Intelligent dynamic data encryption adjustment system

Abstract

The invention discloses an intelligent dynamic data encryption adjustment system, which comprises a context sensing module, a core decision module and a security execution module, the context sensing module collects external environment indexes, equipment computing resource use conditions and to-be-encrypted data characteristics, the core decision-making module dynamically generates encryption configuration based on a preprocessing result, and the security execution module adaptively calls a bottom layer encryption hardware or software library. Through multi-dimensional data collaboration and dynamic decision making, the problem that an existing static encryption mode lacks adaptability is solved, accurate matching between an encryption scheme and environment, resource and data characteristics is achieved, and balance between encryption safety and system operation efficiency is guaranteed.

Description

Technical Field

[0001] This invention relates to the field of data encryption technology, and more specifically to an intelligent dynamic data encryption adjustment system. Background Technology

[0002] Current data encryption technologies generally employ static or pre-configured modes, meaning that fixed encryption algorithms and key lengths are pre-set for specific data types or communication channels, and the encryption process remains unchanged regardless of external environment or system status. The core problem with this mode is its inability to dynamically balance encryption security and system efficiency. In practical applications, the intensity of electromagnetic interference and network transmission status directly affect the security of encrypted data transmission; the CPU utilization and memory usage of devices limit the efficiency of encryption algorithms; and the sensitivity and size of the data to be encrypted determine the varying encryption strength requirements. Static encryption uses a one-size-fits-all approach. When external interference is strong or data sensitivity is high, a fixed encryption scheme may not provide sufficient security; when device resources are limited or real-time data requirements are high, a complex fixed encryption scheme can consume excessive resources, leading to system lag and increased transmission latency. This lack of dynamic adaptability makes it difficult for existing encryption technologies to simultaneously meet security and performance requirements in complex and ever-changing application scenarios.

[0003] Based on the above problems, there is an urgent need for a technical solution that can dynamically adjust the encryption strategy according to the actual scenario. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing an intelligent dynamic data encryption adjustment system, comprising a context-aware module, a core decision-making module, and a secure execution module. The context-aware module collects and preprocesses input signals related to encryption decisions. The core decision-making module receives input signals and makes encryption decisions. The secure execution module receives encryption configuration descriptions and converts them into actual calls to underlying encryption hardware or software libraries. The context-aware module simultaneously collects external environmental indicators, current device computing resource usage, and characteristics of the data to be encrypted. Based on the preprocessing results of external environmental indicators, device computing resource usage, and characteristics of the data to be encrypted, the core decision-making module dynamically generates an encryption configuration that includes encryption algorithm type, key length, and encryption execution mode. The secure execution module adaptively calls the corresponding underlying encryption hardware or software library to perform data encryption operations according to the encryption configuration.

[0005] Preferably, the external environmental indicators collected by the context-aware module include electromagnetic interference intensity, network transmission delay, and ambient temperature. The context-aware module collects electromagnetic interference intensity through a distributed sensor array, calculates network transmission delay through the difference in network data packet timestamps, and collects ambient temperature through an embedded temperature sensor.

[0006] Preferably, the context-aware module collects device computing resource usage information including CPU utilization, memory utilization, and remaining storage space. The context-aware module reads CPU utilization in real time through the system kernel interface, calculates memory utilization through memory page tables, and obtains remaining storage space through storage medium read / write status monitoring.

[0007] Preferably, the characteristics of the data to be encrypted collected by the context-aware module include the data sensitivity level, data volume, and data real-time requirements. The context-aware module extracts the data sensitivity level by identifying the data packet header, obtains the data volume by counting the number of bytes in the data block, and determines the data real-time requirements by parsing the application layer transport protocol fields.

[0008] Preferably, the core decision-making module determines the encryption algorithm adaptation coefficient based on the collected external environmental indicators, equipment computing resource usage, and the characteristics of the data to be encrypted, using the encryption algorithm adaptation coefficient calculation formula. The encryption algorithm adaptation coefficient calculation formula is as follows: ; Where ZJ represents the encryption algorithm adaptation coefficient, D represents the electromagnetic interference intensity, C represents the CPU utilization rate, M represents the data sensitivity level, α is the electromagnetic interference intensity calibration coefficient, β is the CPU utilization rate calibration coefficient, and γ is the data sensitivity level calibration coefficient. α, β, and γ are all non-zero positive numbers, obtained through experimental data calibration.

[0009] Preferably, the core decision module determines the key length based on the encryption algorithm adaptation coefficient and through a dynamic key length calculation formula. The dynamic key length calculation formula is as follows: , where ML represents the key length, ZJ represents the encryption algorithm adaptation coefficient, Y represents the network transmission delay, N represents the memory utilization rate, S represents the data volume, δ is the adaptation coefficient adjustment coefficient, and ε is the memory utilization rate weighting coefficient. δ and ε are both positive real numbers, obtained through system performance testing and calibration.

[0010] Preferably, the encryption configuration generated by the core decision module also includes an encryption strength level. The encryption strength level is determined based on the encryption algorithm adaptation coefficient and the key length. The core decision module maps the combination value of the encryption algorithm adaptation coefficient and the key length to a preset encryption strength level range through a preset mapping relationship. The encryption strength level range includes a low strength range, a medium strength range, and a high strength range.

[0011] Preferably, the preprocessing process of the context-aware module includes data cleaning, data standardization, and data fusion. The data cleaning process removes outliers from the collected data, the data standardization process converts collected data of different dimensions into standardized data with the same value range, and the data fusion process merges multiple collected data of the same type into a single data value through a weighted average algorithm.

[0012] Preferably, the secure execution module includes an encryption algorithm library, a key management unit, and an execution control unit. The encryption algorithm library stores a variety of encryption algorithms. The key management unit dynamically generates a key based on the key length generated by the core decision module. The execution control unit calls the corresponding encryption algorithm from the encryption algorithm library to perform the encryption operation based on the encryption algorithm type, key, and encryption execution mode in the encryption configuration.

[0013] Preferably, the core decision module performs real-time calibration of the encryption strength level using a dynamic encryption strength calibration formula, the expression of which is: ; Where JJ represents the calibrated encryption strength value, ZJ represents the encryption algorithm adaptation coefficient, ML represents the key length, T represents the ambient temperature, K represents the remaining storage space, R represents the data real-time requirement, η is the comprehensive calibration coefficient, θ is the temperature influence adjustment coefficient, and λ is the storage space weight coefficient. η, θ, and λ are all positive real numbers, obtained through multi-scenario testing and calibration. The core decision module adjusts the encryption strength level in the encryption configuration based on the calibrated encryption strength value.

[0014] Technical Effects: The core inventive technology of this invention lies in constructing a collaborative architecture that integrates multi-dimensional data acquisition, dynamic coefficient calculation, and hierarchical encryption configuration. A context-aware module synchronously collects three key indicators: environment, resources, and data. The core decision-making module dynamically generates an adaptive encryption scheme using a progressively related mathematical model. This technical solution precisely addresses the core problem of existing static encryption modes lacking dynamic adaptability, breaking the fixed contradiction between security and performance. It achieves real-time matching of encryption strategies with actual application scenarios, ensuring data transmission security while avoiding system resource waste. Attached Figure Description

[0015] Figure 1This is a connection block diagram of the intelligent dynamic data encryption and adjustment system of this application. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0017] Traditional technical solutions have the following technical problems: Existing data encryption technologies adopt a static pre-configuration mode, which sets a fixed encryption algorithm and key length only for specific data or channels. This cannot respond to changes in the external environment, fluctuations in device resources, and differences in data characteristics, resulting in an inability to dynamically balance security and performance.

[0018] Based on this, please refer to Figure 1 This embodiment provides an intelligent dynamic data encryption adjustment system, including a context-aware module, a core decision-making module, and a secure execution module. The context-aware module is used to collect and preprocess input signals related to encryption decisions. The core decision-making module is used to receive input signals and make encryption decisions. The secure execution module is used to receive encryption configuration descriptions and convert them into actual calls to underlying encryption hardware or software libraries. The context-aware module simultaneously collects external environment indicators, current device computing resource usage, and characteristics of the data to be encrypted. Based on the preprocessing results of external environment indicators, device computing resource usage, and characteristics of the data to be encrypted, the core decision-making module dynamically generates an encryption configuration that includes encryption algorithm type, key length, and encryption execution mode. The secure execution module adaptively calls the corresponding underlying encryption hardware or software library to perform data encryption operations according to the encryption configuration.

[0019] The technical solution is described below: The system adopts a modular architecture design. Three core modules interact via a high-speed PCIe 4.0 interface, with a data transmission bandwidth of no less than 8GB / s to ensure real-time performance. The context-aware module is equipped with an Intel Xeon D-2750 processor and integrates multi-source data acquisition interfaces, including analog signal acquisition, digital signal acquisition, and network data capture interfaces. The frequency for synchronously acquiring three types of key information is fixed at 100Hz, with acquisition latency controlled within 1ms. The acquired raw data is transmitted to the preprocessing unit via an internal bus. The preprocessing unit uses an FPGA chip XC7K325T to achieve parallel data processing, ensuring data processing efficiency. The core decision-making module uses an ARM Cortex-A78 architecture processor with a main frequency of 3.2GHz and 16GB of LPDDR5 memory for caching preprocessed data. The decision logic is written in C++ and embedded in the processor. The decision-making process consists of four steps: data parsing, factor correlation analysis, encrypted parameter calculation, and configuration generation. The entire decision cycle does not exceed 5ms. The core decision-making module and the context-aware module transfer data via DMA direct memory access, avoiding latency caused by CPU intervention. The secure execution module is equipped with a dedicated encryption chip SM4100 and a software encryption algorithm library. Hardware interfaces include PCIe 4.0, USB 3.2, and SPI interfaces. The software library supports multiple operating systems including Windows, Linux, and Android, and can automatically select the implementation path based on the execution mode specified in the encryption configuration. When hardware acceleration is specified in the encryption configuration, the execution control unit sends control commands and data to the encryption chip via the PCIe 4.0 interface. After encryption, the encryption chip returns the ciphertext through the same interface. When software execution is specified, the execution control unit calls the software implementation version of the corresponding algorithm, utilizing system CPU resources to complete the encryption operation. During encryption, data is transmitted through a memory encryption channel to prevent data leakage.

[0020] The technical effects achieved by this solution include: dynamic adaptive adjustment of the existing encryption strategy, breaking the fixed limitations of the static encryption mode, ensuring encryption security when the external environment is complex or the data is highly sensitive, optimizing system performance when equipment resources are scarce or the data real-time requirements are high, and achieving a dynamic balance between security and performance.

[0021] Traditional technical solutions have the following technical problems: existing encryption systems have weak environmental awareness capabilities, can only obtain single environmental parameters or completely ignore environmental influences, and cannot fully capture the impact of the external environment on encrypted transmission, resulting in insufficient security of encryption solutions in complex environments.

[0022] Based on this, the external environmental indicators collected by the context awareness module include electromagnetic interference intensity, network transmission delay, and ambient temperature. The context awareness module collects electromagnetic interference intensity through a distributed sensor array, calculates network transmission delay through the difference in network data packet timestamps, and collects ambient temperature through an embedded temperature sensor.

[0023] The technical solution is described below: The external environment acquisition unit of the context-aware module consists of three dedicated acquisition sub-modules, corresponding to three types of environmental indicators. The electromagnetic interference intensity acquisition sub-module employs a distributed sensor array, consisting of four TITLV2543 electromagnetic sensors evenly deployed in the four corners of the system chassis. The operating frequency band covers 1kHz to 1GHz, with a sensitivity of -120dBm. The acquired raw analog signal is converted into a digital signal by a 16-bit ADC converter at a conversion rate of 1MHz. After filtering by an FIR filter, the quantized electromagnetic interference intensity value is calculated using the effective value, with dimensions in dB and a range of 0dB to 100dB. The network transmission delay acquisition sub-module captures network packets through a gigabit Ethernet interface, employing a Wireshark-based packet capture engine. It can extract the sending and receiving timestamps of data packets in real time, with a timestamp accuracy of 1 microsecond. The difference between the sending and receiving times of the same data packet is the one-way transmission delay. To reduce measurement errors, a moving average method is used to process the delay values ​​of 10 consecutive sampling points. The moving average window size is 10, and the processed delay data is in milliseconds, ranging from 1 millisecond to 1000 milliseconds. The ambient temperature acquisition submodule uses a DS18B20 embedded temperature sensor, integrated near the CPU on the system motherboard. The sensor has a sampling accuracy of 0.1℃ and a sampling period of 10ms, synchronized with the overall data acquisition frequency. The acquired temperature data is transmitted to the preprocessing unit via the I2C bus. The data is in degrees Celsius, ranging from -40℃ to 85℃, covering the temperature range of most application scenarios. The output data of the three acquisition submodules are synchronized via a synchronization controller, with a synchronization error not exceeding 10 microseconds, ensuring consistency of the three environmental indicators in the time dimension and providing an accurate environmental data correlation analysis basis for the core decision-making module.

[0024] The technical effects achieved by this solution include: enabling multi-dimensional and high-precision perception of the external environment, comprehensively capturing the impact of electromagnetic interference, transmission delay, and temperature on encrypted transmission, providing comprehensive environmental data support for the core decision-making module, and improving the environmental adaptability of the encryption solution.

[0025] Traditional technical solutions have the following technical problems: Existing encryption systems do not consider the device's computing resource status and adopt a fixed encryption scheme. When device resources are scarce, encryption operations will consume a lot of resources, causing system lag and affecting the overall service quality.

[0026] Based on this, the context-aware module collects device computing resource usage data, including CPU utilization, memory utilization, and remaining storage space. The context-aware module reads CPU utilization in real-time through the system kernel interface, calculates memory utilization using memory page tables, and obtains remaining storage space through storage medium read / write status monitoring. The technical solution is described below: The device computing resource acquisition unit designs dedicated acquisition interfaces and algorithms for different resource types. CPU utilization is acquired through the system kernel interface. In Windows systems, the PerfMonAPI interface is used, and in Linux systems, the proc file system interface is used. It directly interacts with the operating system kernel, reading the CPU's user-mode time, kernel-mode time, idle time, and wait time. The sampling period is 10ms. The CPU utilization is calculated using the formula: CPU utilization = (user-mode time + kernel-mode time) / (user-mode time + kernel-mode time + idle time + wait time) × 100%. The result is a dimensionless parameter, ranging from 0 to 100, rounded to one decimal place. Memory usage is collected through memory page table statistics. The context-aware module obtains the base address and length of the memory page table through system calls, traverses all memory page table entries, and counts the number of allocated memory pages and the total number of memory pages. The memory page size is 4KB. Memory usage = number of allocated memory pages / total number of memory pages × 100%. At the same time, by monitoring the allocation and release frequency of memory pages, the memory change rate is calculated to help judge the dynamic trend of memory resources. Memory change rate = (current number of allocated memory pages - number of allocated memory pages in the previous cycle) / number of allocated memory pages in the previous cycle × 100%. The sampling period is consistent with the CPU utilization rate. The remaining storage space acquisition supports various storage media such as mechanical hard drives, solid-state drives, and USB flash drives. Information is obtained through the storage media's controller interface. In Windows systems, the DeviceIoControl function is used, while in Linux systems, the ioctl function is used. It reads the total number of sectors, the number of used sectors, and the number of bytes per sector. The remaining storage space is calculated as (total sectors - used sectors) × bytes per sector, measured in bytes. Simultaneously, the read and write speeds of the storage media are monitored. The average speed of 10 consecutive read / write operations of 1MB of data reflects the storage resource load status, measured in MB / s. The acquisition of these three types of resource data is performed in parallel using multi-threading to ensure acquisition efficiency and data real-time performance.

[0027] The technical effects achieved by this solution include: accurately acquiring the real-time status of device computing resources, providing resource constraints for core decision-making modules, avoiding excessive resource consumption during encryption operations, and ensuring the overall stability of the system.

[0028] Traditional technical solutions have the following technical problems: existing encryption systems use a uniform encryption strategy for all data without considering the differences in the characteristics of the data itself, resulting in insufficient encryption strength for highly sensitive data or excessive resource consumption for ordinary data encryption.

[0029] Based on this, the context-aware module collects the characteristics of the data to be encrypted, including the data sensitivity level, data volume, and data real-time requirements. The context-aware module extracts the data sensitivity level by identifying the data packet header, obtains the data volume by counting the number of bytes in the data block, and determines the data real-time requirements by parsing the application layer transport protocol fields.

[0030] The technical solution is described as follows: The data characteristic acquisition unit to be encrypted is integrated into the data receiving interface and executes synchronously with the data receiving process, without adding any additional data processing delay. Data sensitivity level extraction is based on a preset data packet header format. The data to be encrypted uses a custom data packet format with a header length of 20 bytes. Bytes 16 to 19 are the sensitivity identifier field, occupying 4 bits, with the remaining 28 bits used for other control information. The bit combinations of the sensitivity identifier field correspond to the sensitivity levels as follows: 0001 corresponds to level 1, 0010 to level 2, 0100 to level 3, 1000 to level 4, and 1111 to level 5. The sensitivity increases sequentially from level 1 to level 5. When the context-aware module parses the data packet header, it extracts the identifier field through bitwise operations and converts it into the corresponding sensitivity level. The extraction process takes no more than 1 microsecond. Data volume statistics employ a data block partitioning and accumulation method. The data to be encrypted is divided into fixed 1KB blocks, with any portion less than 1KB counted as a single block. The context-aware module uses a counter to count the total number of data blocks. Data volume = total number of data blocks × 1024 bytes. When the data volume exceeds 1GB, it is automatically converted to GB and rounded to two decimal places. The statistical process is implemented using a hardware counter to ensure accuracy. Real-time requirement analysis is based on application-layer transport protocols, supporting mainstream protocols such as HTTP, TCP, and UDP. A 1-byte real-time identifier field is reserved in the protocol header. A value of 01 corresponds to low real-time requirement, 02 to medium real-time requirement, and 03 to high real-time requirement. The context-aware module uses a protocol parsing engine to identify the application-layer protocol type, extract the real-time identifier field value, and map it to the corresponding real-time requirement level. The parsing engine supports dynamic protocol identification and can automatically adapt to different protocol formats, with a parsing latency of no more than 5 microseconds. These three types of data characteristic parameters are bound to the identifier information of the data to be encrypted and transmitted together to the core decision module, ensuring the correspondence between data characteristics and the data itself.

[0031] The technical effects achieved by this solution include: accurately identifying the characteristics of the data to be encrypted, providing data attribute basis for the core decision-making module, accurately matching the encryption scheme with the data characteristics, improving encryption security while optimizing resource utilization efficiency.

[0032] Traditional technical solutions have the following technical problems: existing encryption systems lack quantitative basis when selecting encryption algorithms, relying only on experience or fixed rules, and cannot dynamically select the optimal encryption algorithm based on the comprehensive influence of multiple factors.

[0033] Based on this, the core decision-making module determines the encryption algorithm adaptation coefficient using the collected external environmental indicators, equipment computing resource usage, and characteristics of the data to be encrypted, through the encryption algorithm adaptation coefficient calculation formula. The encryption algorithm adaptation coefficient calculation formula is as follows: ; Where ZJ represents the encryption algorithm adaptation coefficient, D represents the electromagnetic interference intensity, C represents the CPU utilization rate, M represents the data sensitivity level, α is the electromagnetic interference intensity calibration coefficient, β is the CPU utilization rate calibration coefficient, and γ is the data sensitivity level calibration coefficient. α, β, and γ are all non-zero positive numbers, obtained through experimental data calibration.

[0034] The technical solution of this plan is described as follows: The encryption algorithm adaptation coefficient calculation formula is the core algorithm model of the core decision module. It is used to quantify the comprehensive influence of multi-dimensional factors on the adaptability of encryption algorithms, providing an objective quantitative basis for the selection of encryption algorithms. The definitions and technical details of each parameter are as follows: Electromagnetic interference intensity D is the standardized data collected by the context awareness module, with the dimension in dB and a value range of 0dB to 100dB. The larger the D value, the stronger the external electromagnetic interference, and the higher the requirement for the anti-interference capability of the encryption algorithm. Therefore, a square term is used in the formula to strengthen its influence on the adaptation coefficient, so that the adaptation coefficient grows faster when the interference is stronger. CPU utilization C is a dimensionless parameter, with a value range of 0 to 100. The larger the C value, the higher the CPU load of the device, and the stricter the constraint on the computational complexity of the encryption algorithm. A square root term is used in the formula to weaken its influence, avoiding small fluctuations in CPU utilization from causing large changes in the adaptation coefficient, and ensuring the stability of algorithm selection. The data sensitivity level M is an integer parameter, ranging from 1 to 5. A higher level indicates a higher level of encryption security required for the data. The formula uses a natural logarithm term to reflect its positive impact on the fit coefficient. The base of the logarithm is e. The form M+1 avoids the situation where M=0 is meaningless, ensuring that the impact of level changes on the fit coefficient shows a steady increasing trend. The calibration coefficients α, β, and γ have dimensions of 1 / dB. 21 / √%, 1 / level, are all non-zero positive numbers. Their calibration process was completed through multiple sets of orthogonal experiments: The experiments selected five typical electromagnetic interference intensities (20dB, 40dB, 60dB, 80dB, 100dB), five CPU utilization rates (10%, 30%, 50%, 70%, 90%), and five data sensitivity levels (1 to 5), forming a total of 125 experimental scenarios. In each scenario, the encryption success rate, execution latency, and resource utilization of five encryption algorithms—AES-128, AES-256, RSA-2048, RSA-4096, and ECC-256—were tested, and the comprehensive adaptation score of each algorithm was calculated. Using the comprehensive adaptation score as the dependent variable, and D... 2 With C^(1 / 2) and ln(M+1) as independent variables, α = 0.0021 / dB was obtained through multiple linear regression analysis. 2 β=0.15 / √%, γ=0.85 / grade, goodness of fit R 2 =0.98, ensuring that the calculated fit coefficient ZJ accurately reflects the selection criteria for the optimal encryption algorithm. After calculating ZJ using this formula, the core decision module compares it with the preset algorithm fit threshold: AES-128 algorithm is selected when ZJ < 2.5, AES-256 algorithm is selected when 2.5 ≤ ZJ < 4.5, ECC-256 algorithm is selected when 4.5 ≤ ZJ < 6.5, RSA-2048 algorithm is selected when 6.5 ≤ ZJ < 8.5, and RSA-4096 algorithm is selected when ZJ ≥ 8.5.

[0035] The technical effects achieved by this solution include: providing a quantitative basis for the selection of encryption algorithms, comprehensively considering the impact of environmental interference, equipment resources and data sensitivity, realizing the dynamic optimal selection of encryption algorithms, and improving the scientificity and adaptability of encryption solutions.

[0036] Traditional technical solutions have the following technical problems: the key length of existing encryption systems is fixed and cannot be dynamically adjusted according to changes in environment, resources and data volume, resulting in insufficient security if the key length is too short or affecting encryption efficiency if the key length is too long.

[0037] Based on this, the core decision module determines the key length using a dynamic key length calculation formula based on the encryption algorithm adaptation coefficient. The dynamic key length calculation formula is as follows: ; Where ML represents the key length, ZJ represents the encryption algorithm adaptation coefficient, Y represents the network transmission delay, N represents the memory utilization rate, S represents the data volume, δ is the adaptation coefficient adjustment coefficient, and ε is the memory utilization rate weighting coefficient. δ and ε are both positive real numbers, obtained through system performance testing and calibration.

[0038] The technical solution is described below: The dynamic key length calculation formula, based on the encryption algorithm adaptation coefficient, further integrates three key factors: network transmission status, memory resources, and data volume, to achieve precise dynamic adjustment of the key length. The definitions and technical details of each parameter are as follows: Key length ML is the final output parameter, measured in bits, and its value must be an integer multiple of 8 to ensure compatibility with the key length requirements of mainstream encryption algorithms. Its value range is 128 bits to 4096 bits. The encryption algorithm adaptation coefficient ZJ is the result of the preceding calculations, a dimensionless parameter ranging from 0 to 10, directly reflecting the adaptation characteristics of the encryption algorithm and providing a basis for key length calculation. The network transmission delay Y is measured in milliseconds, ranging from 1 millisecond to 1000 milliseconds. A smaller Y value indicates a faster network transmission speed, supporting longer key lengths. Therefore, the reciprocal of Y is used to reflect its positive impact on key length, ensuring that a smaller transmission delay allows for a larger adjustment range of the key length. Memory utilization N is a dimensionless parameter, ranging from 0 to 100. A larger N value indicates a higher memory load and weaker support for long-key encryption. The 3 / 2 power of N term is used to strengthen its constraint effect, preventing memory overflow caused by excessively long keys when memory load is high. Data size S is measured in bytes, ranging from 0 bytes to 1073741824 bytes (1GB). Larger data sizes require longer keys to ensure encryption security. The positive impact is reflected by the √(S+1) term, and the S+1 setting avoids the situation where S=0 is meaningless. Both the adjustment coefficient δ and the weighting coefficient ε are dimensionless positive real numbers. Their calibration process was completed through system performance testing: 10 different ZJ values ​​(1 to 10), 10 Y values ​​(10 milliseconds to 1000 milliseconds), 10 N values ​​(5% to 95%), and 10 S values ​​(1KB to 1GB) were selected, forming 10,000 test scenarios. In each scenario, the encryption security and execution efficiency of different key lengths were tested. The optimal key length was determined with the goal of achieving the required security strength and minimizing execution latency. The relationship between the optimal key length and each parameter was fitted using a nonlinear least squares method, yielding δ = 12.8, ε = 0.003, and a goodness-of-fit R0. 2 =0.97, ensuring that the calculated ML achieves a balance between security and efficiency requirements. After the core decision module calculates the ML, it rounds it to make it an integer multiple of 8. If the ML is less than 128, it is rounded to 128; if it is greater than 4096, it is rounded to 4096, ensuring that the key length is within a reasonable range.

[0039] Modified key length formula middle, Through 10 types Values ​​(1-10), 10 types Values ​​(10ms-1000ms), 10 types Value (5%-95%), 10 types The system performance was recalibrated using 10,000 sets of values ​​(1KB-1GB) to determine the final system performance. , goodness of fit This ensures that the key length calculation result meets both security and efficiency requirements.

[0040] The technical effects achieved by this solution include: enabling dynamic and precise adjustment of key length, comprehensively considering the impact of algorithm adaptability, transmission status, memory resources and data volume, ensuring encryption security while also taking into account encryption execution efficiency.

[0041] Traditional technical solutions have the following technical problems: existing encryption systems lack clear classification of encryption strength levels, and the adjustment of encryption strategies lacks hierarchical basis, resulting in a mismatch between encryption strength and actual needs.

[0042] Based on this, the encryption configuration generated by the core decision module also includes an encryption strength level. The encryption strength level is determined based on the encryption algorithm adaptation coefficient and the key length. The core decision module maps the combination value of the encryption algorithm adaptation coefficient and the key length to a preset encryption strength level range through a preset mapping relationship. The encryption strength level range includes a low strength range, a medium strength range, and a high strength range.

[0043] The technical solution is described below: The encryption strength level classification is a quantitative representation of the security level of the encryption scheme by the core decision-making module, providing a clear basis for hierarchical adjustment of the encryption strategy. The core decision-making module first calculates the combined value of the encryption algorithm adaptation coefficient ZJ and the key length ML. The calculation method for the combined value is: Combined Value = ZJ × (ML / 1024), where ML is in bits, divided by 1024 to convert to kilobits, ensuring the magnitude of the combined value is consistent with ZJ. The combined value is a dimensionless parameter, ranging from 0 to 40. The core decision-making module has a built-in preset mapping table, which is determined through multi-scenario security testing. The test scenarios cover different application scenarios, including general office scenarios, industrial control scenarios, government communication scenarios, and financial transaction scenarios. In each scenario, professional security testing tools are used to evaluate the encryption security strength corresponding to different combined values. Combined with industry security standards, the critical values ​​for each strength level range are determined. The mapping table is divided as follows: Combination values ​​< 5 correspond to the low-strength range, with a low encryption strength level; 5 ≤ combination value < 15 correspond to the medium-strength range, with a medium encryption strength level; and combination values ​​≥ 15 correspond to the high-strength range, with a high encryption strength level. The low-strength level is suitable for low-sensitivity data such as general office data, used in secure environments and resource-constrained situations. The preferred encryption algorithm is AES-128, with a key length of 128 to 256 bits, and software execution is the preferred execution mode. The medium-strength level is suitable for general sensitive data such as industrial control data, used in normal environments and resource conditions. The preferred encryption algorithm is AES-256 or ECC-256, with a key length of 256 to 1024 bits, and the execution mode can be selected based on resource availability. The high-strength level is suitable for highly sensitive data such as government data and financial transaction data, used in complex environments and with sufficient resources. The preferred encryption algorithm is RSA-2048 or RSA-4096, with a key length of 1024 to 4096 bits, and hardware acceleration is the preferred execution mode. The mapping table can be dynamically adjusted through the system configuration interface to adapt to the security needs of different industries.

[0044] The technical effects achieved by this solution include: establishing a hierarchical encryption strength system, providing a clear basis for adjusting encryption strategies, ensuring that encryption strength is accurately matched with actual needs, and improving the flexibility and practicality of the encryption system.

[0045] Traditional technical solutions have the following technical problems: existing encryption systems have problems such as outliers and inconsistent dimensions in the perception data, which can lead to inaccurate encryption configuration if used directly for decision-making.

[0046] Based on this, the preprocessing process of the context-aware module includes data cleaning, data standardization, and data fusion. The data cleaning process removes outliers from the collected data, the data standardization process converts collected data of different dimensions into standardized data with the same value range, and the data fusion process merges multiple collected data of the same type into a single data value through a weighted average algorithm.

[0047] The technical solution is described below: The preprocessing unit of the context-aware module adopts an FPGA+CPU collaborative processing architecture. The FPGA is responsible for parallel processing of data cleaning and standardization, while the CPU is responsible for data fusion and anomaly handling, ensuring preprocessing efficiency and accuracy. The data cleaning process uses the 3σ criterion to remove outliers. The preprocessing unit performs statistical analysis on each type of collected data, calculating the mean μ and standard deviation σ of nearly 1000 sampling points. Then, it determines whether the current collected data is within the range of [μ-3σ, μ+3σ]. If it exceeds this range, it is identified as an outlier and removed. Simultaneously, the previous valid data value is used to fill the gap, ensuring data continuity. For data with rapid dynamic changes, such as electromagnetic interference intensity and network transmission delay, a sliding window 3σ criterion is used, with a window size of 100 sampling points. The mean and standard deviation are updated in real time to improve the real-time performance of outlier identification. For data with slower changes, such as ambient temperature and remaining storage space, the window size is 1000 sampling points to reduce computational load. The data standardization process employs a min-max standardization method, uniformly converting collected data of different dimensions to a value range of 0 to 1. The specific calculation formula is: Standardized Data = (Original Data - Minimum Data Value) / (Maximum Data Value - Minimum Data Value). The minimum and maximum data values ​​are determined through historical statistics. The minimum value for electromagnetic interference intensity is 0dB, and the maximum value is 100dB; the minimum value for CPU utilization is 0, and the maximum value is 100; the minimum value for data sensitivity level is 1, and the maximum value is 5. The minimum and maximum values ​​for other parameters are set according to their respective ranges. The standardization process is implemented using the parallel computing unit of the FPGA, with a processing latency of no more than 1 microsecond. The data fusion process, for multiple collected data of the same type, such as four channels of electromagnetic interference intensity data collected by a distributed sensor array, uses a weighted average algorithm to merge them into a single data value. The weighting coefficients are set according to the accuracy and reliability of the acquisition equipment; acquisition equipment with higher accuracy and reliability corresponds to a larger weighting coefficient. Taking electromagnetic interference intensity acquisition as an example, the weighting coefficients of the four sensors are 0.3, 0.25, 0.25, and 0.2, respectively, and the sum of the weighting coefficients is 1. The fused data = sensor 1 data × 0.3 + sensor 2 data × 0.25 + sensor 3 data × 0.25 + sensor 4 data × 0.2. The weighting coefficients can be adjusted through the system configuration interface to adapt to different deployment environments.

[0048] The preprocessing of the context-aware module also includes a network transmission delay normalization sub-step: normalizing the collected network transmission delay. We use inverse min-max standardization to convert it into a standardized value. , The range of values ​​is fixed. The specific calculation logic is as follows: ,in , The purpose of reverse normalization design is to reduce network transmission latency. The smaller the size, the faster the transmission speed. The larger it is, the more it makes Its contribution to key real length calculation is increased to 20%-30%, avoiding the problems in the original formula. The problem is that the contribution is small.

[0049] The context-aware module's data standardization process replaces the original min-max standardization method with the z-score standardization method. The specific logic is as follows: Data statistics: For each type of collected data, such as electromagnetic interference intensity CPU utilization Real-time statistics of the average value of nearly 1000 valid sampling points. and standard deviation ; Standardized calculation: through formula' 'The original data Convert to standardized data , The range of values ​​is controlled within To avoid the impact of outliers on the standardization results; Dynamic update: Recalculated every 500 sampling points. and And update it to ensure that the standardization results adapt to the dynamic changes in the external environment and equipment resources; Interval mapping: Transformed by linear mapping The interval data satisfies the core decision-making module's requirement for the range of input parameter values, and the mapping formula is ' '.

[0050] The technical effects achieved by this solution include: improving the quality and consistency of perceived data, providing accurate and reliable data input for the core decision-making module, and ensuring the accuracy of encrypted configuration decisions.

[0051] Traditional technical solutions have the following technical problems: the execution unit structure of existing encryption systems is simple and cannot flexibly select hardware or software execution paths according to encryption configuration, resulting in low encryption execution efficiency.

[0052] Based on this, the secure execution module includes an encryption algorithm library, a key management unit, and an execution control unit. The encryption algorithm library stores a variety of encryption algorithms. The key management unit dynamically generates keys based on the key length generated by the core decision module. The execution control unit calls the corresponding encryption algorithm from the encryption algorithm library to perform encryption operations based on the encryption algorithm type, key, and encryption execution mode in the encryption configuration.

[0053] The technical solution is described below: The secure execution module adopts a hardware-software co-design. Each unit interacts with the others via an internal bus with a speed of 1GHz, ensuring rapid transmission of instructions and data. The encryption algorithm library stores various mainstream encryption algorithms, including symmetric encryption algorithms AES-128, AES-256, and SM4, and asymmetric encryption algorithms RSA-2048, RSA-4096, ECC-256, and SM2. Each algorithm provides both hardware-accelerated and software-executed implementations. The software version of the algorithm is written in C language, supports 32-bit and 64-bit operating systems, and the optimized code execution efficiency is 30% higher than that of the open-source algorithm library. The hardware version of the algorithm is embedded in the encryption chip, achieving parallel computation through hardware circuitry, resulting in an encryption speed 5 to 10 times faster than the software version. The key management unit incorporates a random number generator compliant with national cryptographic standards. It uses physical noise sources to generate seeds and employs the SHA-256 algorithm for entropy enhancement. The generated random numbers conform to the NISTSP800-90B standard, ensuring key security. The key management unit dynamically generates corresponding keys based on the key length generated by the core decision module. The generation process includes three steps: seed generation, entropy extraction, and key expansion. The generated keys are stored in the secure storage area of ​​the encryption chip, protected by AES-256 encryption to prevent key leakage. The secure storage area also supports periodic key updates and destruction, with the update cycle configurable from 1 hour to 7 days via system configuration. The execution control unit uses an ARM Cortex-M7 processor with a clock speed of 480MHz and incorporates an encryption configuration parsing engine and execution path selection logic. After receiving the encryption configuration from the core decision module, the execution control unit parses the encryption algorithm type, key identifier, and encryption execution mode, and retrieves the corresponding key from the key management unit using the key identifier. When the encryption execution mode is hardware accelerated, the execution control unit sends the algorithm selection command, key, and data to be encrypted to the encryption chip via the PCIe 4.0 interface. The encryption chip then returns the ciphertext after encryption. When the encryption execution mode is software executed, the execution control unit calls the corresponding software version algorithm from the encryption algorithm library and uses the system CPU resources to complete the encryption operation. During encryption, data is transmitted through a memory encryption channel, which uses AES-128 for real-time encryption of memory data to prevent data leakage in memory. The execution control unit also has a built-in encryption result verification module to perform integrity verification on the encrypted ciphertext, ensuring the correctness of the encryption operation.

[0054] The technical effects achieved by this solution include: enabling flexible selection of encryption execution paths, improving encryption execution efficiency, and ensuring key security and the standardization of encryption operations.

[0055] Traditional technical solutions have the following technical problems: once the encryption strength of existing encryption systems is determined, it is no longer adjusted, and it cannot respond to dynamic changes in environmental temperature, storage resources and data real-time requirements, resulting in insufficient adaptability of encryption strength.

[0056] Based on this, the core decision module performs real-time calibration of the encryption strength level through a dynamic encryption strength calibration formula, which is expressed as follows: ; Where JJ represents the calibrated encryption strength value, ZJ represents the encryption algorithm adaptation coefficient, ML represents the key length, T represents the ambient temperature, K represents the remaining storage space, R represents the data real-time requirement, η is the comprehensive calibration coefficient, θ is the temperature influence adjustment coefficient, and λ is the storage space weight coefficient. η, θ, and λ are all positive real numbers, obtained through multi-scenario testing and calibration. The core decision module adjusts the encryption strength level in the encryption configuration based on the calibrated encryption strength value. The technical solution of this scheme is described as follows: The dynamic encryption strength calibration model is the key model for the core decision module to achieve real-time dynamic adjustment of encryption strength. Based on the initial encryption strength level, three dynamic influencing factors are introduced to further improve the adaptability of the encryption scheme. The definitions and technical details of each parameter are as follows: The calibrated encryption strength value JJ is a dimensionless parameter, ranging from 0 to 10, used to accurately characterize the encryption strength. The larger the value, the higher the encryption strength. The encryption algorithm adaptation coefficient ZJ and the key length ML are the results of the preceding calculations. ZJ ranges from 0 to 10, and ML ranges from 128 bits to 4096 bits. Their product constitutes the initial encryption strength basis. The ambient temperature T is measured in degrees Celsius and ranges from -40℃ to 85℃. Temperatures that are too high or too low can affect the performance of the hardware encryption chip, leading to a decrease in encryption strength. Therefore, (1+θ×T) -1 The T item adjusts the encryption strength. -1 The setting allows for a larger adjustment range as the temperature decreases, avoiding security risks caused by hardware performance degradation in low-temperature environments. The remaining storage space K is measured in bytes, ranging from 0 bytes to 1073741824 bytes. A larger K value indicates more abundant storage resources, supporting stronger encryption operations, through (1-λ×e...). - ᵏ) reflects its impact, e -The exponential form of ᵏ allows for a larger adjustment range when the K value is small, and a more stable adjustment range when the K value is large, avoiding overcalibration when storage resources are sufficient. The data real-time requirement R is a dimensionless parameter, ranging from 1 to 3, corresponding to low, medium, and high real-time levels respectively. A larger R value indicates a higher real-time requirement and stricter requirements for encryption latency. The √R term reflects its inverse effect on encryption strength, ensuring that the higher the real-time requirement, the smoother the encryption strength calibration range, balancing real-time performance and security. The comprehensive calibration coefficient η, temperature influence adjustment coefficient θ, and storage space weight coefficient λ are all dimensionless positive real numbers. Their calibration process was completed through multi-scenario testing: 10 ZJ values ​​(1 to 10), 10 ML values ​​(128 bits to 4096 bits), 10 T values ​​(-40℃ to 85℃), 10 K values ​​(0 bytes to 1GB), and 10 R values ​​(1 to 3) were selected, forming a total of 100,000 test scenarios. In each scenario, the encryption strength adaptation effect corresponding to different calibration parameters was tested. The optimal calibration parameters were determined with the goal of achieving security strength standards and meeting real-time requirements. Through multivariate nonlinear regression analysis, η=0.0025, θ=50, and λ=0.0000001 were obtained, with a goodness of fit R... 2 =0.96, ensuring that the calibrated JJ accurately reflects the dynamically changing actual needs. The core decision module compares the calibrated JJ with the preset strength level thresholds: JJ < 3 corresponds to a low strength level, 3 ≤ JJ < 7 corresponds to a medium strength level, and JJ ≥ 7 corresponds to a high strength level. Based on the comparison results, the encryption strength level in the encryption configuration is adjusted. The calibration cycle is consistent with the data acquisition cycle, which is 100Hz, to ensure real-time dynamic adaptation of the encryption strength.

[0057] Key length rounding rule explanation: The core decision module calculates the initial key length. Then, the key length must be rounded to a multiple of 8 according to the following rules to ensure compatibility with the key length requirements of mainstream encryption algorithms such as AES, RSA, and ECC: The rounding formula is ,in This is a rounding function. 128 bits is the lower limit of the key length to ensure basic security, and 4096 bits is the upper limit of the key length to avoid excessive consumption of system resources.

[0058] Rounding rule example explanation: Specific examples are as follows: ① If the initial Bit, , ,but Bits; ② If the initial Bits (below the lower limit), then Bit; ③ If the initial Bits (above the upper limit), then Bits; ④ If the initial If the number of bits is a multiple of 8 and within the upper and lower limits, then... Bit.

[0059] The technical effects achieved by this solution include: enabling dynamic real-time calibration of encryption strength, comprehensively responding to changes in temperature, storage resources, and data real-time requirements, further enhancing the dynamic adaptability of the encryption solution, and ensuring that encryption security matches actual needs in real time.

[0060] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. An intelligent dynamic data encryption and adjustment system, comprising: The system comprises a context-aware module, a core decision-making module, and a secure execution module. The context-aware module collects and preprocesses input signals related to encryption decisions. The core decision-making module receives input signals and makes encryption decisions. The secure execution module receives encryption configuration descriptions and transforms them into actual calls to underlying encryption hardware or software libraries. The system is characterized by the context-aware module simultaneously collecting external environmental indicators, current device computing resource usage, and the characteristics of the data to be encrypted. The core decision-making module dynamically generates an encryption configuration containing encryption algorithm type, key length, and encryption execution mode based on the preprocessed results of these indicators. The secure execution module adaptively calls the corresponding underlying encryption hardware or software library to perform data encryption operations according to the encryption configuration.

2. The intelligent dynamic data encryption and adjustment system according to claim 1, characterized in that, The context-aware module collects external environmental indicators including electromagnetic interference intensity, network transmission delay, and ambient temperature. The context-aware module collects electromagnetic interference intensity through a distributed sensor array, calculates network transmission delay through the difference in network data packet timestamps, and collects ambient temperature through an embedded temperature sensor.

3. The intelligent dynamic data encryption and adjustment system according to claim 2, characterized in that, The context-aware module collects information on device computing resource usage, including CPU utilization, memory utilization, and remaining storage space. The context-aware module reads CPU utilization in real time through the system kernel interface, calculates memory utilization through memory page tables, and obtains remaining storage space through storage medium read / write status monitoring.

4. The intelligent dynamic data encryption and adjustment system according to claim 3, characterized in that, The context-aware module collects the characteristics of the data to be encrypted, including data sensitivity level, data volume, and data real-time requirements. The context-aware module extracts the data sensitivity level by identifying the data packet header, obtains the data volume by counting the number of bytes in the data block, and determines the data real-time requirements by parsing the application layer transport protocol fields.

5. The intelligent dynamic data encryption and adjustment system according to claim 4, characterized in that, The core decision-making module determines the encryption algorithm adaptation coefficient based on collected external environmental indicators, equipment computing resource usage, and the characteristics of the data to be encrypted, using the encryption algorithm adaptation coefficient calculation formula. The encryption algorithm adaptation coefficient calculation formula is as follows: ； Where ZJ represents the encryption algorithm adaptation coefficient, D represents the electromagnetic interference intensity, C represents the CPU utilization rate, M represents the data sensitivity level, α is the electromagnetic interference intensity calibration coefficient, β is the CPU utilization rate calibration coefficient, and γ is the data sensitivity level calibration coefficient. α, β, and γ are all non-zero positive numbers, obtained through experimental data calibration.

6. The intelligent dynamic data encryption and adjustment system according to claim 5, characterized in that, The core decision module determines the key length based on the encryption algorithm adaptation coefficient and through a dynamic key length calculation formula. The dynamic key length calculation formula is as follows: ； Where ML represents the key length, ZJ represents the encryption algorithm adaptation coefficient, Y represents the network transmission delay, N represents the memory utilization rate, S represents the data volume, δ is the adaptation coefficient adjustment coefficient, and ε is the memory utilization rate weighting coefficient. δ and ε are both positive real numbers, obtained through system performance testing and calibration.

7. The intelligent dynamic data encryption and adjustment system according to claim 6, characterized in that, The encryption configuration generated by the core decision module also includes an encryption strength level, which is determined based on the encryption algorithm adaptation coefficient and the key length. The core decision module maps the combination value of the encryption algorithm adaptation coefficient and the key length to a preset encryption strength level range through a preset mapping relationship. The encryption strength level range includes a low strength range, a medium strength range, and a high strength range.

8. The intelligent dynamic data encryption and adjustment system according to claim 1, characterized in that, The preprocessing process of the context-aware module includes data cleaning, data standardization, and data fusion. The data cleaning process removes outliers from the collected data. The data standardization process converts collected data with different dimensions into standardized data with the same value range. The data fusion process combines multiple collected data of the same type into a single data value through a weighted average algorithm.

9. The intelligent dynamic data encryption and adjustment system according to claim 1, characterized in that, The secure execution module includes an encryption algorithm library, a key management unit, and an execution control unit. The encryption algorithm library stores a variety of encryption algorithms. The key management unit dynamically generates keys based on the key length generated by the core decision module. The execution control unit calls the corresponding encryption algorithm from the encryption algorithm library to perform encryption operations based on the encryption algorithm type, key, and encryption execution mode in the encryption configuration.

10. The intelligent dynamic data encryption and adjustment system according to claim 7, characterized in that, The core decision-making module performs real-time calibration of the encryption strength level through a dynamic encryption strength calibration formula, which is expressed as follows: ； Where JJ represents the calibrated encryption strength value, ZJ represents the encryption algorithm adaptation coefficient, ML represents the key length, T represents the ambient temperature, K represents the remaining storage space, R represents the data real-time requirement, η is the comprehensive calibration coefficient, θ is the temperature influence adjustment coefficient, and λ is the storage space weight coefficient. η, θ, and λ are all positive real numbers, obtained through multi-scenario testing and calibration. The core decision module adjusts the encryption strength level in the encryption configuration based on the calibrated encryption strength value.

Images