Transmission data security system, method and medium adapted to a switch

Abstract

The application discloses a transmission data security system, method and medium suitable for a switch, a chaotic sequence generation module generates a pseudo-random sequence based on coupled Logistic mapping and Henon mapping; a dynamic port mapping module changes the mapping relationship between a physical port and a logical channel in real time according to the chaotic sequence; a chaotic driving encryption module maps the chaotic sequence into encryption parameters, and dynamically switches among three algorithms of AES-256, SM4 and ChaCha20 and three modes of CBC, CTR and GCM; a port hopping synchronization protocol module establishes a master-slave chaotic synchronization mechanism; a threat detection module detects abnormal behaviors such as port scanning and replay attacks; and an adaptive parameter adjustment module dynamically adjusts a hopping period according to a threat level. The application effectively improves the security and attack resistance of switch data transmission.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a data transmission security system, method, and computer-readable storage medium adapted to a switch. Background Technology

[0002] Traditional switch data transmission mainly relies on static port configurations and fixed encryption methods, which are easily cracked by attackers through port scanning, traffic analysis, replay attacks, and other means, leading to the leakage of sensitive data.

[0003] While some data protection schemes based on encryption algorithms exist in the current technology, these schemes typically employ fixed encryption parameters and static communication paths, lacking dynamism and unpredictability. Attackers can gradually grasp the system's communication patterns through long-term analysis, thereby launching targeted attacks. Furthermore, traditional solutions lack effective proactive defense mechanisms against attacks such as port scanning and traffic sniffing, making it difficult to meet the data transmission requirements of high-security scenarios.

[0004] Therefore, how to improve the security, dynamism, and anti-attack capabilities of the transmission process while ensuring the data transmission efficiency of the switch has become an urgent technical problem to be solved. Summary of the Invention

[0005] This invention achieves high-security protection for data transmitted by a switch by constructing a dynamic port switching and multi-layer encryption mechanism based on chaos theory. This effectively resists various network threats such as port scanning, replay attacks, and traffic analysis, thereby improving data transmission security and system anti-attack capabilities.

[0006] To achieve the above objectives, the present invention provides a data transmission security system adapted to a switch, the system comprising: a chaotic sequence generation module, a dynamic port mapping module, a chaotic drive encryption module, a port transition synchronization protocol module, a threat detection module, and an adaptive parameter adjustment module.

[0007] The chaotic sequence generation module is configured in the hardware encryption chip of the switch and is used to generate pseudo-random sequences based on multidimensional chaotic mapping. The multidimensional chaotic mapping adopts a combination model of coupled Logistic mapping and Henon mapping, and generates a sequence of chaotic state variables with high randomness and unpredictability by setting initial values ​​and chaotic parameters.

[0008] The dynamic port mapping module is used to change the mapping relationship between the physical ports of the switch and the logical communication channels in real time according to the chaotic sequence. The mapping relationship is updated according to the jump period determined by the chaotic sequence, so that the physical port position through which the data flows changes dynamically over time.

[0009] The chaos-driven encryption module is used to map chaotic sequences into encryption parameters. The chaos-driven encryption module includes a session key generation unit, an encryption algorithm selection unit, and an encryption mode switching unit. The session key generation unit converts chaotic state variables into session keys through a hash function. The encryption algorithm selection unit dynamically selects from three algorithms—AES-256, SM4, and ChaCha20—based on the value range of the chaotic variables. The encryption mode switching unit switches between three modes—CBC, CTR, and GCM—based on the chaotic variables.

[0010] The port transition synchronization protocol module is used to establish a chaotic synchronization mechanism between the switches of the two communicating parties to ensure that the port transition sequence and encryption parameters of the sending end and the receiving end are consistent. The synchronization protocol adopts a master-slave driven synchronization method. The master switch periodically sends part of the chaotic state information, and the slave switch updates its local chaotic system and calculates the synchronization error after receiving it.

[0011] The threat detection module is used to detect attacks targeting the dynamic port switching mechanism. The threat detection module includes a port scanning detection unit, a replay attack detection unit, and a synchronization disruption detection unit. The port scanning detection unit counts the frequency of access to different ports per unit time. The replay attack detection unit adds a timestamp based on a chaotic sequence to each data packet and verifies its validity. The synchronization disruption detection unit monitors for abnormal entropy values ​​in the port switching sequence.

[0012] The adaptive parameter adjustment module is used to dynamically adjust the transition period according to the network threat level. The threat level is evaluated based on the number of detected attacks, the frequency of abnormal traffic, and the synchronization success rate. When the threat level increases, the transition period is shortened to improve security.

[0013] Based on the same inventive concept, this invention provides a data transmission security method adapted to a switch, applied to the aforementioned system, the method comprising the following steps:

[0014] In step S1, the two communication switches negotiate the initial value and parameters of the chaotic system through a secure channel. The master and slave switches initialize their local chaotic systems respectively, perform preheating iterations to bring the chaotic system into a stable chaotic state, and verify the synchronization state.

[0015] Step S2: At the beginning of each transition cycle, the main switch generates a new port mapping relationship based on the current chaotic state, extracts random numbers from the chaotic sequence to map physical ports to logical channels, calculates the transition cycle, and verifies the validity of the mapping relationship.

[0016] Step S3: When the data packet arrives at the switch to be forwarded, extract the current state of the chaotic sequence, select the encryption algorithm and encryption mode according to the chaotic variables, generate a session key, encrypt the data packet using the selected algorithm, mode and key, and generate a message authentication code.

[0017] Step S4: Determine the physical port for sending data packets based on the current port mapping relationship, embed a transition synchronization identifier in the header of the data packet, send encrypted data packets from the mapped physical port, and perform port mapping switching using a double buffering mechanism when the next transition cycle arrives.

[0018] In step S5, the receiving switch calculates the current port mapping relationship based on the synchronized chaotic system, extracts and verifies the jump synchronization identifier, determines the encryption algorithm and mode based on the synchronized chaotic state and generates a session key, decrypts the data packet and verifies the message authentication code, and forwards the data packet after successful verification.

[0019] Step S6: Continuously monitor port scanning, replay attacks, and synchronous sabotage anomalies, calculate the overall threat level, dynamically adjust the jump cycle and chaos parameters according to the threat level, and trigger the emergency response mechanism when a serious attack is detected.

[0020] Step S7: Monitor the statistical characteristics of the chaotic sequence in real time. When the reinitialization condition is met, generate a new initial value through a hash function and notify the other party to perform reinitialization synchronously.

[0021] Furthermore, the two communicating parties negotiate the initial values ​​and parameters of the chaotic system through a secure channel. The initial values ​​include the initial values ​​of three state variables, and the parameters include chaotic parameters and coupling coefficients.

[0022] The master and slave switches initialize their local chaotic systems respectively. The master switch starts the drive signal sending function, and the slave switch starts the synchronization controller.

[0023] The chaotic system is brought into a stable chaotic state through preheating iterations, and the number of preheating iterations is not less than 100.

[0024] Calculate the synchronization error of the master and slave switches in chaotic state. If the synchronization error is less than the preset threshold, the synchronization is considered successful; otherwise, the initialization is re-executed.

[0025] Furthermore, at the beginning of each transition cycle, the master switch generates a new port mapping relationship based on the current chaotic state.

[0026] Extract random numbers equal to the number of physical ports from the chaotic sequence, and map each physical port to a unique logical channel through a modulo operation.

[0027] Calculate the current transition period, which is equal to the base period plus the time perturbation determined by the chaotic variable. The time perturbation is calculated by multiplying the chaotic variable by the perturbation step size and rounding it down.

[0028] Verify the difference between the new mapping relationship and the current mapping relationship, and ensure that the rate of change between two adjacent mappings is not lower than the minimum rate of change threshold.

[0029] Port mapping information is transmitted to the slave switch via a synchronization mechanism, or the slave switch independently calculates the same mapping relationship through a synchronized chaotic system.

[0030] Furthermore, the chaos-driven encryption includes: when a data packet arrives at the switch to be forwarded, extracting three state variables of the current state of the chaotic sequence;

[0031] The encryption algorithm is selected based on the numerical range of the first state variable. When the variable is in the first range, the AES-256 algorithm is selected; when it is in the second range, the SM4 algorithm is selected; and when it is in the third range, the ChaCha20 algorithm is selected.

[0032] The encryption mode is selected based on the numerical range of the second state variable. When the variable is in the first range, the CBC mode is selected; when it is in the second range, the CTR mode is selected; and when it is in the third range, the GCM mode is selected.

[0033] A 256-bit session key is generated by combining multiple continuous state variables of a chaotic sequence and mapping them using a hash function.

[0034] The data packet is encrypted using the selected encryption algorithm, encryption mode, and session key, and a message authentication code based on the session key is generated and appended to the data packet.

[0035] Furthermore, the port switching execution in step S4 includes:

[0036] Based on the current port mapping, determine which physical port the encrypted data packet should be sent from;

[0037] A jump synchronization identifier is embedded in the header of the data packet. The jump synchronization identifier is generated by a hash function from the current chaotic state variable and the start time of the jump cycle.

[0038] Send the encrypted data packet from the mapped physical port;

[0039] When the time reaches the next transition period, the port mapping is switched. A double buffering mechanism is used to maintain both the old and new mappings during the transition period before the new mapping takes effect, ensuring that no data packets are lost during the switching process.

[0040] Furthermore, the receiving switch calculates the port mapping relationship at the current moment based on the synchronized chaotic system to determine which logical channel the data packet should be received from;

[0041] Extract the jump synchronization identifier from the packet header and verify whether it is consistent with the locally calculated identifier. If they are inconsistent, it is determined that the synchronization has failed or that an attack has occurred. The packet is then discarded and an alarm is triggered.

[0042] The encryption algorithm and encryption mode used by the sender are determined based on the synchronized chaotic state, and the same session key is generated.

[0043] Use the session key to decrypt the data packet and verify the validity of the message authentication code;

[0044] If decryption and verification are successful, the data packet is forwarded to the target port; if they fail, the security event is recorded and the data packet is discarded.

[0045] Furthermore, port scanning behavior is detected, and the frequency of access to different ports within a unit time window is counted. When the frequency exceeds a preset multiple of the normal frequency, a port scanning alarm is triggered.

[0046] To detect replay attacks, the validity of the timestamps generated based on chaotic sequences in the data packets is verified. These timestamps are obtained by XORing the real timestamps with the hash values ​​of the chaotic variables.

[0047] To detect synchronous sabotage attacks, collect port transition sequences within a time window, calculate the Shannon entropy of the sequence, and determine that the randomness of the transition sequence has been compromised when the entropy value is lower than a preset threshold.

[0048] The overall threat level is determined by weighting and summing the number of attacks, the frequency of abnormal traffic, and the synchronization success rate.

[0049] The transition period is dynamically adjusted based on the threat level, and the transition period is shortened by an exponential decay function when the threat level increases.

[0050] When the threat level exceeds the critical value, an emergency response mechanism is triggered, including immediately updating the initial values ​​of the chaotic system, switching to a backup communication channel, and sending an alarm to the security management center.

[0051] Furthermore, the statistical properties of the chaotic sequence are monitored in real time, including the calculation of the Lyapunov exponent and the approximate entropy. The Lyapunov exponent is used to characterize the sensitivity of the chaotic system to initial conditions, and the approximate entropy is used to measure the complexity of the sequence.

[0052] Determine whether the reinitialization conditions are met. The reinitialization conditions include the amount of transmitted data reaching a threshold, the running time reaching a threshold, or the Lyapunov exponent being less than or equal to zero, or the approximate entropy being lower than a threshold.

[0053] When the reinitialization condition is met, a new initial value is generated using the current chaotic state variable and the reinitialization counter through a hash function.

[0054] The reinitialization event is notified to the communicating party through a secure channel, ensuring that both parties perform reinitialization synchronously and update the local chaotic system state.

[0055] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor of a switch, implements the method of the present invention.

[0056] Compared with the prior art, the beneficial effects of the present invention are:

[0057] This invention employs a chaotic sequence-driven dynamic port mapping mechanism, making data transmission paths highly random and unpredictable, effectively preventing attackers from obtaining communication information through port scanning and traffic analysis. By dynamically selecting encryption algorithms and modes using chaotic variables, it achieves multi-layered and diversified encryption protection, significantly increasing the difficulty of password cracking. A master-slave chaotic synchronization protocol ensures that port transitions and encryption parameters remain consistent between communicating parties, guaranteeing data transmission reliability. A threat detection module monitors various attack behaviors in real time, and an adaptive parameter adjustment mechanism dynamically adjusts security strategies for proactive defense. The overall solution significantly improves the security, dynamism, and anti-attack capabilities of switch data transmission without significantly increasing system overhead, making it particularly suitable for high-security scenarios such as the Industrial Internet and intelligent manufacturing. Attached Figure Description

[0058] Figure 1 This is a schematic diagram of a data transmission security system adapted to a switch according to the present invention. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention are described clearly and completely below. Obviously, the described embodiments are only a part of the embodiments of this invention, not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0060] Example 1

[0061] like Figure 1 The diagram shows a data transmission security system adapted to a switch according to the present invention. The system includes: a chaotic sequence generation module, a dynamic port mapping module, a chaotic drive encryption module, a port transition synchronization protocol module, a threat detection module, and an adaptive parameter adjustment module.

[0062] The chaotic sequence generation module is configured in the hardware encryption chip of the switch and is used to generate pseudo-random sequences based on multidimensional chaotic mapping. The multidimensional chaotic mapping adopts a combination model of coupled Logistic mapping and Henon mapping, and generates a sequence of chaotic state variables with high randomness and unpredictability by setting initial values ​​and chaotic parameters.

[0063] The combined model of the coupled Logistic and Henon maps is specifically expressed as follows:

[0064] Let n be the state variable in the nth iteration. , The parameters are chaotic and , Let be the coupling coefficient, with initial value. As a system key.

[0065] Coupling coefficient The preferred value range is Coupling coefficient The preferred range of values Coupling coefficient The preferred value range is initial value The values ​​of must satisfy the condition that none of them are equal to 0 and are located at 0. Within the interval, the preferred initial value is .

[0066] The dynamic port mapping module is used to change the mapping relationship between the physical ports of the switch and the logical communication channels in real time according to the chaotic sequence. The mapping relationship is updated according to the jump period determined by the chaotic sequence, so that the physical port position through which the data flows changes dynamically over time.

[0067] When generating port mapping relationships, the dynamic port mapping module sets the minimum change rate threshold to 30%, meaning that at least 30% of the physical port mapping relationships change in two consecutive port mappings. The generation of port mapping relationships adopts an improved version of the Fisher-Yates shuffling algorithm, using random numbers provided by the chaotic sequence as shuffling seeds. For a switch with 24 physical ports, 24 state variables are continuously extracted from the chaotic sequence, each variable is multiplied by 65536 and rounded to obtain a 16-bit integer, and then mapped to the logical channel number through modulo operation.

[0068] The double buffering mechanism is implemented as follows: The system maintains two port mapping tables, namely the current mapping table and the reserve mapping table; 100 milliseconds before the end of the transition period, the new mapping relationship is calculated and the reserve mapping table is filled, while the current mapping table continues to process data packets; when the transition moment arrives, the pointers of the two mapping tables are switched through atomic operations. Newly arrived data packets immediately use the new mapping table, while data packets that are being processed continue to use the old mapping table until processing is completed; the transition period is set to 200 milliseconds to ensure that all data packets switch smoothly.

[0069] Jump cycle The calculation formula is: ;in, Based on the basic jump cycle Let the time perturbation step size be , This indicates rounding down to the nearest integer. For example, Set to 100 milliseconds, and ΔT to 10 milliseconds. Because... The port changes between 0 and 1, with the transition period dynamically varying between 100 milliseconds and 1100 milliseconds, making it impossible for attackers to predict the timing of the port transition.

[0070] The chaos-driven encryption module is used to map chaotic sequences into encryption parameters. The chaos-driven encryption module includes a session key generation unit, an encryption algorithm selection unit, and an encryption mode switching unit. The session key generation unit converts chaotic state variables into session keys through a hash function. The encryption algorithm selection unit dynamically selects from three algorithms—AES-256, SM4, and ChaCha20—based on the value range of the chaotic variables. The encryption mode switching unit switches between three modes—CBC, CTR, and GCM—based on the chaotic variables.

[0071] Chaotic sequence The key is converted into a 256-bit session key using a hash function and quantization mapping. According to chaotic variables The encryption algorithm is dynamically selected based on the value range. When selecting AES-256, When SM4 is selected, Choose ChaCha20; based on chaotic variables Switch between CBC, CTR, and GCM modes.

[0072] In the chaos-driven encryption module, the keystream generation process is as follows: First, the L consecutive state variables of the chaotic sequence are combined into a matrix. Then, each element of the matrix is ​​quantized, mapping floating-point numbers between 0 and 1 to 8-bit integers between 0 and 255. The quantized matrix is ​​expanded into a one-dimensional sequence, and a 256-bit key is generated using the SHA-256 hash function. Due to the one-way and collision-resistant nature of the hash function, even if an attacker obtains part of the chaotic state, they cannot deduce the complete key.

[0073] The port transition synchronization protocol module is used to establish a chaotic synchronization mechanism between the switches of the two communicating parties to ensure that the port transition sequence and encryption parameters of the sending end and the receiving end are consistent. The synchronization protocol adopts a master-slave driven synchronization method. The master switch periodically sends part of the chaotic state information, and the slave switch updates its local chaotic system and calculates the synchronization error after receiving it.

[0074] Synchronization error The expression is: ;when ( When the synchronization threshold is reached, the system is considered to be in a synchronized state.

[0075] The port transition synchronization protocol module employs a master-slave driven synchronization method, with synchronization error calculated based on the Euclidean distance between the chaotic states of the master and slave switches. When the synchronization error is less than a preset synchronization threshold, the switch is considered synchronized. The master switch periodically sends drive signals containing partial chaotic state information. The slave switch receives the drive signals and updates its local state, gradually converging to a chaotic trajectory consistent with the master switch through multiple iterations.

[0076] In the port transition synchronization protocol module, the synchronization threshold for During the system initialization phase, the number of preheating iterations is set to no less than 100, preferably 150. During the preheating iterations, the Lyapunov exponent of the current state is calculated after each iteration. When the Lyapunov exponent is greater than 0.5 for 30 consecutive iterations, the system is considered to have entered a stable chaotic state. The drive signal transmission period of the main switch is set to 50 milliseconds, and each transmission includes the current chaotic state variables. The first 16 significant digits are received from the switch and then updated to the local status through the synchronization controller. The synchronization controller adopts an error feedback control method, and the control gain coefficient is set to 0.8.

[0077] The threat detection module is used to detect attacks targeting the dynamic port switching mechanism. The threat detection module includes a port scanning detection unit, a replay attack detection unit, and a synchronization disruption detection unit. The port scanning detection unit counts the frequency of access to different ports per unit time. The replay attack detection unit adds a timestamp based on a chaotic sequence to each data packet and verifies its validity. The synchronization disruption detection unit monitors for abnormal entropy values ​​in the port switching sequence.

[0078] In the threat detection module, the judgment condition for port scan detection is: when the frequency of accessing different ports within a unit of time exceeds a preset multiple of the normal frequency, an alarm is triggered. For replay attack detection, the timestamp attached to each data packet is associated with a chaotic state. Because the chaotic state is constantly changing, replayed data packets will be discarded due to timestamp verification failure.

[0079] The adaptive parameter adjustment module is used to dynamically adjust the transition period according to the network threat level. The threat level is evaluated based on the number of detected attacks, the frequency of abnormal traffic, and the synchronization success rate. When the threat level increases, the transition period is shortened to improve security.

[0080] Statistical analysis of the frequency of access to different ports per unit time ,when ( An alarm is triggered when the alarm coefficient is reached; a timestamp based on a chaotic sequence is appended to each data packet. Verify the validity of the timestamp; continuously monitor the entropy value of the port transition sequence. When the entropy value drops abnormally, it is determined that a synchronization interference attack has occurred.

[0081] In the adaptive parameter adjustment module, the threat level assessment is based on a weighted sum of the number of attacks, the frequency of abnormal traffic, and the synchronization success rate. The transition period is dynamically adjusted according to the threat level. When the threat level is high, the transition period is shortened using an exponential decay function, thereby increasing the frequency of port transitions and making it more difficult for attackers to track the port.

[0082] The adaptive parameter adjustment module continuously monitors the statistical characteristics of the chaotic sequence. The Lyapunov exponent is calculated using the Wolf algorithm with a calculation window of 1000 iterations.

[0083] For the coupled chaotic system used in this invention, the maximum Lyapunov exponent in the stable chaotic state should be between 0.5 and 1.5. When the maximum Lyapunov exponent is less than or equal to 0, it indicates that the system has entered a periodic or convergent state and needs to be reinitialized immediately. The approximate entropy is calculated using the ApEn algorithm proposed by Pincus, with the mode length m set to 2 and the similarity tolerance r set to [value missing]. ,in The standard deviation of the sequence is used, and the calculation window is 2000 iterations.

[0084] Under normal circumstances, the approximate entropy should be greater than 1.5, and the approximate entropy threshold is set to 1.2. The specific thresholds for re-initialization are set as follows: the data transmission volume threshold is set to 100GB to ensure that the key system is updated after a large amount of data transmission; the runtime threshold is set to 24 hours to ensure that the system is updated regularly even under low traffic conditions; the Lyapunov exponent threshold is 0, which indicates that the chaotic system is degenerating; the approximate entropy threshold is 1.2, which indicates that the sequence complexity is decreasing. Meeting any of the above conditions triggers the re-initialization process. The re-initialization counter is initially set to 0 and increments by 1 after each re-initialization to ensure that each generated initial value is different. During the re-initialization process, the system enters a brief safe mode, pausing the reception of new data packets. After the re-initialization is complete, normal operation resumes. The entire process takes approximately 500 milliseconds.

[0085] In a specific application example, the switch security system of this invention was deployed in an industrial internet environment. The system configuration is as follows: 24 physical ports, 48 ​​logical channels, a basic transition period of 100 milliseconds, and a time perturbation step of 10 milliseconds. Under normal operation, the port transition period randomly varies between 100 milliseconds and 1100 milliseconds. The encryption algorithm dynamically switches between AES-256, SM4, and ChaCha20, and the encryption mode dynamically switches between CBC, CTR, and GCM. The session key is updated with each transition. The system operates stably, the chaotic synchronization error between the communicating parties remains within a very small range, and the synchronization success rate reaches over 99.9%.

[0086] When the system detects a port scanning attack, the frequency of accessing different ports per unit time increases significantly, exceeding the alarm threshold, and the threat detection module triggers an alarm. After calculating the threat level, the adaptive parameter adjustment module significantly shortens the jump cycle, making it more difficult for attackers to track the data flow. At the same time, the system triggers an emergency response mechanism, immediately updates the initial value of the chaotic system, re-establishes master-slave synchronization, and sends alarm information to the security management center.

[0087] During the system initialization phase, the two communicating switches negotiate the chaotic system parameters through a secure channel. This secure channel is established using the TLS 1.3 protocol and uses RSA-4096 or ECC-P384 for key exchange to ensure the confidentiality and integrity of the initial parameter transmission. The key derivation function KDF uses the PBKDF2 algorithm. The minimum length of the initial key input by the user is required to be 128 bits, and 256 bits is recommended.

[0088] The salt value is generated using a cryptographically secure random number generator (CSPRNG) with a length of 256 bits. It is randomly generated each time it is initialized to ensure uniqueness. The iteration count of PBKDF2 is set to 100,000 times, which strikes a balance between security and computational efficiency and can effectively resist cracking attacks. The key negotiation process uses a variant of Diffie-Hellman key exchange, combined with the initial value of the chaotic system as an additional entropy source.

[0089] The main switch generates random numbers. Generate random numbers from the switch After exchanging keys, both parties calculate the shared key. This shared key is used for the encrypted transmission of subsequent synchronization information. The entire key negotiation process must be completed within 30 seconds of system startup; otherwise, the negotiation is considered a failure, and the system enters a secure waiting state.

[0090] Example 2

[0091] A data transmission security method adapted to a switch, applied to the system of Embodiment 1, the method includes the following steps:

[0092] In step S1, the two communication switches negotiate the initial value and parameters of the chaotic system through a secure channel. The master and slave switches initialize their local chaotic systems respectively, perform preheating iterations to bring the chaotic system into a stable chaotic state, and verify the synchronization state.

[0093] The two communicating parties' switches negotiate the initial values ​​and parameters of the chaotic system through a secure channel. The initial values ​​include the initial values ​​of three state variables. The parameters include chaos parameters and coupling coefficients; the initial key input by the user (at least 128 bits in length) is mapped to the initial value of the chaotic system through the key expansion function KDF, and the calculation formula is as follows:

[0094] ;in, For random salt values, This represents the number of iterations.

[0095] The master and slave switches initialize their local chaotic systems respectively. The master switch starts the drive signal sending function, and the slave switch starts the synchronization controller.

[0096] The system is subjected to preheating iterations to bring it into a stable chaotic state, and the number of preheating iterations is not less than 100.

[0097] Calculate the synchronization error of the master and slave switches in chaotic state. If the synchronization error is less than the preset threshold, the synchronization is considered successful; otherwise, the initialization is re-executed.

[0098] In step S1, the establishment of the secure channel and parameter negotiation have strict timing requirements and verification mechanisms. The master and slave switches establish a TCP connection through a physical connection or an existing management network, using the non-standard port 8883 (to avoid common port scanning), and then initiate the TLS 1.3 handshake process. The TLS handshake uses a pre-deployed digital certificate for mutual authentication. The certificate adopts the X.509 v3 format and is either issued by the enterprise's internal PKI or uses a self-signed certificate. After successful certificate verification, an encrypted secure channel is established. The master switch sends a negotiation message containing the chaotic system configuration through the secure channel.

[0099] The message format is a JSON structure, containing the following fields: initial value Each occupies 64 bits of double-precision floating-point numbers, and the chaos parameter... Each occupies 64 bits, coupling coefficient Each parameter occupies 64 bits, the salt value occupies 256 bits, the KDF iteration count occupies a 32-bit integer, the negotiation timestamp occupies a 64-bit Unix timestamp, and the message authentication code occupies 256 bits. After receiving the negotiation message from the switch, the message authentication code is verified to confirm the validity of the parameters, check whether the parameters are within the specified range, and then an acknowledgment message is sent.

[0100] After parameter negotiation is complete, the master and slave switches initialize their local chaotic systems. The initialization process includes: allocating storage space for chaotic state variables, loading initial values ​​and parameters, initializing the hardware encryption chip (if hardware acceleration is configured), and establishing a chaotic iterative calculation thread. The master switch starts the drive signal sending function, creates a periodic timer with a period set to 50 milliseconds, and sends a drive signal to the slave switch through a secure channel each period.

[0101] The driving signal contains the current chaotic state. The iteration count n, timestamp, and checksum are used to start the synchronization controller from the switch, create a drive signal receiving thread, update the local chaotic system state after receiving the drive signal, and adopt an error feedback control law. , where k is the control gain, set to 0.8.

[0102] During the preheating iteration, the system performs chaotic iteration but does not use it for actual data transmission. After each iteration, the state variables are recorded, and the trajectory characteristics of the most recent 100 iterations are calculated.

[0103] A state of stable chaos is determined to be entered when the following conditions are met:

[0104] (1) The Lyapunov exponent in the last 30 iterations is greater than 0.5;

[0105] (2) State variables The value of traverses the entire interval [0, 1];

[0106] (3) The autocorrelation coefficient of the sequence is less than 0.1 when delayed by more than 10 steps.

[0107] After the preheating iteration is completed, the synchronization error of the master-slave switch in the chaotic state is calculated. The average synchronization error was calculated after 10 samplings. ;when If synchronization is successful, the master switch sends a synchronization confirmation message, and both sides enter normal working state. If synchronization verification fails 5 times consecutively, the initialization process is re-executed, and a security event log is recorded. The typical execution time of the entire step S1 is 5-10 seconds, including approximately 1 second for the TLS handshake, approximately 1 second for parameter negotiation, approximately 3-5 seconds for warm-up iteration, and approximately 1-2 seconds for synchronization verification.

[0108] Step S2: At the beginning of each transition cycle, the main switch generates a new port mapping relationship based on the current chaotic state, extracts random numbers from the chaotic sequence to map physical ports to logical channels, calculates the transition cycle, and verifies the validity of the mapping relationship.

[0109] At the beginning of each transition cycle, the master switch generates a new port mapping relationship based on the current chaotic state;

[0110] Extract random numbers equal to the number of physical ports from the chaotic sequence, and map each physical port to a unique logical channel through modulo operation;

[0111] Calculate the current jump period, which is equal to the base period plus the time perturbation determined by the chaotic variable. The time perturbation is calculated by multiplying the chaotic variable by the perturbation step size and rounding it down.

[0112] Verify the difference between the new mapping relationship and the current mapping relationship, and ensure that the rate of change between two adjacent mappings is not lower than the minimum rate of change threshold;

[0113] Port mapping information is transmitted to the slave switch via a synchronization mechanism, or the slave switch independently calculates the same mapping relationship through a synchronized chaotic system.

[0114] The port mapping relationships are generated using a deterministic random mapping algorithm based on chaotic sequences. Assuming the switch has P physical ports (numbered 0 to P-1) and L logical channels (numbered 0 to L-1), typically... To provide a larger mapping space. First, starting from the current chaotic state, iterate the chaotic system P times consecutively to obtain P sets of state variables ( ,in .

[0115] For the i-th physical port, extract the corresponding chaotic variable. Calculate the target logical channel number for mapping: To ensure one-to-one mapping (each physical port maps to a unique logical channel), a conflict detection and remapping mechanism is employed: A set S of used logical channels is maintained; if... If a conflict occurs, the chaotic system continues to iterate and recalculate until an unused logical path is found.

[0116] The jump period is calculated immediately after the port mapping is generated. The current chaotic variable is extracted. Calculate the time disturbance. Current jump cycle For example, when millisecond, millisecond, At that time, the calculation yielded milliseconds, jump period Milliseconds. After the jump period calculation is completed, the system sets a timer to trigger the next port mapping update after a time interval T_{hop}.

[0117] The validity verification of the mapping relationship includes the following checks: (1) Mapping integrity check, ensuring that all P physical ports are successfully mapped; (2) Mapping uniqueness check, ensuring that no two physical ports are mapped to the same logical channel; (3) Mapping change rate check, calculating the Hamming distance d = \sum_{i=0}^{P-1} [NewMapping_i \neqOldMapping_i] between the new mapping and the current mapping, and the change rate r = \frac{d}{P}, requiring r \geq 0.3, that is, at least 30% of the mapping relationship has changed. If the change rate is insufficient, continue to iterate the chaotic system and regenerate the mapping, trying a maximum of 5 times. If it is still not satisfied, adjust the chaotic parameters and retry. The transmission of mapping information adopts two modes: in the initial synchronization stage or when the synchronization error is large, the master switch explicitly sends the mapping table through the secure channel; under normal working conditions, the slave switch independently calculates the same mapping relationship through the synchronized chaotic system, without transmitting the mapping table, reducing communication overhead. The mapping table is transmitted using incremental encoding, only sending the difference from the previous mapping, compressing the amount of transmitted data.

[0118] Step S3: When the data packet arrives at the switch to be forwarded, extract the current state of the chaotic sequence, select the encryption algorithm and encryption mode according to the chaotic variables, generate a session key, encrypt the data packet using the selected algorithm, mode and key, and generate a message authentication code.

[0119] When a data packet arrives at the switch to be forwarded, extract the three state variables of the current state of the chaotic sequence;

[0120] The encryption algorithm is selected based on the numerical range of the first state variable. When the variable is in the first range, the AES-256 algorithm is selected; when it is in the second range, the SM4 algorithm is selected; and when it is in the third range, the ChaCha20 algorithm is selected.

[0121] The encryption mode is selected based on the numerical range of the second state variable. When the variable is in the first range, the CBC mode is selected; when it is in the second range, the CTR mode is selected; and when it is in the third range, the GCM mode is selected.

[0122] A 256-bit session key is generated by combining multiple continuous state variables of a chaotic sequence and mapping them using a hash function.

[0123] The data packet is encrypted using the selected encryption algorithm, encryption mode, and session key, and a message authentication code based on the session key is generated and appended to the data packet.

[0124] The intervals for encryption algorithm selection and encryption mode switching are divided into three equal parts; for encryption algorithm selection, when... When selecting AES-256, When SM4 is selected, Choose ChaCha20; based on chaotic variables Switch between CBC, CTR, and GCM modes.

[0125] The specific implementation of the session key generation unit is as follows: continuously extract 32 chaotic state variables. arrive The sequence consists of 96 floating-point numbers. Each floating-point number is multiplied by 256 and rounded down to obtain an integer between 0 and 255, forming a 96-byte original sequence. This sequence is then subjected to two iterative hash operations using the SHA-256 hash function to obtain the final 256-bit session key. The output of the first hash is used as the input for the second hash, enhancing the key's complexity and collision resistance. The message authentication code is generated using the HMAC-SHA256 algorithm, with the session key as the key. The output length is 256 bits, which is appended to the end of the encrypted data packet. A complete secure data packet is encapsulated in the following format: [Ethernet Header][IP Header][Transport Layer Header][Encrypted Payload][MAC][Jump Synchronization Identifier].

[0126] Step S4: Determine the physical port for sending data packets based on the current port mapping relationship, embed a transition synchronization identifier in the header of the data packet, send encrypted data packets from the mapped physical port, and use a double buffering mechanism to perform port mapping switching when the next transition cycle is reached.

[0127] Based on the current port mapping, determine which physical port the encrypted data packet should be sent from;

[0128] A jump synchronization identifier is embedded in the header of the data packet. The jump synchronization identifier is generated by a hash function from the current chaotic state variable and the start time of the jump cycle.

[0129] Send the encrypted data packet from the mapped physical port;

[0130] When the time reaches the next transition period, the port mapping is switched. A double buffering mechanism is used to maintain both the old and new mappings during the transition period before the new mapping takes effect, ensuring that no data packets are lost during the switching process.

[0131] After the data packet is encrypted and its MAC address is calculated, the current port mapping table is queried. Based on the destination address and routing information of the data packet, the logical channel number C is determined, and then the corresponding physical port number P = Mapping[C] is obtained by searching the mapping table. Since the mapping table is updated at transition times, the query operation needs to be protected by a read lock to ensure that the mapping table is not modified during the reading process.

[0132] The generation of the transition synchronization identifier is crucial to the port transition mechanism. Identifier It consists of three parts: the fingerprint of the current chaotic state, the sequence number of the transition period, and the timestamp. The specific calculation formula is as follows: ,in `SeqNum` is the Unix timestamp (in seconds) at the start of the transition period, and `SeqNum` is the transition sequence number (incrementing from 0). The identifier is 8 bytes long and is embedded in a custom header field of the data packet, located between the IP header and the transport layer header, without affecting the parsing of standard protocols. For scenarios that do not support custom headers, the identifier can be embedded in the IP options field or a reserved field of UDP / TCP.

[0133] The final checks before packet transmission include: verifying the physical port status (Link Up / Down), checking the congestion level of the transmission queue, and confirming that the hardware forwarding table has been updated. The packet is transferred to the network interface card's (NIC) transmit buffer via DMA, where the NIC hardware performs physical and data link layer encapsulation, and finally sends it out from the designated physical port. After transmission is complete, the system updates the transmission statistics counter, recording information such as port traffic, packet count, and timestamps for subsequent threat detection and performance analysis.

[0134] Detailed implementation of the double buffering mechanism: The system maintains two port mapping table structures. and And a pointer CurrentTable pointing to the currently active mapping table. Before the transition cycle ends... Time (set to 100 milliseconds), start the mapping table pre-computation task, call the algorithm in step S2 to calculate the new mapping relationship in the background, and populate it into the standby mapping table (if the current table is...). Then fill (And vice versa). After pre-calculation, the system enters a ready state, waiting for the transition moment to arrive. When the system clock reaches the transition moment... When a transition interrupt is triggered, the interrupt handler performs the following atomic operations:

[0135] (1) Save the old value of the current mapping table pointer;

[0136] (2) Switch the CurrentTable pointer to the alternate mapping table;

[0137] (3) Notify the packet forwarding engine that the mapping table has been updated.

[0138] After the switchover is complete, newly arriving packets immediately use the new mapping table for port lookup, while packets currently being processed continue using the old mapping table via saved old pointers until processing is complete. (Transition period) The transition period is set to 200 milliseconds. During this time, the system maintains the validity of two mapping tables simultaneously. The forwarding engine needs to distinguish the arrival time of data packets to select the correct mapping table. After the transition period ends, the old mapping table can be safely released, completing a full port transition cycle.

[0139] Step S5: The receiving switch calculates the current port mapping relationship based on the synchronized chaotic system, extracts and verifies the jump synchronization identifier, determines the encryption algorithm and mode based on the synchronized chaotic state and generates a session key, decrypts the data packet and verifies the message authentication code, and forwards the data packet after successful verification.

[0140] The receiving switch calculates the port mapping relationship at the current moment based on the synchronous chaotic system to determine which logical channel the data packet should be received from.

[0141] Extract the jump synchronization identifier from the packet header and verify whether it is consistent with the locally calculated identifier. If they are inconsistent, it is determined that the synchronization has failed or that an attack has occurred. The packet is then discarded and an alarm is triggered.

[0142] The encryption algorithm and encryption mode used by the sender are determined based on the synchronized chaotic state, and the same session key is generated.

[0143] Use the session key to decrypt the data packet and verify the validity of the message authentication code;

[0144] If decryption and verification are successful, the data packet is forwarded to the target port; if they fail, the security event is recorded and the data packet is discarded.

[0145] The security processing module first extracts the transition synchronization identifier. This identifier is located at a predefined position in the data packet; simultaneously, the receiver calculates the appropriate jump synchronization identifier for the current moment based on the locally synchronized chaotic system. Identifier verification uses a strict comparison: Validation passed; else validation failed.

[0146] To prevent verification failures caused by clock skew, a tolerance of ±1 transition cycle is allowed. This means the receiver additionally calculates identifiers for the previous and next transition cycles; verification is considered successful if either matches. If 10 consecutive data packet verifications fail, the system determines it to be a serious synchronization failure or under attack, immediately triggering an alarm, sending an emergency notification to the security management center, and initiating the synchronization recovery process. Alarm information includes: failure time, number of consecutive failures, received identifier value, locally calculated identifier value, current chaotic state, synchronization error, etc., facilitating fault diagnosis.

[0147] After the synchronization identifier verification is successful, the timestamp and sequence number information carried by the data packet are extracted to determine which transition period the data packet belongs to, thereby determining the port mapping relationship to be used. Based on the chaotic system of synchronization, the receiver independently calculates the port mapping table for that transition period, looks up the logical channel corresponding to the physical port where the data packet actually arrived, and verifies whether it matches the logical channel declared in the data packet header. This verification step can detect whether the data packet has been tampered with or spoofed.

[0148] Based on the synchronized chaotic state The receiver uses the same logic as the sender to determine the encryption algorithm and encryption mode: Read Choose an algorithm, read Select the mode. Then generate the same session key. It uses the exact same key generation algorithm as the sender (32 consecutive iterations of a chaotic system, quantized to bytes, double SHA-256 hash). After key generation, it calls the decryption function library according to the selected algorithm and mode. The input is the encrypted payload and IV, and the output is the plaintext payload. For GCM mode, the decryption process verifies the authentication tag simultaneously. If the tag does not match, the data packet is rejected directly.

[0149] After decryption, verify the message authentication code. Use the session key. The HMAC-SHA256 algorithm calculates the MAC value for the decrypted data packet (excluding the MAC field itself). , and the MAC value carried in the data packet Comparison. Verification passed; else verification failed. MAC verification failure indicates that the data packet has been tampered with during transmission or that the key does not match. The system records the security event, including: failure time, source IP address, destination IP address, data packet hash value, chaotic state, etc., discards the data packet, and determines whether to trigger an alarm based on the failure frequency.

[0150] If decryption and all verifications are successful, the data packet enters the forwarding phase. The forwarding table is consulted based on the destination address of the data packet to determine the output port, and the plaintext data packet is forwarded from the output port to the target device. After forwarding is complete, the forwarding statistics counter is updated to record performance metrics such as the number of successfully forwarded packets, the number of bytes, and latency. The typical latency of the entire receive verification process is 1-2 milliseconds, with identifier verification approximately 0.1 milliseconds, decryption approximately 0.5-1 milliseconds, MAC verification approximately 0.3 milliseconds, and forwarding approximately 0.1-0.2 milliseconds. The impact on network performance is within an acceptable range.

[0151] Step S6: Continuously monitor port scanning, replay attacks, and synchronous sabotage anomalies, calculate the overall threat level, dynamically adjust the jump cycle and chaos parameters according to the threat level, and trigger the emergency response mechanism when a serious attack is detected.

[0152] Detect port scanning behavior, count the frequency of accessing different ports within a unit time window, and trigger a port scanning alarm when the frequency exceeds a preset multiple of the normal frequency;

[0153] To detect replay attacks, the validity of the timestamps generated based on chaotic sequences in the data packets is verified. These timestamps are obtained by XORing the real timestamps with the hash values ​​of the chaotic variables.

[0154] To detect synchronous sabotage attacks, collect port transition sequences within a time window, calculate the Shannon entropy of the sequence, and determine that the randomness of the transition sequence has been compromised when the entropy value is lower than a preset threshold.

[0155] The overall threat level is determined by weighting and summing the number of attacks, the frequency of abnormal traffic, and the synchronization success rate.

[0156] The transition period is dynamically adjusted based on the threat level, and the transition period is shortened by an exponential decay function when the threat level increases.

[0157] Overall Threat Level The calculation formula is: ,in This represents the number of attacks detected per unit time (normalized to the [0, 1] interval). For abnormal traffic frequency (normalized to the [0, 1] interval), To improve the success rate of synchronization, For weighting coefficients; preferably .

[0158] The attack count normalization method is as follows: ,in This represents the actual number of attacks detected. The normalization upper limit is set to 10 times; the abnormal traffic frequency normalization method is as follows: Where f_{actual} represents the percentage of actual abnormal traffic. The threshold is set to 20%; Threat Level The value range is [0, 1], and the critical value is set to 0.7.

[0159] when When the threat level is low, maintain the basic jump cycle; when When the threat level is medium, the transition period should be appropriately shortened; when When the threat level is high, the transition period is significantly shortened and the emergency response mechanism is triggered; the exponential decay function for adjusting the transition period is: , where k is the attenuation coefficient, preferably 2; under high threat levels, the transition period can be shortened to about 25% of the base period.

[0160] When the threat level exceeds the critical value, an emergency response mechanism is triggered, including immediately updating the initial values ​​of the chaotic system, switching to a backup communication channel, and sending an alarm to the security management center.

[0161] The port scanning detection unit's time window is set to 60 seconds. The frequency of access to different physical ports within this time window is counted, including normal frequencies. Based on historical statistics, the optimal frequency is 5 different ports accessed per second. The alarm coefficient λ is set to 3, meaning that a port scan alarm is triggered when the frequency of accessing different ports per unit time exceeds 3 times the normal frequency (more than 15 different ports accessed per second).

[0162] The replay attack detection unit sets the effective window for the timestamp attached to each data packet to 10 seconds. This means the time difference between the actual timestamp in the data packet and the received time must be less than 10 seconds. Data packets exceeding this window are judged as replay attacks or network latency anomalies and are discarded. The formula for calculating the chaotic timestamp is: ,in For Unix timestamps (in seconds), The first 32 bits of the SHA-256 hash value of the chaotic variable.

[0163] The synchronous destruction detection unit collects port transition sequences within a 300-second time window and calculates the Shannon entropy. ,in For the first The probability of a port appearing, where N is the total number of physical ports; theoretically, the entropy value of a completely random jump sequence should be close to... For a 24-port switch, the theoretical entropy value is approximately 4.585; the entropy threshold is set to 80% of the theoretical entropy value, i.e., 3.668; when the actual entropy value is lower than this threshold, it is determined that the randomness of the transition sequence is disrupted and may be subject to synchronization interference attacks.

[0164] Step S7: Monitor the statistical characteristics of the chaotic sequence in real time. When the reinitialization condition is met, generate a new initial value through a hash function and notify the other party to perform reinitialization synchronously.

[0165] Real-time monitoring of the statistical properties of chaotic sequences, including calculating the Lyapunov exponent and approximate entropy, wherein the Lyapunov exponent is used to characterize the sensitivity of the chaotic system to initial conditions, and the approximate entropy is used to measure the complexity of the sequence;

[0166] Determine whether the reinitialization conditions are met. The reinitialization conditions include the amount of transmitted data reaching a threshold, the running time reaching a threshold, or the Lyapunov exponent being less than or equal to zero, or the approximate entropy being lower than a threshold.

[0167] When the reinitialization condition is met, a new initial value is generated using the current chaotic state variable and the reinitialization counter through a hash function; the reinitialization process uses the following formula: ; where Counter is the reinitialized counter.

[0168] The reinitialization event is notified to the communicating party through a secure channel, ensuring that both parties perform reinitialization synchronously and update the local chaotic system state.

[0169] The following example of a complete data transmission process further illustrates the practical application of the method of the present invention.

[0170] In an industrial internet system within a smart manufacturing workshop, a PLC controller, acting as the sender, needs to transmit a 256-byte control command data packet to a SCADA system, which is acting as the receiver. Both switches have completed system initialization, and the chaotic system is in a synchronized state.

[0171] In the dynamic port mapping step, the master switch generates port mapping relationships based on the current chaotic state. Random numbers are extracted from the chaotic sequence, and each physical port is mapped to a unique logical channel through modulo operations. The current transition cycle is calculated, and the difference between the new mapping relationship and the previous mapping relationship is verified to ensure that the rate of change between two adjacent mappings meets the requirements.

[0172] In the chaos-driven encryption step, when the control command data packet arrives at the sending exchange, three state variables of the current chaotic state are extracted. An encryption algorithm is selected based on the numerical range of the first state variable, and an encryption mode is selected based on the numerical range of the second state variable. Multiple consecutive state variables of the chaotic sequence are combined and a session key is generated using a hash function. The data packet is encrypted using the selected algorithm, mode, and key, and a message authentication code is generated and appended to the end of the data packet.

[0173] During the port transition execution step, the physical port from which the data packet should be sent is determined based on the current port mapping relationship. A transition synchronization identifier is embedded in the data packet header; this identifier is generated by a hash function using the current chaotic state variable and the start time of the transition period. The complete data packet is then sent out from the mapped physical port. At the end of the transition period, a port mapping switch is triggered, employing a double-buffering mechanism to ensure that no data packets are lost during the switchover process.

[0174] In the receive verification step, the receiving switch calculates the current chaotic state and port mapping relationship based on the synchronized chaotic system. When a data packet arrives, it extracts the transition synchronization identifier from the header and uses the locally calculated chaotic state to generate an identifier for comparison and verification. Since the master and slave chaotic states are highly synchronized, the verification passes. The receiver determines the encryption algorithm and mode used by the sender based on the synchronized chaotic state, generates the same session key, decrypts the data packet, and verifies the message authentication code. After successful verification, the data packet is forwarded to the target port, completing the data transmission.

[0175] In the threat detection and response process, the threat detection module continuously monitors network behavior. During normal transmission, no abnormal port scanning behavior, replay attacks, or synchronization disruption attacks were detected. Entropy analysis of the port hopping sequence showed an entropy ratio higher than the threshold, indicating good randomness in the hopping sequence. Overall, the threat level was assessed as low, and no adjustment to the hopping cycle was necessary.

[0176] At a certain point, the system detected an anomaly: multiple port scan attempts were detected, the proportion of abnormal traffic increased, and the synchronization success rate decreased. The threat detection module calculated a high threat level, and the adaptive parameter adjustment module significantly shortened the transition cycle. Because the threat level exceeded the critical threshold, an emergency response mechanism was triggered: a new initial value was generated using the current chaotic state and the re-initialization counter via a hash function, and notified to the switch through an encrypted secure channel. Both parties synchronously reinitialized the chaotic system. Simultaneously, the system switched to the backup communication channel and sent detailed alarm information to the security management center.

[0177] During the maintenance of the chaotic system, the system continuously monitors the statistical characteristics of the chaotic sequence. After a period of normal operation, the cumulative amount of transmitted data reaches a preset reinitialization threshold. Although the statistical characteristics of the chaotic system are normal, a periodic reinitialization mechanism is triggered. The system uses the current chaotic state and the reinitialization counter to generate a new initial value through a hash function. The master switch notifies the slave switch of the reinitialization event through an encrypted channel, and both sides synchronously perform reinitialization, update the initial value of the chaotic system, and re-enter the preheating iteration phase to ensure the security and randomness of the chaotic system's long-term operation.

[0178] As can be seen from the above complete data transmission process example, the method of the present invention achieves an organic combination of dynamic port switching, multi-layer encryption, synchronous verification, threat detection, and adaptive adjustment. Under normal circumstances, the system transmits data efficiently and stably, with small synchronization errors, high encryption strength, and good randomness of port switching. When attacked, the system can quickly detect anomalies, dynamically adjust security parameters, and trigger emergency response, effectively resisting various network threats and significantly improving the security of switch data transmission.

[0179] Example 3

[0180] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor of a switch, implements the method described in Embodiment 2.

[0181] The computer-readable storage medium can be a non-volatile storage medium, such as flash memory, read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), etc. It can also be a volatile storage medium, such as random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), etc. Furthermore, the computer-readable storage medium can also include physical storage devices such as hard disks, floppy disks, optical disks, magnetic tapes, USB flash drives, and portable hard drives.

[0182] The computer program contains program instructions that implement all the steps of the aforementioned method. When the switch's processor reads and executes the computer program from the storage medium, the processor will perform a series of operations in a predetermined logical order, including system initialization, dynamic port mapping, chaotic-driven encryption, port transition execution, reception verification, threat detection and response, and chaotic system maintenance, thereby realizing the data transmission security method of the present invention.

[0183] Specifically, the computer program includes the following functional modules: the chaotic sequence generation module implements the iterative calculation of multidimensional chaotic mapping; the dynamic port mapping module implements the generation of port mapping relationships and the calculation of transition periods; the chaotic-driven encryption module implements the dynamic selection of encryption algorithms and modes and the generation of session keys; the port transition synchronization protocol module implements the synchronization of master-slave chaotic systems; the threat detection module implements the detection of various attack behaviors; and the adaptive parameter adjustment module implements the assessment of threat levels and the dynamic adjustment of parameters.

[0184] The computer program also includes interface code with a hardware encryption chip, used to offload computationally intensive tasks such as chaotic sequence generation to the hardware encryption chip for execution, improving computational efficiency and reducing the load on the main processor. The hardware encryption chip can employ a dedicated chaotic circuit design to achieve high-speed chaotic iterative calculations, meeting the real-time requirements of high-speed network data transmission.

[0185] In a specific application scenario, this computer-readable storage medium is integrated as firmware into the onboard flash memory of an industrial-grade switch. When the switch boots up, the bootloader reads and loads the computer program from the flash memory into memory, and the processor begins executing program instructions. The program first initializes hardware resources, then enters the main loop, continuously receiving and processing data packets, updating the chaotic state, performing port switching, detecting security threats, and other operations. The program also provides a management interface, allowing network administrators to configure chaotic system parameters, view system operating status, and adjust security policies via command line or graphical interface.

[0186] For different application scenarios, the system parameters can be flexibly adjusted: (1) High security scenario (such as critical infrastructure): shorten the basic transition period to 50 milliseconds, increase the number of warm-up iterations to 200 times, improve alarm sensitivity (reduce the alarm coefficient λ to 2), and shorten the reinitialization threshold (data volume 50GB, running time 12 hours); (2) High performance scenario (such as data center, cloud computing): extend the basic transition period to 200 milliseconds, reduce the number of encryption algorithm options (only use hardware-accelerated AES-256), simplify threat detection (only detect port scanning and replay attacks), and improve performance in exchange for a moderate reduction in security; (3) Low power scenario (such as Internet of Things, edge computing): extend the basic transition period to 500 milliseconds, use a lightweight encryption algorithm (prefer ChaCha20), reduce the frequency of chaotic iteration calculation (only calculate once per transition period), and reduce energy consumption.

[0187] For ease of implementation, Table 1 lists recommended values ​​for all key threshold parameters:

[0188] Table 1: Recommended values ​​for key threshold parameters

[0189]

[0190] The computer-readable storage medium of this invention enables the secure data transmission method to be easily deployed on various types of switching devices without requiring large-scale modifications to the switch hardware; it can be implemented simply through firmware upgrades or software installations. This significantly reduces the deployment cost and implementation difficulty of the technical solution, enhancing its practicality and promotional value. Furthermore, because the program is stored in a standardized format, version management, feature upgrades, and security patch releases are facilitated, ensuring the system can continuously respond to evolving cybersecurity threats.

[0191] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data transmission security system adapted to a switch, characterized in that, The system includes: a chaotic sequence generation module, a dynamic port mapping module, a chaotic drive encryption module, a port transition synchronization protocol module, a threat detection module, and an adaptive parameter adjustment module; The chaotic sequence generation module is configured in the hardware encryption chip of the switch and is used to generate pseudo-random sequences based on multidimensional chaotic mapping. The multidimensional chaotic mapping adopts a combination model of coupled Logistic mapping and Henon mapping, and generates a sequence of chaotic state variables with high randomness and unpredictability by setting initial values ​​and chaotic parameters. The dynamic port mapping module is used to change the mapping relationship between the physical ports of the switch and the logical communication channels in real time according to the chaotic sequence. The mapping relationship is updated according to the jump period determined by the chaotic sequence, so that the physical port position through which the data flows changes dynamically over time. The chaos-driven encryption module is used to map chaotic sequences to encryption parameters. The chaos-driven encryption module includes a session key generation unit, an encryption algorithm selection unit, and an encryption mode switching unit. The session key generation unit converts chaotic state variables into session keys through a hash function. The encryption algorithm selection unit dynamically selects from three algorithms, AES-256, SM4, and ChaCha20, based on the value range of the chaotic variables. The encryption mode switching unit switches between three modes, CBC, CTR, and GCM, based on the chaotic variables. The port transition synchronization protocol module is used to establish a chaotic synchronization mechanism between the switches of the two communicating parties to ensure that the port transition sequence and encryption parameters of the sending end and the receiving end are consistent. The synchronization protocol adopts a master-slave driven synchronization method. The master switch periodically sends part of the chaotic state information, and the receiving switch updates its local chaotic system and calculates the synchronization error after receiving it. The threat detection module is used to detect attacks targeting the dynamic port switching mechanism. The threat detection module includes a port scanning detection unit, a replay attack detection unit, and a synchronization disruption detection unit. The port scanning detection unit counts the frequency of accessing different ports per unit time. The replay attack detection unit adds a timestamp based on a chaotic sequence to each data packet and verifies its validity. The synchronization disruption detection unit monitors for abnormal entropy values ​​in the port switching sequence. The adaptive parameter adjustment module is used to dynamically adjust the transition period according to the network threat level. The threat level is evaluated based on the number of detected attacks, the frequency of abnormal traffic, and the synchronization success rate. When the threat level increases, the transition period is shortened to improve security.

2. A data transmission security method adapted to a switch, applied to the system described in claim 1, characterized in that, The method includes the following steps: Step S1: The two communication switches negotiate the initial value and parameters of the chaotic system through a secure channel. The master and slave switches initialize their local chaotic systems respectively, perform preheating iterations to bring the chaotic system into a stable chaotic state, and verify the synchronization state. Step S2: At the beginning of each transition cycle, the main switch generates a new port mapping relationship based on the current chaotic state, extracts random numbers from the chaotic sequence to map physical ports to logical channels, calculates the transition cycle, and verifies the validity of the mapping relationship. Step S3: When the data packet arrives at the switch to be forwarded, extract the current state of the chaotic sequence, select the encryption algorithm and encryption mode according to the chaotic variables, generate a session key, encrypt the data packet using the selected algorithm, mode and key, and generate a message authentication code. Step S4: Determine the physical port for sending data packets based on the current port mapping relationship, embed a transition synchronization identifier in the header of the data packet, send encrypted data packets from the mapped physical port, and use a double buffering mechanism to perform port mapping switching when the next transition cycle is reached. Step S5: The receiving switch calculates the current port mapping relationship based on the synchronized chaotic system, extracts and verifies the jump synchronization identifier, determines the encryption algorithm and mode based on the synchronized chaotic state and generates a session key, decrypts the data packet and verifies the message authentication code, and forwards the data packet after successful verification. Step S6: Continuously monitor port scanning, replay attacks, and synchronous sabotage anomalies, calculate the overall threat level, dynamically adjust the jump cycle and chaos parameters according to the threat level, and trigger the emergency response mechanism when a serious attack is detected. Step S7: Monitor the statistical characteristics of the chaotic sequence in real time. When the reinitialization condition is met, generate a new initial value through a hash function and notify the other party to perform reinitialization synchronously.

3. The method according to claim 2, characterized in that, The two communicating parties negotiate the initial values ​​and parameters of the chaotic system through a secure channel. The initial values ​​include the initial values ​​of three state variables, and the parameters include chaotic parameters and coupling coefficients. The master and slave switches initialize their local chaotic systems respectively. The master switch starts the drive signal sending function, and the slave switch starts the synchronization controller. The chaotic system is brought into a stable chaotic state through preheating iterations, and the number of preheating iterations is not less than 100. Calculate the synchronization error of the master and slave switches in chaotic state. If the synchronization error is less than the preset threshold, the synchronization is considered successful; otherwise, the initialization is re-executed.

4. The method according to claim 3, characterized in that, At the beginning of each transition cycle, the master switch generates a new port mapping relationship based on the current chaotic state; Extract random numbers equal to the number of physical ports from the chaotic sequence, and map each physical port to a unique logical channel through modulo operation; Calculate the current jump period, which is equal to the base period plus the time perturbation determined by the chaotic variable. The time perturbation is calculated by multiplying the chaotic variable by the perturbation step size and rounding it down. Verify the difference between the new mapping relationship and the current mapping relationship, and ensure that the rate of change between two adjacent mappings is not lower than the minimum rate of change threshold; Port mapping information is transmitted to the slave switch via a synchronization mechanism, or the slave switch independently calculates the same mapping relationship through a synchronized chaotic system.

5. The method according to claim 4, characterized in that, The chaos-driven encryption includes: when a data packet arrives at the switch to be forwarded, extracting three state variables of the current state of the chaotic sequence; The encryption algorithm is selected based on the numerical range of the first state variable. When the variable is in the first range, the AES-256 algorithm is selected; when it is in the second range, the SM4 algorithm is selected; and when it is in the third range, the ChaCha20 algorithm is selected. The encryption mode is selected based on the numerical range of the second state variable. When the variable is in the first range, the CBC mode is selected; when it is in the second range, the CTR mode is selected; and when it is in the third range, the GCM mode is selected. A 256-bit session key is generated by combining multiple continuous state variables of a chaotic sequence and mapping them using a hash function. The data packet is encrypted using the selected encryption algorithm, encryption mode, and session key, and a message authentication code based on the session key is generated and appended to the data packet.

6. The method according to claim 5, characterized in that, The port switching execution in step S4 includes: Based on the current port mapping, determine which physical port the encrypted data packet should be sent from; A jump synchronization identifier is embedded in the header of the data packet. The jump synchronization identifier is generated by a hash function from the current chaotic state variable and the start time of the jump cycle. Send the encrypted data packet from the mapped physical port; When the time reaches the next transition period, the port mapping is switched. A double buffering mechanism is used to maintain both the old and new mappings during the transition period before the new mapping takes effect, ensuring that no data packets are lost during the switching process.

7. The method according to claim 6, characterized in that, The receiving switch calculates the port mapping relationship at the current moment based on the synchronous chaotic system to determine which logical channel the data packet should be received from. Extract the jump synchronization identifier from the packet header and verify whether it is consistent with the locally calculated identifier. If they are inconsistent, it is determined that the synchronization has failed or that an attack has occurred. The packet is then discarded and an alarm is triggered. The encryption algorithm and encryption mode used by the sender are determined based on the synchronized chaotic state, and the same session key is generated. Use the session key to decrypt the data packet and verify the validity of the message authentication code; If decryption and verification are successful, the data packet is forwarded to the target port; if they fail, the security event is recorded and the data packet is discarded.

8. The method according to claim 7, characterized in that, Detect port scanning behavior, count the frequency of accessing different ports within a unit time window, and trigger a port scanning alarm when the frequency exceeds a preset multiple of the normal frequency; To detect replay attacks, the validity of the timestamps generated based on chaotic sequences in the data packets is verified. These timestamps are obtained by XORing the real timestamps with the hash values ​​of the chaotic variables. To detect synchronous sabotage attacks, collect port transition sequences within a time window, calculate the Shannon entropy of the sequence, and determine that the randomness of the transition sequence has been compromised when the entropy value is lower than a preset threshold. The overall threat level is determined by weighting and summing the number of attacks, the frequency of abnormal traffic, and the synchronization success rate. The transition period is dynamically adjusted based on the threat level, and the transition period is shortened by an exponential decay function when the threat level increases. When the threat level exceeds the critical value, an emergency response mechanism is triggered, including immediately updating the initial values ​​of the chaotic system, switching to a backup communication channel, and sending an alarm to the security management center.

9. The method according to claim 8, characterized in that, Real-time monitoring of the statistical properties of chaotic sequences, including calculating the Lyapunov exponent and approximate entropy, wherein the Lyapunov exponent is used to characterize the sensitivity of the chaotic system to initial conditions, and the approximate entropy is used to measure the complexity of the sequence; Determine whether the reinitialization conditions are met. The reinitialization conditions include the amount of transmitted data reaching a threshold, the running time reaching a threshold, or the Lyapunov exponent being less than or equal to zero, or the approximate entropy being lower than a threshold. When the reinitialization condition is met, a new initial value is generated using the current chaotic state variable and the reinitialization counter through a hash function. The reinitialization event is notified to the communicating party through a secure channel, ensuring that both parties perform reinitialization synchronously and update the local chaotic system state.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor of the switch, it implements the method as described in any one of claims 2 to 9.

Images