Data sending method, device and equipment based on deep packet detection and coding

Abstract

The embodiment of the invention discloses a data sending method, device and equipment based on deep packet detection and coding. According to the technical scheme provided by the embodiment of the invention, the to-be-sent data is acquired, the traffic characteristics of the to-be-sent data are extracted based on the deep packet inspection strategy, the to-be-sent data are classified according to the traffic characteristics, and the traffic classification information of the to-be-sent data is obtained; according to the method, the to-be-sent data is subjected to encoding-based encryption processing to obtain the encrypted data, and the encrypted data is sent to the receiving end, so that the receiving end decrypts the encrypted data according to the private key corresponding to the encoding-based encryption processing to obtain the to-be-sent data, and the data security in the data sending process is effectively improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data transmission method, apparatus and device based on deep packet inspection and encoding. Background Technology

[0002] With the rapid development of internet and computer technologies, the requirements for data security are becoming increasingly stringent. Traditional information security systems are facing unprecedented challenges, requiring data to be encrypted before being sent and then decrypted at the receiving end.

[0003] Currently, encryption of important data generally employs asymmetric encryption algorithms (such as RSA and ECC) or deep packet inspection (DPI). However, traditional asymmetric encryption algorithms rely on large integer factorization or discrete logarithms, making them vulnerable to quantum algorithms. Traditional deep packet inspection techniques struggle to analyze encrypted traffic, relying on transport layer security protocols for decryption or metadata identification, resulting in low accuracy and privacy risks, and ultimately, low data security during data transmission. Summary of the Invention

[0004] This application provides a data transmission method, apparatus, and device based on deep packet inspection and encoding to solve the technical problem of low data security during data transmission in related technologies, and can effectively improve data security during data transmission.

[0005] In a first aspect, embodiments of this application provide a data transmission method based on deep packet inspection and encoding, comprising: Acquire the data to be sent, and extract the traffic characteristics of the data to be sent based on the deep packet inspection strategy; The data to be sent is classified according to the traffic characteristics to obtain the traffic classification information of the data to be sent; When the traffic classification information is a preset key type, the data to be sent is encrypted using encoding-based encryption to obtain encrypted data. The encrypted data is sent to the receiving end so that the receiving end can decrypt the encrypted data using the private key corresponding to the encoding-based encryption process to obtain the data to be sent.

[0006] In a second aspect, embodiments of this application provide a data transmission apparatus based on deep packet inspection and encoding, including a feature extraction module, a feature analysis module, an encryption processing module, and a data transmission module, wherein: The feature extraction module is used to acquire the data to be sent and extract the traffic features of the data to be sent based on the deep packet inspection strategy. The feature analysis module is configured to classify the to-be-sent data according to the traffic features, to obtain traffic classification information of the to-be-sent data. The encryption processing module is configured to, in a case where the traffic classification information is a preset key type, perform encoding-based encryption processing on the to-be-sent data to obtain encrypted data. The data sending module is configured to send the encrypted data to a receiving end, so that the receiving end performs decryption processing on the encrypted data according to a private key corresponding to the encoding-based encryption processing, to obtain the to-be-sent data.

[0007] In a third aspect, an embodiment of the present application provides a data sending device based on deep packet detection and encoding, comprising a memory and one or more processors. The memory is configured to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the data sending method based on deep packet detection and encoding as described in the first aspect.

[0008] In a fourth aspect, an embodiment of the present application provides a storage medium storing computer executable instructions, which, when executed by a computer processor, are used to perform the data sending method based on deep packet detection and encoding as described in the first aspect.

[0009] The embodiments of the present application effectively improve the data security in the data sending process by obtaining to-be-sent data, extracting traffic features of the to-be-sent data based on a deep packet detection strategy, classifying the to-be-sent data according to the traffic features to obtain traffic classification information of the to-be-sent data, performing encoding-based encryption processing on the to-be-sent data to obtain encrypted data in a case where the traffic classification information is a preset key type, and sending the encrypted data to a receiving end so that the receiving end performs decryption processing on the encrypted data according to a private key corresponding to the encoding-based encryption processing to obtain the to-be-sent data. BRIEF DESCRIPTION OF DRAWINGS

[0010] Figure 1 is a flowchart of a data sending method based on deep packet detection and encoding provided by an embodiment of the present application; Figure 2 is a flowchart of another data sending method based on deep packet detection and encoding provided by an embodiment of the present application; Figure 3 is a structural schematic diagram of a data sending device based on deep packet detection and encoding provided by an embodiment of the present application; Figure 4 is a structural schematic diagram of a data sending device based on deep packet detection and encoding provided by an embodiment of the present application. DETAILED DESCRIPTION

[0011] To make the purposes, technical solutions and advantages of the present application clearer, the following further describes specific embodiments of the present application in conjunction with the drawings. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only parts related to the present application are shown in the drawings, but not all. Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the operations (or steps) as sequential processes, many of the operations can be implemented in parallel, concurrently or simultaneously. In addition, the order of the operations can be rearranged. The above processes can be terminated when the operations are completed, but can also have additional steps not included in the drawings. The above processes can correspond to methods, functions, procedures, subroutines, subprograms, etc.

[0012] Figure 1 A flowchart of a data sending method based on deep packet detection and coding provided by an embodiment of the present application is given. The data sending method based on deep packet detection and coding provided by the embodiment of the present application can be executed by a data sending device based on deep packet detection and coding. The data sending device based on deep packet detection and coding can be realized in a hardware and / or software manner and integrated in a data sending device based on deep packet detection and coding.

[0013] The following describes a data sending method based on deep packet detection and coding executed by a data sending device based on deep packet detection and coding. Referring to Figure 1 , the data sending method based on deep packet detection and coding comprises: S110: obtaining to-be-sent data, and extracting traffic features of the to-be-sent data based on a deep packet detection strategy.

[0014] Exemplarily, to-be-sent data to be sent to a receiving end is obtained, and traffic features of the to-be-sent data are extracted based on a deep packet detection strategy. Optionally, the to-be-sent data can be sent to a trained feature extraction model, and the to-be-sent data is analyzed and processed by the feature extraction model to output the traffic features of the to-be-sent data.

[0015] In one embodiment, the traffic features of the data to be sent are extracted based on a deep packet inspection strategy, which can include protocol stack unpacking, multi-level feature matching, and semantic understanding processing. Among them, the protocol stack unpacking can be to peel off the data packet header layer by layer (to peel off the Ethernet frame header, IP header, TCP / UDP header and application layer header in turn), until the original payload (such as HTTP body, DNS query content) is parsed. Multi-level feature matching can be to identify traffic features through regular expressions, behavior modeling (such as packet size / frequency distribution) or machine learning (CNN / LSTM). For example, parsing Host / URL / Cookie in HTTP traffic, extracting SNI (Server Name Indication) or JA3 fingerprint in TLS encrypted traffic, and analyzing query domain name in DNS traffic. Semantic understanding can be to analyze the semantic content of the application layer by using natural language processing technology and large language model (LLM), such as identifying SQL injection statements in HTTP requests.

[0016] Optionally, the application can extract the traffic features of the data to be sent in a hardware accelerated manner. The deep packet inspection system can adopt a five-layer (including a hardware acceleration layer, a protocol parsing layer, an application identification layer, a policy execution layer and a management control layer) pipeline architecture to achieve high-speed processing capability. Among them, the hardware acceleration layer can use FPGA / NP chips to quickly unpack (MAC / IPv4 / IPv6 header stripping), and the traffic distribution engine can distribute the traffic to multi-core CPUs based on 5-tuple hash. The protocol parsing layer can support a protocol identification library (identify multiple communication protocols such as SIP / RDP / QUIC) and a TLS proxy (decrypt HTTPS, support TLS session multiplexing). The application identification layer can include a feature code engine (AC automaton matching multiple rules), a behavior analysis model (LSTM time series classification), and metadata extraction (URL / domain name / file hash). The policy execution layer can be used for traffic control (QoS rate limiting / blocking), threat detection (IDS linkage), and data recording (NetFlow / IPFIX log generation). The management control layer can be used to provide a policy configuration station and a visualization engine (such as a Kibana dashboard). The traffic feature extraction method of deep packet inspection can include TLS decryption (decrypting HTTPS traffic by pre-installing CA certificates (requiring a man-in-the-middle proxy), checking the plaintext content), certificate fingerprint analysis (matching JA3 / JA3S fingerprints to identify malware), TLS metadata analysis (extracting SNI, ALPN, certificate validity period, etc. Metadata, identify malicious traffic through anomaly detection), and file restoration (reconstructing transmission files (such as PDF / EXE), sending to sandbox to detect malicious code), to achieve fine-grained traffic management and control.

[0017] In an embodiment, the traffic features of the to-be-sent data provided by the present application can be a combination of one or more of protocol types, transport layer security protocol metadata, packet length sequences, time intervals, and application layer semantic features. Accordingly, extracting the traffic features of the to-be-sent data based on the deep packet inspection strategy can be extracting a combination of one or more of the protocol types, the transport layer security protocol metadata, the packet length sequences, the time intervals, and the application layer semantic features of the to-be-sent data based on the deep packet inspection strategy. The combination of the multi-dimensional traffic features extracted by the deep packet inspection can effectively improve the comprehensiveness and accuracy of traffic identification, enhance the reliability of traffic classification, adapt to diversified network scenarios, and provide accurate basis for subsequent traffic classification and encryption strategy selection, while ensuring identification accuracy, taking into account scenario adaptability and security.

[0018] S120: classifying the to-be-sent data according to the traffic features to obtain traffic classification information of the to-be-sent data.

[0019] Illustratively, after extracting the traffic features of the to-be-sent data, the to-be-sent data is classified according to the traffic features to obtain the traffic classification information of the to-be-sent data. Alternatively, the to-be-sent data can be classified by using a trained neural network to obtain the traffic classification information of the to-be-sent data.

[0020] Alternatively, the traffic classification information provided by the present application corresponds to a traffic type including a preset key type and a non-pre-set key type. The preset key type can be understood as a traffic type that needs to be encrypted based on coding (quantum encryption), and the non-pre-set key type can be understood as a traffic type that does not need to be encrypted based on coding (quantum encryption). When the traffic classification information is a non-pre-set key type, the data can be encrypted using a traditional quantum encryption method, or a traditional encryption method, or not encrypted at all, and the to-be-sent data can be sent in a clear text transmission manner. For example, for data with the highest security level, an encryption scheme based on coding can be used; for medium security requirements, a traditional encryption scheme can be used; and for ordinary data, a transparent transmission scheme can be selected. The encryption method used for different non-pre-set key types can be preset in advance. When it is determined to use data encryption based on coding (quantum encryption), the process jumps to step S130 for data encryption based on coding.

[0021] In one possible embodiment, the data sending method based on deep packet inspection and coding provided by the present application classifies the to-be-sent data according to the traffic features to obtain the traffic classification information of the to-be-sent data, which can be: sending the traffic features to a trained machine learning classification model, analyzing and processing the traffic features by the machine learning classification model, and obtaining the traffic classification information of the to-be-sent data.

[0022] The machine learning classification model provided in the application includes a long short-term memory network (LSTM) for analyzing time sequence features of traffic features, and a graph neural network (GNN) for analyzing network topology correlation features of the traffic features. The long short-term memory network receives the traffic features and outputs a time sequence feature vector, and the graph neural network receives the traffic features and outputs a topology feature vector. The time sequence feature vector and the topology feature vector form a space-time joint feature vector through a fusion mode such as splicing and weighted summation, and the space-time joint feature vector is input into a classifier (such as a full connection layer) to output traffic classification information of a traffic type.

[0023] The long short-term memory network can focus on the time dimension of the traffic features, capture the dynamic change rule of the data packet on the time axis through a memory unit, for example, a sequence of sending / receiving time intervals of the data packet (for example, periodic change from dense sending to sparse sending), time sequence fluctuation of the data packet length (for example, length distribution mode of a certain type of service flow “small first and large later”), and time sequence logic of session establishment / termination (for example, phase features of TCP three-way handshake and QUIC connection establishment). The graph neural network can focus on the spatial topology dimension of the traffic features, regard devices (such as terminals and routers) in the network as nodes and data flow directions as edges, capture the correlation between the nodes through graph structure learning, for example, connection density of nodes involved in a certain traffic (for example, whether the traffic frequently communicates with multiple strangers), path features of the traffic in the network topology (for example, whether the traffic passes through an abnormal transit node), and matching degree of the role attribute of the node and the traffic (for example, whether a server node suddenly initiates a large number of connections as a client). The long short-term memory network and the graph neural network analyze the traffic features from two orthogonal dimensions of time evolution and space correlation respectively, jointly cover multi-dimensional attributes of the traffic, and enable the machine learning classification model to adapt to more complex network environments and improve traffic classification accuracy.

[0024] In a case where the traffic classification information is a preset key type, the method further includes: performing encoding-based encryption processing on the to-be-sent data to obtain encrypted data.

[0025] For example, in a case where the traffic classification information is a preset key type, the to-be-sent data is subjected to encoding-based encryption processing to obtain encrypted data. A coding-based cryptographic system uses the decoding difficulty of an error correction code to construct an encryption algorithm, has a natural advantage of resisting quantum attacks, and a deep packet inspection technology realizes fine management of traffic by deeply analyzing the content of a network data packet. The combination of the two can realize safe distribution and effective control of key information in a quantum computing environment, and effectively improve data transmission security. Optionally, a data sending device based on deep packet inspection and coding can integrate a quantum key distribution (QKD) module, negotiate with a quantum key distribution device through a quantum link, and obtain the current quantum key quantity and the quantum key coding rate.

[0026] The encoding-based encryption processing selects a random decodable linear code (such as a Goppa code), a random invertible matrix, and a permutation matrix, and generates a public key through the product of the three matrices. The encryption process encodes the plaintext (that is, the data to be sent) into a codeword and adds a random error vector, so that only a party that holds the private key (including the decoding algorithm) can correctly decode. The decryption process corrects the error vector by using the decoding algorithm in the private key to restore the original plaintext. The ability of this encryption scheme to resist quantum attacks is derived from its mathematical foundation based on coding theory, rather than based on large integer factorization or discrete logarithm problems, so that the encoding-based encryption processing has good anti-quantum characteristics and improves the security of data transmission.

[0027] In an embodiment, because the encoding-based encryption algorithm has high computational complexity, and the deep packet inspection technology also needs to process a large amount of network traffic, the application can use hardware acceleration to achieve high-performance data processing. For data encryption and decryption acceleration, a hardware acceleration engine can be used to process the encoding-based encryption operation. For traffic processing acceleration, a data plane development kit can be used to implement a user-mode network card driver, and kernel bypass technology can be used to reduce protocol parsing delay. For pattern matching acceleration, an FPGA regular engine can be used to parallelly match multiple feature rules to achieve higher throughput.

[0028] S140: Send the encrypted data to the receiving end, so that the receiving end decrypts the encrypted data according to a private key corresponding to the encoding-based encryption processing to obtain the data to be sent.

[0029] For example, after the encoding-based encryption processing of the data to be sent obtains the encrypted data, the encrypted data is sent to the receiving end. After receiving the encrypted data, the encrypted data is decrypted according to a private key corresponding to the public key of the encoding-based encryption processing to obtain the data to be sent.

[0030] As described above, by obtaining the data to be sent, extracting the traffic features of the data to be sent based on the deep packet inspection strategy, classifying the data to be sent according to the traffic features to obtain the traffic classification information of the data to be sent, when the traffic classification information is a preset key type, performing the encoding-based encryption processing on the data to be sent to obtain the encrypted data, and sending the encrypted data to the receiving end, so that the receiving end decrypts the encrypted data according to a private key corresponding to the encoding-based encryption processing to obtain the data to be sent, the data security in the data sending process is effectively improved.

[0031] On the basis of the above embodiment, Figure 2 A flowchart of another data sending method based on deep packet inspection and coding provided by an embodiment of the application is given, which is a specific embodiment of the above data sending method based on deep packet inspection and coding. For details, refer to Figure 2The data sending method based on deep packet detection and coding includes: S210: obtaining the to-be-sent data, and extracting the traffic features of the to-be-sent data based on a deep packet detection strategy.

[0032] S220: classifying the to-be-sent data according to the traffic features to obtain traffic classification information of the to-be-sent data.

[0033] S230: in the case where the traffic classification information is a preset key type, performing encryption processing on the to-be-sent data according to a quasi-cyclic moderate density parity-check code encryption algorithm to obtain encrypted data.

[0034] In an embodiment, the quasi-cyclic moderate density parity-check code encryption algorithm is used as the encryption algorithm based on coding. Accordingly, when the traffic classification information of the to-be-sent data is determined and the traffic classification information is the preset key type, the to-be-sent data can be encrypted according to the quasi-cyclic moderate density parity-check code encryption algorithm to obtain the encrypted data. The quasi-cyclic moderate density parity-check code encryption algorithm uses a more efficient code type (for example, Quasi-Cyclic Moderate Density Parity-Check, QC-MDPC code) and compression technology for data encryption, which can effectively reduce the size of the key (the size of a common key usually reaches hundreds of KB or even MB level, and the quasi-cyclic moderate density parity-check code encryption algorithm can reduce the size of the key by more than 70%) and reduce the storage space occupied by the key.

[0035] In an embodiment, the data sending method based on deep packet detection and coding provided by the present application further includes, before obtaining the to-be-sent data: obtaining a generator matrix, an invertible matrix, and a permutation matrix of a quasi-cyclic moderate density parity-check code, and generating a public key and a private key according to the generator matrix, the invertible matrix, and the permutation matrix. The private key can be provided to the receiving end.

[0036] Accordingly, the encrypted data obtained by encrypting the to-be-sent data according to the quasi-cyclic moderate density parity-check code encryption algorithm includes: encrypting the to-be-sent data based on the following encryption formula of coding:

[0037]

[0038] wherein, is the encrypted data, is the to-be-sent data, is a preset error vector, is the public key, is the invertible matrix, is the generator matrix, is the permutation matrix, and the corresponding private key is , the receiving end can correct the error vector in the encrypted data using the private key to recover the original data to be sent (using S 、 G 、 P correcting errors e recovery m ). By using the quasi-cyclic structure of the quasi-cyclic low-density parity-check code to generate the generator matrix, the invertible matrix and the permutation matrix, and generating smaller size public key and private key accordingly, the key storage overhead is reduced, effectively solving the deployment bottleneck problem of traditional encoding encryption scheme in resource-constrained scenarios such as Internet of Things terminals and edge devices, while effectively reducing the network bandwidth consumption of key transmission, and adapting to high-speed network environment.

[0039] In one possible embodiment, the deep packet inspection and encoding-based data sending method provided by the present application further comprises determining a risk score of the data to be sent according to the traffic features after extracting the traffic features of the data to be sent based on the deep packet inspection strategy. The risk score can be used to reflect the security risk of the data to be sent. The higher the risk score, the stronger the data stream security requirement, and a higher security level encryption method (such as quantum-resistant encryption based on encoding) needs to be used first. The lower the risk score, the lower the security requirement, and traditional encryption or plaintext transmission can be used to balance security and system efficiency.

[0040] Optionally, the risk score of the data to be sent according to the traffic features can be a confidentiality risk score, an integrity risk score and an availability risk score of the data to be sent, and the confidentiality risk score, the integrity risk score and the availability risk score are processed by weighted summation to obtain the risk score of the data to be sent. The confidentiality risk score can be used to measure the risk degree of "confidentiality being destroyed" of the data stream, that is, the possibility of sensitive information exposure due to data leakage. The integrity risk score can be used to measure the risk degree of "integrity being destroyed" of the data stream, that is, the possibility of unauthorized tampering of data in the transmission or storage process. The availability risk score can be used to measure the risk degree of "availability being destroyed" of the data stream, that is, the possibility of authorized subject being unable to normally access or use the data due to network interruption, device failure, malicious attack, etc. Optionally, the confidentiality risk score, the integrity risk score and the availability risk score can be obtained by analyzing and processing the traffic features through a risk score model trained.

[0041] Optionally, the risk score of the data to be sent can be determined by the following formula:

[0042] wherein, is the confidentiality weight, is the integrity weight, is the availability weight, is the confidentiality risk score, For completeness risk score, For availability risk score. The application obtains the risk score of the to-be-sent data by weighted sum processing of the confidentiality risk score, the completeness risk score and the availability risk score, realizes differentiated encryption management and control of different security level service flows, preferentially allocates quantum encryption resources to high-sensitive data, and transmits medium and low-sensitive data by using traditional encryption or plaintext transmission, reduces overall system calculation and communication overhead, and balances security protection and resource utilization efficiency.

[0043] Correspondingly, the application provides a data sending method based on deep packet detection and coding. When the traffic classification information is of a preset key type, the to-be-sent data is subjected to coding-based encryption processing to obtain encrypted data. The encrypted data can be obtained by coding-based encryption processing of the to-be-sent data when the traffic classification information is of a preset key type and the risk score reaches a preset risk threshold.

[0044] The application triggers coding-based encryption through the dual conditions of traffic type and risk score, solves the problems of insufficient protection of high-risk key data and excessive encryption of low-risk key data caused by traditional type-based encryption, refines the security requirement differences of preset key type data through risk score, accurately locks the real high-risk key data in combination with a preset threshold, avoids invalid encryption of low-risk key data, and significantly reduces the consumption of computing resources and network bandwidth. While ensuring the anti-quantum security of high-risk key information, the application realizes dynamic balance between security protection and system efficiency.

[0045] It needs to be explained that the security of the coding-based encryption algorithm depends on the decoding problem of general linear codes (NP difficult problem), and even quantum computers cannot effectively solve this problem, so it has anti-quantum characteristics. Assuming that an attacker attempts to break the ciphertext , he needs to solve the following problem:

[0046] This problem is equivalent to decoding a random linear code, which is known to be an NP difficult problem.

[0047] Demonstration of performance optimization: the key size is reduced from MB level to hundred KB level by QC-MDPC code, the transmission efficiency is improved, the encryption speed is fast, which is suitable for real-time communication, and the decryption slow problem is relieved by hardware acceleration. Assuming that the decryption delay is , after using hardware acceleration:

[0048] wherein the acceleration ratio k =3~5. The overall system throughput improvement can be estimated by Amdahl's law:

[0049] in, p This represents the proportion of the parts that can be parallelized. k For acceleration ratio.

[0050] For the argument on resistance to quantum attacks based on NP-hard problems, the QC-MDPC code encryption scheme adopted in this paper has its security reduced to the following two classical computational complexity problems: 1. The General Decoding Problem (GDP) of linear codes, example: a binary linear code. C From the generating matrix ( ) is defined as a target vector ( ), and an integer ( w >0). Question: Does an error vector exist? ) makes ( )(in wt (indicating Hamming weight) and ( )? 2. Coset Weight Problem (CWP): Given... G and C Find (min wt(cnG)), where This problem is equivalent to GDP. GDP is NP-hard, and NP-hardness is an effective way to address the threat of quantum algorithms.

[0051] The feasibility of achieving this through parameter optimization is demonstrated to prove that using QC-MDPC codes and hardware acceleration can solve the core defects of the original McEliece scheme, namely excessive key size and slow decryption, making it suitable for high-speed network DPI environments. Original McEliece: uses Goppa codes; the public key is a random matrix, requiring ( 80-bit storage. For 80-bit security, typical parameters are (( n, k, t The public key size is approximately (1751 × 2048 / 8 ≈ 448) KB, with a value of (2048, 1751, 27). The QC-MDPC code used in this application generates a matrix with a quasi-cyclic structure. ,in It is the identity matrix, and Q is a matrix composed of (r×r) cyclic matrix blocks (n=2r, k=r). The entire matrix Q can be formed by the vector in the first row ( q The public key is uniquely determined. Therefore, the public key does not need to store the entire (k×n) matrix, but only the short seed ( q That's it. At this point, the storage space will be... Reduce to For the same security level, the public key of QC-MDPC code can be reduced to about 0.5 KB to 10 KB.

[0052] For decryption speed optimization argument (Amdahl's law), the encryption and decryption process based on coding (decoding) has high computational complexity, which is the performance bottleneck. The application uses hardware acceleration (such as Intel QAT acceleration card) to offload and decrypt. Mathematical modeling uses Amdahl's law: Amdahl's law defines the overall speedup that can be obtained after optimizing a part of the system:

[0053] The overall speedup of the entire task, p The proportion of execution time of the part that can be optimized (i.e. decryption operation), s The speedup of the part that can be optimized itself (through hardware acceleration). Assuming that without hardware acceleration, decryption time accounts for 40% of the entire data packet processing flow time (i.e. p =40%), after using dedicated hardware (such as QAT card), the decryption operation itself speed is improved ( s =4) times. Substituting into the formula:

[0054] This means that the overall processing throughput is improved by 1.43 times. If we combine DPDK, eBPF, etc. technology to speed up other links (i.e. other ( )) by 10 times, the overall performance will be greatly improved, thus demonstrating the significant progress in meeting the high-speed processing requirements.

[0055] For intelligent strategy effectiveness argument, to prove that after deep packet detection classification, dynamically selecting encryption strategy is better than full encryption or full non-encryption strategy in information security and efficiency. Define the security requirement entropy ( ) for different business flows, the higher the security requirement entropy, the more sensitive the data, the higher the protection level required.

[0056]

[0057] Where, represents different security attributes (such as confidentiality risk score, integrity risk score, and availability risk score), is the probability of the attribute being compromised (which can be derived from the policy library and historical threat data). The encryption strategy selection module is essentially a decision function ( F ):

[0058] wherein, and is a threshold preset by a policy library.

[0059] The full encryption policy cost is: wherein is the unit cost of post-quantum encryption, which has a large value.

[0060] The policy cost of the present application is: Since the high-security demand traffic in the network usually only accounts for a small part is much smaller than , therefore is much smaller than . It can be seen that the present application can greatly reduce the overall computing and communication overhead of the system under the premise of almost no loss of high-security data security ) of the data still protected by post-quantum encryption. From the perspective of information theory and resource allocation, it mathematically demonstrates the significant progress of the present application compared to simple and crude solutions. It can be seen that the security of the present application is based on NP-hard problems, which can effectively resist quantum attacks, and the performance is optimized by algorithm (QC-MDPC) and hardware acceleration (Amdahl's law) to achieve efficient data processing. The efficiency is optimized by information theory modeling and intelligent strategy to achieve the optimal balance between security and utility.

[0061] S240: Send the encrypted data to the receiving end, so that the receiving end decrypts the encrypted data according to the private key corresponding to the encoding-based encryption processing to obtain the data to be sent.

[0062] The above, by obtaining the data to be sent, extracting the traffic characteristics of the data to be sent based on the deep packet detection strategy, classifying the data to be sent according to the traffic characteristics, obtaining the traffic classification information of the data to be sent, when the traffic classification information is a preset key type, performing encoding-based encryption processing on the data to be sent to obtain encrypted data, sending the encrypted data to the receiving end, so that the receiving end decrypts the encrypted data according to the private key corresponding to the encoding-based encryption processing to obtain the data to be sent, effectively improving the data security in the data sending process. At the same time, using quasi-cyclic medium density parity check code encryption algorithm as the encoding-based encryption algorithm can effectively reduce the size of the key and reduce the occupation of the storage space by the key, which is suitable for quantum secure communication, Internet of Things security, operator traffic control, cloud native security, military communication and other scenarios, and has wide engineering application prospects.

[0063] Figure 3 A structure diagram of a data sending device based on deep packet detection and encoding provided by an embodiment of the present application is given. Referring to Figure 3The deep packet inspection and coding-based data sending device comprises a feature extraction module 31, a feature analysis module 32, an encryption processing module 33 and a data sending module 34.

[0064] The feature extraction module 31 is configured to acquire the to-be-sent data and extract traffic features of the to-be-sent data based on a deep packet inspection strategy; the feature analysis module 32 is configured to classify the to-be-sent data according to the traffic features to obtain traffic classification information of the to-be-sent data; the encryption processing module 33 is configured to, when the traffic classification information is a preset key type, perform coding-based encryption processing on the to-be-sent data to obtain encrypted data; and the data sending module 34 is configured to send the encrypted data to a receiving end, so that the receiving end decrypts the encrypted data according to a private key corresponding to the coding-based encryption processing to obtain the to-be-sent data.

[0065] According to the above, the to-be-sent data is acquired, the traffic features of the to-be-sent data are extracted based on a deep packet inspection strategy, the to-be-sent data is classified according to the traffic features to obtain traffic classification information of the to-be-sent data, when the traffic classification information is a preset key type, the to-be-sent data is subjected to coding-based encryption processing to obtain encrypted data, and the encrypted data is sent to a receiving end, so that the receiving end decrypts the encrypted data according to a private key corresponding to the coding-based encryption processing to obtain the to-be-sent data, thereby effectively improving the data security in the data sending process.

[0066] In one possible embodiment, the encryption processing module 33 performs coding-based encryption processing on the to-be-sent data to obtain encrypted data, which comprises: The to-be-sent data is encrypted according to a quasi-cyclic LDPC encryption algorithm to obtain the encrypted data.

[0067] In one possible embodiment, the deep packet inspection and coding-based data sending device further comprises a key management module, which is configured to: acquire a generator matrix, an invertible matrix and a permutation matrix of a quasi-cyclic LDPC code, and generate a public key and a private key according to the generator matrix, the invertible matrix and the permutation matrix; Correspondingly, the encryption processing module 33 performs coding-based encryption processing on the to-be-sent data according to a quasi-cyclic LDPC encryption algorithm to obtain encrypted data, which comprises: The to-be-sent data is encrypted based on the following coding encryption public key:

[0068]

[0069] wherein, is the encrypted data, is the to-be-sent data, for a preset error vector, for a public key, for an invertible matrix, for a generating matrix, for a permutation matrix.

[0070] In one possible embodiment, the feature extraction module 31 extracts the traffic features of the to-be-sent data based on a deep packet inspection strategy, including: extracting one or more combinations of the protocol type, the transport layer security protocol metadata, the packet length sequence, the time interval, and the application layer semantic feature of the to-be-sent data based on the deep packet inspection strategy.

[0071] In one possible embodiment, the feature analysis module 32 classifies the to-be-sent data according to the traffic features to obtain the traffic classification information of the to-be-sent data, including: sending the traffic features to a trained machine learning classification model, analyzing and processing the traffic features by the machine learning classification model to obtain the traffic classification information of the to-be-sent data, the machine learning classification model including a long short-term memory network for analyzing the time sequence features of the traffic features and a graph neural network for analyzing the network topology correlation features of the traffic features. In one possible embodiment, the data sending device based on deep packet inspection and encoding further includes a risk scoring module, which is configured to: determine the risk score of the to-be-sent data according to the traffic features; Correspondingly, the encryption processing module 33 performs encoding-based encryption processing on the to-be-sent data to obtain encrypted data when the traffic classification information is a preset key type, including: performing encoding-based encryption processing on the to-be-sent data to obtain encrypted data when the traffic classification information is a preset key type and the risk score reaches a preset risk threshold.

[0072] In one possible embodiment, the encryption processing module 33 determines the risk score of the to-be-sent data according to the traffic features, including: determining the confidentiality risk score, the integrity risk score, and the availability risk score of the to-be-sent data according to the traffic features, and performing weighted summation processing on the confidentiality risk score, the integrity risk score, and the availability risk score to obtain the risk score of the to-be-sent data.

[0073] It is worth noting that in the above embodiment of the data sending device based on deep packet inspection and encoding, each unit and module included is only divided according to functional logic, but is not limited to the above division, as long as the corresponding functions can be implemented; in addition, the specific names of each functional unit are only for easy distinction, and do not limit the protection scope of the embodiments of the present application.

[0074] The embodiment of the present application further provides a deep packet inspection and coding based data sending device, which can integrate the deep packet inspection and coding based data sending apparatus provided by the embodiment of the present application. Figure 4 Fig. 1 is a structural schematic diagram of a deep packet inspection and coding based data sending device provided by the embodiment of the present application. Referring to Fig. 1, Figure 4 The deep packet inspection and coding based data sending device comprises an input apparatus 43, an output apparatus 44, a memory 42 and one or more processors 41; the memory 42 is used for storing one or more programs; when the one or more programs are executed by the one or more processors 41, the one or more processors 41 implement the deep packet inspection and coding based data sending method provided by the above-mentioned embodiment. The input apparatus 43, the output apparatus 44, the memory 42 and the processor 41 can be connected through a bus or other means, Figure 4 For example, the connection through the bus is taken as an example in the embodiment.

[0075] The memory 42 is a readable storage medium of a computing device, which can be used for storing software programs, computer executable programs and modules, such as program instructions / modules (for example, the feature extraction module 31, the feature analysis module 32, the encryption processing module 33 and the data sending module 34 in the deep packet inspection and coding based data sending apparatus) corresponding to the deep packet inspection and coding based data sending method provided by any embodiment of the present application. The memory 42 can mainly comprise a program storage area and a data storage area, wherein the program storage area can store an operating system and application programs required by at least one function; the data storage area can store data created according to the use of the device, etc. In addition, the memory 42 can comprise a high-speed random access memory, and can also comprise a non-volatile memory, for example, at least one magnetic disk storage device, a flash memory device or other non-volatile solid-state storage device. In some examples, the memory 42 can further comprise a memory remotely arranged relative to the processor 41, which can be connected to the device through a network. Examples of the above-mentioned network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network and a combination thereof.

[0076] The input apparatus 43 can be used for receiving input digital or character information, and generating key signal input related to the user settings and function control of the device. The output apparatus 44 can comprise a display device such as a display screen.

[0077] The processor 41 executes various function applications and data processing of the device by running the software programs, instructions and modules stored in the memory 42, that is, implements the above-mentioned deep packet inspection and coding based data sending method.

[0078] The deep packet inspection and encoding-based data sending device, the deep packet inspection and encoding-based data sending apparatus and the computer provided in the above embodiments can be used to execute the deep packet inspection and encoding-based data sending method provided in any of the above embodiments, and have the corresponding functions and advantages.

[0079] The embodiment of the present application further provides a storage medium storing computer executable instructions, which, when executed by a computer processor, are used to execute the deep packet inspection and encoding-based data sending method provided in the above embodiments, the deep packet inspection and encoding-based data sending method comprising: obtaining to-be-sent data, extracting traffic features of the to-be-sent data based on a deep packet inspection strategy; classifying the to-be-sent data according to the traffic features to obtain traffic classification information of the to-be-sent data; in a case where the traffic classification information is a preset key type, performing encoding-based encryption processing on the to-be-sent data to obtain encrypted data; and sending the encrypted data to a receiving end, so that the receiving end decrypts the encrypted data according to a private key corresponding to the encoding-based encryption processing to obtain the to-be-sent data.

[0080] Storage medium - any of various types of memory devices or storage devices. The term "storage medium" is intended to include an installation medium, e.g., a CD-ROM, floppy disks, or tape device; computer system memory or random access memory such as DRAM, DDR RAM, SRAM, EDO RAM, Rambus RAM, etc.; or a non-volatile memory such as a magnetic medium (e.g., a hard disk drive), optical storage (e.g., a CD-ROM, DVD, Blu-ray Disc, etc.), or flash memory. The storage medium can further include other types of storage medium or combinations thereof. Additionally, the storage medium can be located in a first computer system that executes a program containing the instructions, or the storage medium can be located in a second different computer system that connects to the first computer system over a network such as the Internet. The second computer system can provide program instructions to the first computer system for execution. The term "storage medium" can include two or more storage mediums that can reside in different locations, e.g., in different computer systems that are connected over a network. The storage medium can store a program of instructions that can be executed by one or more processors.

[0081] Of course, the storage medium storing computer executable instructions provided in the embodiment of the present application is not limited to the deep packet inspection and encoding-based data sending method provided in the above, and can also execute the related operations in the deep packet inspection and encoding-based data sending method provided in any of the embodiments of the present application.

[0082] The deep packet inspection and encoding-based data sending apparatus, device and storage medium provided in the above embodiments can execute the deep packet inspection and encoding-based data sending method provided in any of the embodiments of the present application, and technical details not described in the above embodiments can be referred to the deep packet inspection and encoding-based data sending method provided in any of the embodiments of the present application.

[0083] The above are only preferred embodiments of the present application and the technical principles applied. The present application is not limited to the specific embodiments provided herein, and various obvious changes, re-adjustments and replacements that can be made by those skilled in the art will not deviate from the protection scope of the present application. Therefore, although the present application has been described in more detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without deviating from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. A method for data transmission based on deep packet inspection and encoding, characterized in that, The method comprises: obtaining to-be-sent data, extracting traffic features of the to-be-sent data based on a deep packet inspection strategy; classifying the to-be-sent data according to the traffic features to obtain traffic classification information of the to-be-sent data; in a case where the traffic classification information is a preset key type, performing encoding-based encryption processing on the to-be-sent data to obtain encrypted data; sending the encrypted data to a receiving end, so that the receiving end performs decryption processing on the encrypted data according to a private key corresponding to the encoding-based encryption processing to obtain the to-be-sent data.

2. The method of claim 1, wherein, The encoding-based encryption processing on the to-be-sent data to obtain encrypted data comprises: performing encryption processing on the to-be-sent data according to a quasi-cyclic LDPC encryption algorithm to obtain encrypted data.

3. The method of claim 2, wherein the method further comprises: Before the obtaining to-be-sent data, the method further comprises: obtaining a generator matrix, an invertible matrix, and a permutation matrix of a quasi-cyclic LDPC code, and generating a public key and a private key according to the generator matrix, the invertible matrix, and the permutation matrix; correspondingly, the encryption processing on the to-be-sent data according to the quasi-cyclic LDPC encryption algorithm to obtain encrypted data comprises: performing encryption processing on the to-be-sent data based on the following encoding encryption public: wherein, is encrypted data, is data to be transmitted, is a preset error vector, is a public key, is an invertible matrix, is a generation matrix, is a permutation matrix.

4. The method of claim 1, wherein the deep packet inspection and encoding based data transmission method is characterized by, The extracting of the traffic features of the to-be-sent data based on the deep packet inspection strategy comprises: extracting a combination of one or more of a protocol type, transport layer security protocol metadata, a packet length sequence, a time interval, and application layer semantic features of the to-be-sent data based on the deep packet inspection strategy.

5. The method of claim 1, wherein the method further comprises: The classifying of the to-be-sent data according to the traffic features to obtain traffic classification information of the to-be-sent data comprises: sending the traffic features to a trained machine learning classification model, and obtaining traffic classification information of the to-be-sent data by analyzing and processing the traffic features by the machine learning classification model, wherein the machine learning classification model comprises a long short-term memory network for analyzing time sequence features of the traffic features, and a graph neural network for analyzing network topology correlation features of the traffic features.

6. The deep packet inspection and encoding based data transmission method of claim 1, wherein, After the extracting of the traffic features of the to-be-sent data based on the deep packet inspection strategy, the method further comprises: determining a risk score of the to-be-sent data according to the traffic features; correspondingly, the encoding-based encryption processing on the to-be-sent data to obtain encrypted data in a case where the traffic classification information is a preset key type comprises: in a case where the traffic classification information is a preset key type and the risk score reaches a preset risk threshold, performing encoding-based encryption processing on the to-be-sent data to obtain encrypted data.

7. The deep packet inspection and encoding based data transmission method of claim 6, wherein, The determining of the risk score of the to-be-sent data according to the traffic features comprises: determining a confidentiality risk score, an integrity risk score, and an availability risk score of the to-be-sent data according to the traffic features, and performing weighted sum processing on the confidentiality risk score, the integrity risk score, and the availability risk score to obtain the risk score of the to-be-sent data.

8. A data transmitting apparatus based on deep packet inspection and encoding, characterized by, The method comprises a feature extraction module, a feature analysis module, an encryption processing module, and a data sending module. The feature extraction module is configured to acquire to-be-sent data and extract traffic features of the to-be-sent data based on a deep packet inspection strategy. The feature analysis module is configured to classify the to-be-sent data according to the traffic features to obtain traffic classification information of the to-be-sent data. The encryption processing module is configured to, in a case where the traffic classification information is a preset key type, perform encoding-based encryption processing on the to-be-sent data to obtain encrypted data. The data sending module is configured to send the encrypted data to a receiving end, so that the receiving end performs decryption processing on the encrypted data according to a private key corresponding to the encoding-based encryption processing to obtain the to-be-sent data.

9. A data transmitting apparatus based on deep packet inspection and encoding, characterized by, Comprise: a memory and one or more processors; The memory is configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the deep packet inspection and encoding-based data sending method of any one of claims 1-7.

10. A storage medium storing computer-executable instructions, wherein: The computer executable instructions, when executed by a computer processor, are configured to perform the deep packet inspection and encoding-based data sending method of any one of claims 1-7.

Images