A VPN dynamic layered encryption system and method for cross-border data transmission

Abstract

This application relates to the field of data encryption technology, specifically a VPN dynamic layered encryption system and method for cross-border data transmission. The method includes: dividing the data stream into different layers based on information entropy; utilizing low-entropy redundant space to embed high-entropy core data via chaotic algorithms through steganography; implementing full-domain basic encryption on the hybrid carrier, and performing chaotic scrambling and differentiated iterative diffusion for the steganography area and medium-entropy area respectively; dynamically injecting fill blocks based on entropy feedback to achieve traffic uniformity shaping; and splitting and covertly distributing the deconstruction index through threshold secret sharing. This method effectively improves the concealment and security of cross-border data transmission.

Description

Technical Field

[0001] This application relates to the field of data encryption technology, specifically a VPN dynamic layered encryption system and method for cross-border data transmission. Background Technology

[0002] In the current field of cross-border network data transmission technology, Virtual Private Networks (VPNs) are a common means of ensuring data privacy. However, with the development of Deep Packet Inspection (DPI) technology, traditional VPN transmission mechanisms face serious challenges in terms of traffic concealment and resistance to identification.

[0003] Existing encrypted transmission schemes typically employ homogeneous full encryption of the transmitted data stream, meaning they uniformly convert the data to ciphertext without distinguishing its inherent attributes (such as information density or randomness). While this approach masks the plaintext content, it results in the encrypted data stream exhibiting highly distinctive statistical characteristics: on one hand, the ciphertext stream often displays a continuous, unnatural state of extremely high entropy, significantly differing from the statistical distribution of ordinary business traffic; on the other hand, if the plaintext data itself possesses specific structured characteristics, simple full encryption may not completely erase the dynamic fluctuations in the data stream's entropy (i.e., the peak-valley distribution characteristics of entropy), allowing traffic analysis systems to identify the existence of VPN tunnels through statistical methods.

[0004] Furthermore, critical control information used for data decryption, reconstruction, and location (such as index tables and parameter configurations) typically relies on standard handshake protocols or fixed header structures for centralized or explicit transmission. This static metadata transmission mode makes the data stream deconstruction logic easily located by traffic monitoring devices, thereby leading to the risk of the transmission channel being identified, blocked, or targeted for interference.

[0005] In view of this, this application proposes a VPN dynamic layered encryption system and method for cross-border data transmission. Summary of the Invention

[0006] To achieve the above objectives, this application provides a VPN dynamic layered encryption system and method for cross-border data transmission, the specific technical solution of which is as follows:

[0007] A VPN dynamic layered encryption method for cross-border data transmission includes:

[0008] Calculate the information entropy value of the data stream to be transmitted, divide the data into different entropy levels according to the preset dual thresholds, and generate a hierarchical mapping table that records the hierarchical affiliation and original position offset of each data block.

[0009] Scan the redundant bits of the protocol padding field and repeated data blocks in the low-entropy redundant layer to determine the available embedding capacity. When the capacity is sufficient, use a chaotic sequence-controlled dispersion algorithm to discretize and embed the high-entropy core layer data into the carrier space. When the capacity is insufficient, only embed the encryption seed and location digest of the core data to generate a steganographic location mapping vector and a hybrid data carrier.

[0010] A full-domain encryption algorithm is used to process the hybrid data carrier containing embedded data. At the ciphertext level, chaotic scrambling transformation is superimposed on the embedded region based on the steganographic location mapping vector. Iterative diffusion processing is used for the medium-entropy business layer region.

[0011] Monitor the entropy distribution curve of the encrypted data stream, inject high-entropy filler blocks generated by a deterministic pseudo-random generator in the low entropy region, and insert compressible structured redundant blocks in the high entropy region. Each filler block carries a type identifier for the receiver to identify and strip.

[0012] The hierarchical mapping table, steganographic location mapping vector, and padding block location table are integrated into a deconstructed index set. A threshold secret sharing mechanism is used to split it into multiple shares and encrypt them separately. Each share is then embedded into the header extension field and payload reserved area of ​​multiple consecutive data packets and encapsulated into the VPN tunnel for transmission.

[0013] Preferably, the data stream is sampled by a sliding window of fixed size and a sliding step size, and the continuous data stream is discretized into data blocks;

[0014] Calculate the information entropy of each data block, obtain the entropy value sequence corresponding to the data block sequence, and divide all data blocks into different entropy levels based on the preset dual thresholds, including high entropy threshold and low entropy threshold, including high entropy core layer, medium entropy business layer and low entropy redundancy layer.

[0015] After completing the hierarchical division of all data blocks, a hierarchical mapping table is generated to record the hierarchical affiliation of each data block and its position information in the original data stream.

[0016] The specific contents recorded in the hierarchical mapping table include: data block index, original position offset, and hierarchy identifier; the original position offset indicates the starting byte position of the data block in the original data stream, and the hierarchy identifier is used to indicate the hierarchy to which the data block belongs.

[0017] Preferably, all data blocks marked as low-entropy redundancy layers are scanned to calculate the available redundant bits in the low-entropy redundancy layer data blocks;

[0018] Based on the scan results, the available embedding capacity is calculated. The total available embedding capacity is the sum of the bit capacity contributed by all available carrier bytes.

[0019] After calculating the available embedding capacity, determine whether the available embedding capacity is sufficient by comparing the total number of bits of all data blocks in the high-entropy core layer with the total embedding bit capacity. If the total embedding bit capacity is greater than or equal to the total number of bits of all data blocks in the high-entropy core layer, the capacity is considered sufficient; if the total embedding bit capacity is less than the total number of bits of all data blocks in the high-entropy core layer, the capacity is considered insufficient, and the backup plan is activated.

[0020] The backup plan's data packet to be embedded includes an encryption seed for decrypting core data, and a location digest for ensuring data integrity and location accuracy.

[0021] Calculate the total number of bits for the encryption seed and the location digest, and perform a capacity check again to see if the total embedding bit capacity can accommodate the total number of bits for the encryption seed and the location digest. If it can, use the data packet composed of the encryption seed and the location digest as the embedding object; if it cannot, abandon the steganography operation in this round of data stream.

[0022] Preferably, after determining the data to be embedded, a chaotic sequence-controlled dispersion algorithm is used to discretely embed the data to be embedded into the determined carrier bits.

[0023] During the embedding process, a steganographic location mapping vector is generated to record the absolute address of the original data to be embedded into the hybrid data carrier.

[0024] After all embeddings are completed, the data blocks of the low-entropy redundant layer have been modified. The modified low-entropy redundant layer data blocks and the original medium-entropy business layer data blocks together form a new data set, resulting in a hybrid data carrier.

[0025] Preferably, the data in the hybrid data carrier is subjected to full-domain encryption, treating the entire hybrid data carrier as a continuous plaintext stream and using a block cipher algorithm for full-domain encryption.

[0026] The hybrid data carrier is transformed into homogenized ciphertext through an encryption algorithm. Based on the generated steganographic location mapping vector, a superimposed chaotic scrambling transformation is performed on the ciphertext region containing the embedded data.

[0027] Preferably, an iterative diffusion process is used for the medium-entropy service layer. Based on the hierarchical mapping table, all ciphertext blocks in the ciphertext stream corresponding to the original medium-entropy service layer are identified, and additional lightweight encryption transformations are added.

[0028] After iteration, a new ciphertext block is obtained, replacing the original ciphertext.

[0029] Preferably, the encrypted data stream after full-domain encryption and layered differential enhancement processing is shaped;

[0030] The ciphertext data stream is sampled using a sliding window method, and the information entropy value of each window's data is calculated. The information entropy values ​​of all window data in the ciphertext data stream are then calculated to obtain the entropy distribution curve describing the change of the ciphertext stream's entropy value with position.

[0031] Low-entropy thresholds and high-entropy thresholds are set respectively. When a low-entropy region is detected, a high-entropy filler block is injected; when a high-entropy region is detected, a compressible structured redundant block is inserted.

[0032] Preferably, during the data stream shaping process, a fill block location table is generated. Whenever an injection or insertion operation is performed, the specific information of the corresponding operation is recorded, including: the absolute offset position of the insertion point in the original encrypted data stream, the type identifier of the insertion block, and the total length of the insertion block.

[0033] Preferably, a deconstructed index set is constructed and serialized by concatenating the hierarchical mapping table, the steganographic location mapping vector, and the padding block location table, and converting them into a continuous byte stream using a binary serialization format, which serves as the deconstructed index set.

[0034] The destructuring index set is split into multiple shares using a threshold secret sharing mechanism.

[0035] After generating the shares, each share is independently encrypted. The encrypted shares are then concealed, distributed, embedded, and tunneled before being sent to the destination over the network.

[0036] A VPN dynamic layered encryption system for cross-border data transmission is provided, which implements a VPN dynamic layered encryption method for cross-border data transmission, including: an entropy layer partitioning module, a redundancy embedding module, a layered encryption module, an entropy rectification module, and a split transmission module.

[0037] The entropy layer division module calculates the information entropy value of the data stream to be transmitted, divides the data into different entropy levels according to preset dual thresholds, and generates a hierarchical mapping table that records the hierarchical affiliation and original position offset of each data block.

[0038] The redundant embedding module scans the redundant bits of the protocol padding field and repeated data blocks in the low-entropy redundant layer to determine the available embedding capacity. When the capacity is sufficient, a chaotic sequence-controlled dispersion algorithm is used to discretize and embed the high-entropy core layer data into the carrier space. When the capacity is insufficient, only the encryption seed and location digest of the core data are embedded to generate a steganographic location mapping vector and a hybrid data carrier.

[0039] The layered encryption module performs full-domain processing on the hybrid data carrier containing embedded data using an encryption algorithm. At the ciphertext level, it superimposes chaotic scrambling transformation on the embedded region based on the steganographic location mapping vector, and performs iterative diffusion processing on the medium-entropy business layer region.

[0040] The entropy rectification module monitors the entropy distribution curve of the encrypted data stream, injects high-entropy filler blocks generated by a deterministic pseudo-random generator in the low entropy region, and inserts compressible structured redundant blocks in the high entropy region. Each filler block carries a type identifier for the receiving end to identify and strip.

[0041] The split transmission module integrates the hierarchical mapping table, the steganographic location mapping vector, and the padding block location table into a deconstructed index set. It then uses a threshold secret sharing mechanism to split the index into multiple shares and encrypts them separately. Each share is then embedded into the header extension fields and payload reserved areas of multiple consecutive data packets and encapsulated into a VPN tunnel for transmission.

[0042] The beneficial effects of this application are as follows: This application uses information entropy dual threshold layering and generates a layer mapping table, which can accurately distinguish between high-entropy sensitive data and low-entropy redundant data, making subsequent encryption and steganography processing more targeted, reducing unnecessary high-strength encryption overhead, and improving overall processing efficiency and security resource utilization.

[0043] This application achieves a dynamic balance between steganography strength and capacity by scanning low-entropy redundant bits and evaluating available capacity. This allows for adaptive selection of embedding complete core data or only embedding cryptographic seeds and location digests, thereby improving the concealment of high-entropy core data while avoiding the exposure of anomalous features caused by over-embedding.

[0044] This application first encrypts the entire hybrid carrier, and then superimposes chaotic scrambling and hierarchical diffusion on the ciphertext layer. This adds a second nonlinear perturbation in addition to unified encryption, making both the embedded region and the medium-entropy service layer exhibit highly confused characteristics, enhancing resistance to statistical analysis and local cracking, while controlling the overall computational overhead.

[0045] This application monitors the entropy distribution, injects high-entropy blocks in the trough area and inserts compressible redundant blocks in the peak area, which can smooth the data flow entropy curve, make the overall traffic statistics more uniform, reduce the probability of being detected by traffic fingerprinting and anomaly detection systems, and ensure reversible recovery at the receiving end by relying on type identification.

[0046] This application integrates multiple indexes and then uses threshold secret sharing to split and embed multiple packet headers and payloads in a distributed manner. This avoids the exposure of the global structure caused by single point of leakage, improves the confidentiality and integrity of index information, and enhances the resistance to eavesdropping and replay attacks by utilizing the multi-packet transmission characteristics of VPN tunnels.

[0047] The technical solution of this application realizes integrated processing of entropy layering, steganography embedding, ciphertext-level chaotic transformation and entropy shaping in cross-border VPN transmission, so that sensitive data can be concealed and disguised in terms of content and traffic characteristics at the same time, which significantly improves resistance to traffic censorship, statistical analysis and feature detection, and ensures performance and compatibility with existing VPN protocols while ensuring reversible recovery. It is suitable for high-security cross-border data transmission and privacy compliance scenarios. Attached Figure Description

[0048] Figure 1 A flowchart of a VPN dynamic layered encryption method for cross-border data transmission is provided in this application;

[0049] Figure 2 Flowchart of redundant space exploration and core data steganography provided for this application;

[0050] Figure 3 A flowchart of the full-domain basic encryption and layered differential enhancement processing provided for this application;

[0051] Figure 4 A flowchart of flow uniformity shaping based on entropy feedback provided for this application;

[0052] Figure 5 This application provides a diagram of a VPN dynamic layered encryption system architecture for cross-border data transmission. Detailed Implementation

[0053] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the specific embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0054] Many specific details are set forth in the following description in order to provide a full understanding of this application. However, this application may also be implemented in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this application. Therefore, this application is not limited to the specific embodiments disclosed below.

[0055] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of this application. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single embodiment or an embodiment selectively excluded from other embodiments.

[0056] Example 1

[0057] Reference Figures 1 to 4 This is the first embodiment of the present application, such as Figure 1 As shown, a VPN dynamic layered encryption method for cross-border data transmission is provided.

[0058] Step 1: Calculate the information entropy value of the data stream to be transmitted, divide the data into different entropy levels according to the preset dual thresholds, and generate a hierarchical mapping table that records the hierarchical affiliation and original position offset of each data block.

[0059] For input data stream Perform sliding window sampling, setting a fixed-size sliding window with a byte length of [value missing]. And a fixed sliding step size, the length of which is byte-length. From data stream Starting from the initial position, extract the first segment of length . The data block is denoted as The window then slides forward. 1 byte, truncate the second length to 1 byte The data block is denoted as This process continues until the entire data stream to be transmitted is covered, thus connecting the continuous data stream. Discretized into a series of data blocks { },in, For the first There are several data blocks, where i is the variable index of the data block. Window size. The choice of step size needs to balance computational efficiency and statistical validity. This determines the overlap between adjacent data blocks, using a value less than... The step size (i.e., the overlapping window) helps to capture changes in data features more smoothly and avoids missing key patterns due to block boundary segmentation. By using sliding window sampling, the macroscopic data stream is transformed into independently analyzable data units, enabling preprocessing for quantitative analysis of local data features.

[0060] Calculate each sampled data block Information entropy, a key indicator for measuring the uncertainty or information content of data, is calculated in this step using Shannon's information entropy formula to determine the entropy value of each data block. The specific calculation method is as follows:

[0061] ;

[0062] in, Represents data blocks The information entropy value is expressed in bits per byte. This represents the total number of different symbols that may appear in a data block, when analyzed on a byte-by-byte basis. The value is 256 because one byte can represent 256 different values ​​from 0 to 255; Representing the A possible symbolic value, i.e., a specific byte value (e.g., byte values ​​0x00, 0x01, ..., 0xFF); log represents the logarithmic function; Represents symbolic value In data blocks The probability of it appearing in; this probability is calculated by the symbol In data blocks Number of times it appears Then divide by the total number of bytes in the data block. The number of bytes captured by the sliding window is used to obtain the result. .

[0063] Perform this calculation on each data block to obtain a sequence of entropy values ​​corresponding to the sequence of data blocks. The calculation of information entropy provides an objective and quantitative basis for subsequent data stratification. High entropy values ​​usually correspond to information-density content such as compressed data, encrypted data, or random data, while low entropy values ​​are often related to redundant information such as protocol padding, blank areas in text data, and repetitive structures.

[0064] Based on preset dual thresholds, including a high-entropy threshold and low entropy threshold All data blocks are hierarchically divided. These two thresholds are configurable parameters set based on long-term statistical analysis of typical cross-border data transmission in the target application scenario.

[0065] Specifically, the rules for hierarchical partitioning of data blocks include: if data blocks Information entropy value This data block is then classified as a high-entropy core layer. High-entropy core layer data is considered the most valuable and sensitive information, such as encryption keys, identity credentials, and core transaction instructions. If... If so, the data block is classified as a medium-entropy business layer. Medium-entropy business layer data typically contains regular business data, such as structured text and application layer interaction data, and has a moderate information density. If If the data block is classified as low-entropy redundancy layer, the data information density of the low-entropy redundancy layer is the lowest, containing a large amount of predictable or repetitive content, such as protocol fill fields, large areas of data with the same background color, etc.

[0066] For example, suppose the window size is set. Bytes, high entropy threshold bits / byte, low entropy threshold bits / byte. For a calculated entropy value Data blocks of bits / bytes ,because This data block was assigned to the high-entropy core layer. For another entropy value... Data blocks of bits / bytes ,because Then it is classified into the medium-entropy business layer. And for an entropy value of... Data blocks of bits / bytes ,because It is classified into a low-entropy redundancy layer. In this way, the internal value of the data stream is automatically identified and separated.

[0067] After all data blocks are hierarchically partitioned, a hierarchical mapping table is generated. This mapping table is a crucial metadata structure; its function is to accurately record the hierarchical affiliation of each data block and its position within the original data stream, ensuring that the original data can be reconstructed flawlessly at the data receiving end.

[0068] For the first in the sequence Data blocks The hierarchical mapping table records an entry that contains at least three key fields: data block index ( ), original position offset ( ) and hierarchical identifiers ( The original position offset is typically calculated as follows: , With a fixed sliding step size in bytes, it specifies the length of the data block in the original data stream. The starting byte position is specified in the table. The level identifier is an enumeration value or a specific code that indicates whether the data block belongs to a high-entropy, medium-entropy, or low-entropy level. The level mapping table provides precise navigation for all subsequent encryption, embedding, and obfuscation operations targeting a specific level, and is the core hub for implementing dynamic leveling strategies and ensuring their reversibility.

[0069] This step, through refined analysis and layering of the data stream based on information entropy, fundamentally changes the traditional VPN processing model that treats all data as homogeneous information and employs a single encryption strategy. It achieves intelligent perception of the intrinsic value and sensitivity of data, deconstructing a complex data stream into three logically clear and value-distinct layers. This preprocessing not only provides a solid foundation for subsequent steps to implement differentiated and efficient security protection strategies (such as strengthening the protection of high-value data and using the space of low-value data for steganography), but it is also a preliminary form of information obfuscation, as the logical structure of the data has been separated from its physical continuity. This makes it difficult for attackers to directly analyze the internal structure and key protected objects from the apparent characteristics of the data stream, even if they intercept the data, thus improving the overall security of data transmission.

[0070] Step 2: Scan the redundant bits of the protocol padding fields and repeating data blocks in the low-entropy redundant layer to determine the available embedding capacity. When the capacity is sufficient, a chaotic sequence-controlled dispersion algorithm is used to discretize and embed the high-entropy core layer data into the carrier space. When the capacity is insufficient, only the encryption seed and location digest of the core data are embedded, generating a steganography mapping vector and a hybrid data carrier. See also Figure 2 This is a flowchart of the redundancy space detection and core data steganography process for this step.

[0071] All data blocks marked as low-entropy redundancy layers are scanned to detect available redundant bits. The detection primarily targets two types of targets: first, protocol padding fields, such as fixed-value bytes (e.g., all zeros or all spaces) padded for alignment or preservation purposes in certain network protocols or file formats. The values ​​of these bytes can be safely modified in some bits (usually the least significant bit, LSB) without affecting protocol parsing and functionality; second, repeating data blocks, i.e., regions with extremely low information entropy containing a large number of consecutive identical byte values. These low-entropy data blocks are analyzed byte-by-byte to identify carrier bytes that conform to preset rules and can be used for information embedding. A byte is determined to be a carrier byte if it belongs to a known padding pattern or a long repeating sequence. Through this scanning process, a list containing the precise locations of all available carrier bytes in the original data stream can be constructed.

[0072] Based on the scan results, the available embedding capacity is calculated, and the total available embedding capacity is determined. It is the sum of the bit capacity contributed by all available carrier bytes. The calculation formula is: ;in, This represents the total number of embedded bits that the low-entropy redundant layer can provide, as calculated in the final analysis. It is the total number of available carrier bytes determined by scanning; Representing the The number of embedded bits that a carrier byte can provide; The value of is a configurable system parameter that defines the embedding depth; for example, if the least significant bit (LSB) is used for embedding, then If the least two significant bits are used for embedding, then Choose the larger one. Values ​​can increase embedding capacity, but they may also cause more significant perturbations to the statistical properties of the carrier data, so a trade-off needs to be made between capacity and concealment.

[0073] After capacity calculation, the dynamic decision-making phase of the embedding strategy is initiated, which determines whether the available embedding capacity is sufficient. Let the total number of bits in all data blocks of the high-entropy core layer be... Total embedded bit capacity With total number of bits If a comparison is made, If the capacity is sufficient, it means that the available space in the low-entropy redundant layer is enough to accommodate all the high-entropy core layer data. If the capacity is insufficient, then directly embedding all core data is no longer feasible, and a backup plan is activated.

[0074] The backup solution's data packet to be embedded consists of two parts, including an encryption seed for subsequent decryption of the core data. It is a short (e.g., 256-bit) random number that will be used as input to the key derivation function (KDF); it also includes a location digest to ensure data integrity and location accuracy. It is a fixed-length digest generated by applying a hash algorithm (such as SHA-256) to the original high-entropy core layer data. Let the total number of bits in these two parts be . ;in Indicates the byte length of the key seed; Represents location summary The length in bytes. Perform the capacity check again. Whether it is large enough to accommodate this much smaller data packet, i.e., to determine Check if the condition is met. If it is met, use this backup data packet as the embedding object; if it is not met, the current data stream will abandon the steganography operation, and the high-entropy data will be processed together with the medium-entropy data in subsequent steps using conventional encryption.

[0075] Once the data to be embedded (whether complete or not) is determined Or a spare pack Afterwards, a chaotic sequence-controlled dispersion algorithm is used to discretely embed the data into the predetermined carrier bits. The purpose of this process is to shuffle the data to be embedded and distribute it randomly in the carrier space to counteract detection of continuous embedding patterns.

[0076] Specifically, choose a chaotic mapping, such as the Logistic mapping: , where the initial value and parameters ( It is derived from a pre-shared secret key. Let d be the d-th mapping value. Iterate through this mapping to generate a pseudo-random floating-point sequence. Perform numerical transformations (such as modulo operations) on this sequence to map it to the position indices of available carrier bits. Then, according to the order of the data bit stream to be embedded, map the d-th bit... The bit is embedded into the th bit generated by the chaotic sequence. The carrier bit pointed to by each unique position index.

[0077] During the embedding process, a steganographic location mapping vector is generated. The vector is a one-dimensional array whose length is equal to the total number of bits of the embedded data. The The first element records the original data to be embedded. Each bit is embedded in the absolute address of the hybrid data carrier (e.g., byte offset and bit position relative to the entire data stream). This mapping vector is the only credential that allows the data receiver to accurately extract the hidden information from the carrier, and it itself constitutes the critical metadata that needs to be securely transmitted.

[0078] After all embedding operations are completed, the original data flow structure changes. The data blocks in the low-entropy redundant layer have been modified to include hidden information; the data blocks in the high-entropy core layer (if capacity is sufficient) are removed from the logical flow, their content broken down and scattered throughout the redundant layers. At this point, the new data set composed of the modified low-entropy redundant layer data blocks and the original medium-entropy business layer data blocks is called a hybrid data carrier. This carrier superficially retains most of the original data flow structure, but internally it carries additional high-value information.

[0079] This step achieves information transfer within the data stream by hiding high-value core data within low-value redundant data, significantly reducing the risk of core data being directly identified and located. Using chaotic sequences for distributed embedding results in a pseudo-random and non-linear distribution of the hidden data, effectively combating steganography attacks based on simple statistical models (such as LSB difference analysis). This method not only hides the core data but also creates a novel, non-uniform protection object for subsequent encryption and obfuscation processing, thereby significantly enhancing the data's resistance to interception and analysis during cross-border transmission.

[0080] Step 3: The hybrid data carrier containing embedded data undergoes full-domain encryption processing using an encryption algorithm. At the ciphertext level, chaotic scrambling transformation is superimposed on the embedded region based on the steganographic location mapping vector. Iterative diffusion processing is then applied to the medium-entropy business layer region. (See also...) Figure 3 This is a flowchart of the full-domain basic encryption and layered differential enhancement processing for this step.

[0081] A fundamental encryption process is applied to the entire data domain of the hybrid data carrier to completely eliminate regional identifiability. In the constructed hybrid data carrier, although its high-entropy core layer is hidden, its original medium-entropy business layer and the low-entropy redundant layer used as the carrier may still retain some structural or statistical characteristics before encryption. To eliminate these potential attack surfaces, the entire hybrid data carrier is treated as a continuous plaintext stream, and a block cipher algorithm of uniform strength is used for full-domain encryption.

[0082] Specifically, the Advanced Encryption Standard (AES) algorithm is selected, operating in Cipher Block Chaining (CBC) mode, with a key length of 256 bits. The encryption process uses a base encryption key derived from the master session key. A randomly generated 128-bit initialization vector is appended to the beginning of the encrypted ciphertext to ensure correct decryption at the receiving end. After this processing, the entire data carrier is transformed into a homogenized ciphertext that appears as a high-entropy pseudo-random sequence. From an external perspective, any statistical information regarding the original data's hierarchical structure (such as medium-entropy or low-entropy regions) is completely masked. This operation provides a homogenized and featureless ciphertext basis for subsequent differential processing, making it impossible for attackers to find potential weaknesses by locating low-entropy regions.

[0083] In the generated homogenized ciphertext Above, based on the steganography location mapping vector generated in step two... A superimposed chaotic scrambling transformation is performed on the ciphertext region containing the core data. The purpose of this is to provide a second, independent layer of security for the hidden core data.

[0084] Specifically, firstly, based on the steganographic location mapping vector Precisely locate homogenized ciphertext Let be the set of all bytes that carry steganographic bits. The total number of bytes it contains is Then, using a key with an independent key An initialized chaotic system (such as a chaotic map based on Chebyshev polynomials) generates a length of permutation sequence The permutation sequence It is from arrive The scrambling process is as follows: (The original text appears to be a list of numbers and symbols, possibly related to a sequence of numbers or symbols. A direct translation wouldn't be meaningful without further context.)

[0085] ;

[0086] in, It is the new set of bytes obtained after scrambling; It is ciphertext The set of raw bytes corresponding to the steganographic position; It is the index of the byte in the set; It is a permutation function generated from a chaotic sequence, which will index... Map to a new index position.

[0087] Will The bytes in the steganography are written back to the ciphertext stream in their original positions, completing the ciphertext-level scrambling of the hidden region. In this way, even the underlying encryption key... Leaked, attackers decrypt What is obtained later is only the scrambled and fragmented core data; the chaos key must also be mastered simultaneously. Only through scrambling algorithms can it be correctly reassembled. This greatly enhances the resilience of core data against cracking, forming a robust data encryption defense.

[0088] Iterative diffusion processing is employed for the medium-entropy service layer region to optimize computational overhead while ensuring sufficient security. Based on the hierarchical mapping table generated in step one, all ciphertext blocks in the ciphertext stream corresponding to the original medium-entropy service layer are identified. An additional lightweight encryption transformation is applied to these ciphertext blocks. This transformation is based on the Feistel network structure, but its iteration rounds are significantly reduced. It is set to a value significantly smaller than that of standard block ciphers (such as 10 / 12 / 14 rounds of AES). For example, it can be set to... A cycle. Each cycle's transformation can be represented as:

[0089] ;

[0090] in, and Representing respectively in the After rounds of iteration, the left and right halves of the currently processed ciphertext block are shown. and It is the result of the previous iteration. This indicates the XOR operation. It is a non-linear round function, for example, it can be a combination structure containing S-box substitution and P-box permutation. It is the first The subkey used in the round is processed by a separate iterative key. It is derived from it.

[0091] go through After rounds of iteration, the final result is obtained The ciphertext is combined into a new ciphertext block, replacing the original ciphertext. Since the data volume of the medium-entropy business layer is usually large, this processing method can further enhance its diffusion and obfuscation properties with a small computational cost on top of the already fully encrypted data, effectively balancing security and VPN transmission performance.

[0092] This step constructs a sophisticated and efficient composite encryption system through a combination of basic encryption and layered differentiated enhancements. Global encryption ensures the overall indistinguishability of the data stream, eliminating attack entry points from a macroscopic perspective. Ciphertext scrambling for the high-entropy core layer provides a second layer of protection for the most critical data assets, independent of basic encryption, achieving in-depth encryption defense. Lightweight iterative processing for the medium-entropy business layer serves as a refined resource allocation strategy, further strengthening the security of this data layer without significantly increasing latency or computational burden, demonstrating a thorough consideration of performance and efficiency in ensuring the security of cross-border data transmission.

[0093] Step 4: Monitor the entropy distribution curve of the encrypted data stream. Inject high-entropy filler blocks generated by a deterministic pseudo-random generator into regions with low entropy values, and insert compressible structured redundant blocks into regions with high entropy values. Each filler block carries a type identifier for the receiver to identify and strip. See also Figure 4 This is a flowchart of the flow uniformization and shaping process based on entropy feedback in this step.

[0094] The entropy distribution of the encrypted data stream is monitored. This process continuously reshapes the ciphertext data stream after the global basic encryption and layered differential enhancement processes in step three. A fixed-size sliding window is used to scan the data stream block by block. Let the size of the sliding window be... Bytes, the step size for each forward slide is Bytes; for each block of data within a window ,in Given the window number, calculate its information entropy value using the Shannon entropy formula:

[0095] ;

[0096] in, Representing the window The information entropy value, in bits per byte; This represents the possible values ​​that a byte can take, ranging from 0 to 255; Represents byte value In the current window The probability of it appearing within the range is calculated as follows: ,in It is a byte value In the window The number of times it appears in It is the total number of bytes in the window.

[0097] Through continuous calculations, an entropy distribution curve describing the change of ciphertext stream entropy with position is obtained. Ideally, the encrypted traffic should have a stable entropy value close to the theoretical maximum (8 bits / byte). Therefore, a target entropy value is set. (For example, a preset value close to 8, such as 7.95 bits / byte), and set a low-entropy threshold and a high-entropy threshold around this target value. This real-time monitoring process provides precise quantitative basis for subsequent traffic shaping, making data injection and insertion operations no longer blind, but feedback-driven behaviors with clear objectives.

[0098] Next, when a region with a low entropy value is detected, i.e., a certain window... entropy value Below the preset low entropy threshold At this time, a high-entropy fill block injection operation is performed. This operation aims to improve the randomness of this local region. A deterministic pseudo-random generator (DRBG) is employed, specifically the AES-256-based CTR_DRBG mode, using a key dedicated to traffic shaping. Initialize to generate a high-quality pseudo-random bit sequence.

[0099] The injected padding block consists of: a 1-byte type identifier (e.g., 0x01 represents a high-entropy padding block), a 2-byte length field (indicating the number of bytes of subsequent pseudo-random data), and a variable-length pseudo-random data payload. The length of the injected data block is dynamically calculated to raise the entropy of the current window to near the target level, and its calculation formula is as follows: ;in, This is the length in bytes of the pseudo-random data payload to be generated; This represents the floor function; It is a preset fill factor used to adjust the sensitivity and strength of the fill operation; it is a dimensionless positive constant. This represents the difference between the current window's entropy value and the low threshold, i.e., entropy deficit.

[0100] For example, if the window size Bytes, low entropy threshold Fill factor When the entropy value of a certain window is detected... At that time, the calculated pseudo-random data payload in bytes was bytes. Generate a string with a total length of bytes. A padding block of bytes is inserted into the current window. This effectively fills the entropy gaps caused by statistical biases in encryption algorithms on finite data blocks or certain residual characteristics of the original data, making the randomness of the data stream more consistent.

[0101] When a peak region of entropy value is detected, i.e., a certain window entropy value Higher than the preset high entropy threshold At this time, a compressible structured redundant block insertion operation is performed. Even with strong encryption, a finite-length sequence can occasionally exhibit statistically excessive randomness, resulting in abnormally high entropy values—a statistical characteristic in itself. To eliminate these spikes, a structured data block with extremely low entropy is inserted; this redundant block also consists of a type identifier (e.g., 0x02 representing a compressible redundant block), a length field, and a data payload, which is a continuous sequence of identical bytes, such as a sequence of all 0x00 bytes. This data block is highly compressible, with its information entropy approaching zero.

[0102] The load length of the inserted redundant block is also dynamically calculated: ;in, It is the byte length of the structured redundant payload to be inserted. It is a preset redundancy coefficient used to adjust the strength of redundant block insertion. This indicates the amount by which the current window entropy value exceeds the high threshold, i.e., entropy surplus.

[0103] Insert the generated structured redundant block into the current window. At the end of the range. By incorporating low-entropy components, excessively high local entropy values ​​can be effectively brought back to the target range.

[0104] Throughout the data stream shaping process, a padding block location table is generated in real time. Each time an injection or insertion operation is performed, detailed information about the operation is recorded, including: the absolute offset of the insertion point in the original encrypted data stream, the type identifier of the inserted block, and the total length of the inserted block (including identifier and length fields). This table is the key output of this step, providing the receiving end with the sole basis for accurately identifying and stripping all added data blocks.

[0105] This step, through a dynamic adjustment mechanism based on real-time entropy feedback, elevates the encrypted data stream from a state that only satisfies pseudo-randomness overall to a level that exhibits high statistical consistency even at the microscopic level. This method actively eliminates potential entropy peaks and troughs in the data stream, making the entire VPN traffic appear as a uniform statistical feature resembling white noise at any scale. This significantly increases the difficulty of traffic analysis, preventing attackers from inferring data content, communication behavior, or weaknesses in the encryption scheme by searching for statistical anomalies, thereby significantly enhancing the concealment and security of cross-border data transmission. Furthermore, because all added data blocks carry explicit identifiers and length information, this process is completely reversible at the receiving end, causing no loss of the original data.

[0106] Step 5: Integrate the hierarchical mapping table, steganographic location mapping vector, and padding block location table into a deconstructed index set. Use a threshold secret sharing mechanism to split it into multiple shares and encrypt them separately. After embedding each share into the header extension field and payload reserved area of ​​multiple consecutive data packets, encapsulate it into the VPN tunnel and send it.

[0107] The deconstructed index set is constructed and serialized, and the three key metadata generated in the previous steps are integrated into a single data unit. These three key metadata are: the hierarchical mapping table generated in step one (which records the entropy level and original location of each data block), the steganographic location mapping vector generated in step two (which precisely indicates the embedding location of high-entropy data or its seeds), and the fill block location table generated in step four (which records the location, type, and length of all data blocks injected or inserted to achieve traffic uniformity).

[0108] These three structured data tables are concatenated in a predefined order and then converted into a continuous byte stream using a compact binary serialization format. This byte stream is the destructured index set, denoted as . By integrating all metadata into a single atomic unit, the integrity of the information required for data recovery at the receiving end is ensured, avoiding parsing failures caused by asynchronous metadata streams.

[0109] To address potential issues such as packet loss, corruption, or malicious discarding during cross-border network transmissions, the deconstructed index set... Using Shamir-based The threshold secret sharing mechanism is split. This mechanism aims to deconstruct the set of indexes and break down the secret. Split into Each share allows for the collection of any number of shares. One (or more) shares are sufficient to fully recover the original deconstructed index set. And any less than The individual share combinations cannot reveal information about Any valid information.

[0110] Specifically, first, the serialized destructuring index set... Treat it as a large integer Then in a finite field Construct a Polynomials of degree:

[0111] ;

[0112] in, It is a secret shared polynomial used to generate shares; It is a set of secret deconstruction indexes Integer representation after serialization and numerical conversion; In a finite field Randomly selected from There are 10 coefficients, which are not related to the secret itself, but are only used to construct the polynomial; It is a preset recovery threshold, that is, the minimum recovery threshold required. Only a certain share can restore the secret; It is a large prime number, and its value must be greater than 1. and total share This ensures that all calculations are performed effectively within this finite domain. It is the independent variable of the polynomial; It is a modulo function.

[0113] Then select A set of distinct and non-zero public values By calculating the values ​​of the polynomial at these points, the following is generated: Individual shares ,..., : , ,…, , For the first The independent variable of a polynomial For the first A polynomial. For example, a threshold scheme can be set to (3,5), meaning a total of 5 shares are generated, and recovery is achieved by collecting any 3. This processing method gives the metadata data transmission extremely high fault tolerance, even if data is lost during transmission. Even with a data packet carrying a certain share, the receiving end can still perfectly reconstruct the complete deconstruction index.

[0114] After generating shares, to further enhance security, for each share... Independent encryption is applied. This is intended to achieve deep encryption defense, even if an attacker successfully intercepts and identifies the data. Even with one or more shares, without the corresponding key, it is still impossible to decrypt and reconstruct the original deconstruction index. The encryption process uses an Authentication Encryption Algorithm with Associated Data (AEAD), specifically in AES-256-GCM mode. Each share (including its) Value and The value is used as plaintext, using a key specifically designed for share encryption. Encryption is performed to generate the corresponding ciphertext share. , , It is an index value. It is an integer. Key Independent of the master session key of the VPN tunnel, it is securely distributed either out-of-band or during the key negotiation phase at the beginning of the VPN tunnel setup. This encryption step provides a second, robust layer of protection for critical metadata.

[0115] The encrypted shares are concealed, distributed, embedded, and tunneled. One encrypted share Embedded one by one, in a dispersed manner into a continuous The embedded location is not in the standard payload area, but rather utilizes the header extension fields of VPN protocols (such as IPsecESP) or the reserved / padding areas of the payload.

[0116] For example, in the IPsecESP protocol, ciphertext shares can be... Placed within the Padding field of the ESP payload. To facilitate receiver identification and extraction, each embedded... A short identifier header will be appended, which contains a number to identify it as share data and an index value for the current share. Once embedded, these data packets carrying encrypted portions are fully encapsulated within the external header of the VPN tunneling protocol (such as the external IP header of IPsec) and sent over the network to their destination.

[0117] This step establishes a metadata data transmission mechanism that, through threshold secret sharing, achieves natural immunity to network packet loss and malicious attacks, significantly improving communication reliability. By independently encrypting and covertly embedding shares, the keys required for data deconstruction are also rigorously protected and broken down into smaller parts, greatly reducing the risk of being completely cracked. Distributing this critical information across non-standard areas of continuous data packets makes it difficult to detect and correlate within massive VPN traffic, achieving the concealment of metadata data transmission. This step ensures that even in complex and challenging cross-border network environments, the receiver can efficiently, securely, and reliably obtain all the instructions needed to deconstruct the data, thus completing the closed loop of the entire dynamic layered encrypted communication.

[0118] Example 2

[0119] Reference Figure 5 This is the second embodiment of the present application, which provides a VPN dynamic layered encryption system for cross-border data transmission.

[0120] The system includes: an entropy layer partitioning module, a redundancy embedding module, a layered encryption module, an entropy rectification module, and a split transmission module.

[0121] The entropy layer division module calculates the information entropy value of the data stream to be transmitted, divides the data into different entropy levels according to preset dual thresholds, and generates a hierarchical mapping table that records the hierarchical affiliation and original position offset of each data block.

[0122] The redundant embedding module scans the redundant bits of the protocol padding field and repeated data blocks in the low-entropy redundant layer to determine the available embedding capacity. When the capacity is sufficient, a chaotic sequence-controlled dispersion algorithm is used to discretize and embed the high-entropy core layer data into the carrier space. When the capacity is insufficient, only the encryption seed and location digest of the core data are embedded to generate a steganographic location mapping vector and a hybrid data carrier.

[0123] The layered encryption module performs full-domain processing on the hybrid data carrier containing embedded data using an encryption algorithm. At the ciphertext level, it superimposes chaotic scrambling transformation on the embedded region based on the steganographic position mapping vector, and performs iterative diffusion processing on the medium-entropy business layer region.

[0124] The entropy rectification module monitors the entropy distribution curve of the encrypted data stream, injects high-entropy filler blocks generated by a deterministic pseudo-random generator in the low entropy region, and inserts compressible structured redundant blocks in the high entropy region. Each filler block carries a type identifier for the receiver to identify and strip.

[0125] The split transmission module integrates the hierarchical mapping table, the steganographic location mapping vector, and the padding block location table into a deconstructed index set. It then uses a threshold secret sharing mechanism to split the index into multiple shares and encrypts them separately. Each share is then embedded into the header extension fields and payload reserved areas of multiple consecutive data packets and encapsulated into a VPN tunnel for transmission.

[0126] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0127] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments under the guidance of this application without departing from the spirit and scope of protection of the claims. All of these variations are within the protection scope of this application.

Claims

1. A VPN dynamic hierarchical encryption method for cross-border data transmission, characterized in that, The method comprises the following steps: calculating the information entropy value of the data stream to be transmitted, dividing the data into different entropy levels according to preset double thresholds, and generating a layered mapping table recording the level attribution and original position offset of each data block; scanning the redundant bits of the protocol padding field and repeated data block in the low-entropy redundant layer to determine the available embedding capacity, and when the capacity is sufficient, using a dispersion algorithm controlled by a chaotic sequence to disperse and embed the high-entropy core layer data in the carrier space, and when the capacity is insufficient, only embedding the encryption seed and positioning digest of the core data to generate a steganographic position mapping vector and a mixed data carrier; performing global processing on the mixed data carrier containing embedded data using an encryption algorithm, and superimposing chaotic permutation transformation on the embedding region according to the steganographic position mapping vector at the ciphertext level, and using iterative diffusion processing on the medium-entropy service layer region; monitoring the entropy value distribution curve of the encrypted data stream, injecting high-entropy padding blocks generated by a deterministic pseudo-random generator in the entropy valley region, and inserting compressible structured redundant blocks in the entropy peak region, and each padding block carries a type identifier for the receiving end to identify and strip; integrating the layered mapping table, the steganographic position mapping vector and the padding block position table into a disassembly index set, using a threshold secret sharing mechanism to split it into multiple shares and encrypt each share, and embedding each share in the header extension field and the payload reserved area of multiple consecutive data packets and then encapsulating it into a VPN tunnel for transmission.

2. The VPN dynamic hierarchical encryption method for cross-border data transmission according to claim 1, characterized in that, The data stream is sampled by a fixed-size sliding window and a sliding step, and the continuous data stream is discretized into data blocks; calculate the information entropy of each data block, obtain the entropy value sequence corresponding to the data block sequence, and divide all data blocks into different entropy levels according to preset double thresholds, including a high-entropy threshold and a low-entropy threshold, to divide the data blocks into different entropy levels, including a high-entropy core layer, a medium-entropy service layer, and a low-entropy redundant layer; After completing the level division of all data blocks, a layered mapping table is generated to record the level attribution and position information of each data block in the original data stream; The specific content recorded in the layered mapping table includes: data block index, original position offset, and level identifier. The original position offset indicates the starting byte position of the data block in the original data stream, and the level identifier is used to indicate the level to which the data block belongs.

3. The VPN dynamic hierarchical encryption method for cross-border data transmission according to claim 2, characterized in that, All data blocks marked as low-entropy redundant layers are scanned to calculate the available redundant bits of the low-entropy redundant layer; Based on the scanning result, the available embedding capacity is calculated, and the total available embedding capacity is accumulated by the bit capacity contributed by all available carrier bytes; After calculating the available embedding capacity, it is determined whether the available embedding capacity is sufficient. The total number of bits of all data blocks in the high-entropy core layer is compared with the total embedding bit capacity. If the total embedding bit capacity is greater than or equal to the total number of bits of all data blocks in the high-entropy core layer, it is determined that the capacity is sufficient. If the total embedding bit capacity is less than the total number of bits of all data blocks in the high-entropy core layer, it is determined that the capacity is insufficient, and a backup scheme is started; The data packets to be embedded in the backup scheme include an encryption seed for decrypting the core data and a positioning digest for ensuring data integrity and positioning accuracy. The total bit number of the encryption seed and the positioning digest is calculated, and capacity judgment is performed again to check whether the total embedding bit capacity can accommodate the total bit number of the encryption seed and the positioning digest. If it can, the data packet composed of the encryption seed and the positioning digest is taken as the embedding object. If it cannot, the current round of data stream gives up steganography operation.

4. The VPN dynamic hierarchical encryption method for cross-border data transmission according to claim 3, characterized in that, After determining the data to be embedded, a dispersion algorithm controlled by a chaotic sequence is used to embed the data to be embedded in the determined carrier bit positions in a dispersed manner; At the same time of embedding, a steganographic position mapping vector is generated to record the absolute address of the original data to be embedded in the mixed data carrier; After all the embedding is completed, the data blocks of the low-entropy redundancy layer have been modified, and the mixed data carrier is obtained by combining the modified data blocks of the low-entropy redundancy layer and the original data blocks of the medium-entropy service layer to form a new data set.

5. The VPN dynamic hierarchical encryption method for cross-border data transmission according to claim 4, characterized in that, The data of the mixed data carrier is subjected to global encryption processing, the entire mixed data carrier is regarded as a continuous plaintext stream, and a block cipher algorithm is used for global encryption; The mixed data carrier is converted into homogenized ciphertext through the encryption algorithm, and the ciphertext region of the embedded data is subjected to superimposed chaotic permutation transformation according to the generated steganographic position mapping vector.

6. The VPN dynamic hierarchical encryption method for cross-border data transmission according to claim 5, characterized in that, The medium-entropy service layer is subjected to iterative diffusion processing, and all ciphertext blocks corresponding to the original medium-entropy service layer in the ciphertext stream are identified according to the layered mapping table, and additional lightweight encryption transformation is added. After iteration, the final new ciphertext block is obtained to replace the original position ciphertext.

7. The VPN dynamic hierarchical encryption method for cross-border data transmission according to claim 5, characterized in that, The ciphertext data stream subjected to global encryption and layered differential enhancement processing is shaped. The sliding window method is used to sample the ciphertext data stream in a sliding window manner, and the information entropy value of each window data is calculated. The information entropy values of all window data of the ciphertext data stream are calculated to obtain an entropy value distribution curve describing the change of the entropy value of the ciphertext stream with the position. Low-entropy and high-entropy threshold values are respectively set, high-entropy padding blocks are injected when the entropy valley region is monitored, and compressible structured redundancy blocks are inserted when the entropy peak region is monitored.

8. The VPN dynamic hierarchical encryption method for cross-border data transmission according to claim 7, characterized in that, In the data stream shaping process, a padding block position table is generated, and each time an injection or insertion operation is performed, the specific information of the corresponding operation is recorded, including: the absolute offset position of the insertion point in the original encrypted data stream, the type identification of the inserted block, and the total length of the inserted block.

9. The VPN dynamic hierarchical encryption method for cross-border data transmission according to claim 8, characterized in that, A deconstruction index set is constructed and serialized, the layered mapping table, the steganographic position mapping vector, and the padding block position table are spliced, and are converted into a continuous byte stream in a binary serialization format as the deconstruction index set. The deconstruction index set is split using a threshold secret sharing mechanism to split the deconstruction index set into multiple shares. After generating the shares, each share is independently encrypted, the encrypted shares are steganographically embedded and tunnel-encapsulated, and are sent to the destination through the network.

10. A VPN dynamic hierarchical encryption system for cross-border data transmission, which is used to implement the VPN dynamic hierarchical encryption method for cross-border data transmission in any one of claims 1 to 9, characterized in that, It comprises: an entropy layer division module, a redundancy embedding module, a layered encryption module, an entropy shaping and rectifying module, and a splitting and transmission module; The entropy layer division module calculates the information entropy value of the data stream to be transmitted, divides the data into different entropy levels according to the preset double threshold value, and generates a layered mapping table recording the level attribution and original position offset of each data block. The redundancy embedding module scans the redundancy bits of the protocol padding field and the repeated data block in the low-entropy redundancy layer, determines the available embedding capacity, and when the capacity is sufficient, uses a dispersion algorithm controlled by a chaotic sequence to disperse and embed the high-entropy core layer data in the carrier space; when the capacity is insufficient, only the encryption seed and the positioning digest of the core data are embedded to generate a steganographic position mapping vector and a mixed data carrier; The hierarchical encryption module performs global processing on the mixed data carrier containing embedded data using an encryption algorithm, and superimposes a chaotic permutation transformation on the embedding region according to the steganographic position mapping vector at the ciphertext level, and uses an iterative diffusion process on the medium-entropy service layer region; The entropy shape rectification module monitors the entropy value distribution curve of the encrypted data stream, injects high-entropy padding blocks generated by a deterministic pseudo-random generator in the entropy value trough region, and inserts compressible structured redundancy blocks in the entropy value peak region, and each padding block carries a type identifier for the receiving end to identify and strip; The split transmission module integrates the hierarchical mapping table, the steganographic position mapping vector, and the padding block position table into a deconstruction index set, uses a threshold secret sharing mechanism to split it into multiple shares and encrypts each share, embeds each share in the header extension field and the payload reserved area of multiple consecutive data packets, and then encapsulates it into a VPN tunnel for transmission.

Images