A bidirectional data security transmission method

Abstract

This application relates to the field of network security, and more particularly to a bidirectional data secure transmission method. The method includes an upper-level node generating a one-time key and distributing it to lower-level nodes. Lower-level nodes apply for access using the key. After verification, the upper-level node assigns a virtual IP address and generates an identity fingerprint to complete the network formation, establishing an independent secure channel. Task instructions are issued through this channel, and lower-level nodes execute the tasks and transmit encrypted data back in real time. The upper-level node continuously verifies the trustworthiness of node identities through a heartbeat mechanism. This method significantly reduces the resource consumption of the central node, avoids the security risks of traditional VPNs, adapts to complex network environments, and achieves efficient and secure data transmission and collaborative management.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to a method for secure two-way data transmission. Background Technology

[0002] Network assets and vulnerabilities have always been key to hacker attacks and network defense. In multi-level organizations or hierarchical relationships such as those between regulators and enterprises, a comprehensive understanding of the asset and vulnerability status of subordinate units by higher-level or regulatory bodies helps them to manage and protect their network assets.

[0003] Currently, there are generally two solutions available. The first is to deploy monitoring and detection equipment at the higher-level unit, sending scans for vulnerabilities and discovering assets via the public internet. However, this approach has significant difficulties and problems. Subordinate units may have their own networks, including but not limited to hybrid clouds, private clouds, and branch isolation networks, which makes it very difficult for the higher-level unit to send and collect information. Even if a VPN can be used to connect to the network, VPN technology carries the risk of leaking access accounts. Moreover, data security is also an issue since it is transmitted over the public internet. Another problem is that deploying monitoring and detection equipment at the higher-level unit will consume a large amount of the higher-level unit's dedicated network and computing resources, resulting in a very large deployment scale. Since scanning and monitoring must be performed in real time via the public internet, execution efficiency is also somewhat problematic.

[0004] The second approach involves lower-level units deploying monitoring and detection equipment, then sending the data to higher-level units in report form or via traditional network methods. Reporting requires significant manpower and is cumbersome to maintain. Using a network method also encounters the problems of the first approach, such as VPN account security and the security of public network data transmission. Summary of the Invention

[0005] To address the aforementioned problems in the prior art, this application provides a bidirectional data secure transmission method. Firstly, the method provided by this application includes the following steps:

[0006] The parent node generates a one-time key and distributes it to the child nodes;

[0007] The lower-level node uses the one-time key to initiate a network access request to the upper-level node;

[0008] After verifying the one-time key, the upper-level node assigns a virtual IP to the lower-level node and generates an identity fingerprint to complete the network formation and establish an independent and secure communication channel with the lower-level node;

[0009] The upper-level node sends task instructions to the lower-level node through the secure communication channel; the lower-level node receives and executes the task instructions, and during the execution process, it synchronizes the task data to the upper-level node in real time through the secure communication channel. The synchronization transmission process of the task data adopts triple encryption: system encryption, HTTPS certificate encryption and secure channel encryption. In addition, the algorithm selection and key length of system encryption and secure channel encryption are configured differently to adapt to the resource constraints in the collaborative architecture, depending on the different sensitivity and real-time requirements of the task instructions and status data.

[0010] The parent node receives and processes the synchronized task data;

[0011] In this process, the upper-level node and the lower-level node continuously verify the identity fingerprint through a heartbeat mechanism to maintain a trusted connection of the secure communication channel. The message sending frequency and verification code generation complexity of the heartbeat mechanism are adjusted in coordination based on the current encryption load of the secure channel and the transmission status of the task data.

[0012] Specifically, after the upper-level node establishes the independent secure communication channel with the lower-level node, the upper-level node dynamically determines the message sending frequency based on the current encrypted load and task data transmission status of the secure channel, and sends a heartbeat request message to the lower-level node, which contains a dynamic verification code generated based on the identity fingerprint.

[0013] After receiving the heartbeat request message, the lower-level node uses the locally stored identity fingerprint to generate a response verification code using the same algorithm and replies to the upper-level node.

[0014] The upper-level node compares the received response check code with the expected value. If they match, the lower-level node is deemed trustworthy. If they do not match multiple times or fail to respond within a timeout period, the node is deemed abnormal and automatically isolated from the secure communication channel.

[0015] The complexity of the verification code generation algorithm is adjusted according to the transmission traffic of the task data. During the transmission idle period, a complex hash operation with more iterations is used to improve security, while a lightweight hash operation is used during the transmission peak period to reduce computational overhead.

[0016] Specifically, when the upper-level node generates the identity fingerprint for the lower-level node, the upper-level node verifies the one-time key, and then extracts the device feature information of the lower-level node, including MAC address, hardware serial number and certificate identifier, and uses the SM3 hash algorithm to generate a hash value as the initial identity fingerprint;

[0017] Subsequently, during each heartbeat verification, based on the synchronization status of the current task data and the encrypted payload of the secure channel, the identity fingerprint of the previously successfully verified identity is selectively combined with the current timestamp and hashed again to generate a dynamically changing identity fingerprint for subsequent heartbeat verifications.

[0018] When the task data synchronization is in a state of continuous encrypted transmission, the re-hashing operation adopts a simplified round to maintain communication efficiency;

[0019] When task data synchronization is intermittent or the channel is idle, standard round-robin hashing is used to enhance identity verification strength.

[0020] Specifically, when the triple encryption is used in the synchronous transmission process of the task data, for the status data transmitted in batches, the system encryption uses the simplified operation mode and standard length key in the national cryptographic SM4 algorithm for encryption.

[0021] For critical task instructions and security alerts, the full operation mode of the SM4 algorithm and the incrementing key are used for encryption;

[0022] The encryption key is dynamically generated by the upper-level node when the task is issued and distributed to the lower-level nodes through a secure channel;

[0023] The HTTPS certificate encryption uses two-way certificate authentication based on the Chinese national cryptographic algorithm SM2;

[0024] The temporary session key and its negotiation frequency used for encryption of the secure channel are dynamically adjusted according to the real-time requirements of the current collaborative task and network conditions.

[0025] Specifically, when the upper-level node issues a task instruction, it estimates the resource consumption based on the scanning range and execution time in the configured task parameters, and dynamically selects the encryption algorithm and key length for the task. For large-scale scanning tasks, it prioritizes the use of encryption algorithm combinations with lower computational overhead and standard key lengths.

[0026] The task instructions and task parameters are encrypted using the selected system encryption method and then sent to the lower-level node through a secure channel.

[0027] After receiving the instruction, the lower-level node parses the parameters and creates a local task instance based on the encryption algorithm combination to start execution.

[0028] Specifically, during the execution of tasks by the lower-level nodes, the real-time collected task status data includes completion progress, resource usage, and exception logs;

[0029] Progress and resource usage data are synchronized using lightweight encryption;

[0030] Error logs and security event-related data are synchronized using high-strength encryption;

[0031] After receiving the data, the higher-level node decrypts and displays it in real time, while dynamically adjusting the subsequent task scheduling strategy and encrypted resource allocation based on the decrypted status data.

[0032] Specifically, the method also includes an exception handling procedure:

[0033] If a lower-level node detects a security vulnerability or asset anomaly during task execution, it should immediately generate a security event alert.

[0034] Based on the severity level of the alarm, select the corresponding encryption strength and transmission priority, and encrypt and upload it to the upper-level node through a secure channel;

[0035] After receiving an alarm, the superior node, based on the current system encryption load, chooses to automatically issue a handling instruction or issue a handling instruction after manual confirmation by the administrator. The handling instructions include isolating assets, fixing vulnerabilities, or updating policies, and the encryption level of the handling instructions matches the alarm level.

[0036] Specifically, the upper-level node can also remotely log in to the management system of the lower-level node without VPN through a secure channel. The upper-level node selects the target node in the management interface and initiates a remote control request. After the lower-level node verifies the legality of the request, it establishes a remote desktop session.

[0037] All operation commands and screen data in the session are transmitted using the triple encryption method, and authentication credentials are automatically destroyed after the session ends.

[0038] Specifically, the method also supports a multi-level network architecture, in which an upper-level node can simultaneously establish secure communication channels with multiple lower-level nodes, and each lower-level node is isolated from the others.

[0039] The upper-level node can simultaneously issue batch tasks to multiple lower-level nodes and aggregate the task data returned by each node to generate a comprehensive report.

[0040] Specifically, the validity period of the one-time key is limited to a single network formation process, and it expires immediately after the network formation is completed;

[0041] Furthermore, the upstream node will record the usage of each key, including the usage time, the node using it, and the operator, forming an audit log for security traceability.

[0042] This application has the following technical advantages:

[0043] By constructing an optimized hierarchical task collaboration architecture, a differentiated encryption strategy based on data type and resource constraints is introduced for the triple encryption mechanism in the process of achieving bidirectional data secure transmission, effectively balancing the contradiction between security strength and computational overhead.

[0044] Meanwhile, the heartbeat mechanism under this architecture can dynamically adjust the verification strength and frequency based on the real-time encrypted load and task status, which not only ensures the reliability of long-term communication links, but also avoids unnecessary performance loss, thereby significantly improving the efficiency, security and resource adaptability of cross-level data collaborative management in complex network environments. Attached Figure Description

[0045] The above and other objects, features, and advantages of exemplary embodiments of this application will become readily understood by reading the following detailed description with reference to the accompanying drawings. Several embodiments of this application are illustrated in the drawings by way of example and not limitation, and the same or corresponding reference numerals denote the same or corresponding parts.

[0046] Figure 1 This is a flowchart of a bidirectional data secure transmission method according to an embodiment of this application. Detailed Implementation

[0047] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0048] This invention aims to overcome the inherent defects of existing technologies in cross-level network security data transmission and collaborative management. Traditional architectures often face a dilemma: while centralizing monitoring and scanning functions at the upper level facilitates unified management, it leads to unbearable resource overhead and execution efficiency issues, especially when probing lower-level nodes scattered in hybrid clouds, private clouds, or isolated network environments via public networks, where network latency and bandwidth bottlenecks are extremely significant. More seriously, relying on VPN technology to establish connections carries the risk of leakage and impersonation due to its static account and password authentication mechanism, and data transmission in plaintext over the public network poses a significant security risk. Another approach, decentralized deployment and manual aggregation, while reducing central pressure, introduces high labor costs and operational delays, resulting in a delayed response to security threats, and similarly fails to avoid authentication and confidentiality issues in network transmission. These defects collectively point to a core need: an urgent requirement for a two-way data interaction mechanism that can adapt to complex heterogeneous network environments and achieve resource collaboration and secure reliability.

[0049] Based on the above motivations, this invention proposes a bidirectional data secure transmission method. The core of this method lies in constructing a dynamic, reliable, and independent overlay network, separating control signaling from data flow, and implementing multi-layered security safeguards. For example... Figure 1As shown, the specific implementation process begins with the initial deployment of the system, and specifically includes the following steps:

[0050] The parent node generates a one-time key and distributes it to the child nodes;

[0051] Lower-level nodes use a one-time key to initiate a network access request to the upper-level node;

[0052] After verifying the one-time key, the upper-level node assigns a virtual IP and generates an identity fingerprint to the lower-level node to complete the network formation and establish an independent and secure communication channel with the lower-level node;

[0053] The upper-level node sends task instructions to the lower-level node through a secure communication channel; the lower-level node receives and executes the task instructions, and during the execution process, it synchronizes the task data to the upper-level node in real time through the secure communication channel. The synchronization transmission of task data adopts triple encryption: system encryption, HTTPS certificate encryption and secure channel encryption. In addition, the algorithm selection and key length of system encryption and secure channel encryption are configured differently to adapt to the resource constraints in the collaborative architecture, taking into account the different sensitivity and real-time requirements of task instructions and status data.

[0054] The parent node receives and processes the synchronized task data;

[0055] In this process, the upper-level node and the lower-level node continuously verify identity fingerprints through a heartbeat mechanism to maintain a trusted connection in the secure communication channel. The message sending frequency and verification code generation complexity of the heartbeat mechanism are adjusted in coordination based on the current encrypted load of the secure channel and the transmission status of the task data.

[0056] In this embodiment, the central node server deployed by the higher-level unit is not a traditional resource-intensive scanning engine, but a lightweight command, coordination, and authentication center. Each lower-level unit deploys corresponding node agent programs within its local network. These agents are responsible for receiving instructions, executing localized tasks, and transmitting data back.

[0057] In one embodiment of this application, the upper-level node first generates a one-time-use key credential. This key has an expiration date and is temporarily bound to the identity information of a specific lower-level node. This key is distributed to the target lower-level node after being encrypted via a pre-arranged secure offline channel or using existing public key infrastructure. Upon obtaining the key, the lower-level node uses it as its identity credential to proactively initiate a network access request to the upper-level node. Upon receiving the request, the upper-level node first verifies the validity and legitimacy of the one-time key. If the verification is successful, it then assigns a virtual IP address to the lower-level node. This virtual IP address is used to identify the node in subsequent communications, decoupling it from its real physical network environment, thereby avoiding connectivity problems caused by the lower-level node potentially being behind complex NAT or firewalls.

[0058] Then, the upper-level node extracts the device characteristic information of the lower-level node, such as MAC address, hardware serial number, or pre-set security certificate identifier, and combines it with a random factor to generate a unique identity fingerprint using a cryptographic hash algorithm. This fingerprint will become the trusted identity identifier for the node throughout the entire session. After the network is established, the upper and lower-level nodes do not establish a regular network connection, but rather construct an independent, logically isolated secure communication channel. All subsequent command issuance and data synchronization will take place within this channel.

[0059] To ensure the continuous reliability of the connection, after the upper-level node establishes an independent secure communication channel with the lower-level node, the upper-level node sends a heartbeat request message to the lower-level node at a preset time interval. This message contains a dynamic verification code generated based on the identity fingerprint.

[0060] After receiving the heartbeat request message, the lower-level node uses the locally stored identity fingerprint to generate a response verification code using the same algorithm and replies to the upper-level node;

[0061] The upper-level node compares the received response check code with the expected value. If they match, the lower-level node is deemed trustworthy. If they do not match multiple times or fail to respond within a timeout period, the node is deemed abnormal and automatically isolated from the secure communication channel.

[0062] In practice, the upstream node assesses the encryption load by monitoring the throughput and CPU utilization of ongoing encryption / decryption operations within the current channel, and determines the transmission status by the packet sending queue length and transmission latency. Based on these real-time metrics, the heartbeat management service dynamically calculates the timing for sending the next heartbeat message. This message embeds a dynamically generated checksum based on the current session state and identity fingerprint. Upon receiving it, the downstream node must use locally stored key materials to generate a response checksum using the same algorithm and reply.

[0063] When generating an identity fingerprint, the device characteristic information of the lower-level node is extracted, including its MAC address, hardware serial number, and pre-set security certificate identifier. This data is combined with a randomly generated value, and then a fixed-length hash value is generated using the national cryptographic SM3 hash algorithm. This hash value is used as the node's initial identity fingerprint. This fingerprint, along with the virtual IP address and node description information, is stored in the security database of the upper-level node, signifying that the node has successfully connected to the network.

[0064] Subsequently, during each heartbeat verification, based on the synchronization status of the current task data and the encrypted payload of the secure channel, the identity fingerprint of the previously successfully verified identity is selectively combined with the current timestamp and hashed again to generate a dynamically changing identity fingerprint for subsequent heartbeat verifications.

[0065] When task data synchronization is in a state of continuous encrypted transmission, in order to reduce the occupation of computing resources and ensure the smoothness of main business data, the hash operation adopts a simplified round to maintain communication efficiency.

[0066] When task data synchronization is intermittent or the channel is idle, to prevent potential replay attacks and forgery risks, the system employs complex hash operations involving more iterations, while standard round hash operations are used to enhance identity verification strength. This process requires lower-level nodes to also possess the same cryptographic computation capabilities to ensure that responses cannot be easily forged by third parties. The generated response verification code is immediately encapsulated in a reply message and sent back to the upper-level node.

[0067] The upstream node verifies in real time that the node's identity has not been tampered with and the connection has not been hijacked by comparing the expected value of the response code with the actual value. If they match perfectly, the heartbeat verification is considered successful, the node's identity is trusted, and the connection is healthy. Simultaneously, the system uses the successful response code as a new basis, combining it with the next timestamp to generate a new dynamic identity fingerprint required for the next heartbeat, thus achieving dynamic rolling updates of identity and further increasing the difficulty for attackers to intercept and replay authentication data. If multiple consecutive heartbeat verifications fail or there is no response after timeout, the upstream node immediately determines that the node is abnormal, automatically isolates it from the secure network, and triggers a security alert. This dynamic continuous authentication mechanism avoids the risks associated with the long-term validity of static credentials in traditional VPNs.

[0068] In one specific implementation scenario of this invention, a complete two-way data security transmission and task collaboration system is deployed within an organization with multiple branch offices. The upper-level node, serving as the control center, is deployed at headquarters, while lower-level nodes are installed in the internal networks of each branch office. Administrators of the upper-level nodes log in to the central management platform via secure authentication. In the task management interface, the administrator first selects a target lower-level node from the node list; this node represents a branch office requiring asset vulnerability scanning. The administrator configures the specific parameters of the scanning task, including but not limited to the target IP address range, a list of vulnerability types to be detected, the intensity of the scanning operation to avoid impacting business operations, and the desired time window for task execution. After confirming the configuration, the administrator issues the task command.

[0069] When a task instruction is sent, the system encryption layer first serializes the task instruction and parameters. For batch transmission of status data, the system encryption uses the simplified operation mode and standard length key in the national cryptographic SM4 algorithm for encryption.

[0070] For critical task instructions and security alerts, the full operation mode of the SM4 algorithm and the incrementing key are used for encryption;

[0071] The encrypted task data packet, along with the SM4 session key, is sent to the next step of processing. Then, in the secure channel encryption layer, the upstream node uses the downstream node's public key based on the SM2 algorithm to encrypt the newly generated SM4 session key, ensuring that only the target downstream node with the corresponding private key can decrypt and obtain it. Subsequently, the entire data packet, including the SM4-encrypted task data and the SM2-encrypted SM4 session key, is transmitted through the established secure communication channel based on a virtual IP. Finally, the HTTPS certificate encryption layer performs the outermost encryption, and all data transmitted within the channel is further encapsulated using the TLS / SSL protocol with two-way SM2 certificate authentication, ensuring the confidentiality, integrity, and trustworthiness of the endpoint identity during transmission.

[0072] When the upper-level node issues a task instruction, it estimates the resource consumption based on the scan range and execution time in the configured task parameters, and dynamically selects the encryption algorithm and key length for the task. For large-scale scanning tasks, it prioritizes the use of encryption algorithm combinations with lower computational overhead and standard key lengths.

[0073] Task instructions and parameters are encrypted using the selected system encryption method and then sent to the next-level node through a secure channel.

[0074] Upon receiving the task instructions, the target downstream node's proxy service first strips away the outermost HTTPS encryption, then uses its own SM2 private key to decrypt the SM4 session key, and finally uses this SM4 key to decrypt the plaintext task instructions and parameters. After parsing the parameters, the proxy service creates a vulnerability scanning task instance locally and calls the local scanning engine to begin execution. Since all scanning and probing traffic originates and terminates within the branch office's internal network, the headquarters' upstream node does not need to consume any computing resources to process scan packets, nor does it need to provide significant bandwidth to transmit the original traffic back and forth, thus reducing the burden on the central node.

[0075] During task execution, the monitoring module of the lower-level node continuously collects the task's execution status, including completion progress, resource usage, and exception logs;

[0076] Progress and resource usage data are synchronized using lightweight encryption;

[0077] Error logs and security event-related data are synchronized using high-strength encryption;

[0078] After receiving the data, the higher-level node decrypts and displays it in real time, while dynamically adjusting the subsequent task scheduling strategy and encrypted resource allocation based on the decrypted status data.

[0079] This status data is periodically packaged and immediately sent back to the parent node through a triple encryption process that is the reverse of the distribution process. Upon receiving the data, the parent node decrypts it layer by layer and renders the resulting status data in real-time on the task monitoring interface of the administrator console. This allows administrators to obtain real-time details of task execution from remote nodes, just as if they were on their local machine. If a lower-level node detects a security vulnerability or asset anomaly during task execution, it immediately generates a security event alarm, interrupting the regular status synchronization process. This alarm is processed with the highest priority, and based on its severity level, the corresponding encryption strength and transmission priority are selected before it is encrypted and uploaded to the parent node via a secure channel.

[0080] After receiving an alarm, the superior node will choose to issue a handling instruction automatically or after manual confirmation by the administrator, depending on the current encryption load of the system. The handling instructions include isolating assets, fixing vulnerabilities, or updating policies, and the encryption level of the handling instructions will match the alarm level.

[0081] The lower-level node receives and executes this disposal instruction, completes the isolation of the threatened assets within the local network, and sends back the disposal result status. The entire process can be completed in a short time and is carried out under a triple encryption mechanism, effectively avoiding secondary threats that may be caused by data leakage or instruction tampering.

[0082] In one extended application scenario of this application, the upper-level node, acting as the core control center, needs to simultaneously manage and securely collaborate with dozens of lower-level nodes distributed across different regions and operating in diverse network environments. The upper-level node first generates a batch of unique, one-time-use keys. These keys are valid only for the single network setup process and expire immediately upon completion. After being distributed securely, each lower-level node sequentially uses its key to initiate an access request, and the upper-level node records the usage of each key, including the usage time, the node using the key, and the operator, forming an audit log for security traceability. After verifying the key's validity, the upper-level node assigns a virtual IP address and generates a unique identity fingerprint for each node. In other words, the upper-level node can simultaneously establish secure communication channels with multiple lower-level nodes, and these lower-level nodes are isolated from each other.

[0083] A higher-level node can simultaneously issue batch tasks to multiple lower-level nodes and aggregate the task data returned by each node to generate a comprehensive report. Administrators can select multiple lower-level nodes on the management interface to issue batch tasks at once. Task instructions are distributed to all selected nodes simultaneously and in encryption via a secure channel. Each node executes tasks in parallel locally, with data and operations isolated from each other, effectively preventing the risk of lateral movement or unauthorized access. Data generated during task execution is transmitted back in real time via an encrypted channel, and the higher-level node automatically aggregates, correlates, and analyzes this dispersed data.

[0084] In addition, the abnormal node can be selected directly from the node list in the management interface of the parent node to initiate a VPN-free remote control request. The request is transmitted to the target node in an encrypted manner through a secure channel. After verifying the legitimacy of the request, the target node establishes an encrypted remote session. The administrator can then perform configuration checks, log analysis, and other operations directly on the system of this node, just as if operating a local machine. All interactive commands and displayed data are transmitted through a high-strength encrypted channel, ensuring the security of the remote maintenance process. After the session ends, the system automatically destroys all temporary authentication credentials generated during the session, leaving no security risks and eliminating subsequent risks caused by credential residue.

[0085] Obviously, the embodiments described above are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0086] It should be understood that when the terms "first," "second," etc., are used in the claims, description, and drawings of this application, they are only used to distinguish different objects and not to describe a specific order. The terms "comprising" and "including" used in the description and claims of this application indicate the presence of the described features, integrals, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or collections thereof.

Claims

1. A bidirectional data secure transmission method for an architecture of hierarchical task collaboration, characterized in that, Includes the following steps: The parent node generates a one-time key and distributes it to the child nodes; The lower-level node uses the one-time key to initiate a network access request to the upper-level node; After verifying the one-time key, the upper-level node assigns a virtual IP to the lower-level node and generates an identity fingerprint to complete the network formation and establish an independent and secure communication channel with the lower-level node; The upper-level node sends task instructions to the lower-level node through the secure communication channel; the lower-level node receives and executes the task instructions, and during the execution process, it synchronizes the task data to the upper-level node in real time through the secure communication channel. The synchronization transmission process of the task data adopts triple encryption: system encryption, HTTPS certificate encryption and secure channel encryption. In addition, the algorithm selection and key length of system encryption and secure channel encryption are configured differently to adapt to the resource constraints in the collaborative architecture, depending on the different sensitivity and real-time requirements of the task instructions and status data. The parent node receives and processes the synchronized task data; In this process, the upper-level node and the lower-level node continuously verify the identity fingerprint through a heartbeat mechanism to maintain a trusted connection of the secure communication channel. The message sending frequency and verification code generation complexity of the heartbeat mechanism are adjusted in coordination based on the current encryption load of the secure channel and the transmission status of the task data. After the upper-level node establishes the independent secure communication channel with the lower-level node, the upper-level node dynamically determines the message sending frequency based on the current encrypted load and task data transmission status of the secure channel, and sends a heartbeat request message to the lower-level node, which contains a dynamic verification code generated based on the identity fingerprint. After receiving the heartbeat request message, the lower-level node uses the locally stored identity fingerprint to generate a response verification code using the same algorithm and replies to the upper-level node. The upper-level node compares the received response check code with the expected value. If they match, the lower-level node is deemed trustworthy. If they do not match multiple times or fail to respond within a timeout period, the node is deemed abnormal and automatically isolated from the secure communication channel. The complexity of the verification code generation algorithm is adjusted according to the transmission traffic of the task data. During the transmission idle period, a complex hash operation with more iterations is used to improve security, while a lightweight hash operation is used during the transmission peak period to reduce computational overhead. When the upper-level node generates the identity fingerprint for the lower-level node, the upper-level node verifies the one-time key, and then extracts the device feature information of the lower-level node, including MAC address, hardware serial number and certificate identifier, and uses the SM3 hash algorithm to generate a hash value as the initial identity fingerprint; Subsequently, during each heartbeat verification, based on the synchronization status of the current task data and the encrypted payload of the secure channel, the identity fingerprint of the previously successfully verified identity is selectively combined with the current timestamp and hashed again to generate a dynamically changing identity fingerprint for subsequent heartbeat verifications. When the task data synchronization is in a state of continuous encrypted transmission, the re-hashing operation adopts a simplified round to maintain communication efficiency; When task data synchronization is intermittent or the channel is idle, standard round-robin hashing is used to enhance identity verification strength. The method also supports a multi-level network architecture, in which an upper-level node can establish secure communication channels with multiple lower-level nodes simultaneously, and each lower-level node is isolated from the others. The upper-level node can simultaneously issue batch tasks to multiple lower-level nodes and aggregate the task data returned by each node to generate a comprehensive report.

2. The bidirectional data secure transmission method as described in claim 1, characterized in that, When the triple encryption is used in the synchronous transmission process of the task data, for the status data transmitted in batches, the system encryption uses the simplified operation mode and standard length key in the national cryptographic SM4 algorithm for encryption. For critical task instructions and security alerts, the full operation mode of the SM4 algorithm and the incrementing key are used for encryption; The encryption key is dynamically generated by the upper-level node when the task is issued and distributed to the lower-level nodes through a secure channel; The HTTPS certificate encryption uses two-way certificate authentication based on the Chinese national cryptographic algorithm SM2; The temporary session key and its negotiation frequency used for encryption of the secure channel are dynamically adjusted according to the real-time requirements of the current collaborative task and network conditions.

3. The bidirectional data secure transmission method as described in claim 1, characterized in that, When the upper-level node issues a task instruction, it estimates the resource consumption based on the scanning range and execution time in the configured task parameters, and dynamically selects the encryption algorithm and key length for the task. For large-scale scanning tasks, it prioritizes the use of encryption algorithm combinations with lower computational overhead and standard key lengths. The task instructions and task parameters are encrypted using the selected system encryption method and then sent to the lower-level node through a secure channel. After receiving the instruction, the lower-level node parses the parameters and creates a local task instance based on the encryption algorithm combination to start execution.

4. The bidirectional data secure transmission method as described in claim 1, characterized in that, During the execution of tasks by the lower-level nodes, the real-time collected task status data includes completion progress, resource usage, and exception logs; Progress and resource usage data are synchronized using lightweight encryption; Error logs and security event-related data are synchronized using high-strength encryption; After receiving the data, the higher-level node decrypts and displays it in real time, while dynamically adjusting the subsequent task scheduling strategy and encrypted resource allocation based on the decrypted status data.

5. The bidirectional data secure transmission method as described in claim 1, characterized in that, The method also includes an exception handling procedure: If a lower-level node detects a security vulnerability or asset anomaly during task execution, it should immediately generate a security event alert. Based on the severity level of the alarm, select the corresponding encryption strength and transmission priority, and encrypt and upload it to the upper-level node through a secure channel; After receiving an alarm, the superior node, based on the current system encryption load, chooses to automatically issue a handling instruction or issue a handling instruction after manual confirmation by the administrator. The handling instructions include isolating assets, fixing vulnerabilities, or updating policies, and the encryption level of the handling instructions matches the alarm level.

6. The bidirectional data secure transmission method as described in claim 1, characterized in that, The upper-level node can also remotely log in to the management system of the lower-level node through a secure channel without VPN. The upper-level node selects the target node in the management interface and initiates a remote control request. After the lower-level node verifies the legality of the request, it establishes a remote desktop session. All operation commands and screen data in the session are transmitted using the triple encryption method, and authentication credentials are automatically destroyed after the session ends.

7. The bidirectional data secure transmission method as described in claim 1, characterized in that, The validity period of the one-time key is limited to a single network formation process, and it expires immediately after the network formation is completed. Furthermore, the upstream node will record the usage of each key, including the usage time, the node using it, and the operator, forming an audit log for security traceability.

Images