A data delivery method based on trusted connectors

Abstract

This invention provides a data delivery method based on trusted connectors, belonging to the field of data transmission; it solves the problem of low security during data delivery; specifically, it involves: encrypting and locally storing the original data to obtain the data to be sent; evaluating the trustworthiness of the connector; if the evaluation result is a trusted connector, selecting a standard data protocol to transmit the data to be sent; if the evaluation result is an untrusted connector, selecting an encrypted protocol to transmit the data to be sent; calculating the error cost of each route to determine the routing link of the local server; adjusting the data size when the local server transmits data to the router on the routing link; detecting anomalies in the process of the local server transmitting data to the connector and issuing an alarm; this invention ensures secure data transmission by evaluating the trustworthiness of the connector, using different protocols to transmit data, and adding data protection measures.

Description

Technical Field

[0001] This invention relates to a data delivery method based on a trusted connector, and pertains to the field of data transmission. Background Technology

[0002] Existing methods for delivering connector data have the following shortcomings:

[0003] High data transmission latency:

[0004] A common problem in existing connector data delivery methods is high data transmission latency. Traditional connectors often use multi-layered middleware or relay mechanisms to complete data transmission. Data needs to go through multiple stages between the source and target systems, including format conversion, protocol adaptation, and routing scheduling, each of which introduces additional processing time. For example, the delivery of structured data between different systems often requires standardization, serialization, and network transmission, all of which add to the latency. When data delivery scenarios have high real-time requirements (such as financial transactions and IoT sensor monitoring), latency directly affects the timeliness of business operations and the accuracy of decision-making.

[0005] Insufficient security and compliance: Existing connector data delivery methods also have deficiencies in terms of security and compliance; many connectors focus more on the "accessibility" of data delivery, while ignoring the security risks that data may encounter during transmission, such as black pants attacks, data leaks, and malicious tampering; if connectors do not have built-in complete encryption mechanisms and access controls, sensitive data can easily be exposed in the delivery chain, posing significant risks to the enterprise's data delivery system.

[0006] High maintenance and learning costs: While existing connectors simplify system interoperability to some extent, their configuration and maintenance remain complex. First, many connectors require complex environments (specific middleware, drivers, or library files) for installation and configuration, increasing deployment costs. Second, in real-world business scenarios, business logic often needs frequent adjustments, requiring constant modification of connector adaptation rules and mapping relationships. Such modifications typically lack automated support, necessitating manual intervention and being prone to errors. Finally, for resource-constrained SMEs, these high learning and maintenance costs may outweigh the convenience offered by connectors. Summary of the Invention

[0007] To address the shortcomings of existing technologies, the present invention aims to provide a data delivery method based on trusted connectors, thereby solving the problem of low security during data delivery.

[0008] To achieve the above objectives, the present invention provides a data delivery method based on a trusted connector, comprising:

[0009] The original data is encrypted and stored locally to obtain the data to be sent; the trust level of the connector is evaluated. If the evaluation result is a trusted connector, the standard data protocol is selected to transmit the data to be sent; if the evaluation result is an untrusted connector, the encrypted protocol is selected to transmit the data to be sent.

[0010] Get the average latency and packet loss rate of each route for each hour over the past day, and calculate the error cost of each route; determine the routing links of the local server based on the error cost of each route; get the maximum transmission unit and data transmission rate of each route on the routing link, and adjust the data size when the local server transmits data to the router based on the bit error rate and header overhead;

[0011] The system detects whether any anomalies occur during the data transmission process from the local server to the trusted or untrusted connector. If no anomalies occur, the detection continues until the data transmission is complete. If an anomaly occurs, an alarm is triggered, and the connection between the local server and the trusted or untrusted connector is disconnected.

[0012] Furthermore, the processing procedure for the raw data is as follows:

[0013] The original data is compressed and encrypted to obtain encrypted data;

[0014] The length of the encrypted data is l （ds） The encrypted data is transformed into N using a byte stream reshaping algorithm. （o） ×N （o） From a two-dimensional matrix, obtain matrix data;

[0015] Where, N （o） N represents the order of the matrix. （o） The formula for calculation is:

[0016] ;

[0017] The matrix data is iteratively processed using a fractal algorithm to obtain a chaotic fractal matrix. The specific iterative process is as follows:

[0018] Generate fractal parameter c （ju） Squaring each element in the matrix data and then adding the complex constant c （ju） The iterative process replaces the original elements in the matrix with the elements obtained after the iteration.

[0019] Let z be the element in the matrix data. （0） The element after one iteration is z. （1） :

[0020] ;

[0021] This process continues until I is iterated over every element in the matrix data. （it） Next, retain the fractal parameter c. （ju） and iteration number I （it） ;

[0022] The total number of bytes L of all elements in a statistical fractal matrix （fm） The number of bytes in a single element, si （fm） Calculate the initial number of fragments n of the fractal matrix. （sh） :

[0023] ;

[0024] by Divide the fractal matrix into n rows at fixed intervals. （sh） One original fragment;

[0025] The original fragments are encoded into n using erasure coding. （re） One redundant fragment;

[0026] For n （sh） One original partition and n （re） Gaussian noise is added to each redundant shard, and the original shard and the redundant shard are stored as data to be sent on the local server.

[0027] Assess the trustworthiness of the connector; if it is a trusted connector, use the MQTT protocol to transmit the data to be sent.

[0028] If the connector is not trusted, the data to be sent is transmitted using the SSL / TLS protocol.

[0029] Furthermore, the specific steps for transmitting data to be sent using the MQTT protocol are as follows:

[0030] Step A1: Establish a secure connection based on AugPAKE authentication and key negotiation;

[0031] Step A11: The local server generates a random number a. （ls） And send a connection request, ClientID, and a to the Broker. （ls） ;

[0032] Broker generates random number b （br） Based on a （ls） and b （br） Calculate the value Z of bilinear pairs （eg） and Z （eg） Return to the local server;

[0033] Step A12: The local server uses the pre-shared password p （wd） and random number a （ls） Calculate the hash value v（h） Based on v （h） Calculate the value W of the bilinear pair （eg） and W （eg） Send to the authentication server;

[0034] Authentication server obtains b （br） and p （wd） and Z （eg） According to b （br） and p （wd） Calculate hash value u （h） Based on u （h） Calculate the value S of the bilinear pair （eg） The authentication server verifies S （eg） Is it related to Z? （eg） If they are equal, authentication is successful; otherwise, authentication fails.

[0035] Step A13: After successful authentication by the authentication server, the local server exchanges a random number 'a' with the authentication server. （ls） and b （br） And generate the session key SK;

[0036] Step A2: Control access permissions for pending data by authorizing OAuth 2.0.

[0037] Step A3: Based on two-way authentication, define the information encryption process of the message during data transmission.

[0038] Furthermore, the specific steps of step A2 are as follows:

[0039] Step A21: After the local server is authenticated by AugPAKE, it sends a permission request to the authorization server. The permission request includes the retrieval scope and validity period of the data to be sent.

[0040] After receiving the permission request and verifying the identity of the local server, the authorization server generates an encrypted token containing the permission request content and returns the encrypted token to the local server.

[0041] Step A22: The local server sends the data to be sent to the trusted connector in the form of a message; the local server carries an encrypted token in the header of each message;

[0042] Before a message sent by the local server is received by the trusted server, the local server intercepts the message and checks whether the token in the message header is an encrypted token. If it is, the message is sent to the trusted connector; if not, the message is refused to be sent to the trusted connector and a security log is recorded.

[0043] Furthermore, the specific steps of step A3 are as follows:

[0044] Step A31: Two-way authentication process;

[0045] The local server will store the ClientID, the trusted connector's authentication certificate, and the random number a. （new） Send it to the Broker in the form of a CONNECT message;

[0046] The broker decrypts the CONNECT message to obtain a （new） And combined with the value Z of the bilinear pair （eg） Verify random number a （new） ;

[0047] If the verification fails, the connection to the local server will be disconnected.

[0048] If the verification passes, then verify the validity period of the trusted connector certification certificate;

[0049] If the timeliness verification fails, the standard data protocol will be stopped from being used to transmit the data to be sent, and an encrypted protocol will be used instead.

[0050] If the timeliness verification passes, the Broker will generate a random number b. （br） The Broker's service certificate is sent to the trusted connector; the authentication server will then send the bilinear pair value W. （eg） Send to trusted connector;

[0051] The trusted connector verifies the validity period of the Broker's service certificate;

[0052] If the timeliness verification fails, the Broker connection will be disconnected.

[0053] If the timeliness verification passes, the trusted connector will support W. （eg） Perform the inverse operation on the bilinear pair to obtain v. （h） According to p （wd） For v （h） Perform a dehaze operation to obtain a （ls） ;

[0054] Based on a （ls） and b （br） The trusted connector generates the session key SK through a negotiation function.

[0055] Furthermore, step A3 also includes the following:

[0056] Step A32: Data transmission process;

[0057] The local server converts the data to be sent into a message and uses the session key SK to symmetrically encrypt the first message to obtain the encrypted payload;

[0058] The encrypted payload is assembled into a PUBLISH message and sent to the Broker;

[0059] The broker checks the token in the PUBLISH message;

[0060] If the check passes, the Broker sends the PUBLISH message to the trusted connector; the Broker then sends a request to the local server to obtain the fractal parameters c of the data to be sent. （ju） and iteration number I （it） The request to obtain;

[0061] Broker obtains fractal parameter c （ju） and iteration number I （it） Then, the fractal parameter c （ju） and iteration number I （it） The message is temporarily stored in the cache, and the local server is prompted to continue sending messages. The message sent by the local server is checked to see if there is a terminator at the end.

[0062] If it does not exist, it means that the local server did not send the last message and will not process it.

[0063] If it exists, it means that the local server sent the last message. The Broker adds a fractal parameter c between the end of the last message and the terminator. （ju） and iteration number I （it） Then, the last message is sent to the trusted connector;

[0064] The trusted connector uses the session key SK to convert all messages into data to be sent, and obtains the fractal parameter c at the end of the last message. （ju） and iteration number I （it） The data to be sent is restored to its original form.

[0065] If the detection fails, the Broker sends the PUBLISH message back to the local server, records the security log, and prompts the local server to reapply for permissions as a trusted connector.

[0066] Furthermore, the steps for calculating the cost of the error are as follows:

[0067] Get the average hourly latency of the first route. （1） ~ne （24） And calculate the mean μ （ne） and standard deviation σ （ne） ;

[0068] Let the delay of the first route be nd, and the probability function p(nd) of the delay of the first route be:

[0069] ;

[0070] Get the current latency of the first router. （now） Calculate the probability p(ne) that the delay decreases. （now） The probability of delay increasing (ne) （now） ): ;

[0071] The latency of the first router is less than or equal to ne. （now） frequency f （高-低） The delay is greater than ne （now） frequency f （低-高） ;

[0072] Calculate the estimated probability p of increased latency （+） The estimated probability p of lower latency （-） ;

[0073] ;

[0074] Construct the state transition matrix P （k） :

[0075] ;

[0076] The number of data to be sent, n （fi） Obtain the historical average latency of the first router. （h） Construct about P （k） Given the matrix equation, calculate the delay cost Ri of the first router. （1） The matrix equation is as follows:

[0077] ;

[0078] Calculate the delay cost Ri for the 2nd to the roth routers. （2） ~Ri （ro） And the packet loss cost Rc of the first to the roth routers. （1） ~Rc （ro） ;

[0079] Calculate the error cost fa of the first router. （1） : ;

[0080] Similarly, the cost of failure for the ro-th router is fa. （ro） : ;

[0081] The router with the lowest error cost is selected as the starting router. The starting router selects routers with low latency, low packet loss rate and few hops as successor routers, until the local server completes the route search for trusted or untrusted connectors and determines the route link.

[0082] Furthermore, the steps for adjusting the size of the transmitted data are as follows:

[0083] Obtain the maximum transmission unit M of the first route on the routing link. （1） Data transmission rate b （1） and bit error rate B （e） Let s be the size of the data transmitted by the local server to the first router in a single transmission. （1） :

[0084] Get the header overhead H （协议） Construct the objective function G(s) （1） ):

[0085] ;

[0086] in, Indicates the probability of successful message transmission:

[0087] ;

[0088] Take G(s) （1） The logarithm of ) and its relation to s （1） Taking the derivative, we get Formula 1:

[0089] ;

[0090] Setting the derivative of Equation 1 to zero, we obtain Equation 2:

[0091] ;

[0092] make Solving formula 2, we obtain s. （err） :

[0093] ;

[0094] Select s （err） and The smaller value in s is used as s （1） ;

[0095] Adjust the data size of each transmission by subsequent routers on the routing link.

[0096] Compared with the prior art, the beneficial effects of the present invention are:

[0097] Improving transmission efficiency: In this invention, the system classifies connectors through a "trust assessment module": trusted connectors are transmitted directly using ordinary data protocols; untrusted connectors are then encrypted. This differentiated approach offers two significant advantages: First, it avoids redundant encryption operations on trusted connectors, saving significant CPU and memory resources while reducing transmission latency; second, it allows for more rational resource allocation, concentrating computing power on links that truly require security hardening, thus improving overall network utilization.

[0098] Enhancing data security and reliability: The method of this invention effectively improves the overall security protection capability through differentiated processing of "trusted connectors" and "untrusted connectors". For connectors that are determined to be untrusted, the system will automatically enable encryption to ensure that data is transmitted even in insecure network environments. This design not only prevents data leakage, but also ensures data consistency and integrity, allowing the recipient to obtain original, tamper-proof, and reliable data.

[0099] Reduce network overhead and improve data utilization: This invention adjusts the actual traffic and packet size of each router to allow data to pass through the link at an appropriate "size," avoiding repeated splitting and reassembly of data during transmission. This not only reduces the waste of bandwidth and computing resources but also lowers packet loss and retransmission rates. Attached Figure Description

[0100] Other features, objects, and advantages of the invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0101] Figure 1 This is a schematic diagram of the method of the present invention;

[0102] Figure 2 This is a schematic diagram of the process of the present invention;

[0103] Figure 3 This is a schematic diagram of data transmission via the trusted connector of the present invention. Detailed Implementation

[0104] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0105] Please see Figure 1 and Figure 2 A data delivery method based on trusted connectors includes:

[0106] Step S1: Encrypt and save the original data locally to obtain the data to be sent; evaluate the trust level of the connector. If the (trust) evaluation result is "trusted connector", select a standard data protocol (such as MQTT or HTTP) to transmit the data to be sent; if the (trust) evaluation result is "untrusted connector", select an encryption protocol (such as SSL / TLS or AES) to transmit the data to be sent.

[0107] The processing procedure for the raw data is as follows:

[0108] The original data is compressed using algorithms such as zlib or LZMA, and then symmetrically encrypted using encryption algorithms such as AES-256-GCM or ChaCha20-Poly1305 to obtain encrypted data.

[0109] If the original data is text data, it is converted into a byte stream using UTF-8 encoding before compression, and then the byte stream data is compressed and processed. If the original data is unstructured video or audio data, it is determined whether the original video or audio data is in a compressed format. If it is, the data compression process is skipped and subsequent steps are executed. If not, the original video or audio data is compressed and then subsequent steps are executed.

[0110] The length of the encrypted data is l （ds） (Unit: bytes) Use the byte stream reshaping algorithm to transform encrypted data into (one) N （o） ×N （o） From a two-dimensional matrix, obtain matrix data;

[0111] Where, N （o） N represents the order of the matrix. （o） The formula for calculation is:

[0112] ;

[0113] The matrix data is iteratively processed using the fractal algorithm of the Julia set to obtain a chaotic fractal matrix. The specific iterative process is as follows:

[0114] (Julia set) generates a complex constant c （ju） , as the fractal parameter for iterative processing;

[0115] Square each element in the matrix data and then add the complex constant c. （ju） The iterative process replaces the original elements in the matrix with the elements obtained after the iteration.

[0116] Let z be one element in the matrix data. （0）The element after one iteration is z. （1） :

[0117] ;

[0118] The element after two iterations is z （2） :

[0119] ;

[0120] This process continues until I is iterated over every element in the matrix data. （it） Next, preserve the fractal parameter c of the Julia set. （ju） and iteration number I （it） (Iteration number I) （it） The value of I is 7; the number of iterations I can be adjusted by the user or relevant technical personnel according to actual needs. （it） Value, number of iterations I （it） The value should ideally not exceed 15 to avoid making the reverse engineering too difficult.

[0121] The total number of bytes L of all elements in a statistical fractal matrix （fm） The number of bytes in a single element, si （fm） Calculate the initial number of fragments n of the fractal matrix. （sh） :

[0122] ;

[0123] by Divide the fractal matrix into n rows at fixed intervals. （sh） One original fragment (of which, (Round up)

[0124] The original fragments are encoded into n using erasure coding (such as Reed-Solomon). （re） n redundant partitions (where n （re） The value is generally n （sh） (5% to 10% of the value)

[0125] For n （sh） One original partition and n （re） Gaussian noise is added to each redundant shard, and the original shard and redundant shard (after adding Gaussian noise) are stored as data to be sent on the local server.

[0126] The process of assessing a connector's trustworthiness includes: certification checks, (network) behavior checks, and (external) reputation checks;

[0127] Certification check: Obtain the connector's verification certificate (issued by a trusted third-party organization, i.e., CA), and determine if the verification certificate has expired. If it has not expired, the connector passes the certification check; otherwise, the connector fails the certification check.

[0128] (Network) Behavior Check: This check detects whether the connector's network environment and access behavior are secure. If secure (i.e., the connector does not exhibit any of the network behavior check items listed below), the connector passes the (network) behavior check; otherwise, the connector fails the (network) behavior check.

[0129] The inspection items for (online) behavior checks include, but are not limited to:

[0130] Check if the connector's IP address matches its geographical location;

[0131] Check whether the network environment where the connector is located contains known attack sources (known attack sources refer to malicious network entities that have been identified, analyzed and recorded by network security researchers, companies or organizations);

[0132] Check whether the connector (within the past month) has engaged in any unauthorized or illegal activities such as unauthorized access to the local server;

[0133] (External) Reputation Check: By accessing a third-party reputation database, the system checks whether the connector has been marked as suspicious or has a bad record in past (nearly one month) transactions or services. If the connector's reputation score in the third-party reputation database is higher than the preset reputation threshold, the connector passes the (external) reputation check; otherwise, the connector fails the (external) reputation check.

[0134] It should be noted that the "reputation threshold" here is jointly determined by the user and relevant technical personnel from the third-party reputation database.

[0135] The evaluation results are based on the combined results of connector certification checks, (network) behavior checks, and (external) reputation checks. If a connector passes all checks, the evaluation result is "Trusted Connector"; if a connector fails any check, the evaluation result is "Untrusted Connector".

[0136] Step A: Please refer to Figure 3 Choose to use the MQTT protocol (such as HTTP or MQTT) to transmit the data to be sent to the "Trusted Connector";

[0137] Step A1: Establish a secure connection based on AugPAKE authentication and key negotiation; (i.e., the local server proves its identity through the authentication server).

[0138] Step A11: (Authentication Process) The local server generates (a) random number a.（ls） It then sends a connection request (CONNECT) to the Broker, along with the ClientID (i.e., the unique identifier of the local server) and a （ls） ;

[0139] (Server Response) After receiving the connection request (CONNECT), the Broker generates (another) random number b. （br） Based on a （ls） and b （br） Calculate the value Z of bilinear pairs （eg） and Z （eg） Return to the local server;

[0140] Step A12: (Client Verification) The local server uses the pre-shared password p （wd） and random number a （ls） Calculate the hash value v （h） Based on v （h） Calculate the value W of the bilinear pair （eg） and W （eg） Send it to the authentication server; it should be noted that the above "pre-shared password p" （wd） "Set by the user or relevant technical personnel on the local server, and the password p..." （wd） This information was shared by technical personnel working on the local server and the trusted connector.

[0141] (Server Verification): The authentication server obtains b （br） and p （wd） and Z （eg） According to b （br） and p （wd） Calculate hash value u （h） Based on u （h） Calculate the value S of the bilinear pair （eg） The authentication server verifies S （eg） Is it related to Z? （eg） If they are equal, authentication is successful; otherwise, authentication fails.

[0142] Step A13: (Session Key Generation) After successful authentication by the authentication server, the local server exchanges a random number 'a' with the authentication server. （ls） and b （br） A unique session key SK is generated through a negotiation function; (this key will be used for encryption and decryption of subsequent communication between the local server and the trusted connector, and it will change with each connection to ensure forward security).

[0143] Step A2: Control access permissions for pending data through OAuth2.0 authorization (i.e., the local server requests access permissions for the trusted connector through the authorization server).

[0144] Step A21: (Token Request) After the local server is authenticated by AugPAKE, it sends a permission request to the authorization server. The permission request includes the retrieval scope and validity period of the data to be sent.

[0145] After receiving the permission request and verifying the identity of the local server (i.e., the unique identifier for verifying the local server), the authorization server generates an encrypted token (usually in JWT format) containing the permission request content and returns the encrypted token to the local server.

[0146] Step A22: (Access Control Execution) The local server sends the data to be sent to the trusted connector in the form of a message; the local server carries an encrypted token in the header of each message (sent to the trusted connector);

[0147] (MQTT's Broker integration authorization plugin (such as Request_T_plugin) intercepts the message sent by the local server before it is received by the trusted server, and checks whether the token in the message header is an encrypted token; if it is, the message is sent to the trusted connector; if not, the message is refused to be sent to the trusted connector and a security log is recorded.)

[0148] Step A3: Based on two-way authentication, define the information encryption process of the message during data transmission;

[0149] Step A31: Two-way authentication process;

[0150] Local server:

[0151] The local server will store the ClientID, the trusted connector's authentication certificate, and the random number a. （new） Send it to the Broker in the form of a CONNECT message;

[0152] Broker:

[0153] The Broker uses its own private key to decrypt the CONNECT message and obtain a （new） And combined with the value Z of the bilinear pair （eg） Verify random number a （new） ;

[0154] If the verification fails (i.e., a) （new） ≠a （ls） If the connection to the local server is lost, then the connection to the local server will be disconnected.

[0155] If the verification passes (i.e., a) （new） =a （ls） If the validity period of the trusted connector certification certificate is verified, then the validity period of the certificate is verified.

[0156] If the timeliness verification fails, stop using standard data protocols (such as MQTT or HTTP) to transmit the data to be sent, and switch to an encrypted protocol to transmit the data to be sent.

[0157] If the timeliness verification passes, the Broker will generate a random number b. （br） The Broker's service certificate is sent to the trusted connector;

[0158] The authentication server will assign the value W of the bilinear pair. （eg） Send to trusted connector;

[0159] Trusted Connector:

[0160] The trusted connector verifies the validity period of the Broker's service certificate;

[0161] If the timeliness verification fails, the Broker connection will be disconnected.

[0162] If the timeliness verification passes, the trusted connector will support W. （eg） Perform the inverse operation on the bilinear pair to obtain v. （h） According to p （wd） For v （h） Perform a dehaze operation to obtain a （ls） ;

[0163] Based on a （ls） and b （br） The trusted connector generates a unique session key SK through a negotiation function;

[0164] Step A32: Data transmission process;

[0165] The local server converts the data to be sent into a message (with application layer semantics) and uses the session key SK to symmetrically encrypt the first message to obtain the encrypted payload;

[0166] The encrypted payload is assembled into a PUBLISH message and sent to the Broker;

[0167] The broker checks the token in the PUBLISH message;

[0168] If the check passes, the Broker sends the PUBLISH message to the trusted connector; the Broker then sends a request to the local server to obtain the fractal parameters c of the data to be sent. （ju） and iteration number I （it） The request to obtain;

[0169] Broker obtains fractal parameter c （ju） and iteration number I （it） Then, the fractal parameter c （ju） and iteration number I （it）The message is temporarily stored in the cache, and the local server is prompted to continue sending messages. The message sent by the local server is checked to see if there is a terminator at the end.

[0170] If it does not exist, it means that the local server did not send the last message and will not process it.

[0171] If it exists, it means that the local server sent the last message. The Broker adds a fractal parameter c between the end of the last message and the terminator. （ju） and iteration number I （it） Then, the last message is sent to the trusted connector;

[0172] The trusted connector uses the session key SK to convert all messages received by the trusted connector into data to be sent, and obtains the fractal parameter c at the end of the last message. （ju） and iteration number I （it） The data to be sent is restored to its original form.

[0173] If the test fails, the Broker sends the PUBLISH message back to the local server, records the security log, and prompts the local server to re-apply for permissions as a trusted connector.

[0174] Step B: Select to use the SSL / TLS protocol to transmit the data to be sent to the "Untrusted Connector";

[0175] The local server initiates a standard TCP connection to the designated port of the "untrusted connector," establishing a raw, bidirectional byte stream channel through the TCP three-way handshake (SYN, SYN-ACK, ACK).

[0176] After the byte stream channel is established, the local server will send all the data to be sent, along with the fractal parameter c. （ju） and iteration number I （it） As target data, it is submitted to the TLS layer; the TLS layer encrypts the target data based on a symmetric encryption algorithm (such as AES) and the session key of the TCP three-way handshake, calculates the authentication code (MAC), and sends the ciphertext of the target data through the underlying TCP connection;

[0177] After receiving the ciphertext of the target data, the "untrusted connector" performs the reverse decryption and verification operation, recovering all the data to be sent and the fractal parameter c. （ju） and iteration number I （it） .

[0178] Step S2: Obtain the average latency and packet loss rate of each route per hour over the past day, and calculate the error cost of each route; determine the routing links of the local server based on the error cost of each route; obtain the maximum transmission unit and data transmission rate of each route on the routing link, and adjust the data size when the local server transmits data to the router based on the bit error rate and header overhead;

[0179] Get the total number of routes (ro) from the local server to either the "Trusted Connector" or the "Untrusted Connector";

[0180] Obtain the average latency and packet loss rate for each route over the past day, and calculate the failure cost for each route; select a route for the local server based on the failure cost for each route.

[0181] Calculate the error cost of the first route:

[0182] The first route's average hourly latency over nearly a day is ne （1） ~ne （24） and packet loss rate pl （1） ~pl （24） ;

[0183] Use the Shapiro-Wilk test to determine if ne （1） ~ne （24） It follows a normal distribution;

[0184] If it is (normal distribution), then calculate ne. （1） ~ne （24） mean μ （ne） and standard deviation σ （ne） ;

[0185] If it is not (normally distributed), then use the logit transformation to make ne （1） ~ne （24） Normalize, then calculate (after normalization, ne) （1） ~ne （24） (mean and standard deviation);

[0186] Let the delay of the first route be nd, and the probability function p(nd) of the delay of the first route be:

[0187] ;

[0188] Get the current latency of the first router. （now） Calculate the probability p(ne) of the first route delay decreasing (based on the probability function p(nd)). （now） The probability of delay increasing (ne) （now） ):

[0189] ;

[0190] Obtain the average hourly latency of the first router over the past month, and count routers with latencies less than or equal to 0. （now） frequency f （高-低） The delay is greater than ne （now） frequency f （低-高） ;

[0191] The estimated probability p of the first router having high latency （+） The estimated probability p of the current latency decreasing （-） ;

[0192] Construct the state transition matrix P （k） :

[0193] ;

[0194] The number of data to be sent, n （fi） (n) （fi） That is, the original number of fragments n （sh） With the number of redundant fragments n （re） (and), get the average latency of the first router in the previous hour. （h） Construct about P （k） Given the matrix equation, calculate the delay cost Ri of the first router. （1） The matrix equation is as follows:

[0195] ;

[0196] Repeat Ri （1） The calculation process calculates the delay cost Ri of the 2nd to the roth routers. （2） ~Ri （ro） And the packet loss cost Rc of the 1st, 2nd, and up to the roth routers. （1） 、Rc （2） ~Rc （ro） ;

[0197] Calculate the error cost fa of the first router. （1） : ;

[0198] The cost of the second router's failure （2） : ;

[0199] And so on, the cost of failure for the roth router is fa （ro） : ;

[0200] The router with the lowest error cost is selected as the starting router. The starting router selects routers with low latency, low packet loss rate and few hops as successor routers, until the local server completes the route search for "trusted connector" or "untrusted connector" and determines the route link.

[0201] Obtain the Maximum Transmission Unit (MTU) for each route on the routing link. （1） ~M （ru） and data transmission rate b （1） ~b （ru） Where ru represents the number of routers on the routing link;

[0202] Extract the bit error rate B of the first router (on the routing link). （e） Let s be the size of the data transmitted by the local server to the first router (on the routing link) in a single transmission. （1） :

[0203] Get the header overhead H （协议） (i.e., the sum of the link layer header, IP header, and TCP / UDP header), construct the objective function G(s) （1） ):

[0204] ;

[0205] in, Indicates the probability of successful message transmission:

[0206] ;

[0207] Take G(s) （1） The logarithm of ) and its relation to s （1） Taking the derivative, we get Formula 1:

[0208] ;

[0209] Setting the derivative of Equation 1 to zero, we obtain Equation 2:

[0210] ;

[0211] make Solving formula 2, we obtain s. （err） :

[0212] ;

[0213] Select s （err） and The smaller value in s is used as s （1） ;

[0214] Repeatedly determine s （1）The steps involve adjusting the data size of subsequent routers transmitting data in a single transaction (on the routing link).

[0215] Step S3: Detect whether any abnormalities occur during the data transmission process from the local server to the "Trusted Connector" or "Untrusted Connector" (such as unauthorized access, data tampering, etc.); if no abnormalities occur, continue detection until the data transmission is completed; if abnormalities occur, start an alarm and disconnect the local server from the "Trusted Connector" or "Untrusted Connector".

[0216] The above formulas are all dimensionless calculations. The formulas are derived from software simulations using a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation. For example, there are weighting coefficients and proportional coefficients. The values ​​set are to quantify each parameter to obtain a specific value, which is convenient for subsequent comparison. The values ​​of the weighting coefficients and proportional coefficients are only required to not affect the proportional relationship between the parameters and the quantified values.

[0217] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A data delivery method based on a trusted connector, characterized in that, The method includes: The original data is encrypted and stored locally to obtain the data to be sent; the trust level of the connector is evaluated. If the evaluation result is a trusted connector, the standard data protocol is selected to transmit the data to be sent; if the evaluation result is an untrusted connector, the encrypted protocol is selected to transmit the data to be sent. Get the average latency and packet loss rate of each route for each hour over the past day, and calculate the error cost of each route; determine the routing links of the local server based on the error cost of each route; get the maximum transmission unit and data transmission rate of each route on the routing link, and adjust the data size when the local server transmits data to the router based on the bit error rate and header overhead; The system detects whether any abnormalities occur during the data transmission process from the local server to the trusted or untrusted connector. If no abnormalities occur, the detection continues until the data transmission is complete. If an abnormality occurs, an alarm is triggered, and the connection between the local server and the trusted or untrusted connector is disconnected. The steps to adjust the size of the transmitted data are as follows: Obtain the maximum transmission unit M of the first route on the routing link. （1） Data transmission rate b （1） and bit error rate B （e） Let s be the size of the data transmitted by the local server to the first router in a single transmission. （1） : Get the header overhead H （协议） Construct the objective function G(s) （1） ): ； in, Indicates the probability of successful message transmission: ； Take G(s) （1） The logarithm of ) and its relation to s （1） Taking the derivative, we get Formula 1: ； Setting the derivative of Equation 1 to zero, we obtain Equation 2: ； make Solving formula 2, we obtain s. （err） : ； Select s （err） and The smaller value in s is used as s （1） ; Adjust the data size of each transmission by subsequent routers on the routing link.

2. The data delivery method based on a trusted connector according to claim 1, characterized in that, The processing procedure for the raw data is as follows: The original data is compressed and encrypted to obtain encrypted data; The length of the encrypted data is l （ds） The encrypted data is transformed into N using a byte stream reshaping algorithm. （o） ×N （o） From a two-dimensional matrix, obtain the matrix data; Where, N （o） N represents the order of the matrix. （o） The formula for calculation is: ； The matrix data is iteratively processed using a fractal algorithm to obtain a chaotic fractal matrix. The specific iterative process is as follows: Generate fractal parameter c （ju） Squaring each element in the matrix data and then adding the complex constant c （ju） The iterative process replaces the original elements in the matrix with the elements obtained after the iteration. Let z be the element in the matrix data. （0） The element after one iteration is z. （1） : ； This process continues until I is iterated over every element in the matrix data. （it） Next, retain the fractal parameter c. （ju） and iteration number I （it） ; The total number of bytes L of all elements in a statistical fractal matrix （fm） The number of bytes in a single element, si （fm） Calculate the initial number of fragments n of the fractal matrix. （sh） : ； by Divide the fractal matrix into n rows at fixed intervals. （sh） One original fragment; The original fragments are encoded into n using erasure coding. （re） One redundant fragment; For n （sh） One original partition and n （re） Gaussian noise is added to each redundant shard, and the original shard and the redundant shard are stored as data to be sent on the local server. Assess the trustworthiness of the connector; if it is a trusted connector, use the MQTT protocol to transmit the data to be sent. If the connector is not trusted, the data to be sent is transmitted using the SSL / TLS protocol.

3. The data delivery method based on a trusted connector according to claim 2, characterized in that, The specific steps for transmitting data to be sent using the MQTT protocol are as follows: Step A1: Establish a secure connection based on AugPAKE authentication and key negotiation; Step A11: The local server generates a random number a. （ls） And send a connection request, ClientID, and a to the Broker. （ls） ; Broker generates random number b （br） Based on a （ls） and b （br） Calculate the value Z of bilinear pairs （eg） and Z （eg） Return to the local server; Step A12: The local server uses the pre-shared password p （wd） and random number a （ls） Calculate the hash value v （h） Based on v （h） Calculate the value W of the bilinear pair （eg） and W （eg） Send to the authentication server; Authentication server obtains b （br） and p （wd） and Z （eg） According to b （br） and p （wd） Calculate hash value u （h） Based on u （h） Calculate the value S of bilinear pairs （eg） The authentication server verifies S （eg） Is it related to Z? （eg） If they are equal, authentication is successful; otherwise, authentication fails. Step A13: After successful authentication by the authentication server, the local server exchanges a random number 'a' with the authentication server. （ls） and b （br） And generate the session key SK; Step A2: Control access permissions for pending data by authorizing OAuth 2.

0. Step A3: Based on two-way authentication, define the information encryption process of the message during data transmission.

4. The data delivery method based on a trusted connector according to claim 3, characterized in that, The specific steps of step A2 are as follows: Step A21: After the local server is authenticated by AugPAKE, it sends a permission request to the authorization server. The permission request includes the retrieval scope and validity period of the data to be sent. After receiving the permission request and verifying the identity of the local server, the authorization server generates an encrypted token containing the permission request content and returns the encrypted token to the local server. Step A22: The local server sends the data to be sent to the trusted connector in the form of a message; the local server carries an encrypted token in the header of each message; Before a message sent by the local server is received by the trusted server, the local server intercepts the message and checks whether the token in the message header is an encrypted token. If it is, the message is sent to the trusted connector; if not, the message is refused to be sent to the trusted connector and a security log is recorded.

5. A data delivery method based on a trusted connector according to claim 3, characterized in that, The specific steps of step A3 are as follows: Step A31: Two-way authentication process; The local server will store the ClientID, the trusted connector's authentication certificate, and the random number a. （new） Send it to the Broker in the form of a CONNECT message; The broker decrypts the CONNECT message to obtain a （new） And combined with the value Z of the bilinear pair （eg） Verify random number a （new） ; If the verification fails, the connection to the local server will be disconnected. If the verification passes, then verify the validity period of the trusted connector certification certificate; If the timeliness verification fails, the standard data protocol will be stopped from being used to transmit the data to be sent, and an encrypted protocol will be used instead. If the timeliness verification passes, the Broker will generate a random number b. （br） The Broker's service certificate is sent to the trusted connector; the authentication server will then send the bilinear pair value W. （eg） Send to trusted connector; The trusted connector verifies the validity period of the Broker's service certificate; If the timeliness verification fails, the Broker connection will be disconnected. If the timeliness verification passes, the trusted connector will support W. （eg） Perform the inverse operation on the bilinear pair to obtain v. （h） According to p （wd） For v （h） Perform a dehaze operation to obtain a （ls） ; Based on a （ls） and b （br） The trusted connector generates the session key SK through a negotiation function.

6. The data delivery method based on a trusted connector according to claim 5, characterized in that, Step A3 also includes the following: Step A32: Data transmission process; The local server converts the data to be sent into a message and uses the session key SK to symmetrically encrypt the first message to obtain the encrypted payload; The encrypted payload is assembled into a PUBLISH message and sent to the Broker; The broker checks the token in the PUBLISH message; If the check passes, the Broker sends a PUBLISH message to the trusted connector; the Broker then sends a request to the local server to obtain the fractal parameters c of the data to be sent. （ju） and iteration number I （it） The request to obtain; Broker obtains fractal parameter c （ju） and iteration number I （it） Then, the fractal parameter c （ju） and iteration number I （it） The message is temporarily stored in the cache, and the local server is prompted to continue sending messages. The message sent by the local server is checked to see if there is a terminator at the end. If it does not exist, it means that the local server did not send the last message and will not process it. If it exists, it means that the local server sent the last message. The Broker adds a fractal parameter c between the end of the last message and the terminator. （ju） and iteration number I （it） Then, the last message is sent to the trusted connector; The trusted connector uses the session key SK to convert all messages into data to be sent, and obtains the fractal parameter c at the end of the last message. （ju） and iteration number I （it） The data to be sent is restored to its original form. If the detection fails, the Broker sends the PUBLISH message back to the local server, records the security log, and prompts the local server to reapply for permissions as a trusted connector.

7. The data delivery method based on a trusted connector according to claim 1, characterized in that, The steps for calculating the cost of an error are as follows: Get the average hourly latency of the first route. （1） ~ne （24） And calculate the mean μ （ne） and standard deviation σ （ne） ; Let the delay of the first route be nd, and the probability function p(nd) of the delay of the first route be: ； Get the current latency of the first router. （now） Calculate the probability p(ne) that the delay decreases. （now） The probability of delay increasing (ne) （now） ): ; The latency of the first router is less than or equal to ne. （now） frequency f （高-低） The delay is greater than ne （now） frequency f （低-高） ; Calculate the estimated probability p of increased latency （+） The estimated probability p of lower latency （-） ; Construct the state transition matrix P （k） : ； The number of data to be sent, n （fi） Obtain the historical average latency of the first router. （h） Construct about P （k） Given the matrix equation, calculate the delay cost Ri of the first router. （1） The matrix equation is as follows: ； Calculate the delay cost Ri for the 2nd to the roth routers. （2） ~Ri （ro） And the packet loss cost Rc of the first to the roth routers. （1） ~Rc （ro） ; Calculate the error cost fa of the first router. （1） : ; Similarly, the cost of failure for the ro-th router is fa. （ro） ; The router with the lowest error cost is selected as the starting router. The starting router selects routers with low latency, low packet loss rate and few hops as successor routers, until the local server completes the route search for trusted or untrusted connectors and determines the route link.

Images