Mobile encryption box

Abstract

This application provides a mobile encryption box, including a USB interface, a first encryption peripheral circuit, a second encryption peripheral circuit, and an RJ45 interface. Any two of the mobile encryption boxes can be linked to form a transmission link. The mobile encryption box also includes a link monitoring module, which is configured to collect transmission data from the RJ45 interface. Based on the transmission data, a multi-index weighted exponential decay scoring algorithm is used to calculate a link score S characterizing the link's health status. An isolation score A characterizing abnormal conditions of the transmission link indicators is obtained based on the transmission data using an isolated forest algorithm. This application calculates link scores using multiple indicators to assess link health status in real time, ensuring data transmission security. Simultaneously, the use of the isolated forest algorithm to detect abnormal conditions of transmission link indicators enables comprehensive monitoring of multiple transmission link indicators, timely detection of potential security threats, and prevention of data leakage and unauthorized access.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and specifically to a mobile encryption box. Background Technology

[0002] With the rapid development of information technology, data security and privacy protection have increasingly become a focus of attention for businesses and individuals. In traditional scenarios, data often faces the risk of being eavesdropped on, tampered with, or intercepted during transmission and storage, especially in insecure network environments.

[0003] Patent application number 202411789475.3 discloses a USB extended secure real-time bus network card device, including: a USB interface, non-volatile memory, a device ID comparison module, a fingerprint authentication module, and an SRB bus module. The USB interface is used to connect to a network terminal with network access requirements; the non-volatile memory is used to store a list of sensitive device IDs; the device ID comparison module is used to read the device ID of the network terminal, retrieve the device ID of the network terminal from the list of sensitive device IDs, and identify the device type of the network terminal; the fingerprint authentication module is used to perform a fingerprint authentication process on the network terminal whose device type is sensitive: verifying the fingerprint information of the person in charge of the network terminal; after successful authentication, triggering the SRB bus module to open the secure real-time bus channel; and preventing the transmission of sensitive data when authentication fails; the SRB bus module is used to transmit sensitive data of the network terminal whose device type is sensitive through the secure real-time bus channel.

[0004] However, while the aforementioned devices improve data security to some extent, they still have limitations. After successful authentication and connection establishment, these devices lack real-time monitoring of the link connection status. If the link status changes or is compromised by malicious attackers, it may not be detected in time to take appropriate security measures, potentially leading to data leakage. Summary of the Invention

[0005] To address the aforementioned issues, this invention proposes a mobile encryption box that can detect link connection status in real time, effectively preventing data leakage and unauthorized access.

[0006] The specific technical solution of this application is a mobile encryption box, including a USB interface, a first encryption peripheral circuit, a second encryption peripheral circuit, and an RJ45 interface. Any two of the mobile encryption boxes can be linked to form a transmission link. The mobile encryption box also includes a link monitoring module, which is configured to:

[0007] Data is collected from the RJ45 interface, including the number of requests N, processing time T, and network latency. Number of errors (E), Total time And the number of links n;

[0008] A link score S, representing the health status of the transmission link, is calculated using a multi-index weighted exponential decay scoring algorithm based on the transmitted data.

[0009] Based on the transmitted data, the isolated forest algorithm is used to obtain an isolated score A for anomalies in transmission link metrics that characterize the transmission link. These transmission link metrics include unit processing time (RPT), response time (RT), throughput (TH), and error rate (ER).

[0010] Furthermore, the multi-index weighted exponential decay scoring algorithm is shown in equation (1):

[0011] (1)

[0012] in, S represents the link score at time t. This represents the weight of the i-th transmission link index at time t. For adjustment coefficients, This represents the value of the i-th transmission link index at time t. This represents the threshold value of the i-th transmission link index at time t;

[0013] The threshold of the i-th transmission link index at time t The calculation method is shown in equation (2):

[0014] (2)

[0015] in, For smoothing coefficients, This represents the value of the i-th transmission link index at time t. The threshold value is the value of the i-th transmission link metric mentioned in the previous time step.

[0016] Furthermore, the specific steps for obtaining the isolated score A, which characterizes the abnormal condition of the transmission link index, using the isolated forest algorithm based on the transmitted data, are as follows:

[0017] Select any of the aforementioned transmission link metrics, and construct a data sample set from the data of each time point of the transmission link metric;

[0018] Recursively and randomly select split points in the data sample set to divide the data sample set into two subsets until each data is isolated, thus constructing multiple isolated trees;

[0019] Calculate the path length of each data point in the isolated tree, and calculate the average path length based on the path lengths.

[0020] The isolation score A is calculated based on the average path length.

[0021] Furthermore, the first encrypted peripheral circuit includes a reassembly module and a segmentation module;

[0022] The reassembly module is used to receive the uplink data stream from the USB interface, reassemble the uplink data stream, and send it to the second encryption peripheral circuit.

[0023] The segmentation module is used to receive downlink data streams from the second encryption peripheral circuit and segment the downlink data streams before sending them to the USB interface;

[0024] The second encryption peripheral circuit includes an encryption module and a decryption module;

[0025] The encryption module is used to receive the uplink data stream from the first encryption peripheral circuit, encrypt the uplink data stream, and send it to the RJ45 interface;

[0026] The decryption module is used to receive the downlink data stream from the RJ45 interface, decrypt the downlink data stream, and send it to the first encryption peripheral circuit.

[0027] Furthermore, the mobile encryption box also includes an authentication handshake module, which is used to perform identity authentication before any two mobile encryption boxes are linked to form the transmission link;

[0028] The authentication handshake module includes an authentication initiation unit and a verification processing unit, wherein the authentication initiation unit is configured as follows:

[0029] Pre-generated shared secret values ​​in the storage security channel;

[0030] Generate a random number for identity authentication as the authentication value;

[0031] The authentication value is hashed using a preset hash function and the shared secret value to obtain a hash value;

[0032] Construct an authentication data packet containing the authentication value and the hash value;

[0033] The authentication data packet is sent to another mobile encryption box via the RJ45 interface and an external network.

[0034] The verification processing unit is configured as follows:

[0035] The authentication data packet is received from another mobile encryption box via the RJ45 interface. The authentication data packet contains the authentication value and hash value generated by the other mobile encryption box.

[0036] Using the same shared key value and the same hash function stored locally, the received authentication value is hashed to obtain the locally calculated verification value;

[0037] The locally calculated verification value is compared with the received hash value;

[0038] If the comparison results match, the two mobile encryption boxes are linked to form a transmission link.

[0039] Furthermore, the specific steps for the segmentation module to segment the downlink data stream are as follows:

[0040] The downlink data stream is divided into two subsets;

[0041] Recursively perform the same operation on each subset, splitting it 2n times.

[0042] After 2n partitions, swap the order of the two lowest-level subsets;

[0043] Wherein, n is the security level coefficient, which is determined by the link score value S.

[0044] Furthermore, the specific steps for the encryption module to encrypt the uplink data stream are as follows:

[0045] Receive the original data to be encrypted, and combine the original data and the mobile encryption box serial number in segments;

[0046] The original data is encrypted using a first key, and the serial number of the mobile encryption box is encrypted using a second key, wherein the encryption strength of the second key is higher than that of the first key.

[0047] The encrypted original data and the encrypted mobile encryption box serial number are recombined to obtain the encrypted uplink data stream.

[0048] Furthermore, the mobile encryption box also includes a fault finding unit, which is configured to:

[0049] Receive the link score S from the link score calculation unit and compare it with a preset link score threshold;

[0050] If the link score S is lower than the preset link score threshold, the isolated scores A of each transmission link metric from the link monitoring module are received.

[0051] Based on the size of the isolated score A, the indicators of abnormal transmission links are determined.

[0052] Furthermore, the link monitoring module is also configured to generate a control signal based on the link score S and send control commands to the first encryption circuit and the second encryption circuit, specifically including:

[0053] When the link score S is lower than a preset security threshold, the link monitoring module sends a second control command to the second encryption circuit to increase the encryption strength of the second encryption circuit.

[0054] When the link score S is lower than the preset high efficiency threshold, the link monitoring module sends a first control command to the first encryption circuit to reduce the segmentation strength of the first encryption circuit.

[0055] The preset security threshold and efficiency threshold are dynamically adjusted based on the historical statistical results of the transmitted data.

[0056] Furthermore, the link monitoring module is also configured to send a third control command to the authentication handshake module when the link score S is lower than a preset connection threshold, triggering a re-authentication process.

[0057] Compared with existing technologies, the beneficial technical effects of the mobile encryption box in this application are as follows:

[0058] After establishing a transmission link with another mobile encryption box, the mobile encryption box of this application can calculate a link score through multiple indicators to assess the link health status in real time, ensuring the security of data transmission. Simultaneously, by utilizing the isolated forest algorithm to detect abnormal conditions in transmission link indicators, it can comprehensively monitor multiple transmission link indicators, promptly identify potential security threats, and improve the security protection capabilities of data during transmission. Real-time monitoring of the transmission link ensures data security and prevents data leakage and unauthorized access.

[0059] Furthermore, the mobile encryption box of this application improves data transmission efficiency while ensuring data security by dynamically adjusting the encryption strength and segmentation strength. Attached Figure Description

[0060] Figure 1 : A schematic diagram of the link monitoring module in this application;

[0061] Figure 2 : A schematic diagram of a mobile encryption box according to an embodiment of this application;

[0062] Figure 3 : A schematic diagram of a mobile encryption box according to an embodiment of this application;

[0063] Figure 4 : A schematic diagram of the overall structure of the mobile encryption box of this application;

[0064] Figure 5 : A schematic diagram of the second encryption peripheral circuit of this application;

[0065] Figure 6 : A schematic diagram of the first encryption peripheral circuit of this application;

[0066] Figure 7 A schematic diagram of the structure of a mobile encryption box according to an embodiment of this application;

[0067] Figure 8 This application provides a schematic diagram illustrating the links between mobile encryption boxes. Detailed Implementation

[0068] With the rapid development of information technology, data security and privacy protection have increasingly become a focus of attention for businesses and individuals. In traditional scenarios, data often faces the risk of being eavesdropped on, tampered with, or intercepted during transmission and storage, especially in insecure network environments.

[0069] Patent application number 202411789475.3 discloses a USB extended secure real-time bus network card device, including: a USB interface, non-volatile memory, a device ID comparison module, a fingerprint authentication module, and an SRB bus module. The USB interface is used to connect to a network terminal with network access requirements; the non-volatile memory is used to store a list of sensitive device IDs; the device ID comparison module is used to read the device ID of the network terminal, retrieve the device ID of the network terminal from the list of sensitive device IDs, and identify the device type of the network terminal; the fingerprint authentication module is used to perform a fingerprint authentication process on the network terminal whose device type is sensitive: verifying the fingerprint information of the person in charge of the network terminal; after successful authentication, triggering the SRB bus module to open the secure real-time bus channel; and preventing the transmission of sensitive data when authentication fails; the SRB bus module is used to transmit sensitive data of the network terminal whose device type is sensitive through the secure real-time bus channel.

[0070] However, while the encryption schemes described above improve data security to some extent, they still have some limitations. For example, after successful authentication and connection establishment, the devices lack real-time monitoring of the link connection status. If the link status changes or is compromised by malicious attackers, it may not be able to detect the change in time and take appropriate security measures, leading to data leakage.

[0071] To address the aforementioned issues, this application provides a mobile encryption box that incorporates a link status monitoring function, enabling real-time detection of link connection status and effectively preventing data leakage and unauthorized access.

[0072] The mobile encryption box of this application is described in detail below with reference to embodiments:

[0073] In some embodiments, such as Figure 1 As shown, a mobile encryption box is provided, including: a USB interface, a first encryption peripheral circuit, a second encryption peripheral circuit, and an RJ45 interface;

[0074] The first encryption peripheral circuit includes a reassembly module and a segmentation module;

[0075] The reassembly module is used to receive the uplink data stream from the USB interface, reassemble the uplink data stream, and send it to the second encryption peripheral circuit.

[0076] The segmentation module is used to receive downlink data streams from the second encryption peripheral circuit and segment the downlink data streams before sending them to the USB interface;

[0077] The second encryption peripheral circuit includes an encryption module and a decryption module;

[0078] The encryption module is used to receive the uplink data stream from the first encryption peripheral circuit, encrypt the uplink data stream, and send it to the RJ45 interface;

[0079] The decryption module is used to receive the downlink data stream from the RJ45 interface, decrypt the downlink data stream, and send it to the first encryption peripheral circuit.

[0080] In these embodiments, during use, the user can connect the mobile encryption box to a computer or other device via a USB interface. When data needs to be transferred from the computer to an external network, the data first enters the first encryption peripheral circuit via the USB interface. Due to the limitations of the USB interface, the data is typically transmitted serially. In the first encryption peripheral circuit, these data streams are reorganized to suit the needs of subsequent encryption processing. This reorganization process may include data packaging, format adjustment, or sequence rearrangement to ensure that the data is in the most suitable state for encryption before encryption.

[0081] The reconstructed data is then sent to the second encryption peripheral circuit. In this circuit, the encryption / decryption module receives the data and encrypts the uplink data stream using a preset encryption algorithm. The encrypted data is then transmitted to the RJ45 interface, ready to be sent to the external network.

[0082] When data needs to be downloaded from an external network, the process is reversed. Data first enters the second encrypted peripheral circuit via the RJ45 interface, where the encryption / decryption module uses the appropriate decryption algorithm to decrypt the downlink data stream. The decrypted data is then sent back to the first encrypted peripheral circuit, where it is segmented into a serial data stream that can be transmitted via a USB interface, and finally transmitted to a computer or other connected device via the USB interface. This design not only ensures data security during transmission but also effectively improves data transmission efficiency.

[0083] Any two of the aforementioned mobile encryption boxes can be linked to form a transmission link. Specifically, any two mobile encryption boxes can be connected via an RJ45 interface to form a transmission link. Data streams can be transmitted securely between the two mobile encryption boxes on these transmission links.

[0084] In some embodiments, such as Figure 1 and Figure 2 As shown, to ensure the security and reliability of data transmission, each mobile encryption box is equipped with a connection monitoring module. This module is configured to collect transmission data from the RJ45 interface, including the number of requests N, processing time T, and network latency. Number of errors (E), Total time And the number of links n;

[0085] The request count N represents the total number of data requests sent or received via the RJ45 network interface within a specific time period. This metric reflects the activity level of data transmission. Processing time T refers to the time spent from when a data request is sent to when the data is processed; it is directly related to the efficiency of data transmission. Network latency measures the delay time caused by network factors during data transmission and is an important indicator for assessing network conditions. Error count E records the number of errors that occur during data transmission; it is crucial for diagnosing network problems. Total Time This refers to the total time from the start of data transmission to the end of transmission, while the number of links n represents the number of transmission links established simultaneously. This metric helps to understand the network's concurrent processing capabilities.

[0086] The link score S, which characterizes the link health status, is calculated using a multi-index weighted exponential attenuation scoring algorithm based on the transmitted data.

[0087] Based on the transmitted data, the isolated score A, used to characterize abnormal conditions of the transmission link indicators, is obtained using the isolated forest algorithm.

[0088] The transmission link metrics include processing time per unit (RPT), response time (RT), throughput (TH), and error rate (ER).

[0089] The link score S mentioned above is used to assess the overall health of the current transmission link. A higher link score S indicates a healthier link and greater security and stability in data transmission. The calculation of the link score S considers factors such as the number of requests N, processing time T, and network latency. Number of errors (E), Total time In addition, there are multiple transmission link metrics, including the number of links (n), which comprehensively reflect the link's performance. By weighting these metrics and combining them with an exponential decay scoring algorithm, a link score S can be dynamically calculated, enabling real-time monitoring of the link's health status.

[0090] The aforementioned isolation score A is used to identify outliers in transmission link metrics. Specifically, the Isolation Forest algorithm isolates anomalous data points by constructing multiple isolation trees. For each transmission link metric data point, the algorithm calculates its path length in each tree and then calculates the average path length. This average path length reflects the degree of isolation of the data point, i.e., the likelihood that the data point is considered an anomaly. The isolation score A is calculated based on this average path length; the higher the score, the more isolated the data point, and thus the more likely it is to be an outlier. In this way, the mobile encryption box can promptly detect and respond to potential link anomalies, thereby further improving the security and stability of data transmission.

[0091] In practical applications, when the link score S falls below a certain preset security threshold, the decrease in the link score S may be caused by anomalies in one or more transmission link indicators.

[0092] At this time, the link monitoring module will also sort the isolated scores A by size to determine the abnormal transmission link indicators that are most likely to cause the link score S to drop, and provide users with targeted troubleshooting suggestions, thereby speeding up the fault location and repair speed and ensuring the continuity and security of data transmission.

[0093] In these embodiments, by collecting transmission data and utilizing a multi-index weighted exponential decay scoring algorithm and an isolated forest algorithm to comprehensively monitor the transmission link, the mobile encryption box of this application can assess the link health status in real time and promptly detect and respond to potential link anomalies. This further enhances the security of data transmission.

[0094] In some embodiments, the link monitoring module includes: a link score calculation unit, configured to calculate a link score S for characterizing the health status of the link based on the transmitted data using a multi-index weighted exponential decay scoring algorithm;

[0095] The multi-index weighted exponential decay scoring algorithm is shown in equation (1):

[0096] ; (1)

[0097] in, S represents the link score at time t. This represents the weight of the i-th link transmission metric at time t. For adjustment coefficients, This represents the value of the transmission link metric at time t. This represents the threshold value of the i-th transmission link index at time t;

[0098] The threshold of the i-th transmission link index at time t The calculation method is shown in equation (2):

[0099] (2)

[0100] in, For smoothing coefficients, This indicates that the value of the transmission link index at time t is calculated from the transmission data. This is the threshold value of the transmission link metric mentioned in the previous time step.

[0101] Specifically, transmission link metrics include processing time RPT, response time RT, throughput TH, and error rate ER. The value of any of these transmission link metrics at time t... Calculated using the following formula:

[0102] Processing time RPT = N / T,

[0103] Response time RT = RPT + ,

[0104] Throughput TH = N / ,

[0105] Error rate ER = E / N;

[0106] The following specific example illustrates the working principle of the link monitoring module.

[0107] Suppose that at a certain time t, the data acquisition unit collects the following data: number of requests N = 1000, processing time T = 5 seconds, and network latency... =0.2 seconds, number of errors E=5, total time =10 seconds, number of links n=5.

[0108] Based on this data, the data processing unit calculates the processing time RPT = 200 requests / second, the response time RT = 200.2 requests / second, the throughput = 100 requests / second, and the error rate ER = 0.005.

[0109] The data collected at time t-1 is as follows: number of requests N=900, processing time T=4.5 seconds, and network latency. =0.15 seconds, number of errors E=4, total time =9 seconds, number of links n=4. Smoothing coefficient α is set to 0.3.

[0110] Based on this data, the data processing unit calculates the processing time RPT = 200 requests / second, the response time RT = 199.15 requests / second, the throughput = 100 requests / second, and the error rate ER = 0.0044 at time t-1.

[0111] The dynamic threshold unit is based on the formula Calculate the dynamic threshold for each metric at time t. For example, for processing time RPT, its dynamic threshold is... Similarly, the dynamic thresholds for other indicators can be calculated.

[0112] Similarly, we can calculate the dynamic thresholds for metrics such as response time (RT), throughput, and error rate (ER).

[0113] Then, the link scoring unit uses the formula based on these dynamic thresholds and the currently collected indicator values. Calculate the link score S. and These are the weights and adjustment coefficients of each indicator at time t, and these parameters can be set and optimized according to actual needs.

[0114] For example, calculating the link score S for the processing time RPT metric. The value is 0.3. If the value is 0.01, then Similarly, we can calculate the link scores for metrics such as response time (RT), throughput, and error rate (ER), and then add these scores together to obtain the final link score S.

[0115] The link score S reflects the stability and security of the current data link. The higher the score, the more stable and secure the data link.

[0116] In the calculation of the link score S, if the measured value of a certain indicator is... Exceeding its corresponding dynamic threshold ,but The value of will decrease rapidly, causing the link score S to drop. Conversely, if the measured values ​​of all indicators remain within the dynamic threshold, the link score S will remain at a high level, indicating that the current data link is in a stable and secure state.

[0117] In some embodiments, the link monitoring module further includes an anomaly detection unit, configured to obtain an isolated score A for characterizing anomalies in transmission link metrics based on the transmission data using an isolated forest algorithm.

[0118] The specific steps of the isolated forest algorithm are as follows:

[0119] Select any of the aforementioned transmission link metrics, and construct a data sample set from the data of each time point of the transmission link metric;

[0120] Recursively and randomly select split points in the data sample set to divide the data sample set into two subsets until each data is isolated, thus constructing multiple isolated trees;

[0121] Calculate the path length of each data point in each tree, and calculate the average path length;

[0122] The isolation score is calculated based on the average path length.

[0123] For example, regarding the Processing Time (RPT) transmission link metric, if the calculated isolated score shows that the data points for this metric have high isolated scores, it means that the RPT may be abnormal. In this case, the anomaly detection unit will promptly issue an alert, reminding users or administrators to pay attention to changes in the RPT and take corresponding measures, such as checking network equipment and optimizing data processing flows, to reduce processing time and improve data transmission efficiency.

[0124] For the response time (RT) metric, a high isolated score indicates a slow network response and latency issues. This could be due to network congestion, excessive server load, or other bottlenecks in the data transmission process. In this case, the anomaly detection unit will trigger an alarm, prompting users or administrators to monitor and investigate the RT. This may include optimizing network configuration, increasing server resources, or adjusting data transmission strategies to improve network response speed and ensure timely data transmission.

[0125] Isolated anomalies in throughput may indicate a decrease in data transmission rate, while isolated anomalies in error rate may mean that more errors have occurred during data transmission. In these cases, the anomaly detection unit will provide timely alerts and troubleshooting suggestions to help users or administrators quickly locate the root cause of the problem and take appropriate remedial measures to maintain the efficiency and accuracy of data transmission.

[0126] In some embodiments, such as Figure 5As shown, the specific structure of the second encryption peripheral circuit is provided. The second encryption peripheral circuit includes a first RGMII interface, an encryption / decryption module, a second RGMII interface, and a second processor.

[0127] The RGMII interface is a gigabit media-independent interface (GMII) for high-speed data transmission. The first RGMII interface connects to a first encryption peripheral circuit for receiving uplink data streams from it. The second RGMII interface connects to an RJ45 interface for transmitting encrypted uplink data streams to an external network or receiving downlink data streams from an external network. An encryption / decryption module is located between the first and second RGMII interfaces to encrypt the uplink data streams and decrypt the downlink data streams. A second processor is connected to the encryption / decryption module to control its encryption and decryption processes, ensuring both security and efficiency in data transmission.

[0128] The second processor can send encryption commands to the encryption / decryption module based on a preset encryption algorithm and key. The encryption / decryption module then encrypts the uplink data stream according to the received commands. Similarly, when data needs to be downloaded from an external network, the second processor sends decryption commands to the encryption / decryption module, which then decrypts the downlink data stream according to the received commands. This design not only improves the efficiency of data encryption and decryption but also ensures the integrity and confidentiality of data during transmission.

[0129] In some embodiments, such as Figure 6 The diagram illustrates the specific structure of a first encrypted peripheral circuit. This first encrypted peripheral circuit includes an RNDIS interface, a segmentation and reassembly module, a third RGMII interface, and a first processor. The RNDIS interface, or Remote Network Driver Interface Specification interface, is used for data communication with the USB interface. Through the RNDIS interface, the first encrypted peripheral circuit can receive uplink data streams from the USB interface and send the processed downlink data streams back to the USB interface. The segmentation and reassembly module is located between the RNDIS interface and the third RGMII interface. It is used for reassembling the uplink data stream before segmentation and for segmenting the downlink data stream after decryption, to meet the transmission requirements of the USB interface. The third RGMII interface is connected to a second encrypted peripheral circuit, used to send the reassembled uplink data stream to the second encrypted peripheral circuit or receive the unsegmented downlink data stream from the second encrypted peripheral circuit. The first processor is connected to the segmentation and reassembly module and is used to control the data processing flow of the segmentation and reassembly module, ensuring data integrity and transmission efficiency.

[0130] In practice, the first processor can send processing instructions to the segmentation and reassembly module according to preset data processing rules. When the uplink data stream enters the first encryption peripheral circuit through the USB interface, the RNDIS interface first receives these data streams. Subsequently, the segmentation and reassembly module reassembles the uplink data stream according to the processing instructions sent by the first processor to meet the requirements of subsequent encryption. The reassembled data is sent to the second encryption peripheral circuit for encryption processing through the third RDMII interface. When data needs to be downloaded from an external network, the process is reversed. The encrypted downlink data stream is first decrypted through the second encryption peripheral circuit and then sent back to the first encryption peripheral circuit. In the first encryption peripheral circuit, the segmentation and reassembly module segments the decrypted data to meet the transmission requirements of the USB interface. Finally, these data are sent to the USB interface through the RNDIS interface and transmitted to a computer or other connected devices.

[0131] In some embodiments, such as Figure 4 As shown, the first encrypted peripheral circuit and the second encrypted peripheral circuit are connected through a high-speed data bus. A first physical layer module and a second physical layer module are connected in series on the bus. The second encrypted peripheral circuit and the RJ45 interface are connected through a third physical layer module. The first physical layer module is used to perform a first processing on the uplink data stream transmitted from the first encrypted peripheral circuit to the second encrypted peripheral circuit, and to perform a second processing on the downlink data stream transmitted from the second encrypted peripheral circuit to the first encrypted peripheral circuit.

[0132] The second physical layer module is used to perform second processing on the uplink data stream transmitted from the first encrypted peripheral circuit to the second encrypted peripheral circuit, and to perform first physical layer processing on the downlink data stream transmitted from the second encrypted peripheral circuit to the first encrypted peripheral circuit.

[0133] The first processing step in this embodiment refers to signal amplification and format conversion of the uplink data stream to ensure stable and high-speed data transmission between the first and second encryption peripheral circuits. This process is crucial for maintaining data stream integrity and improving transmission efficiency. Simultaneously, the second processing step involves the reverse operation on the downlink data stream: signal attenuation adjustment and format restoration, so that the data can smoothly return to the first encryption peripheral circuit and ultimately be transmitted to a computer or other device via the USB interface. Through this design, the present invention not only enhances the reliability of data transmission but also further improves the overall system performance.

[0134] In some embodiments, the specific steps for the segmentation module to segment a data stream as described above are as follows:

[0135] The data stream is divided into two subsets;

[0136] Recursively perform the same operation on each subset, splitting it 2n times;

[0137] After 2n partitions, swap the order of the two lowest-level subsets;

[0138] Wherein, n is the security level coefficient, which is determined by the link score value S.

[0139] In this embodiment, there is a preset correspondence between the security level coefficient n and the link score S. When the link score S is high, it indicates that the data link is stable and secure. In this case, a lower security level coefficient n can be selected to reduce the number of data segmentations and improve data transmission efficiency. Conversely, if the link score S is low, it means that the data link may be unstable or have security risks. In this case, a higher security level coefficient n should be selected to increase the complexity of data segmentation and improve the security of data transmission.

[0140] Specifically, different security level thresholds can be set according to actual needs, and these thresholds can be mapped to corresponding security level coefficients n. When the link score S falls within a certain threshold range, the corresponding security level coefficient n is used for data stream segmentation. This design enables the present invention to dynamically adjust the data segmentation strategy according to the actual data link conditions, ensuring the security and efficiency of data transmission.

[0141] In some embodiments, the specific steps of an encryption module to encrypt a data stream are as follows: receiving the original data to be encrypted and combining the original data and the mobile encryption box serial number in segments;

[0142] The original data is encrypted using a first key, and the serial number of the mobile encryption box is encrypted using a second key, wherein the encryption strength of the first key is higher than that of the second key.

[0143] The encrypted original data and the encrypted mobile encryption box serial number are recombined to obtain an encrypted data stream.

[0144] This embodiment employs a dual encryption strategy to ensure a high level of data security during transmission. During encryption, the original data to be encrypted is first identified and then segmented and combined with the serial number of the mobile encryption box.

[0145] The system uses two different keys to encrypt both the original data and the mobile encryption box serial number. Notably, the second key used to encrypt the mobile encryption box serial number has higher encryption strength, further enhancing data security. Through this double encryption, even if a portion of the data is cracked during transmission, an attacker cannot easily obtain the complete original data, because the original data and the mobile encryption box serial number are encrypted separately and then recombined. Furthermore, because the mobile encryption box serial number is unique, even if an attacker obtains partial encrypted data, they cannot determine which specific mobile encryption box it belongs to. This design increases the difficulty for attackers to crack the data, further ensuring data security. Simultaneously, using keys with different encryption strengths to encrypt the original data and the mobile encryption box serial number reflects a multi-layered consideration of data security, effectively protecting data confidentiality.

[0146] After encryption is complete, the system reassembles the encrypted original data and the encrypted mobile encryption box serial number to form the final encrypted data stream. This encrypted data stream is then securely transmitted to the target location, awaiting decryption.

[0147] During decryption, the mobile encryption box serial number is first decrypted. After decryption, it is checked against a pre-stored sequence set. If the check passes, the original data is decrypted using the decryption key corresponding to the first key, yielding the decrypted original data. If the check fails, the decryption request is rejected, and a security alarm is issued. This design not only improves data transmission security but also ensures that only users with the correct mobile encryption box serial number can decrypt data, effectively preventing unauthorized access.

[0148] In some embodiments, such as Figure 8 As shown, there are mobile encryption boxes A, B, C, and D in the network, connected to the external network via RJ45 interfaces. During normal data transmission, mobile encryption box A may need to communicate with mobile encryption box B. First, through an authentication handshake module, mobile encryption boxes A and B authenticate each other to ensure they are legitimate communicating parties. After successful authentication, data transmission link 1 is established between mobile encryption boxes A and B. Similarly, transmission link 2 is established between mobile encryption boxes B and D, transmission link 3 between mobile encryption boxes A and D, transmission link 4 between mobile encryption boxes A and C, transmission link 5 between mobile encryption boxes C and D, and so on. Any two mobile encryption boxes must perform an authentication handshake before establishing a link to ensure the legitimacy of their identities and the reliability of the data link.

[0149] The mobile encryption box also includes an authentication handshake module, which includes an authentication initiation unit and a verification processing unit.

[0150] The authentication initiation unit is configured as follows:

[0151] Pre-generated shared secret values ​​in the storage security channel;

[0152] Generate a random number for identity authentication as the authentication value;

[0153] The authentication value is hashed using a preset hash function and the shared secret value to obtain a hash value;

[0154] Construct an authentication data packet containing the authentication value and hash value;

[0155] The authentication data packet is sent to another mobile encryption box via the RJ45 interface and an external network.

[0156] The verification processing unit is configured to receive an authentication data packet from another mobile encryption box via the RJ45 interface, the authentication data including the authentication value and hash value generated by the other mobile encryption box;

[0157] Using the same shared key value and the same hash function stored locally, the received authentication value is hashed to obtain the locally calculated verification value;

[0158] Compare the locally calculated verification value with the received hash value;

[0159] If the comparison results match, the two mobile encryption boxes are linked to form a transmission link.

[0160] In these embodiments, the present invention further enhances the security of data communication through the dual authentication mechanism of the authentication handshake module. Before establishing a connection, the authentication initiating unit actively generates a random number as the authentication value. This step increases the randomness and unpredictability of authentication, reducing the risk of malicious attacks. Subsequently, the authentication value is hashed using a shared key value and a preset hash function to obtain a hash value. This process enhances the data's resistance to tampering.

[0161] The constructed authentication data, containing an authentication value and a hash value, is sent via an RJ45 interface over an external network to another mobile encryption box. Upon receiving the data packet, the receiving device's verification processing unit begins operation. It uses the same locally stored shared key and hash function to perform a hash operation on the received authentication value, obtaining a locally calculated verification value, which is then compared with the received hash value.

[0162] If the comparison results match, it indicates that the initial authentication between the two parties has been successful. At this point, a new random number is generated as the response value. The response value is then hashed again using the shared secret value and a hash function to obtain an encrypted response value, which is sent back to the other party via the RJ45 interface. Upon receiving the encrypted response value, the other party also uses the shared secret value and a hash function for verification.

[0163] If the verification result meets expectations, the authentication of both parties is ultimately successful. At this point, an enable command is sent to the encryption / decryption module via the second processor, allowing subsequent encrypted / decrypted communication transmitted through the RJ45 interface to officially begin.

[0164] In some embodiments, to quickly troubleshoot faults and ensure secure data transmission, the mobile encryption box further includes a fault finding unit configured to:

[0165] Receive the link score value S from the link score calculation unit and compare it with a preset link score threshold;

[0166] If the link score S is lower than the preset link score threshold, the isolated scores of each transmission link indicator from the link monitoring module are received.

[0167] Based on the size of the isolated scores, indicators of abnormal transmission links are determined.

[0168] In this embodiment, when the link score S is lower than a preset link score threshold, it indicates that the current data link may be unstable or have security risks. The fault finding unit will quickly intervene and receive the isolated scores of various transmission link indicators provided by the link monitoring module. By comparing and sorting these isolated scores, the fault finding unit can accurately identify abnormal transmission link indicators, i.e., those indicators with high isolated scores. These indicators are often key factors leading to data link instability or security problems. Once the abnormal transmission link indicators are identified, the fault finding unit will immediately generate a fault report and provide corresponding troubleshooting suggestions. These suggestions may include checking network equipment, optimizing network configuration, and adjusting data transmission strategies, aiming to quickly locate the root cause of the problem and take effective measures to solve it, thereby ensuring the security and stability of data transmission. This design not only improves the efficiency of fault troubleshooting but also further enhances the reliability and security of data transmission.

[0169] In some embodiments, to ensure data transmission security, the link monitoring module is further configured to generate a control signal based on the link score S and send control commands to the first encryption circuit and the second encryption circuit, specifically including:

[0170] When the link score S is lower than a preset security threshold, the link monitoring module sends a second control command to the second encryption circuit to increase the encryption strength of the second encryption circuit.

[0171] When the link score S is lower than the preset high efficiency threshold, the link monitoring module sends a first control command to the first encryption circuit to reduce the segmentation strength of the first encryption circuit.

[0172] The preset security threshold and efficiency threshold are dynamically adjusted based on the historical statistical results of the transmitted data.

[0173] When the link monitoring module detects that the link score S is below a certain preset threshold, it indicates that the data transmission link may face significant security risks or efficiency issues. At this point, the link monitoring module intelligently sends corresponding control commands to the encryption circuit based on the state of the link score S, dynamically adjusting the encryption and segmentation strategies to ensure the security and efficiency of data transmission.

[0174] Specifically, when the link score S falls below a preset security threshold, it indicates a potential significant security vulnerability in the data transmission link. To address this risk, the link monitoring module promptly sends a second control command to the second encryption circuit, requesting it to increase the encryption strength. This adjustment aims to enhance the confidentiality and integrity of data transmission by increasing the complexity of the encryption algorithm and the length of the key, thereby preventing sensitive information from being illegally stolen or tampered with.

[0175] On the other hand, when the link score S is lower than the preset high-efficiency threshold, although the security of the data transmission link may not yet be seriously threatened, its efficiency may be significantly affected. To optimize transmission efficiency, the link monitoring module sends a first control command to the first encryption circuit, requesting it to reduce the segmentation strength. This adjustment may involve reducing the number of data segments, optimizing the segmentation algorithm, or adjusting the segmentation parameters, aiming to reduce latency during data transmission and improve overall transmission efficiency.

[0176] The preset security and efficiency thresholds are not fixed but can be dynamically adjusted based on historical statistical results of transmitted data. This application can flexibly adjust encryption and segmentation strategies according to the actual network environment and data transmission needs to achieve the best balance between security and efficiency.

[0177] In some embodiments, when the link score S is lower than a preset connection threshold, the link monitoring module sends a third control command to the authentication handshake module to trigger a re-authentication process.

[0178] In this embodiment, when the link score S is lower than a preset connection threshold, it indicates a potential serious connection problem or security risk in the data transmission link. To ensure the continuity and security of data transmission, the link monitoring module responds quickly by sending a third control command to the authentication handshake module. This command triggers a re-authentication process to ensure the current data transmission link is legitimate and trustworthy.

[0179] This design not only enhances the security of the data transmission link but also improves the system's flexibility and adaptability. When faced with complex and ever-changing network environments, this invention can identify potential risks and take effective countermeasures to ensure secure, efficient, and reliable data transmission.

[0180] In summary, by implementing the above technical solutions, this invention integrates and optimizes functions such as encryption, decryption, segmentation, reassembly, and anomaly detection during data transmission. The implementation of these functions not only improves the security and efficiency of data transmission but also provides users with a more convenient and reliable data transmission experience. Furthermore, this invention possesses flexible configuration and dynamic adjustment capabilities, enabling it to adapt to different application scenarios and needs, thus exhibiting broad application prospects and market value.

[0181] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or the scope of the claims, but rather as descriptions of features that can embody specific embodiments of a particular invention. Specific features described in this specification within the context of an independent embodiment may also be implemented in combination with a single embodiment. Conversely, various features described within the context of a single embodiment may also be implemented independently in multiple embodiments, or in any suitable sub-combination. Furthermore, while features may be described for combination and even initially claimed in this way, one or more features from a claimed combination may be removed from that combination in some cases, and the claimed combination may be redirected to a sub-combination or a variation thereof.

[0182] Similarly, although operations are described in the accompanying drawings in a specific order, it should not be construed as requiring that such operations be performed in the specific order shown or in sequential order, or that all illustrated operations be performed, in order to achieve the desired result. In certain cases, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system modules and components in the above embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that program components and systems can generally be integrated into a single software product or packaged into multiple software products.

[0183] Specific implementations of the subject matter have been described. Other implementations are within the scope of the following claims. For example, the activities described in the claims can be performed in a different order and still achieve the desired result. As an example, the processes described in the drawings do not necessarily require a specific order or sequence to be shown in order to achieve the desired result. In certain implementations, multitasking and parallel processing may be advantageous.

Claims

1. A mobile encryption box, comprising a USB interface, a first encryption peripheral circuit, a second encryption peripheral circuit, and an RJ45 interface, wherein any two of the mobile encryption boxes are linked to form a transmission link, characterized in that, The mobile encryption box also includes a connection monitoring module, which is configured to: Data is collected from the RJ45 interface, including the number of requests N, processing time T, and network latency. Number of errors (E), Total time And the number of links n; A link score S, representing the health status of the transmission link, is calculated using a multi-index weighted exponential decay scoring algorithm based on the transmitted data. Based on the transmitted data, the isolated forest algorithm is used to obtain an isolated score A for the abnormal condition of the transmission link indicators, which are used to characterize the transmission link. The transmission link indicators include unit processing time RPT, response time RT, throughput TH, and error rate ER. The mobile encryption box also includes a fault finding unit, which is configured to: Receive the link score S and compare it with a preset link score threshold; If the link score S is lower than the preset link score threshold, the isolated scores A of each transmission link indicator of the link monitoring module are received. Based on the size of the isolated score A, determine the indicators of abnormal transmission links; The link monitoring module is also configured to generate a control signal based on the link score S and send control commands to the first encryption peripheral circuit and the second encryption peripheral circuit, specifically including: When the link score S is lower than a preset security threshold, the link monitoring module sends a second control command to the second encryption peripheral circuit to increase the encryption strength of the second encryption peripheral circuit. When the link score S is lower than the preset high efficiency threshold, the link monitoring module sends a first control command to the first encryption peripheral circuit to reduce the segmentation strength of the first encryption peripheral circuit. The preset security threshold and efficiency threshold are dynamically adjusted based on the historical statistical results of the transmitted data.

2. The mobile encryption box as described in claim 1, characterized in that, The multi-index weighted exponential decay scoring algorithm is shown in equation (1): （1） in, S represents the link score at time t. This represents the weight of the i-th transmission link index at time t. For adjustment coefficients, This represents the value of the i-th transmission link index at time t. This represents the threshold value of the i-th transmission link index at time t; The threshold of the i-th transmission link index at time t The calculation method is shown in equation (2): （2） in, For smoothing coefficients, This represents the value of the i-th transmission link index at time t. The threshold value is the value of the i-th transmission link metric mentioned in the previous time step.

3. The mobile encryption box as described in claim 2, characterized in that, The specific steps for obtaining the isolated score A, which characterizes the abnormal status of the transmission link index, using the isolated forest algorithm based on the transmitted data, are as follows: Select any of the aforementioned transmission link metrics, and construct a data sample set from the data of each time point of the transmission link metric; Recursively and randomly select split points in the data sample set to divide the data sample set into two subsets until each data is isolated, thus constructing multiple isolated trees; Calculate the path length of each data point in the isolated tree, and calculate the average path length based on the path lengths. The isolation score A is calculated based on the average path length.

4. The mobile encryption box as described in claim 1, characterized in that, The first encryption peripheral circuit includes a reassembly module and a segmentation module; The reassembly module is used to receive the uplink data stream from the USB interface, reassemble the uplink data stream, and send it to the second encryption peripheral circuit. The segmentation module is used to receive downlink data streams from the second encryption peripheral circuit and segment the downlink data streams before sending them to the USB interface; The second encryption peripheral circuit includes an encryption module and a decryption module; The encryption module is used to receive the uplink data stream from the first encryption peripheral circuit, encrypt the uplink data stream, and send it to the RJ45 interface; The decryption module is used to receive the downlink data stream from the RJ45 interface, decrypt the downlink data stream, and send it to the first encryption peripheral circuit.

5. The mobile encryption box as described in claim 1, characterized in that, The mobile encryption box also includes an authentication handshake module, which is used to perform identity authentication before any two mobile encryption boxes are linked to form the transmission link. The authentication handshake module includes an authentication initiation unit and a verification processing unit, wherein the authentication initiation unit is configured as follows: Pre-generated shared secret values ​​in the storage security channel; Generate a random number for identity authentication as the authentication value; The authentication value is hashed using a preset hash function and the shared secret value to obtain a hash value; Construct an authentication data packet containing the authentication value and the hash value; The authentication data packet is sent to another mobile encryption box via the RJ45 interface and an external network. The verification processing unit is configured as follows: The authentication data packet is received from another mobile encryption box via the RJ45 interface. The authentication data packet contains the authentication value and hash value generated by the other mobile encryption box. Using the same shared key value and the same hash function stored locally, the received authentication value is hashed to obtain the locally calculated verification value; The locally calculated verification value is compared with the received hash value; If the comparison results match, the two mobile encryption boxes are linked to form a transmission link.

6. The mobile encryption box as described in claim 4, characterized in that, The specific steps for the segmentation module to segment the downlink data stream are as follows: The downlink data stream is divided into two subsets; Recursively perform the same operation on each subset, splitting it 2n times; After 2n partitions, swap the order of the two lowest-level subsets; Wherein, n is the security level coefficient, which is determined by the link score S.

7. The mobile encryption box as described in claim 4, characterized in that, The specific steps for the encryption module to encrypt the uplink data stream are as follows: Receive the original data to be encrypted, and combine the original data and the mobile encryption box serial number in segments; The original data is encrypted using a first key, and the serial number of the mobile encryption box is encrypted using a second key, wherein the encryption strength of the first key is higher than that of the second key. The encrypted original data and the encrypted mobile encryption box serial number are recombined to obtain the encrypted uplink data stream.

8. The mobile encryption box as described in claim 5, characterized in that, The link monitoring module is also configured to send a third control command to the authentication handshake module when the link score S is lower than a preset connection threshold, triggering a re-authentication process.

Images