4. The high-security instant communication method of claim 3, wherein, 1-5, constraint condition: The process of comprehensive calculation and analysis of the performance parameters is: The round-trip delay, available bandwidth and packet loss rate are normalized respectively, and the normalization formula is wherein , and are the maximum allowed round-trip delay, the peak bandwidth under the available network and the maximum allowed packet loss rate set by the technician respectively. The normalized round-trip delay , available bandwidth , and packet loss rate are weighted and fused to obtain a value, and the value is multiplied by an observation coefficient to obtain a node performance value.

5. The high-security instant messaging method of claim 4, wherein, Extract the performance parameters of the available nodes, and the specific performance parameters include round-trip time, available bandwidth, packet loss rate and observation coefficient, and mark them as RTT, BW, L and G respectively; The key negotiation process is: 5-1: Before communication, each communication party generates and holds a pair of ECC identity key for a long time, the receiving end additionally generates a pair of signature pre-key and a set of one-time pre-key, and the initiating end obtains the public key of the other party and generates a one-time temporary key; 5-2: During communication, the initiating end sends a negotiation request to the receiving end and constructs a negotiation request packet, and sends it to the receiving end through secure transmission; the receiving end verifies after receiving the request, and sends an empty packet to the initiating end or directly enters the local key calculation stage without additional return delay; 6. The high-security instant communication method of claim 5, wherein, 5-3: The communication parties generate a session key based on the same operation, and immediately destroy the session key after the communication ends to ensure forward secrecy. The initiator generates and holds the ECC key pair for a long time before exchanging any information with the other party wherein the private key for signing and DH operation, for public identity authentication; the receiver also generates and holds the ECC key pair The receiver generates a pair of ECC keys that are one-time use but have a certain life cycle and signs with the long-term private key as: The receiver uploads and the signature to a decentralized storage; the receiver generates a number of pairs of extremely short period ECC keys i = 1, 2, 3, …, i is the index; each pair is used only once, and after use, it is directly removed from the list to avoid replay.

7. The high-security instant messaging method of claim 6, wherein, The ECC identity key generation process is: The communication party ID, message timestamp, message length, message type and other fields are collectively referred to as metadata, and are encapsulated as a binary string M; a session key is extracted , an initialization vector N is randomly generated, and a plaintext field is randomly selected in the metadata as additional authentication data AD; a standard AES-GCM encryption function is called to output ciphertext C and an authentication tag ; Specifically: , wherein C is an encryption output equal in length to M, is a message authentication tag used to verify that the ciphertext and additional authentication data have not been tampered with; and is concatenated and encapsulated as a transmission data block E ; Extracting the transmission data block length , setting the minimum slice density and the maximum slice density and the minimum recovery threshold and the maximum recovery threshold , calculating the number of slices n according to the formula , wherein is a normalization function of the transmission data block length , specifically: , represents the maximum reference data length, which has the same unit as , in bytes; and then calculating the recovery threshold k according to the formula ; Randomly selected coefficients Constructing polynomials in large prime fields: According to the number of slices n Get n slices, where j is the index of any slice.

8. The high-security instant messaging method of claim 7, wherein, The metadata encapsulation and adaptive fragmentation process is: The intelligent selection of nodes for storage process is: Extracting the logs of each node in real time, and extracting the number of received shard requests, the number of shard successful writes, and the single storage latency of each storage, the number of provided shards, the number of shard reconstruction successes, and the single reconstruction response latency of each reconstruction from the logs; the number of shard successful writes is divided by the number of received shard requests, multiplied by 100 to obtain the storage success rate, and the number of shard reconstruction successes is divided by the number of provided shards to obtain the reconstruction success rate; The single storage latency and the single reconstruction latency are analyzed by the box plot method to obtain the storage latency value and the reconstruction latency value; The storage success rate, the reconstruction success rate, the storage latency value and the reconstruction latency value are normalized and weighted to obtain the observation coefficient of each node, and the observation coefficient is updated to step one in real time; All online nodes are sorted in descending order of their observation coefficients, and online nodes with observation coefficients less than the minimum observation threshold are removed. The top fixed number of online nodes are retained as preferred nodes for shard storage, and an observation interval is set. The preferred nodes greater than the upper limit of the observation interval are classified into a storage main pool, the preferred nodes within the observation interval are classified into a storage secondary pool, and the preferred nodes less than the lower limit of the observation interval are classified into a storage reserve pool. Setting storage primary pool for storing b1's shards, storage secondary pool for storing b2's shards, and storage reserve pool for storing b3's shards, wherein b1>b2>b3>0, and b1+b2+b3=1; allocating shards in random order within the same level of storage pool, and each node only saves the shards allocated to it and encrypting the disk again locally with the session key, and when recovering, only pulling the segment from any one node layer, and adding up to k copies. When each node receives a shard request, the number of received shard requests increases by one, and if it is successfully written, the number of shard successful writes increases by one, and the single storage latency is recorded. At the same time, if a shard request is received, the number of provided shards increases by one, and if the reconstruction is successful, the number of shard reconstruction successes increases by one, and the single reconstruction latency is recorded. The logs of each node are updated based on the shard storage and reconstruction operations of each node.

9. The high-security instant messaging method of claim 8, wherein, The box plot method is as follows: The single storage latency of each shard write operation is extracted, and the single storage latencies are sorted in ascending order to ensure that the format is a one-dimensional numerical sequence. The value at the 25% position is found as the lower quartile Q1, the value at the 50% position is found as the median Q2, and the value at the 75% position is found as the upper quartile Q3. The IOR is obtained by subtracting the lower quartile from the upper quartile. The minimum value of all values greater than or equal to (Q1-1.5IOR) after sorting is taken as the lower whisker, and the maximum value of all values less than or equal to (Q3+1.5IOR) after sorting is taken as the upper whisker, i.e. the whisker top. Points outside the range of the upper whisker and the lower whisker are considered outliers. The single storage latency of each shard write operation is input into the "box plot" function, and the parameters are set to display outliers and horizontal or vertical directions. The box automatically draws a box plot with Q1, Q2, Q3, upper whisker and lower whisker positions, and separately labels and draws outliers. A thick line is drawn at the median position and labeled Q2. Q1 and Q3 are marked at the edge of the box. IQR and whisker top values are displayed outside the box. The Q2, Q3 and upper whisker are weighted and fused to obtain the storage latency value. Similarly, the reconstruction single latency of each reconstruction is subjected to the above box plot method to output the reconstruction latency value.

10. A high-security instant messaging system, characterized by It is applied to the high-security instant messaging method of any one of claims 1-8, and the system comprises: The client includes an initiating end and a receiving end, and is built-in with a key management module and a communication disturbance module; the key management module performs end-to-end temporary key negotiation management on the client before formal communication of the client; the communication disturbance module monitors the flow state of the client in the communication process, and judges whether there is a flow analysis threat; if there is, a strengthened disturbance mode is executed; otherwise, a basic disturbance mode is executed; The decentralized network is built-in with a connection pool management module and a sharded storage module; when the client initiates communication, the connection pool management module sends a probe packet to the node in an online state to measure the round-trip time of the node; if the round-trip time is lower than a preset threshold, the node is marked as an available node; the performance parameters of the available node are acquired, including the round-trip time, available bandwidth, packet loss rate and observation coefficient; the performance parameters are comprehensively calculated and analyzed to obtain a node performance value; if the node performance value is greater than a preset performance threshold, the node is marked as a candidate node, and each candidate node is screened to form a peer-to-peer connection pool; the sharded storage module encapsulates metadata into a transmission data block, adaptively generates a number n of shards and a recovery threshold k for the transmission data block, and accordingly shards the transmission data block to obtain n segments; then, storage nodes are intelligently selected, and each storage node stores a segment; only when at least k shards are obtained at the same time can the transmission data block be recovered.

Images