Data delivery method based on trusted connector

Abstract

The invention provides a data delivery method based on a trusted connector, and belongs to the field of data transmission. The problem of low safety during data delivery is solved; the method specifically comprises the following steps: encrypting and locally storing original data to obtain to-be-sent data; evaluating the credibility of the connector, and if the evaluation result is a credible connector, selecting a standard data protocol to transmit the to-be-sent data; if the evaluation result is a non-trusted connector, selecting an encryption protocol to transmit the to-be-sent data; the error cost of each route is calculated, and a route link of the local server is determined; adjusting the data size when the local server transmits data to the router on the routing link; detecting abnormity in the process of transmitting data to the connector by the local server, and alarming; according to the method, the credibility of the connector is evaluated, different protocols are adopted to transmit data, and data protection measures are added, so that safe transmission of the data is ensured.

Description

Technical Field

[0001] The present invention discloses a data delivery method based on a trusted connector, which relates to the field of data transmission. Background Art

[0002] Existing data delivery methods for connectors have the following shortcomings: High data transmission latency: A common problem with existing connector data delivery methods is high data transmission latency. Traditional connectors often complete data transmission through multiple layers of middleware or transit mechanisms. Data must undergo multiple steps between the source and target systems, including format conversion, protocol adaptation, and routing scheduling. Each step introduces additional processing time. For example, the delivery of structured data between different systems often requires standardization, serialization, and network transmission, all of which add to latency. When data delivery scenarios require high real-time performance (such as financial transactions and IoT sensor monitoring), latency directly impacts business timeliness and decision-making accuracy.

[0003] Insufficient security and compliance: Existing connector data delivery methods also have flaws in security and compliance. Many connectors focus more on the "accessibility" of data delivery, while ignoring the security risks that data may encounter during transmission, such as black pants attacks, data leakage, malicious tampering, etc. If the connector does not have a complete built-in encryption mechanism and access control, it is easy for sensitive data to be exposed in the delivery chain, posing a major hidden danger to the enterprise's data delivery system.

[0004] Excessive maintenance and learning costs: Although existing connectors have simplified the connection between systems to a certain extent, their configuration and maintenance are still complex. First, many connectors rely on complex environments (specific middleware, drivers, or library files) during installation and configuration, which increases deployment costs. Second, in actual business scenarios, business logic often needs to be frequently adjusted, and the connector's adaptation rules and mapping relationships also need to be constantly modified. However, such modifications usually lack automated support, require manual intervention, and are prone to errors. Finally, for small and medium-sized enterprises with limited resources, such high learning and operation and maintenance costs are likely to offset the convenience brought by the connector. Summary of the Invention

[0005] In view of the shortcomings of the existing technology, the purpose of the present invention is to provide a data delivery method based on a trusted connector, aiming to solve the problem of low security during data delivery.

[0006] In order to achieve the above object, the present invention is implemented through the following technical solution: A data delivery method based on a trusted connector includes: The original data is encrypted and saved locally to obtain the data to be sent; the trustworthiness of the connector is evaluated. If the evaluation result is a trusted connector, the standard data protocol is selected to transmit the data to be sent; if the evaluation result is an untrusted connector, the encrypted protocol is selected to transmit the data to be sent; Obtain the average latency and packet loss rate for each route per hour over the past day and calculate the error cost for each route. Based on the error cost for each route, determine the routing link for the local server. Obtain the maximum transmission unit and data transmission rate for each route on the routing link. Based on the bit error rate and header overhead, adjust the data size when the local server transmits data to the router. Detect whether there is any abnormality during the data transmission from the local server to the trusted connector or the untrusted connector; if no abnormality occurs, continue to detect until the transmission of the pending data is completed; if abnormality occurs, activate the alarm and disconnect the local server from the trusted connector or the untrusted connector.

[0007] Furthermore, the processing of the original data is as follows: Compressing and encrypting the original data to obtain encrypted data; Get the data length l of the ciphertext data （ds） , using the byte stream reshaping algorithm to convert the encrypted data into N （o） ×N （o） The two-dimensional matrix of , get the matrix data; Among them, N （o） Indicates the order of the matrix, N （o） The calculation formula is: ; The fractal algorithm is used to iteratively process the matrix data to obtain the fractal matrix of chaotic distribution. The specific iterative process is as follows: Generate fractal parameter c （ju） , square each element in the matrix data and then add the complex constant c （ju） Iterative processing replaces the original elements in the matrix with the elements after iteration: Let the element in the matrix data be z （0） , the element after one iteration is z （1） : ; And so on, until each element in the matrix data is iterated I （it） times, retaining the fractal parameter c （ju） and the number of iterations I （it） ; Count the total number of bytes of all elements in the fractal matrix L （fm） , the number of bytes of a single element si （fm） , calculate the initial number of slices n of the fractal matrix（sh） : ; by Divide the fractal matrix into n rows for fixed intervals （sh） Original shards; Encode the original shard into n through erasure coding （re） redundant shards; n （sh） original shards and n （re） Gaussian noise is added to the redundant shards, and the original shards and redundant shards are stored as data to be sent to the local server; Evaluate the trustworthiness of the connector; if it is a trusted connector, use the MQTT protocol to transmit the data to be sent; If the connector is not trusted, the data to be sent is transmitted using the SSL / TLS protocol.

[0008] Furthermore, the specific steps for transmitting the data to be sent using the MQTT protocol are as follows: Step A1: Establish a secure connection based on AugPAKE authentication and key negotiation; Step A11: The local server generates a random number a （ls） , and initiate a connection request, ClientID and a to Broker （ls） ; Broker generates a random number b （br） , based on a （ls） and b （br） Calculate the value Z of the bilinear pair （eg） , and Z （eg） Return to the local server; Step A12: The local server uses the pre-shared password p （wd） and a random number a （ls） Calculate the hash value v （h） ; Based on v （h） Calculate the value W of the bilinear pairing （eg） , and W （eg） Send to the authentication server; Authentication server obtains b （br） and p （wd） and Z （eg） , according to b （br） and p （wd） Calculate the hash value u （h） ; Based on u （h） Calculate the value S of the bilinear pairing （eg） , the authentication server verifies S （eg） Is it related to Z （eg） If they are equal, the authentication succeeds; otherwise, the authentication fails. Step A13: After the authentication of the authentication server is successful, the local server exchanges the random number a with the authentication server. （ls） and b （br） , and generate a session key SK; Step A2: Control access rights to the data to be sent through OAuth2.0 authorization; Step A3: Based on two-way authentication, define the information encryption process of the message during data transmission.

[0009] Furthermore, the specific steps of step A2 are as follows: Step A21: After the local server passes AugPAKE authentication, it sends a permission request to the authorization server. The permission request includes: the retrieval scope and validity period of the data to be sent; After receiving the permission request and verifying the identity of the local server, the authorization server generates an encrypted token containing the permission request content and returns the encrypted token to the local server; Step A22: The local server sends the data to be sent to the trusted connector in the form of a message; the local server carries an encrypted token in the header of each message; Before the message sent by the local server is received by the trusted server, the local server will intercept the message and check whether the token in the message header is an encrypted token; if so, the message will be sent to the trusted connector; if not, the message will be refused to be sent to the trusted connector and a security log will be recorded.

[0010] Furthermore, the specific steps of step A3 are as follows: Step A31: Two-way authentication process; The local server sends the ClientID, the authentication certificate of the trusted connector, and the random number a （new） Sent to Broker in the form of a CONNECT message; Broker decrypts the CONNECT message to obtain a （new） , and combined with the value Z of the bilinear pairing （eg） Verify random number a （new） ; If the verification fails, the connection with the local server is disconnected; If the verification is successful, the validity of the trusted connector authentication certificate is verified; If the validity verification fails, the standard data protocol will be stopped from being used to transmit the data to be sent, and the encrypted protocol will be used instead; If the validity period is verified, Broker will send the random number b （br） and Broker's service certificate to the trusted connector; the authentication server sends the bilinear pair value W （eg） Send to trusted connector; The trusted connector verifies the validity of the Broker's service certificate; If the validity verification fails, the Broker connection will be disconnected; If the validity verification is passed, the trusted connector will （eg） Perform the inverse operation of the bilinear pairing to obtain v （h） According to p （wd） v （h） Perform anti-hash operation to get a （ls） ; Based on a （ls） and b （br） ,The trusted connector generates the session key SK through the negotiation function.

[0011] Furthermore, step A3 further includes the following: Step A32: Data transmission process; The local server converts the data to be sent into messages and symmetrically encrypts the first message using the session key SK to obtain the encrypted payload; Assemble the encrypted payload into a PUBLISH message and send it to the Broker; Broker checks the token of the PUBLISH message; If the check passes, the Broker sends the PUBLISH message to the trusted connector; the Broker sends a request to the local server to obtain the fractal parameter c of the data to be sent. （ju） and the number of iterations I （it） Get request for Broker obtains fractal parameter c （ju） and the number of iterations I （it） Then, the fractal parameter c （ju） and the number of iterations I （it） Temporarily store the message in the cache, prompt the local server to continue sending the message, and detect whether there is a terminator at the end of the message sent by the local server; If it does not exist, it means that the local server has not sent the last message and will not process it; If it exists, it means that the local server has sent the last message, and Broker adds the fractal parameter c between the end of the last message and the terminator. （ju） and the number of iterations I （it） , and then send the last message to the trusted connector; The trusted connector converts all messages into data to be sent through the session key SK and obtains the fractal parameter c at the end of the last message. （ju） and the number of iterations I （it） , restore the data to be sent to the original data; If the test fails, the Broker returns the PUBLISH message to the local server, records the security log, and prompts the local server to reapply for permissions for the trusted connector.

[0012] Furthermore, the steps to calculate the error cost are as follows: Get the average hourly delay of the first route ne （1） ~ne （24） , and calculate the mean μ （ne） and standard deviation σ （ne） ; Assume that the delay of the first route is nd, and the probability function of the delay of the first route p(nd) is: ; Get the current delay of the first router （now） , calculate the probability p(ne （now） ), the probability of delay increasing up (ne （now） ): ; Get the first router whose delay is less than or equal to ne （now） The frequency f （高-低） , the delay is greater than ne （now） The frequency f （低-高） ; Calculate the estimated probability p of delay becoming higher （+） : ; The estimated probability p that the current delay becomes lower （-） : ; Construct the state transition matrix P （k） : ; Get the number of data to be sent n （fi） , get the historical average delay ne of the first router （h） , construct about P （k） Matrix equation to calculate the delay cost Ri of the first router （1） , the matrix equation is as follows: ; Calculate the delay cost Ri of the 2nd to roth routers （2） ~Ri （ro） And the packet loss cost Rc of the 1st to roth routers （1） ~Rc （ro） ; Calculate the error cost fa of the first router （1） : ; Similarly, the error cost of the roth router is fa （ro） : ; The router with the lowest error cost is selected as the starting router. The starting router selects routers with low delay, low packet loss rate and few hops as the successor router until the local server completes the route retrieval of the trusted connector or non-trusted connector and determines the routing link.

[0013] Furthermore, the steps for adjusting the size of the transmitted data are as follows: Get the maximum transmission unit M of the first route on the routing link （1） , data transmission rate b （1） and bit error rate B （e） , suppose the data size when the local server transmits data to the first router is s （1） : Get header overhead H （协议） , construct the objective function G(s （1） ): ; in, Indicates the probability of successful transmission of the message: ; Take G (s （1） ) and the logarithm of s （1） Taking the derivative, we get formula 1: ; Let the derivative of formula 1 be zero, and we get formula 2: ; make , solve formula 2 and get s （err） : ; Select （err） and The smaller value of （1） ; Adjust the data size of a single transmission of data by subsequent routers on the routing link.

[0014] Compared with the prior art, the present invention has the following beneficial effects: Improved transmission efficiency: In this method, the system uses a "trust assessment module" to classify connectors: if the connector is trusted, normal data protocols are used for transmission; if the connector is untrusted, encryption protocols are used. This differentiated processing strategy offers two significant advantages: First, it avoids redundant encryption operations on trusted connectors, saving significant CPU and memory resources and reducing transmission latency; second, it optimizes resource allocation, focusing computing power on links that truly require security reinforcement, thereby improving overall network utilization.

[0015] Enhanced data security and reliability: The method of the present invention effectively improves the overall security protection capability through differentiated treatment of "trusted connectors" and "untrusted connectors"; for connectors judged to be untrusted, the system will automatically enable encryption to ensure that data is transmitted even in an unsafe network environment. This design not only prevents data leakage, but also ensures the consistency and integrity of the data, allowing the recipient to obtain original, untampered and reliable data.

[0016] Reduce network traffic and improve data utilization: This invention adjusts the actual traffic and packet size of each router to allow data to pass through the link at an appropriate "size", avoiding repeated splitting and reassembly of data during transmission; doing so not only reduces the waste of bandwidth and computing resources, but also reduces packet loss rate and retransmission rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments with reference to the following drawings: Figure 1 Schematic diagram of the method of the present invention; Figure 2 It is a schematic diagram of the process of the present invention; Figure 3 This is a schematic diagram of data transmission of a trusted connector according to the present invention. DETAILED DESCRIPTION

[0018] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0019] See also Figure 1 and Figure 2 , a data delivery method based on a trusted connector includes: Step S1: Encrypt the original data and save it locally to obtain the data to be sent; evaluate the trustworthiness of the connector. If the (trust) evaluation result is "trusted connector", select a standard data protocol (such as MQTT or HTTP) to transmit the data to be sent; if the (trust) evaluation result is "untrusted connector", select an encryption protocol (such as SSL / TLS or AES) to transmit the data to be sent; The processing of the original data is as follows: Use algorithms such as zlib or LZMA to compress the original data, and use encryption algorithms such as AES-256-GCM or ChaCha20-Poly1305 to symmetrically encrypt the compressed original data to obtain encrypted data; If the original data is text data, before data compression, the text-type original data is converted into a byte stream using UTF-8 encoding, and then the original data in the byte stream form is compressed and subsequently processed; if the original data is unstructured data of the video or audio type, it is determined whether the video or audio type original data is in a compressed format; if so, the data compression process is skipped and subsequent steps are performed; if not, the video or audio type original data is compressed and then subsequent steps are performed; Get the data length l of the ciphertext data （ds） (Unit: byte), using the byte stream reshaping algorithm to convert the encrypted data into (one) N （o） ×N （o） The two-dimensional matrix of , get the matrix data; Among them, N （o） Indicates the order of the matrix, N （o） The calculation formula is: ; The fractal algorithm of the Julia set is used to iteratively process the matrix data to obtain the fractal matrix of chaotic distribution. The specific iterative process is as follows: (Julia set) Generate a complex constant c （ju） , as the fractal parameter of the iterative process; Square each element in the matrix data and then add the complex constant c （ju） Iterative processing replaces the original elements in the matrix with the elements after iteration: Let (one) element in the matrix data be z （0） , the element after one iteration is z （1） : ; The element after iterating twice is z （2） : ; And so on, until each element in the matrix data is iterated I （it） times, retaining the fractal parameter c of the Julia set （ju） and the number of iterations I （it） ; (iteration number I （it） The value of is 7; users or relevant technical personnel can adjust the number of iterations I according to actual needs （it） Value, number of iterations I （it） The value of should not exceed 15 to avoid the difficulty of reverse restoration); Count the total number of bytes of all elements in the fractal matrix L （fm） , the number of bytes of a single element si （fm） , calculate the initial number of slices n of the fractal matrix （sh） : ; by Divide the fractal matrix into n rows for fixed intervals （sh） Original shards (where Round up); Encode the original shard into n using an erasure code (such as Reed-Solomon) （re） redundant shards (where n （re） The value is usually n （sh） 5% to 10% of the value); n （sh） original shards and n （re） Add Gaussian noise to each redundant shard, and store the original shard (after adding Gaussian noise) and the redundant shard as the data to be sent to the local server; The process of assessing the trustworthiness of a connector includes: authentication checks, (network) behavior checks, and (external) reputation checks; Certification inspection: Obtain the connector's verification certificate (issued by a trusted third-party organization, i.e., CA) and determine whether the verification certificate has exceeded its validity period. If it has not exceeded (the validity period), the connector has passed the certification inspection; otherwise, the connector has failed the certification inspection. (Network) behavior check: Checks whether the connector's network environment and access behavior are secure. If they are secure (i.e., the connector does not encounter any of the following network behavior check items), the connector passes the (network) behavior check; otherwise, the connector fails the (network) behavior check. (Network) behavior inspection items include but are not limited to: Check whether the connector's IP address is consistent with its geographic location; Check the network environment where the connector is located for known attack sources (known attack sources are malicious network entities that have been identified, analyzed, and documented by cybersecurity researchers, companies, or organizations); Check whether the connector has violated regulations (laws) such as accessing local servers without authorization (in the past month). (External) reputation check: By accessing a third-party reputation database, the connector is checked to see if it has been marked as suspicious or has a bad record in past transactions or services (in the past month). If the connector's reputation score in the third-party reputation database is higher than the preset reputation threshold, the connector passes the (external) reputation check; otherwise, the connector fails the (external) reputation check. It should be noted that the "reputation threshold" here is jointly determined by users and relevant technical personnel of the third-party reputation database; The results of the connector authentication check, (network) behavior check, and (external) reputation check are combined. If the connector passes all checks, the evaluation result is "Trusted Connector". If the connector fails any one check, the evaluation result is "Untrusted Connector". Step A: Please refer to Figure 3 , select the MQTT protocol (such as HTTP or MQTT) to transmit the data to be sent to the "Trusted Connector"; Step A1: Establish a secure connection based on AugPAKE authentication and key negotiation (i.e., the local server proves its identity through the authentication server). Step A11: (Authentication process) The local server generates a random number a （ls） , and initiate a connection request (CONNECT), ClientID (i.e. the unique identifier of the local server) and a （ls） ; (Server response) After receiving the connection request (CONNECT), Broker generates (another) random number b （br） Based on a （ls） and b （br） Calculate the value Z of the bilinear pair （eg） , and Z （eg） Return to the local server; Step A12: (Client Authentication) The local server uses the pre-shared password p （wd） and a random number a （ls） Calculate the hash value v （h） ; Based on v （h） Calculate the value W of the bilinear pairing （eg） , and W （eg） Sent to the authentication server; It should be noted that the above "pre-shared password p （wd）" is set by the user or the relevant technical staff of the local server, and the password is p （wd） Known to the relevant technical personnel of the local server and the trusted connector; (Server verification): The authentication server obtains b （br） and p （wd） and Z （eg） , according to b （br） and p （wd） Calculate the hash value u （h） ; Based on u （h） Calculate the value S of the bilinear pairing （eg） , the authentication server verifies S （eg） Is it related to Z （eg） If they are equal, the authentication succeeds; otherwise, the authentication fails. Step A13: (Session key generation) After the authentication server succeeds, the local server exchanges a random number with the authentication server. （ls） and b （br） , and generate a unique session key SK through the negotiation function; (This key will be used for encryption and decryption of subsequent communications between the local server and the trusted connector, and will change for each connection, ensuring forward security); Step A2: Control access rights to the data to be sent through OAuth2.0 authorization (i.e., the local server applies for access rights for the trusted connector through the authorization server). Step A21: (Token Application) After passing AugPAKE authentication, the local server sends a permission request to the authorization server. The permission request includes: the retrieval scope and validity period of the data to be sent; After receiving the permission request and verifying the local server's identity (i.e., verifying the local server's unique identifier), the authorization server generates an encrypted token (usually in JWT format) containing the permission request content and returns the encrypted token to the local server. Step A22: (Access Control Execution) The local server sends the data to be sent to the trusted connector in the form of a message. The local server carries the encrypted token in the header of each message (sent to the trusted connector). (MQTT's Broker integrates an authorization plug-in (such as Request_T_plugin). Before the message sent by the local server is received by the trusted server, the local server will intercept the message and check whether the token in the message header is an encrypted token. If so, the message will be sent to the trusted connector. If not, the message will be rejected and the security log will be recorded. Step A3: Based on two-way authentication, define the information encryption process of the message during data transmission; Step A31: Two-way authentication process; Local Server: The local server sends the ClientID, the authentication certificate of the trusted connector, and the random number a （new） Sent to Broker in the form of a CONNECT message; Broker: Broker uses (Broker's own) private key to decrypt the CONNECT message and obtain a （new） , and combined with the value Z of the bilinear pairing （eg） Verify random number a （new） ; If the verification fails (i.e. a （new） ≠a （ls） ), then disconnect from the local server; If the verification is successful (i.e. a （new） =a （ls） ), then verify the validity of the trusted connector authentication certificate; If the validity verification fails, the standard data protocol (such as MQTT or HTTP) will be stopped from transmitting the data to be sent, and the encrypted protocol will be used instead; If the validity period is verified, Broker will send the random number b （br） and Broker's service certificate is sent to the trusted connector; The authentication server takes the value W of the bilinear pairing （eg） Send to trusted connector; Trusted Connector: The trusted connector verifies the validity of the Broker's service certificate; If the validity verification fails, the Broker connection will be disconnected; If the validity verification is passed, the trusted connector will （eg） Perform the inverse operation of the bilinear pairing to obtain v （h） According to p （wd） v （h） Perform anti-hash operation to get a （ls） ; Based on a （ls） and b （br） ,The trusted connector generates (a) unique session key SK through the negotiation function; Step A32: Data transmission process; The local server converts the data to be sent into a message (with application layer semantics) and symmetrically encrypts the first message using the session key SK to obtain the encrypted payload. Assemble the encrypted payload into a PUBLISH message and send it to the Broker; Broker checks the token of the PUBLISH message; If the check passes, the Broker sends the PUBLISH message to the trusted connector; the Broker sends a request to the local server to obtain the fractal parameter c of the data to be sent. （ju） and the number of iterations I （it） Get request for Broker obtains fractal parameter c （ju） and the number of iterations I （it） Then, the fractal parameter c （ju） and the number of iterations I （it） Temporarily store the message in the cache, prompt the local server to continue sending the message, and detect whether there is a terminator at the end of the message sent by the local server; If it does not exist, it means that the local server has not sent the last message and will not process it; If it exists, it means that the local server has sent the last message, and Broker adds the fractal parameter c between the end of the last message and the terminator. （ju） and the number of iterations I （it） , and then send the last message to the trusted connector; The trusted connector converts all messages (received by the trusted connector) into data to be sent through the session key SK, and obtains the fractal parameter c at the end of the last message. （ju） and the number of iterations I （it） , restore the data to be sent to the original data; If the test fails, the Broker returns the PUBLISH message to the local server, records the security log, and prompts the local server to reapply for permissions for the trusted connector; Step B: Select SSL / TLS protocol to transmit the data to be sent to the "untrusted connector"; The local server initiates a standard TCP connection to the designated port of the "untrusted connector" and establishes a raw, bidirectional byte stream channel through the TCP three-way handshake (SYN, SYN-ACK, ACK). After the byte stream channel is established, the local server sends all the data to be sent and the fractal parameter c （ju） and the number of iterations I （it） The target data is submitted to the TLS layer. The TLS layer encrypts the target data using a symmetric encryption algorithm (such as AES) and a session key based on the TCP three-way handshake, calculates a MAC authentication code, and sends the ciphertext of the target data through the underlying TCP connection. After receiving the ciphertext of the target data, the “untrusted connector” performs the reverse decryption and verification operation, and recovers all the data to be sent and the fractal parameter c （ju） and the number of iterations I （it） .

[0020] Step S2: Obtain the average delay and packet loss rate of each route every hour in the past day and calculate the error cost of each route; determine the routing link of the local server based on the error cost of each route; obtain the maximum transmission unit and data transmission rate of each route on the routing link, and adjust the data size when the local server transmits data to the router based on the bit error rate and header overhead; Get the total number of routes ro from the local server to the "trusted connector" or "untrusted connector"; Obtain the average latency and packet loss rate of each route per hour over the past day and calculate the error cost of each route. Based on the error cost of each route, select a route for the local server. Calculate the error cost of the first route: The average delay of the first route per hour in the past day is ne （1） ~ne （24） and packet loss rate pl （1） ~pl （24） ; The Shapiro-Wilk test was used to determine whether （1） ~ne （24） is a normal distribution; If it is (normal distribution), then calculate ne （1） ~ne （24） The mean μ （ne） and standard deviation σ （ne） ; If not (normal distribution), use logit transformation to make ne （1） ~ne （24） Normalize, then calculate (ne after normalization （1） ~ne （24） ) mean and standard deviation; Assume that the delay of the first route is nd, and the probability function of the delay of the first route p(nd) is: ; Get the current delay of the first router （now） , (based on the probability function p(nd)) calculate the probability p(ne) that the first route delay becomes smaller （now） ), the probability of delay increasing up (ne （now） ): ; Get the average hourly delay of the first router in the past month, and the statistical delay is less than or equal to ne （now） The frequency f （高-低） , the delay is greater than ne （now） The frequency f （低-高） ; The estimated probability p of the first router's current delay becoming higher （+） : ; The estimated probability p that the current delay becomes lower （-） : ; Construct the state transition matrix P （k） : ; Get the number of data to be sent n （fi） (n （fi） That is, the original number of shards n （sh） and the number of redundant shards n （re） The sum of the delay of the first router in the previous hour is obtained. （h） , construct about P （k） Matrix equation to calculate the delay cost Ri of the first router （1） , the matrix equation is as follows: ; Repeat Ri （1） The calculation process calculates the delay cost Ri of the second to the roth routers （2） ~Ri （ro） And the packet loss cost Rc of the first, second, and up to the roth router （1） 、Rc （2） ~Rc （ro） ; Calculate the error cost fa of the first router （1） : ; The error cost of the second router is fa （2） : ; Similarly, the error cost of the roth router is fa （ro） : ; The router with the lowest error cost is selected as the starting router. The starting router selects routers with low latency, low packet loss rate, and few hops as the successor routers until the local server completes the route search for the "trusted connector" or "untrusted connector" and determines the routing link; Get the maximum transmission unit (MTU) of each route on the routing link （1） ~M （ru） and data transfer rate b （1） ~b （ru） ; Where ru represents the number of routers on the routing link; Extract the bit error rate B of the first router (on the routing link) （e）, let the data size when the local server transmits data to the first router (on the routing link) be s （1） : Get header overhead H （协议） (i.e. the sum of the link layer header, IP header and TCP / UDP header), construct the objective function G(s （1） ): ; in, Indicates the probability of successful transmission of the message: ; Take G (s （1） ) and the logarithm of s （1） Taking the derivative, we get formula 1: ; Let the derivative of formula 1 be zero, and we get formula 2: ; make , solve formula 2 and get s （err） : ; Select （err） and The smaller value of （1） ; Repeat to confirm （1） The steps are to adjust the data size of a single transmission of data by subsequent routers (on the routing link).

[0021] Step S3: Detect whether any abnormality (such as illegal access, data tampering, etc.) occurs during the data transmission from the local server to the "trusted connector" or "untrusted connector"; if not, continue to detect until the transmission of the pending data is completed; if so, activate the alarm and disconnect the local server from the "trusted connector" or "untrusted connector".

[0022] The above formulas are all dimensionless and calculated by taking their numerical values. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions. For example, if there are weight coefficients and proportional coefficients, the size of the settings is to quantify each parameter to obtain a specific value, which is convenient for subsequent comparison. Regarding the size of the weight coefficient and the proportional coefficient, as long as it does not affect the proportional relationship between the parameter and the quantized value, it is fine.

[0023] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A data delivery method based on a trusted connector, characterized in that: The method comprises: The original data is encrypted and saved locally to obtain the data to be sent; the trustworthiness of the connector is evaluated. If the evaluation result is a trusted connector, the standard data protocol is selected to transmit the data to be sent; if the evaluation result is an untrusted connector, the encrypted protocol is selected to transmit the data to be sent; Obtain the average latency and packet loss rate for each route per hour over the past day and calculate the error cost for each route. Based on the error cost for each route, determine the routing link for the local server. Obtain the maximum transmission unit and data transmission rate for each route on the routing link. Based on the bit error rate and header overhead, adjust the data size when the local server transmits data to the router. Detect whether there is any abnormality during the data transmission from the local server to the trusted connector or the untrusted connector; if no abnormality occurs, continue to detect until the transmission of the pending data is completed; if abnormality occurs, activate the alarm and disconnect the local server from the trusted connector or the untrusted connector.

2. A data delivery method based on a trusted connector according to claim 1, characterized in that: The processing of the original data is as follows: Compressing and encrypting the original data to obtain encrypted data; Get the data length l of the ciphertext data （ds） , using the byte stream reshaping algorithm to convert the encrypted data into N （o） ×N （o） The two-dimensional matrix of , get the matrix data; Among them, N （o） Indicates the order of the matrix, N （o） The calculation formula is: ； The fractal algorithm is used to iteratively process the matrix data to obtain the fractal matrix of chaotic distribution. The specific iterative process is as follows: Generate fractal parameter c （ju） , square each element in the matrix data and then add the complex constant c （ju） Iterative processing replaces the original elements in the matrix with the elements after iteration: Let the element in the matrix data be z （0） , the element after one iteration is z （1） : ； And so on, until each element in the matrix data is iterated I （it） times, retaining the fractal parameter c （ju） and the number of iterations I （it） ; Count the total number of bytes of all elements in the fractal matrix L （fm） , the number of bytes of a single element si （fm） , calculate the initial number of slices n of the fractal matrix （sh） : ； by Divide the fractal matrix into n rows for fixed intervals （sh） Original shards; Encode the original shard into n through erasure coding （re） redundant shards; n （sh） original shards and n （re） Gaussian noise is added to the redundant shards, and the original shards and redundant shards are stored as data to be sent to the local server; Evaluate the trustworthiness of the connector; if it is a trusted connector, use the MQTT protocol to transmit the data to be sent; If the connector is not trusted, the data to be sent is transmitted using the SSL / TLS protocol.

3. A data delivery method based on a trusted connector according to claim 2, characterized in that: The specific steps for transmitting data to be sent using the MQTT protocol are as follows: Step A1: Establish a secure connection based on AugPAKE authentication and key negotiation; Step A11: The local server generates a random number a （ls） , and initiate a connection request, ClientID and a to Broker （ls） ; Broker generates a random number b （br） , based on a （ls） and b （br） Calculate the value Z of the bilinear pair （eg） , and Z （eg） Return to the local server; Step A12: The local server uses the pre-shared password p （wd） and a random number a （ls） Calculate the hash value v （h） ; Based on v （h） Calculate the value W of the bilinear pairing （eg） , and W （eg） Send to the authentication server; Authentication server obtains b （br） and p （wd） and Z （eg） , according to b （br） and p （wd） Calculate the hash value u （h） ; Based on u （h） Calculate the value S of the bilinear pairing （eg） , the authentication server verifies S （eg） Is it related to Z （eg） If they are equal, the authentication succeeds; otherwise, the authentication fails. Step A13: After the authentication of the authentication server is successful, the local server exchanges the random number a with the authentication server. （ls） and b （br） , and generate a session key SK; Step A2: Control access rights to the data to be sent through OAuth2.0 authorization; Step A3: Based on two-way authentication, define the information encryption process of the message during data transmission.

4. A data delivery method based on a trusted connector according to claim 3, characterized in that: The specific steps of step A2 are as follows: Step A21: After the local server passes AugPAKE authentication, it sends a permission request to the authorization server. The permission request includes: the retrieval scope and validity period of the data to be sent; After receiving the permission request and verifying the identity of the local server, the authorization server generates an encrypted token containing the permission request content and returns the encrypted token to the local server; Step A22: The local server sends the data to be sent to the trusted connector in the form of a message; the local server carries an encrypted token in the header of each message; Before the message sent by the local server is received by the trusted server, the local server will intercept the message and check whether the token in the message header is an encrypted token; if so, the message will be sent to the trusted connector; if not, the message will be refused to be sent to the trusted connector and a security log will be recorded.

5. The data delivery method based on a trusted connector according to claim 3, characterized in that: The specific steps of step A3 are as follows: Step A31: Two-way authentication process; The local server sends the ClientID, the authentication certificate of the trusted connector, and the random number a （new） Sent to Broker in the form of a CONNECT message; Broker decrypts the CONNECT message to obtain a （new） , and combined with the value Z of the bilinear pairing （eg） Verify random number a （new） ; If the verification fails, the connection with the local server is disconnected; If the verification is successful, the validity of the trusted connector authentication certificate is verified; If the validity verification fails, the standard data protocol will be stopped from being used to transmit the data to be sent, and the encrypted protocol will be used instead; If the validity period is verified, Broker will send the random number b （br） and Broker's service certificate to the trusted connector; the authentication server sends the bilinear pair value W （eg） Send to trusted connector; The trusted connector verifies the validity of the Broker's service certificate; If the validity verification fails, the Broker connection will be disconnected; If the validity verification is passed, the trusted connector will （eg） Perform the inverse operation of the bilinear pairing to obtain v （h） According to p （wd） v （h） Perform anti-hash operation to get a （ls） ; Based on a （ls） and b （br） ,The trusted connector generates the session key SK through the negotiation function.

6. A data delivery method based on a trusted connector according to claim 5, characterized in that: Step A3 also includes the following: Step A32: Data transmission process; The local server converts the data to be sent into messages and symmetrically encrypts the first message using the session key SK to obtain the encrypted payload; Assemble the encrypted payload into a PUBLISH message and send it to the Broker; Broker checks the token of the PUBLISH message; If the check passes, the Broker sends the PUBLISH message to the trusted connector; the Broker sends a request to the local server to obtain the fractal parameter c of the data to be sent. （ju） and the number of iterations I （it） Get request for Broker obtains fractal parameter c （ju） and the number of iterations I （it） Then, the fractal parameter c （ju） and the number of iterations I （it） Temporarily store the message in the cache, prompt the local server to continue sending the message, and detect whether there is a terminator at the end of the message sent by the local server; If it does not exist, it means that the local server has not sent the last message and will not process it; If it exists, it means that the local server has sent the last message, and Broker adds the fractal parameter c between the end of the last message and the terminator. （ju） and the number of iterations I （it） , and then send the last message to the trusted connector; The trusted connector converts all messages into data to be sent through the session key SK and obtains the fractal parameter c at the end of the last message. （ju） and the number of iterations I （it） , restore the data to be sent to the original data; If the test fails, the Broker returns the PUBLISH message to the local server, records the security log, and prompts the local server to reapply for permissions for the trusted connector.

7. The data delivery method based on a trusted connector according to claim 1, characterized in that: The steps to calculate the cost of a mistake are as follows: Get the average hourly delay of the first route ne （1） ~ne （24） , and calculate the mean μ （ne） and standard deviation σ （ne） ; Assume that the delay of the first route is nd, and the probability function of the delay of the first route p(nd) is: ； Get the current delay of the first router （now） , calculate the probability p(ne （now） ), the probability of delay increasing up (ne （now） ): ; Get the first router whose delay is less than or equal to ne （now） The frequency f （高-低） , the delay is greater than ne （now） The frequency f （低-高） ; Calculate the estimated probability p of delay becoming higher （+） : ； The estimated probability p that the current delay becomes lower （-） : ； Construct the state transition matrix P （k） : ； Get the number of data to be sent n （fi） , get the historical average delay ne of the first router （h） , construct about P （k） Matrix equation to calculate the delay cost Ri of the first router （1） , the matrix equation is as follows: ； Calculate the delay cost Ri of the 2nd to roth routers （2） ~Ri （ro） And the packet loss cost Rc of the 1st to roth routers （1） ~Rc （ro） ; Calculate the error cost fa of the first router （1） : ; Similarly, the error cost of the roth router is fa （ro） ; The router with the lowest error cost is selected as the starting router. The starting router selects routers with low delay, low packet loss rate and few hops as the successor router until the local server completes the route retrieval of the trusted connector or non-trusted connector and determines the routing link.

8. The data delivery method based on a trusted connector according to claim 1, characterized in that: The steps to adjust the transfer data size are as follows: Get the maximum transmission unit M of the first route on the routing link （1） , data transmission rate b （1） and bit error rate B （e） , suppose the data size when the local server transmits data to the first router is s （1） : Get header overhead H （协议） , construct the objective function G(s （1） ): ； in, Indicates the probability of successful transmission of the message: ； Take G (s （1） ) and the logarithm of s （1） Taking the derivative, we get formula 1: ； Let the derivative of formula 1 be zero, and we get formula 2: ； make , solve formula 2 and get s （err） : ； Select （err） and The smaller value of （1） ; Adjust the data size of a single transmission of data by subsequent routers on the routing link.

Images