Data exchange system for performing real-time secure communication with intranet system

Abstract

The invention discloses a data exchange system for performing real-time secure communication with an intranet system, and relates to the technical field of network data security. The system comprises a network environment identification module, a challenge authentication module, a hardware key binding module, a data communication module, an abnormal response module, a strategy updating module and a visual monitoring and log module. According to the invention, by introducing the trust map evaluation module, map modeling is carried out on the characteristics of the equipment in the historical operation process, the rationality of the current operation environment of the system is judged based on the map coincidence evaluation result, the communication module is allowed to operate only when the evaluation result meets the condition, and a judgment mechanism based on the historical trusted behavior is formed; and the prevention and control capability of the system on gradual-change attacks and behavior counterfeit is enhanced.

Description

Technical Field

[0001] This invention relates to the field of network data security technology, and in particular to a data exchange system for real-time secure communication with an intranet system. Background Technology

[0002] With the continuous advancement of information technology development, various organizations are increasingly demanding data exchange and information sharing, covering multiple key areas such as personnel management, business collaboration, operational monitoring, and emergency command. To ensure data confidentiality and compliance, relevant organizations generally adopt closed, designated intranet systems, combined with private network communication, physical isolation, access control, and other measures, to build a relatively secure data circulation environment.

[0003] Existing intranet data exchange platforms have achieved effective network isolation and access control through a series of technical means. These measures have yielded positive results in ensuring data security, effectively preventing unauthorized access and ensuring stable system operation. However, with the improvement of informatization levels and the emergence of higher security requirements, the existing technical system still has room for further optimization and improvement when facing complex business scenarios, especially in areas such as real-time operating environment identification, flexible authentication, linkage response, device historical trajectory verification, and remote policy management.

[0004] Therefore, with the increasing complexity of intranet operating environments and the growing demand for data exchange, improving the security, flexibility, and adaptability of systems has become an important direction for further developing and improving existing technology systems. Summary of the Invention

[0005] This invention proposes a full-process data exchange system with multi-source data fusion perception, historical behavior graph modeling and dynamic response capabilities, in order to achieve substantial credibility and closed-loop security control of private network communication behavior.

[0006] A data exchange system for real-time secure communication with an intranet system, comprising: The network environment identification module is used to collect network fingerprint features before the system starts up, compare them with the trusted fingerprint database of the intranet, and generate a credibility score based on the network fingerprint feature comparison results. The challenge authentication module is used to initiate a dynamic authentication request based on the SM2 algorithm to an authentication server deployed on a specified intranet only when the credibility score exceeds a preset threshold, and obtain a dynamic signature token; during the challenge authentication process, a joint digest of network fingerprint features, device identifier and timestamp is generated; The hardware key binding module is used to call the non-exportable private key in the local dedicated USBKey or TPM chip to sign the federated digest, form a unique trusted boot token, and perform hardware key verification on the trusted boot token, including integrity verification and validity verification. The data communication module is activated only after the network environment identification, challenge authentication and hardware key verification are all passed, and is used to establish an end-to-end data exchange channel based on SM4 encryption. The anomaly response module is used to automatically block the communication interface, encrypt and record the abnormal events as audit logs, and report them to the log audit system when the network environment identification fails, the challenge authentication fails, the trusted start token verification fails, or the hardware device is replaced. The Trust Graph Assessment Module is used to perform graph-based modeling of joint summaries, authentication results, anomalous events, and geographic locations at historical time points. It generates multidimensional behavioral feature sequences through SM3 hashing, constructs a behavioral trust graph, and performs graph overlap assessment. The system only runs the data communication module when the graph overlap assessment result exceeds a preset threshold; otherwise, it interrupts data communication and triggers an anomaly response.

[0007] As a preferred technical solution of the present invention, the network environment identification module adopts a multi-dimensional fingerprint feature combination comparison method. It generates a unique fingerprint hash value through the network fingerprint features collected locally and compares it with the feature hash value in the trusted fingerprint database of the intranet. The comparison result is used to calculate the trustworthiness score of the network environment. The trustworthiness score is used to determine whether the system meets the preconditions for startup or communication. The challenge authentication module is only allowed to be activated when the trustworthiness score exceeds a preset threshold. The network fingerprint features include IP address, subnet mask, default gateway MAC address, DNS server address and response value, NTP server synchronization path, TTL response value, LAN broadcast response, access network segment usage frequency and change frequency index.

[0008] As a preferred technical solution of the present invention, the challenge authentication module adopts a dynamic challenge-response mechanism based on the SM2 national cryptographic algorithm. During the challenge authentication process, a request message with timestamp, device identifier, and network fingerprint feature comparison results is generated and sent to the authentication server via HTTPS or a private network custom communication protocol. The authentication server generates a dynamic signature token based on the content of the request message and the preset trust list, and returns it to the client. The client verifies the dynamic signature token and checks its validity time window. If the authentication is successful, the data communication module is initialized. If the authentication fails or the response times out, the operation of the data communication module is blocked and the abnormal response module is locked or alarmed.

[0009] As a preferred technical solution of the present invention, the authentication server is only accessible in a designated intranet environment, and after the authentication challenge fails more than a preset number of times, the system will enter a restricted mode, which will only allow the communication function to be restored after successful re-authentication; the restricted mode includes four levels of security control measures, namely data channel blocking, functional module freezing, authentication retry cooling timer, and administrator intervention unlocking.

[0010] As a preferred technical solution of the present invention, the abnormal response module includes a self-destruct mechanism, which is used to trigger the system to automatically block the data access interface, clear the local cache data or perform encrypted storage when the network environment identification fails, the number of failed challenge authentications exceeds a set value or the hardware key verification fails. The anomaly response module also includes a path break detection mechanism, which is used to automatically cut off communication, block the data interface and clear the unfinished session cache in the data communication module when any element of the network fingerprint feature, device identifier or timestamp bound to the trusted start token fails, and the system enters a high-risk lockout state.

[0011] As a preferred technical solution of the present invention, the data communication module uses the SM4 symmetric encryption algorithm to encrypt the communication data end-to-end, and all data transmissions during the communication process must be encrypted and initialized through a secure session key dynamic generation mechanism to prevent data from being intercepted or replayed during transmission.

[0012] As a preferred embodiment of the present invention, the data communication module sets up an encrypted data buffer queue during transmission. The buffer queue supports data block integrity verification and transmission failure retry mechanism to ensure the real-time performance of communication and data integrity.

[0013] As a preferred embodiment of the present invention, the spectral overlap assessment includes: The graph structure similarity between the currently generated behavior trust graph and the previous version is evaluated by obtaining the feature node retention rate, edge structure stability, and behavior pattern migration trajectory scores, which are then weighted to obtain the graph overlap score. The current behavior path is evaluated by comparing it with the trusted paths extracted from the behavior trust graph, obtaining the node matching rate, temporal continuity, and behavior trend similarity scores between the paths, which are then weighted to obtain the path similarity comparison score. The graph overlap score and the path similarity comparison score are then weighted and fused to obtain the graph overlap evaluation result. The current behavior path refers to the behavior sequence path collected and constructed by the network environment identification module, challenge authentication module, and hardware key binding module during the actual operation of the system before triggering data communication. This path is constructed by the joint digest of the device at the current moment, the authentication result, the abnormal event, and the geographical location in the order of occurrence. The authentication result includes the network fingerprint feature comparison result and the credibility score, the challenge authentication result and the dynamic signature token, and the hardware key verification and the trusted start token.

[0014] As a preferred technical solution of the present invention, a data exchange system for real-time secure communication with an intranet system further includes a visualization monitoring and log module, which is used to display the data exchange status, network environment identification results, authentication process logs and abnormal behavior alarm information in real time, and supports log retention and remote management access.

[0015] As a preferred technical solution of the present invention, a data exchange system for real-time secure communication with an intranet system further includes a policy update module, which is used to periodically obtain the latest network fingerprint database, authentication rule set and anomaly handling policy from the policy management server of a designated intranet. The update process is verified by digital signature and encrypted and synchronized in the designated intranet to realize dynamic upgrading and unified management of system security policy.

[0016] The present invention has the following advantages: This invention introduces multi-dimensional fingerprint feature combination comparison into the network environment identification module and compares it with the trusted fingerprint database of the internal network, thereby achieving high-precision identification of the authenticity of the system's operating network environment. This effectively prevents the risk of fake access via virtual IP, VPN, or simulated environment, and establishes a reliable foundation for subsequent security control.

[0017] This invention employs a challenge-response mechanism based on the SM2 algorithm and introduces dynamic signature token verification to achieve dynamic verification control of the operating environment and access identity before system startup. This ensures that the system is only authorized and activated in a real, designated intranet environment, preventing authentication information forgery, replay, and man-in-the-middle attacks.

[0018] This invention introduces a non-exportable private key verification from a local dedicated USBKey or TPM chip through a hardware key binding module, ensuring that the system operation is strongly bound to the physical device. Even if the program is copied, it cannot run independently of the original device, significantly improving the system's resistance to migration and physical security.

[0019] This invention introduces a trust graph assessment module to perform graph modeling of the characteristics of the device during its historical operation. Based on the graph overlap assessment results, it judges the rationality of the current operating environment of the system. The communication module is allowed to run only when the assessment results meet the conditions, forming a judgment mechanism based on historical trustworthy behavior, which enhances the system's ability to prevent and control gradual attacks and behavior impersonation.

[0020] This invention introduces a dual verification mechanism based on trusted activation tokens and graph evaluation into the data communication module, constructing a secure communication channel with delayed activation, path consistency, and real-time monitoring. This enables dynamic and trusted control throughout the entire process from access to transmission, preventing data leakage under unauthorized or abnormal behavior.

[0021] This invention links network environment identification, challenge authentication process and graph assessment through an anomaly response module, and responds to anomaly events in real time. It realizes linked operations such as automatic communication interruption, self-destruction, log reporting and visual risk warning, and constructs a closed-loop security adaptive mechanism in system operation, thereby improving the overall system's resistance to attack, recoverability and auditability. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are only schematic diagrams of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort. Figure 1 This is a schematic diagram of a data exchange system for real-time secure communication with an intranet system, as used in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0024] Example 1: A data exchange system for real-time secure communication with an intranet system, specifically comprising: The network environment identification module is used to collect network fingerprint features before the system starts up, compare them with the trusted fingerprint database of the intranet, and generate a credibility score based on the network fingerprint feature comparison results. In this embodiment, the multi-dimensional fingerprint feature combination comparison method refers to the system collecting multiple network attribute fields (i.e., the network fingerprint features listed above) in the early stages of operation to construct a set of network environment state features containing multiple dimensions. This set is then processed through feature concatenation and feature hashing to form an irreversible and unique fingerprint hash value, which is used for accurate matching with the trusted fingerprint database of the internal network.

[0025] The network environment identification module employs a multi-dimensional fingerprint feature combination comparison method. It generates a unique fingerprint hash value using locally collected network fingerprint features and compares it with the feature hash values ​​in the internal network trusted fingerprint database. The comparison result is used to calculate the network environment trust score. The trust score is used to determine whether the system meets the preconditions for startup or communication. The challenge authentication module is only allowed to be activated when the trust score exceeds a preset threshold. The network fingerprint features include IP address, subnet mask, default gateway MAC address, DNS server address and response value, NTP server synchronization path, TTL response value, LAN broadcast response, access network segment usage frequency and change frequency indicators.

[0026] IP address: derived from the system network interface configuration, indicating the logical network range in which the current terminal is located; Subnet mask: Used in conjunction with IP address to determine whether the terminal is in a designated secure subnet segment of the internal network; Default gateway MAC address: obtained via ARP protocol, used to verify whether the connected upstream gateway device is a registered trusted gateway in the specified network (internal network); DNS server address and response value: obtained through a DNS query initiated by the system. The response time can reflect the stability of the domain name resolution path and the risk of intermediate nodes. NTP server synchronization path: Obtain the time source address by calling the terminal time synchronization mechanism, and verify whether the specified intranet time source is used to prevent time tampering; TTL response value: Recorded via ICMP or TCP probe packets, it can help determine whether there are unexpected intermediate network hops; LAN broadcast response: Probes the number of responding devices and the distribution of MAC addresses within the LAN via UDP broadcast, used to identify whether the environment is a real and trustworthy internal LAN environment; Access network segment usage frequency: Extracted based on the device's historical network access records. If a certain network segment is a high-frequency access area, its reliability will be increased accordingly. Change frequency index: This index measures the frequency of changes to the above fields over a certain period of time. The higher the change frequency, the more unstable the environment, and the lower the credibility weight of the current recognition result will be.

[0027] In practical use, the system merges the attribute fields into a feature vector, inputs a hash function (such as SM3) according to the set rules to generate an irreversible fingerprint hash value, and compares it with the feature hash value in the trusted fingerprint database of the internal network.

[0028] The comparison process supports a weighted fault tolerance mechanism, which means that for strong identification fields such as IP or MAC, complete consistency is required; for floating fields such as DNS response values ​​and TTL values, a certain tolerance range is acceptable.

[0029] The credibility score is expressed in the range of 0–100 points and is calculated by the system based on the number of matching items, matching accuracy, and field credibility weights. The system has a preset credibility threshold, and the score result will directly determine whether entry into the subsequent challenge certification process is allowed.

[0030] The challenge authentication module is used to initiate a dynamic authentication request based on the SM2 algorithm to an authentication server deployed on a specified intranet only when the credibility score exceeds a preset threshold, and obtain a dynamic signature token; during the challenge authentication process, a joint digest of network fingerprint features, device identifier and timestamp is generated; In this embodiment, the challenge authentication module serves as the second stage of proactive identity security verification after network environment identification is completed. The authentication process is based on the SM2 elliptic curve public key cryptography algorithm recommended by the State Cryptography Administration to construct a dynamic signature mechanism, which has the characteristics of high strength, low latency, and unforgeability, and is suitable for the sensitive identity authentication needs of internal networks.

[0031] The challenge authentication module adopts a dynamic challenge-response mechanism based on the SM2 national cryptographic algorithm. During the challenge authentication process, it generates a request message with timestamp, device identifier, and network fingerprint feature comparison results, and sends it to the authentication server via HTTPS or a private network custom communication protocol. The authentication server generates a dynamic signature token based on the content of the request message and the preset trust list, and returns it to the client. The client verifies the dynamic signature token and checks its validity time window. If the authentication is successful, the data communication module is initialized. If the authentication fails or the response times out, the operation of the data communication module is blocked and the abnormal response module is locked or alarmed.

[0032] Once the system confirms that the current network environment is trustworthy (i.e., the credibility score exceeds the threshold), the challenge authentication module will immediately collect the following behavioral elements (current network fingerprint characteristics; device identifier (terminal motherboard serial number, USBKey number, or TPM device unique ID); current system timestamp (synchronized from the NTP server)), concatenate them with a predetermined structure, and generate a joint digest using the SM3 hash algorithm. This joint digest serves as the core data of the challenge authentication request message, which will then be signed and sent.

[0033] The request message is sent to the authentication server via HTTPS or a custom communication protocol over a private network. Upon receiving the request message, the authentication server verifies the format and signature integrity of the request message; searches for a valid match in the trusted device list, allowed time window, and network range; if a match is found, it generates a short-lived dynamic signature token; and returns it to the client using symmetric encryption.

[0034] The dynamic signature token includes: an authentication success status code, a validity window (e.g., 30 seconds), the signature result of the digest, and server signature information.

[0035] Upon receiving the token, the client immediately verifies the signature using the SM2 public key and checks if the time has expired. Only if the verification is successful will the system proceed to the data communication module initialization process. If the token is invalid, the signature mismatches, or the timeout fails to return a response, authentication is considered to have failed, triggering the exception response module.

[0036] The authentication server is accessible only within a designated intranet environment. After a series of failed authentication attempts (e.g., 3 times), the system will enter a restricted mode, allowing communication functionality to be restored only after successful re-verification (a complete closed-loop verification process including network environment identification, challenge authentication, hardware key binding verification, and trust graph evaluation). The restricted mode includes four levels of security control measures: data channel blocking (completely interrupting the end-to-end data link), functional module freezing (stopping the operation of all security functional components), authentication retry cooldown timer (enabling an authentication retry waiting time (e.g., retrying after 30 minutes)), and administrator intervention unlocking (only allowing users with intranet administrator privileges to unblock and restore the system via physical login or intranet approval).

[0037] The hardware key binding module is used to call the non-exportable private key in the local dedicated USBKey or TPM chip to sign the federated digest, form a unique trusted boot token, and perform hardware key verification on the trusted boot token, including integrity verification and validity verification. In this embodiment, the hardware key binding module is used to ensure that the system authentication data has terminal binding, physical non-transferability, and private key non-extraction, and is a core link of the system's trusted chain.

[0038] The system digitally signs the federated digest by calling the local dedicated USBKey or the non-exportable private key (the private key part of the SM2 key pair) encapsulated inside the TPM chip. The signing result constitutes a unique trusted start token.

[0039] The USBKey / TPM private keys are pre-made and written, and cannot be exported or read by the system. Signing is only allowed through a secure API call. The national cryptographic SM2 signature algorithm is used to ensure that the generated token cannot be reproduced on other devices. This trusted start token has device uniqueness and behavior uniqueness, and cannot be forged or replayed.

[0040] The generated trusted start token will be immediately sent to the verification mechanism within this module to complete integrity and validity verification. Only when both verifications pass can the system determine that the token is genuine and trusted, and allow it to enter the data communication module stage. If either verification fails, the exception response module will be triggered to immediately terminate the communication initialization process.

[0041] The integrity check verifies whether the consistency between the original federated digest and the signature result can be restored through SM2 public key verification; the validity check determines whether the signature timestamp is within the allowed startup time window (e.g., within 60 seconds) to prevent token expiration and abuse.

[0042] The data communication module is activated only after the network environment identification, challenge authentication and hardware key verification are all passed, and is used to establish an end-to-end data exchange channel based on SM4 encryption. In this embodiment, the data communication module assumes the responsibility of a secure channel for data exchange in the system. Its activation prerequisites are: a trustworthy network environment, successful challenge authentication, and valid hardware key verification. All three are indispensable, thereby ensuring that a complete and trustworthy authentication process is carried out before the communication link is established.

[0043] The data communication module uses the SM4 symmetric encryption algorithm to encrypt communication data end-to-end. In addition, all data transmissions during the communication process must be encrypted and initialized through a dynamic generation mechanism of secure session keys to prevent data from being intercepted or replayed during transmission.

[0044] During communication, the system does not reuse historical keys, but instead uses a secure session key to achieve one-time pad encryption. The secure session key is generated by a dynamic signature token and a trusted start token, and is combined with a timestamp and device identifier to form a temporary session context to prevent key reuse.

[0045] The secure session key generation process includes: after successful authentication, the client and server synchronize asymmetric authentication key negotiation data (an SM2-encrypted random seed); the system takes the joint digest, hardware identifier, and timestamp as input and executes a key derivation function; a unique and valid SM4 symmetric key is generated, which is used for encrypted transmission of all data blocks in the current connection. This key is destroyed immediately after the communication session ends or times out, and is not written to local storage, ensuring that its lifespan is limited to the minimum communication window and reducing the attack surface.

[0046] During communication, if any of the following abnormal situations are detected (session key verification failure (digest mismatch, timestamp expired); replay attack detection (identification of repeated use of the same session token); data packet integrity verification failure exceeding the limit (more than 3 consecutive failures); detection of device identifier or location change (dynamic judgment of geographical location trust consistency)), the data communication module will immediately interrupt the session and notify the abnormal response module.

[0047] The data communication module sets up an encrypted data buffer queue during transmission. This buffer queue supports data block integrity verification and a retry mechanism for transmission failures to ensure real-time communication and data integrity. The data block integrity verification includes attaching an SM3 checksum to each data packet during transmission; the receiver only decrypts the data after successful verification. The retry mechanism for transmission failures includes automatically retransmitting unacknowledged data blocks in the event of network anomalies or packet loss, supporting up to three controllable retransmissions. The anomaly response module is used to automatically block the communication interface, encrypt and record the abnormal events as audit logs, and report them to the log audit system when the network environment identification fails, the challenge authentication fails, the trusted start token verification fails, or the hardware device is replaced. In this embodiment, the anomaly response module is responsible for fault judgment and automatic defense triggering in the overall system security process. Its function is to promptly block the spread of risks and perform closed response processing when the system operating environment or authentication path is found to have a lack of trust, so as to prevent data leakage or communication abuse.

[0048] When any of the following conditions are met—network environment identification failure, challenge authentication failure, trusted start token verification failure, or hardware device replacement—the communication interface is automatically blocked, the following operations are performed: Identify the anomaly type (authentication failure, environment anomaly, key expiration); block the data communication module; package the current behavior path and fault status record into an anomaly event data block; encrypt and encapsulate the data block using the SM4 encryption algorithm to generate an encrypted audit log, and simultaneously submit it to the log audit system for archiving, early warning, or post-audit analysis.

[0049] The abnormal event data block includes a timestamp, network environment summary, device identifier, failure type code, most recent authentication token and verification result, policy number and warning level.

[0050] The anomaly response module includes a self-destruct mechanism, which is used to trigger the system to automatically block the data access interface, clear local cache data, or perform encrypted storage when the network environment identification fails, the number of failed challenge authentications exceeds a set value, or the hardware key verification fails. The self-destruct mechanism specifically includes: freezing all network communication ports and external I / O ports through kernel instructions; erasing incomplete data structures in RAM, or using the public key of the local security chip for one-time sealing and encryption; if the system detects an anomaly accompanied by the risk of hot-plugging, restarting, or illegal power-off, it will be forced into a hibernation protection state, restricting booting.

[0051] The anomaly response module also includes a path break detection mechanism, which is used to automatically cut off communication, block the data interface and clear the unfinished session cache in the data communication module when any element of the network fingerprint feature, device identifier or timestamp bound to the trusted start token fails, and the system enters a high-risk lockout state.

[0052] Once in a high-risk locked state, the system retains only basic security maintenance services, disables communication and authentication capabilities, enters the protection-level zero-trust level, and no longer responds to external requests to prevent further attacks and infiltration.

[0053] The Trust Graph Assessment Module is used to perform graph-based modeling of joint summaries, authentication results, anomalous events, and geographic locations at historical time points. It generates multidimensional behavioral feature sequences through SM3 hashing, constructs a behavioral trust graph, and performs graph overlap assessment. The system only runs the data communication module when the graph overlap assessment result exceeds a preset threshold; otherwise, it interrupts data communication and triggers an anomaly response.

[0054] In this embodiment, the trust graph evaluation module realizes dynamic modeling, analysis and control of the consistency and credibility of the system's historical behavior and current behavior. Its core idea is to serialize, structure and graph the behavior process, and compare and analyze it with historical behavior characteristics to determine whether the current communication is trustworthy.

[0055] The assessment of map overlap includes: The graph structure similarity between the currently generated behavior trust graph and the previous version is evaluated. The feature node retention rate, edge structure stability, and behavior pattern migration trajectory scores are obtained and weighted to calculate the graph overlap score. The current behavior path is evaluated against the trusted paths extracted from the behavior trust graph. The node matching rate, temporal continuity, and behavior trend similarity scores between paths are obtained and weighted to calculate the path similarity comparison score. The graph overlap score and the path similarity comparison score are then weighted and fused to obtain the graph overlap evaluation result. All weights in the above calculations are set through expert experience or obtained by fitting historical data.

[0056] Feature node retention rate: Whether the key nodes existing in the current graph have appeared in the historical graph; Edge structure stability: The proportion of behavioral paths with the same start and end nodes retained in the two versions of the behavioral trust graph; Behavioral pattern migration trajectory score: The behavioral path may have minor adjustments (such as changes in order or insertion of outliers) but the overall trend remains consistent, and it is used to assign weights to offset deductions.

[0057] Node matching rate: The matching rate between each node in the current behavior path and each node in the behavior trust graph; Temporal continuity: Whether the order in which nodes appear is basically consistent, allowing for a certain time offset; Behavioral trend similarity: Whether the behavioral path remains logically consistent (e.g., successful authentication → successful transmission → normal shutdown). The current behavior path refers to the behavior sequence path collected and constructed by the network environment identification module, challenge authentication module, and hardware key binding module during the actual operation of the system before triggering data communication. This path is constructed by the joint digest of the device at the current moment, the authentication result, the abnormal event, and the geographical location in the order of occurrence. The authentication result includes the network fingerprint feature comparison result and the credibility score, the challenge authentication result and the dynamic signature token, and the hardware key verification and the trusted start token.

[0058] The trust graph assessment module collects the following core fields to construct the behavioral feature input sequence: joint summary, abnormal events, and geographic location information. Each feature input sequence is processed by SM3 hashing in chronological order to generate a behavioral feature sequence hash chain, which is used to construct the behavioral trust graph.

[0059] The behavioral trust graph specifically includes: Graph nodes: Represent each behavioral state, such as authentication success, hardware verification failure, and signature delay; Graph edges: represent the temporal or causal relationship between behavioral states, such as authentication success → key verification → data communication activation; Node feature vector: derived from the joint summary field, hashed and mapped to a fixed-length sequence to form a multi-dimensional vector; Timestamp labels: Each edge is attached with a time sequence attribute, which facilitates the assessment of behavioral trend similarity and node matching; Event tags include risk level, warning signs, and information about associated devices.

[0060] All nodes and edges are automatically updated using historical behavior as training data, forming a multi-version evolutionary structure.

[0061] The visualization monitoring and logging module is used to display data exchange status, network environment identification results, authentication process logs and abnormal behavior alarm information in real time, and supports log retention and remote management access.

[0062] In this embodiment, the visual monitoring and logging module is mainly used for backend operation and maintenance support for internal network system administrators, assisting them in realizing the functions of security supervision, risk auditing and behavior tracing of system communication activities.

[0063] Based on the output status of the aforementioned modules, this module provides the following visualizations: Data exchange status, showing whether the current data communication is active, the encryption algorithm used (such as SM4), the communication port, and remote node information; Network environment identification results, displaying the network fingerprint features collected during this startup, the credibility score, and whether the comparison passed; Authentication process log, recording the challenge authentication request initiation time, the token digest returned by the authentication server, the authentication result (success / failure), and the verification time window; Abnormal behavior alarm information, when the system enters the abnormal response process, graphically marking the triggering reason (such as authentication failure, hardware replacement), and displaying the current lock level and remaining retry time.

[0064] The policy update module is used to periodically obtain the latest network fingerprint database, authentication rule set and anomaly handling policy from the policy management server of the designated intranet. The update process is verified by digital signature and encrypted and synchronized in the designated intranet to realize the dynamic upgrade and unified management of system security policies.

[0065] In this embodiment, the core function of the policy update module is to realize centralized management and secure distribution of the system's operating policies, ensuring that the network environment identification, challenge authentication, and anomaly response processes executed by all terminal nodes remain consistent.

[0066] The content obtained includes: Network fingerprint database: includes an internal network trusted fingerprint database, matching weight parameters, and trusted scoring thresholds; Authentication rule set: includes the verification process logic used in the challenge authentication process, signature token structure rules, and time window restriction strategy; Exception handling strategy: Define the response actions, lockout levels, and cooldown times for various exception events (such as the maximum number of failures or equipment change rules); Map evaluation parameters (optional): including map overlap scoring weight setting, path comparison tolerance, and behavioral trend threshold. Example 2: A data exchange system for real-time secure communication with an intranet system, referencing... Figure 1 As shown, it includes the following modules and units: The network environment identification module includes: Fingerprint acquisition unit: used to collect network fingerprint features of the current network environment; Fingerprint hash generation unit: processes the collected data and generates unique fingerprint hash values; Trustworthy scoring unit: compares the fingerprint hash value with the trusted fingerprint database on the internal network and outputs a trustworthiness score.

[0067] The challenge certification module includes: Challenge Request Generation Unit: Generates a request message with timestamp, device identifier, and network fingerprint feature comparison results; Authentication token processing unit: Generates a dynamic signature token based on the content of the request message and the preset trust list, verifies the signature through the client, and checks its validity time window; Process control unit: Determines whether to activate the communication module; if authentication fails, it will trigger the exception response module.

[0068] The hardware key binding module includes: Hardware private key loading unit: calls the non-exportable private key in the local dedicated USBKey or TPM chip; Start Token Signing Unit: Digitally signs the federated digest to generate a trusted start token; Device binding verification unit: Determines whether the device is trusted for binding by verifying the integrity and validity of the trusted startup token.

[0069] The data communication module includes: Encrypted Channel Unit: Activated after the verification of the previous three modules, it establishes an end-to-end data communication channel based on the SM4 symmetric encryption algorithm, and works with dynamically generated secure session keys to ensure that communication data is protected against interception and replay. The graph monitoring linkage unit acquires the results of the trust graph evaluation module and controls the operation of the data communication module. Buffer queue unit: Establishes a buffering mechanism for transmitted data blocks.

[0070] The exception response module includes: Lockdown control unit: Used to perform operations following an abnormal event response; Log audit reporting unit: used to encrypt and record abnormal events as audit logs and report them to the log audit system; Path break switching unit: used to execute the path break detection mechanism.

[0071] The trust graph assessment module includes: Path mapping unit: Used to perform graph-based modeling of joint summaries, authentication results, abnormal events and geographical locations at historical time points, and to generate multi-dimensional behavioral feature sequences through SM3 hashing to construct a behavioral trust graph; Path overlap scoring unit: used for map overlap assessment; Threshold adjustment unit: Based on the system's historical operating trends, device type, risk level, or administrator policies, dynamically adjust the preset threshold for graph overlap assessment to adapt to the behavioral flexibility requirements under different device scenarios.

[0072] The visualization monitoring and logging module includes: Behavior scoring display unit: graphically displays data exchange status, network environment identification results, authentication process logs, and abnormal behavior alarm information; Historical trajectory visualization unit: Displays the current behavior path and behavior trust graph; Log Management Unit: Supports functions such as categorized retrieval of audit logs, archiving by module, and rapid location of abnormal events.

[0073] The policy update module includes: Policy retrieval unit: Used to periodically retrieve updated content from a specified intranet policy server; Version verification unit: Performs integrity hash verification, SM2 signature verification, and version difference comparison on the pulled policy package to ensure policy security and reliability; Local Application and Rollback Unit: Automatically synchronizes local policy configuration after verification is completed. If the application fails or the verification fails, it supports rolling back to the most recent security version and records difference logs for backend analysis.

[0074] Example 3: Construction and function of a behavioral trust graph in a data exchange system for real-time secure communication with an intranet system in practical applications; Scene background: A designated intranet terminal performs daily data synchronization communication with the core database at set intervals. To determine whether this terminal is in a trusted state, the system constructs a behavioral trust graph based on its authentication and communication behavior over a period of time.

[0075] Map construction process: Over the past five consecutive days of use, the terminal has undergone the following steps before each communication, and the system has recorded the following information: Network environment identification results: Fingerprint matching successful, trust score > 90; Access IP: 192.168.0.88, Default gateway MAC: AA:BB:CC:DD:EE:FF; Authentication process challenge: Device identifier, USBKey-123456; timestamp verification passed, authentication successful, dynamic signature token valid; Hardware key binding verification: TPM signature verification passed, trusted boot token verification passed; Data communication status: SM4 channel established, transmission lasted 3 minutes; no abnormal events recorded. Geographic location: Coordinates are local area network locations (trusted locations); Example graph structure: (constructed using nodes and edges); Nodes (each behavior or state): {N1: Network environment identification successful, N2: Challenge authentication successful, N3: Hardware key binding verification successful, N4: Data channel successfully established, N5: Geographical location trusted, N6: No abnormal records}; Edges (representing time and causal relationships): {E1:N1→N2 (authentication can only be initiated after network identification), E2:N2→N3 (key signing will only be triggered after successful authentication), E3:N3→N4 (communication will start after successful signing), E4:N4→N6 (no abnormal events during communication), E5:N1→N5 (network fingerprint is also associated with geographical location)}; Function description: When the next device initiates a communication request, the system compares its current behavior path with the above map, and compares the above map with the image of the previous version to perform map overlap assessment.

[0076] Example 4 illustrates the operation flow and technical effects of a secure communication system in a specified intranet environment. In this example, the overall operation flow of the data exchange system for real-time secure communication with the intranet system includes the following main stages, which are completed sequentially by the system according to a preset security logic path: I. System Startup and Environment Identification Phase When the terminal device starts up, the network environment identification module first runs automatically, collecting multi-dimensional network fingerprint features of the local network environment. These feature fields are concatenated and hashed to form an irreversible network fingerprint hash value, which is then compared with standard fingerprint data registered in the internal trusted fingerprint database. The comparison result generates a trust score. If the score does not reach a set threshold, the system automatically interrupts subsequent processes; only when the score exceeds the threshold can the next stage of authentication proceed.

[0077] Technical effect: Effectively prevents devices from forcibly starting communication processes in non-designated intranets or unknown environments, and resists unauthorized access.

[0078] II. Identity Authentication and Key Binding Phase Once the network environment is deemed trustworthy, the system immediately initiates the challenge authentication module, automatically constructs an authentication request, and performs structured processing based on the SM2 algorithm. The authentication request is sent to the authentication server via a private network communication protocol. The server verifies the request content, and if authentication is successful, it issues a dynamic signature token with a short validity window.

[0079] Upon receiving the token, the client immediately verifies its signature and validity. If verification is successful, it proceeds to the hardware key binding module. The system uses the non-exportable SM2 private key from the terminal's built-in USBKey or TPM to sign the authentication digest, generating a trusted boot token. The system performs dual verification of the boot token's integrity and validity. Once confirmed to be correct, it activates the communication module.

[0080] Technical effect: The dual authentication mechanism (challenge token + launch token) combined with hardware binding ensures that the system only opens communication to trusted devices, trusted networks and trusted time windows.

[0081] III. Communication Encryption and Real-time Monitoring Stage After entering the data communication module, the system automatically generates an SM4 session key based on dynamic context to establish an end-to-end encrypted communication channel. During communication, all data packets are encrypted with SM4, accompanied by an SM3 integrity checksum, and managed by a buffer queue to ensure reliable and orderly data transmission.

[0082] In addition, the system obtains a behavioral trust graph through the trust graph evaluation module and performs graph overlap evaluation on it.

[0083] Technical effect: Encrypted channels combined with behavioral graph monitoring effectively prevent dynamic risks during communication, such as replay attacks, identity impersonation, and configuration hijacking.

[0084] IV. Anomaly Prevention and Closed-Loop Handling Stage If any insufficient credibility, authentication failure, device abnormality, or behavior path break is identified in any stage (network environment identification, challenge authentication, hardware key binding, trust graph evaluation), the system immediately activates the abnormal response module, including blocking data interfaces, recording and encrypting abnormal event logs, triggering self-destruct mechanism or entering restricted mode, and uploading event data to the intranet audit system for subsequent analysis.

[0085] Technical effect: Ensures that no potential attack or abnormal behavior will open the communication link, and the system enters a zero-trust defense state, where data is unreadable and untransmittable.

[0086] V. Security Visibility and Strategy Update Phase The system uses a visualization monitoring and log module to present the scoring data, authentication status, communication trajectory, etc. of each stage in a visual manner, which can be remotely viewed and managed by designated network administrators.

[0087] Meanwhile, the policy update module retrieves the latest network fingerprint database, graph parameters, authentication rules, and other information from the intranet policy server and updates them regularly to ensure that the security policy is always consistent with the specified intranet standard.

[0088] Technical effects: The entire process is visible and controllable, strategies are centralized and unified, and the system has the ability to continuously evolve and dynamically defend.

[0089] Overall technical results summary: The system workflow of this embodiment has the following significant advantages: an end-to-end closed-loop trust authentication chain covering network environment → authentication request → hardware signature → graph behavior → communication control; a dynamic behavior graph-assisted judgment mechanism to realize communication trust trend modeling and anomaly warning; parallel execution of multi-factor protection mechanisms to effectively improve the anti-intrusion, anti-tampering, and anti-migration of designated intranet communication; and a rapid blocking and audit linkage mechanism to ensure that communication security issues are traceable, manageable, and trackable.

[0090] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data exchange system for real-time secure communication with an intranet system, characterized in that, include: The network environment identification module is used to collect network fingerprint features before the system starts up, compare them with the trusted fingerprint database of the internal network, and generate a credibility score based on the network fingerprint feature comparison results. The challenge authentication module is used to initiate a dynamic authentication request based on the SM2 algorithm to the authentication server deployed on the specified intranet only when the credibility score exceeds a preset threshold, and obtain a dynamic signature token. The challenge authentication process generates a joint digest of network fingerprint features, device identifier, and timestamp; The hardware key binding module is used to call the non-exportable private key in the local dedicated USBKey or TPM chip to sign the federated digest, form a unique trusted boot token, and perform hardware key verification on the trusted boot token, including integrity verification and validity verification. The data communication module is activated only after the network environment identification, challenge authentication and hardware key verification are all passed, and is used to establish an end-to-end data exchange channel based on SM4 encryption. The anomaly response module is used to automatically block the communication interface, encrypt and record the abnormal events as audit logs, and report them to the log audit system when the network environment identification fails, the challenge authentication fails, the trusted start token verification fails, or the hardware device is replaced. The Trust Graph Assessment Module is used to perform graph-based modeling of joint summaries, authentication results, anomalous events, and geographic locations at historical time points. It generates multidimensional behavioral feature sequences through SM3 hashing, constructs a behavioral trust graph, and performs graph overlap assessment. The system only runs the data communication module when the graph overlap assessment result exceeds a preset threshold; otherwise, it interrupts data communication and triggers an anomaly response.

2. The data exchange system for real-time secure communication with an intranet system according to claim 1, characterized in that, The network environment identification module employs a multi-dimensional fingerprint feature combination comparison method. It generates a unique fingerprint hash value using locally collected network fingerprint features and compares it with the feature hash values ​​in the internal network trusted fingerprint database. The comparison result is used to calculate the network environment trust score. The trust score is used to determine whether the system meets the preconditions for startup or communication. The challenge authentication module is only allowed to be activated when the trust score exceeds a preset threshold. The network fingerprint features include IP address, subnet mask, default gateway MAC address, DNS server address and response value, NTP server synchronization path, TTL response value, LAN broadcast response, access network segment usage frequency and change frequency indicators.

3. The data exchange system for real-time secure communication with an intranet system according to claim 1, characterized in that, The challenge authentication module adopts a dynamic challenge-response mechanism based on the SM2 national cryptographic algorithm. During the challenge authentication process, it generates a request message with timestamp, device identifier, and network fingerprint feature comparison results, and sends it to the authentication server via HTTPS or a private network custom communication protocol. The authentication server generates a dynamic signature token based on the content of the request message and the preset trust list, and returns it to the client. The client verifies the dynamic signature token and checks its validity time window. If the authentication is successful, the data communication module is initialized. If the authentication fails or the response times out, the operation of the data communication module is blocked and the abnormal response module is locked or alarmed.

4. A data exchange system for real-time secure communication with an intranet system according to claim 3, characterized in that, The authentication server is only accessible within a designated intranet environment. After a preset number of authentication failures, the system will enter a restricted mode, allowing communication functionality to be restored only after successful re-authentication. The restricted mode includes four levels of security control measures: data channel blocking, functional module freezing, authentication retry cooldown timer, and administrator intervention unlocking.

5. A data exchange system for real-time secure communication with an intranet system according to claim 1, characterized in that, The anomaly response module includes a self-destruct mechanism, which is used to trigger the system to automatically block the data access interface, clear local cache data, or perform encrypted storage when the network environment identification fails, the number of failed challenge authentications exceeds a set value, or the hardware key verification fails. The anomaly response module also includes a path break detection mechanism, which is used to automatically cut off communication, block the data interface and clear the unfinished session cache in the data communication module when any element of the network fingerprint feature, device identifier or timestamp bound to the trusted start token fails, and the system enters a high-risk lockout state.

6. A data exchange system for real-time secure communication with an intranet system according to claim 1, characterized in that, The data communication module uses the SM4 symmetric encryption algorithm to encrypt communication data end-to-end. In addition, all data transmissions during the communication process must be encrypted and initialized through a dynamic generation mechanism of secure session keys to prevent data from being intercepted or replayed during transmission.

7. A data exchange system for real-time secure communication with an intranet system according to claim 1, characterized in that, The data communication module sets up an encrypted data buffer queue during transmission. The buffer queue supports data block integrity verification and transmission failure retry mechanism to ensure the real-time performance of communication and data integrity.

8. A data exchange system for real-time secure communication with an intranet system according to claim 1, characterized in that, The assessment of map overlap includes: The graph structure similarity between the currently generated behavior trust graph and the previous version is evaluated by obtaining the feature node retention rate, edge structure stability, and behavior pattern migration trajectory scores, which are then weighted to obtain the graph overlap score. The current behavior path is evaluated by comparing it with the trusted paths extracted from the behavior trust graph, obtaining the node matching rate, temporal continuity, and behavior trend similarity scores between the paths, which are then weighted to obtain the path similarity comparison score. The graph overlap score and the path similarity comparison score are then weighted and fused to obtain the graph overlap evaluation result. The current behavior path refers to the behavior sequence path collected and constructed by the network environment identification module, challenge authentication module, and hardware key binding module during the actual operation of the system before triggering data communication. This path is constructed by the joint digest of the device at the current moment, the authentication result, the abnormal event, and the geographical location in the order of occurrence. The authentication result includes the network fingerprint feature comparison result and the credibility score, the challenge authentication result and the dynamic signature token, and the hardware key verification and the trusted start token.

9. A data exchange system for real-time secure communication with an intranet system according to claim 1, characterized in that, It also includes a visualization monitoring and logging module, which is used to display data exchange status, network environment identification results, authentication process logs and abnormal behavior alarm information in real time, and supports log retention and remote management access.

10. A data exchange system for real-time secure communication with an intranet system according to claim 1, characterized in that, It also includes a policy update module, which is used to periodically obtain the latest network fingerprint database, authentication rule set and anomaly handling policy from the policy management server of the designated intranet. The update process is verified by digital signature and encrypted and synchronized in the designated intranet to realize the dynamic upgrading and unified management of system security policies.

Images