Data Encryption Protection Method and System Based on Edge-Cloud Collaboration

Abstract

This invention relates to the field of data protection technology, specifically to a data encryption protection method and system based on edge-cloud collaboration. The method includes the following steps: receiving encryption task instructions from the cloud; reading and comparing the previous and current states; if a change is detected, interrupting the task and activating a new configuration; and resuming the encryption task and processing the data upon successful completion. This invention introduces an edge-cloud collaboration mechanism, effectively solving the problems of encryption task latency and insufficient dynamic linkage mechanisms. Edge nodes determine their local state based on the real-time received cloud encryption task instructions and status identifier information. They can interrupt encryption tasks and update paths based on real-time differences in key updates and path changes. By activating a new key configuration and establishing a new transmission path, edge nodes can autonomously adjust their encryption behavior, reducing the risk of single-point failures and achieving efficient collaboration between edge devices and the cloud, ensuring the security and integrity of data during transmission and processing.

Description

Technical Field

[0001] This invention relates to the field of data protection technology, and in particular to a data encryption protection method and system based on edge-cloud collaboration. Background Technology

[0002] Data protection technology encompasses measures to safeguard digital information from unauthorized access, tampering, or disclosure during storage, transmission, and processing. These include methodological measures such as data encryption, authentication, access control, backup and recovery, and data anonymization. Widely applied in scenarios like cloud computing, the Internet of Things (IoT), and big data analytics, these methods primarily ensure information security and integrity by protecting critical nodes throughout the data lifecycle. Traditional data encryption methods involve centralized servers for encryption, key distribution, and access control after data generation. These methods include encoding raw data using symmetric encryption algorithms, exchanging keys using asymmetric encryption, encrypting and decrypting data in trusted execution environments, storing key information through physical isolation, and statically judging access behavior using pre-defined rules. These methods largely rely on the computing and storage capabilities of central nodes to complete security tasks, typically performing only simple data collection and forwarding functions at the edge, making it difficult to achieve local autonomous encryption or dynamic linkage protection mechanisms with the cloud.

[0003] Current data encryption protection methods largely rely on centralized servers for encryption processing, key distribution, and access control, which has significant limitations. Since edge devices typically only handle simple data collection and forwarding and lack local autonomous encryption capabilities, encryption tasks at the edge experience high latency and struggle to adapt to rapidly changing cloud control strategies. Furthermore, traditional methods depend on the computing and storage capabilities of central nodes, posing a potential single point of failure risk. The dynamic linkage mechanism between edge nodes and the cloud lacks flexibility and real-time performance, making it prone to delays in encryption task execution, inconsistent path selection, or data security risks during data transmission. This results in inefficient and insecure data protection in distributed environments. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a data encryption protection method based on edge-cloud collaboration.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a data encryption protection method based on edge-cloud collaboration, comprising the following steps:

[0006] S1: Receives encryption task instruction packets from the cloud control platform, extracts key lifecycle status information and path identification information, generates key status identifier and path instruction identifier by combining the corresponding time tags, and outputs key and path instruction information.

[0007] S2: Read the key status identifier and path instruction identifier of the previous task, compare them with the currently received key and path instruction information, identify key update events and path change events, and generate a strategy difference determination result;

[0008] S3: Based on the strategy difference determination result, if a key update event is detected, the current encryption task is terminated and the data encryption operation is stopped. If a path change event is detected, the current data transmission path is interrupted, a new key configuration is activated and a new transmission path is established, and the encryption task and path update execution results are generated.

[0009] S4: Based on the execution results of the encryption task and path update, package the new key configuration, path instruction identifier and timestamp and send them to the cloud control platform for consistency verification. If the key status and path instruction are completely consistent, the policy update is confirmed to be successful. If they are inconsistent, the configuration is re-pushed and a policy synchronization confirmation result is generated.

[0010] S5: Based on the synchronization confirmation result of the strategy, after confirming the successful update of the strategy, the edge node resumes the encryption task, encrypts the data, and generates the execution result of edge-cloud collaborative data encryption protection.

[0011] As a further aspect of the present invention, the key lifecycle status information indicates the current key version and lifecycle stage, and the path identification information indicates the validity period and number of the communication link.

[0012] As a further aspect of the present invention, if the key status identifier is found to be different from the previous one, it is identified as a key update event; if the path instruction identifier is different from the previous one, it is identified as a path change event.

[0013] As a further aspect of the present invention, the key and path instruction information includes a key status consistency flag, a key validity stage attribute, a communication link validity flag, a link number attribute, and an instruction generation time identifier. The policy difference judgment result includes a key status change flag, a path configuration change flag, a policy consistency judgment flag, and a change type classification label. The encryption task and path update execution result includes a task termination status, a path reconstruction status, a cache cleanup completion flag, a new configuration activation status, and an execution completion confirmation flag. The policy synchronization confirmation result includes a cloud-edge configuration consistency verification flag, a policy update confirmation flag, a configuration re-push trigger status, and a synchronization completion time identifier. The edge-cloud collaborative data encryption protection execution result includes an encryption task recovery status, a data encryption validity identifier, a link security stability flag, and a collaborative execution completion confirmation status.

[0014] As a further aspect of the present invention, the key and path instruction information acquisition step specifically comprises:

[0015] S111: The encryption task instruction packet received from the cloud control platform is used to extract the key lifecycle status information, and the fields of key version and lifecycle stage are parsed. Combined with the time tag, an index integration operation is performed to generate a key status identification data unit.

[0016] S112: Extract path identification information from the encrypted task instruction packet, parse the communication link validity period field and the path number field, combine the time tag to perform number splicing and time segment positioning operations, and obtain the path instruction identification data unit;

[0017] S113: Based on the key status identifier data unit and the path instruction identifier data unit, and combined with the instruction sequence in the task instruction package as the merging basis, perform field aggregation and formatting encapsulation processing to generate key and path instruction information.

[0018] As a further aspect of the present invention, the step of obtaining the strategy difference determination result specifically includes:

[0019] S211: Based on the data recorded in the edge node storage unit when the task was last executed, read the key status identifier and path instruction identifier, and perform index extraction and format separation operations on the content to establish a historical identifier parameter set;

[0020] S212: Based on the key status identifier in the historical identifier parameter set, and combined with the currently received key and path instruction information, perform field-by-field matching on the key version and lifecycle stage respectively. If there is a discrepancy between the two, mark the difference bit as valid, and obtain the key update determination mark result.

[0021] S213: Based on the key update determination mark result and the path instruction identifier in the historical identifier parameter set, perform a combination difference judgment operation of path number and link timeliness. If any field is inconsistent, the corresponding field comparison result and key difference mark are jointly encoded to generate a policy difference determination result.

[0022] As a further aspect of the present invention, the step of obtaining the execution result of the encryption task and path update is specifically as follows:

[0023] S311: Based on the strategy difference determination result, extract the key update event flag and determine the status. If the flag is valid, read the task control field and encryption status field in the current task context, perform the task abort operation and data encryption stop operation, and generate key event abort identifier data.

[0024] S312: Based on the status value of the path change event flag in the strategy difference determination result, if the status value is valid, extract the old key field and path instruction field from the edge node storage unit, perform the field clearing operation, load the currently received key status identifier and path identifier data, and establish a configuration reload mapping record set.

[0025] S313: Based on the key event abort identifier data and the configuration reload mapping record set, perform state synchronization and path reconstruction operations on the task status field and path link field respectively, and aggregate and encode the task control status and path configuration status to obtain the encrypted task and path update execution results.

[0026] As a further aspect of the present invention, the step of obtaining the strategy synchronization confirmation result specifically includes:

[0027] S411: Based on the execution results of the encryption task and path update, extract the currently activated new key configuration, path instruction identifier and corresponding timestamp, perform structure aggregation and data frame rearrangement operations, and generate a synchronous verification packaged dataset.

[0028] S412: Based on the key status and path instruction content in the synchronous verification packaged dataset, read the policy configuration parameters currently registered on the cloud control platform, and perform one-to-one mapping and comparison of the key version and path number to obtain the consistency comparison judgment label.

[0029] S413: Based on the status bit result of the consistency comparison judgment tag, if the judgment tag is in a consistent state, write a confirmation flag; if it is in an inconsistent state, reactivate the configuration push flag and record the processing status, and generate a policy synchronization confirmation result.

[0030] As a further aspect of the present invention, the step of obtaining the execution result of edge-cloud collaborative data encryption protection is specifically as follows:

[0031] S511: According to the strategy, the synchronization confirmation result is consistent. If the result is consistent, the task control field and the encryption status flag field are extracted, the task recovery trigger and encryption logic initialization operation are executed, and an encryption task restart flag set is generated.

[0032] S512: Based on the task number in the encrypted task restart identifier set, combined with the currently activated new key configuration field and path instruction identifier, parameters are aggregated according to the order of the key field and path field, and a task execution index mapping is established to obtain parameter-driven execution mapping data;

[0033] S513: Based on the parameters, the key parameter group and path instruction index in the driving execution mapping data are used to encrypt the input data stream, perform key invocation, path binding and data packet replacement operations, and perform status recording on the encrypted data frame set to obtain the execution result of edge cloud collaborative data encryption protection.

[0034] A data encryption protection system based on edge-cloud collaboration includes:

[0035] The encryption instruction acquisition module is used to execute S1: receive encryption task instruction packets from the cloud control platform, extract key lifecycle status information and path identification information, generate key status identifier and path instruction identifier by combining the corresponding time tag, and output key and path instruction information;

[0036] The reading and difference judgment module is used to execute S2: read the key status identifier and path instruction identifier of the previous task, compare them with the currently received key and path instruction information, identify key update events and path change events, and generate a policy difference judgment result;

[0037] The interruption and policy update module is used to execute S3: based on the policy difference determination result, if a key update event is detected, the current encryption task is terminated and the data encryption operation is stopped; if a path change event is detected, the current data transmission path is interrupted, a new key configuration is activated and a new transmission path is established, and the encryption task and path update execution results are generated.

[0038] The policy confirmation feedback module is used to execute S4: based on the execution result of the encryption task and path update, the new key configuration, path instruction identifier and timestamp are packaged and sent to the cloud control platform for consistency verification. If the key status and path instruction are completely consistent, the policy update is confirmed to be successful. If they are inconsistent, the configuration is re-pushed and a policy synchronization confirmation result is generated.

[0039] The encryption execution recovery module is used to execute S5: based on the strategy, the synchronization confirmation result is confirmed, and after the strategy update is successful, the edge node resumes the encryption task, encrypts the data, and generates the edge-cloud collaborative data encryption protection execution result.

[0040] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0041] By introducing an edge-cloud collaboration mechanism in the data encryption protection process, the problems of encryption task latency and insufficient dynamic linkage mechanism are effectively solved. Edge nodes make local status judgments based on the real-time received cloud encryption task instructions and status identification information. They can interrupt encryption tasks and update paths according to the real-time differences between key updates and path changes, ensuring that encryption tasks and data transmission paths are consistent with cloud policies. By activating new key configurations and establishing new transmission paths, edge nodes can autonomously adjust encryption behavior without relying on the computing and storage capabilities of central nodes, thereby reducing the risk of single point of failure, improving the execution efficiency and security of data encryption tasks, realizing efficient collaboration between edge devices and the cloud, and ensuring the security and integrity of data during transmission and processing. Attached Figure Description

[0042] Figure 1 This is a flowchart of the main steps of the present invention;

[0043] Figure 2 This is a flowchart illustrating the process of obtaining key and path instruction information in this invention.

[0044] Figure 3 This is a flowchart of the process for obtaining the strategy difference determination result of the present invention;

[0045] Figure 4 This is a flowchart illustrating the process of obtaining the execution results of the encryption task and path update in this invention.

[0046] Figure 5 This is a flowchart of the strategy synchronization confirmation result acquisition process of the present invention;

[0047] Figure 6 This is a flowchart illustrating the process of obtaining the execution result of edge-cloud collaborative data encryption protection according to the present invention. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0049] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0050] Please see Figure 1 A data encryption protection method based on edge-cloud collaboration includes the following steps:

[0051] S1: Receives encryption task instruction packets from the cloud control platform, extracts key lifecycle status information (indicating the current key version and lifecycle stage) and path identifier information (indicating the validity period and number of the communication link), parses the fields respectively, and generates key status identifier and path instruction identifier by combining the corresponding time tags, and outputs key and path instruction information;

[0052] S2: Read the key status identifier and path instruction identifier recorded in the edge node storage unit when the task was last executed, compare the currently received key and path instruction information with the local storage identifier, if the key status identifier is different from the last one, it is marked as a key update event, if the path instruction identifier is different from the last one, it is marked as a path change event, and generate a policy difference judgment result.

[0053] S3: Based on the policy difference determination result, if a key update event is detected, the current encryption task is terminated and the data encryption operation is stopped. If a path change event is detected, the current data transmission path is interrupted, the old key and path information stored in the local cache are cleared, the new key configuration is activated and a new transmission path is established, and the encryption task and path update execution results are generated.

[0054] S4: Based on the execution results of the encryption task and path update, the edge node packages the currently activated new key configuration, path instruction identifier and timestamp information, and sends it to the cloud control platform for consistency verification. If the key status and path instruction are completely consistent, the policy update is confirmed to be successful. If they are inconsistent, the configuration is re-pushed and a policy synchronization confirmation result is generated.

[0055] S5: Based on the policy synchronization confirmation result, after confirming the successful policy update, the edge node resumes the encryption task, encrypts the data according to the currently activated new key configuration and path instructions, and generates the edge-cloud collaborative data encryption protection execution result.

[0056] Key and path instruction information includes key status consistency flag, key validity stage attribute, communication link validity flag, link number attribute, and instruction generation time identifier. Policy difference judgment results include key status change flag, path configuration change flag, policy consistency judgment flag, and change type classification label. Encryption task and path update execution results include task termination status, path reconstruction status, cache clearing completion flag, new configuration activation status, and execution completion confirmation flag. Policy synchronization confirmation results include cloud-edge configuration consistency verification flag, policy update confirmation flag, configuration re-push trigger status, and synchronization completion time identifier. Edge-cloud collaborative data encryption protection execution results include encryption task recovery status, data encryption validity identifier, link security and stability flag, and collaborative execution completion confirmation status.

[0057] Please see Figure 2 Step S1 is as follows:

[0058] S111: The encryption task instruction packet received from the cloud control platform is used to extract the key lifecycle status information, and the fields of key version and lifecycle stage are parsed. Combined with the time tag, an index integration operation is performed to generate a key status identification data unit.

[0059] Based on the encrypted task instruction packet received from the cloud control platform via the TCP / IP protocol stack, the data payload of this instruction packet is 1024 bytes long. The system first locates the 32-bit task control word at offset 0x0010 in the packet header. Then, it unpacks the payload of the encrypted task instruction packet and locates the key lifecycle status information in the range of offset 0x0040 to 0x004F. This information includes a 1-byte status enumeration value and 3 bytes of reserved bits. The system reads the status enumeration value; for example, if the value read is 0x03, it parses it as "active usage period" according to the preset status mapping table. Next, it locates the 16-bit key version number at offset 0x0050. The system reads a value of 0x0205 (representing version 2.5) and converts the read version number into a decimal value of 205 for subsequent calculations. Simultaneously, it extracts the timestamp field from the end of the instruction packet. This timestamp is a 64-bit UNIX timestamp, such as 1766275200 (corresponding to December 21, 2025). The system then integrates the parsed key version value 205, lifecycle status value 0x03, and timestamp 1766275200 into a structured index. The timestamp is used as the primary key, and the version number and status value are written as attribute fields to a temporary buffer. Through bitwise operations, the fields are combined according to a predetermined format (e.g., the version number occupies the high 16 bits, and the status value occupies the low 8 bits) to generate a key status identifier data unit.

[0060] S112: Extract path identification information from the encrypted task instruction packet, parse the communication link validity period field and path number field, combine the time tag to perform number concatenation and time segment positioning operations, and obtain the path instruction identification data unit;

[0061] Based on the header metadata in the encrypted task instruction packet, the system extracts the path identification information. It locates the path control segment via byte stream scanning and reads the communication link validity period field starting at address 0x0080. This field consists of two 32-bit unsigned integers, representing the link's effective start time stamp (1766275200) and expiration end time stamp (1766361600). Next, it reads the path number field at offset 0x0090. This path number is an 8-byte ASCII string, such as "PATH_A01". The system performs hexadecimal conversion on the read path number and then converts it to... The numerical identifier is 0x504154485F413031. Then, combined with the global timestamp 1766275200 in the instruction packet, a time segment positioning operation is performed to determine whether the global timestamp falls within the closed interval [1766275200, 1766361600] formed by the link's effective start time stamp and failure end time stamp. If the determination result is true, the path number value and the upper and lower limits of the validity period time segment are concatenated into a string, with the format set to "path number_start time_end time", forming a unique path tracking sequence and obtaining the path instruction identifier data unit.

[0062] S113: Based on the key status identifier data unit and the path instruction identifier data unit, and combined with the instruction sequence in the task instruction package as the merging basis, perform field aggregation and formatting encapsulation processing to generate key and path instruction information;

[0063] Based on the version number 205 and status value 0x03 in the key status identifier data unit, and the path tracking sequence "PATH_A01_1766275200_1766361600" in the path instruction identifier data unit, the system reads the instruction sequence number field in the header of the task instruction packet, for example, the sequence number is 0x0000FFFF, and uses it as the primary key for data merging. The system allocates a memory space of 256 bytes in length, and first writes 4 bytes of instruction sequence number in big-endian format, followed by the serialized key status identifier data, and then the path instruction identifier data. A checksum field is added to the end of the data. The checksum is obtained by XORing and accumulating all the bytes of the previously written data, completing the aggregation operation of each scattered field. The encapsulated data packet is then marked with a frame header identifier 0xAA55 and a frame tail identifier 0x55AA to form a standardized internal transmission format, generating key and path instruction information.

[0064] Please see Figure 3 Step S2 is as follows:

[0065] S211: Based on the data recorded in the edge node storage unit when the task was last executed, read the key status identifier and path instruction identifier, and perform index extraction and format separation operations on the content to establish a historical identifier parameter set;

[0066] Based on the data recorded during the last task execution in the non-volatile storage sector (such as Flash address 0x0800F000) in the edge node storage unit, the system calls the underlying file system interface to read the historical configuration file, as shown in Table 1. The key status identifier and path instruction identifier stored therein are extracted. The system performs feature word matching on the read data stream, identifies the delimiter, and then divides the data into key parameter blocks and path parameter blocks. For the key parameter blocks, the historical key version number (e.g., 0x0204, i.e., version 2.4) and historical lifecycle status (e.g., 0x02) are extracted. For the path parameter blocks, the historical path number (e.g., "PATH_A00") and historical link validity are extracted. These extracted parameters are stored in a dynamic linked list in chronological order to construct a parameter set containing the execution status of the previous task and establish a historical identifier parameter set.

[0067] Table 1 Comparison of Historical Identifier Parameter Sets and Current Received Data

[0068] Parameter categories Field Name Historical records (storage units) Current received value (command packet) Data types Key parameters Key version number 2.4（0x0204） 2.5（0x0205） UINT16 Key parameters Lifecycle status 0x02 (Preparatory Period) 0x03 (Active Period) UINT8 Path parameters Path number PATH_A00 PATH_A01 STRING Path parameters Link failure time 1766100000 1766361600 UINT32

[0069] S212: Based on the key status identifier in the historical identifier parameter set, and combined with the currently received key and path instruction information, perform field-by-field matching on the key version and lifecycle stage respectively. If there is a discrepancy between the two, mark the difference bit as valid and obtain the key update determination mark result.

[0070] Based on the key status identifier (historical version 2.4, historical state 0x02) in the historical identifier parameter set, combined with the new key configuration (current version 2.5, current state 0x03) in the currently received key and path instruction information, as shown in Table 1, the system establishes two comparison registers. The historical version number and the current version number are loaded into register A, and the historical lifecycle state and the current lifecycle state are loaded into register B. A numerical comparison operation is performed to determine whether 2.4 in register A is equal to 2.5. If the result is no, the system sets the key version difference flag to 1. The system also determines whether 0x02 in register B is equal to 0x03. If the result is no, the system sets the lifecycle difference flag to 1. The system performs a logical OR operation on these two difference flags. If either bit is 1, it is determined that the key has undergone a substantial change, and a logic high-level signal is output as the update trigger condition. If the two are completely consistent, a logic low-level signal is output. This marks the change in key configuration and obtains the key update determination marking result.

[0071] S213: Based on the key update judgment mark result and the path instruction mark in the historical mark parameter set, perform a combination difference judgment operation of path number and link timeliness. If any field is inconsistent, the corresponding field comparison result and key difference mark are jointly encoded to generate a policy difference judgment result.

[0072] Based on the key update determination flag result (in this case, valid, i.e., a difference exists), the path instruction flag in the historical flag parameter set is read, specifically including the historical path number "PATH_A00" and the historical link validity period 1766100000. The system compares this with the currently received path number "PATH_A01" and the current link validity period 1766361600 byte by byte. First, the length of the path number string and its ASCII code value are compared. It is found that the last character of "A00" and "A01" are different, indicating that the path numbers are inconsistent. Then, the link validity period values ​​are compared. It is found that 1766100000 is less than 1766361600, indicating that the validity period is inconsistent. The system encodes the path number inconsistency event as a binary sequence 01 and the validity period inconsistency event as 10, combining them to obtain the path difference code 11. Then, the path difference code is jointly encoded with the aforementioned key update determination flag (set to 1), using the method of storing the key flag in the high 4 bits and storing the path difference code in the low 4 bits to generate the final policy difference determination byte (e.g., 0x13), generating the policy difference determination result.

[0073] Please see Figure 4 Step S3 is as follows:

[0074] S311: Based on the policy difference determination result, extract the key update event flag and determine the status. If the flag is valid, read the task control field and encryption status field in the current task context, perform task abort operation and data encryption stop operation, and generate key event abort identifier data.

[0075] Based on the byte value 0x13 in the policy difference determination result, the system extracts the high 4 bits of the key update event flag (0x1), determines that its value is greater than 0, confirms that the flag is valid, the system immediately suspends the currently executing data transmission thread, reads the task control field (e.g., Task_ID: 101) and encryption status field (e.g., Encrypt_Status: RUNNING) in the current task context, modifies the task control field to SUSPEND status, sets the encryption status field to STOPPED, and sends a reset signal to the AES encryption engine through the hardware register to forcibly terminate the encryption operation of the current data stream, clear the remaining data in the encryption pipeline, and records the timestamp of the interruption and the interruption reason code, generating a structure containing the interrupt task number, interrupt time, and reason code, and generating key event abort identifier data.

[0076] S312: Based on the status value of the path change event flag in the policy difference determination result, if the status value is valid, extract the old key field and path instruction field from the edge node storage unit, perform the field clearing operation, load the currently received key status identifier and path identifier data, and establish a configuration reload mapping record set.

[0077] Based on the path change event flag status value (0x3) in the lower 4 bits of the strategy difference determination result, it is determined that the status value is valid if it is non-zero. The system accesses the configuration area of ​​the edge node storage unit, locates the memory address range storing the old key field (version 2.4) and the old path instruction field (PATH_A00), executes the memset function to set all memory in this area to 0x00, and completes the field clearing operation. Then, it loads the currently received key status identifier (version 2.5) and path identifier data (PATH_A01) from the input buffer, writes them to the corresponding address in the configuration area, and establishes a new memory address pointer mapping table, pointing the logical address to the new physical storage location. The loading status and check code of the new configuration are recorded to form a configuration reload mapping record set.

[0078] S313: Based on the key event abort identifier data and the configuration reload mapping record set, perform state synchronization and path reconstruction operations on the task status field and path link field respectively, and aggregate and encode the task control status and path configuration status to obtain the encrypted task and path update execution results.

[0079] Based on the key event abort identifier data, the system confirms that the task is in a secure abort state. Combining the new configuration parameters in the configuration overload mapping record set, the system performs a state machine transition operation on the task status field, switching the state from SUSPEND to CONFIGURING. At the same time, the path link field is reset, and the network protocol stack interface is called to establish a virtual link connection through the new path number "PATH_A01" to verify the link connectivity. After the link handshake is successful, the task control state (CONFIGURING) and the path configuration state (LINK_UP) are aggregated and encoded to generate a 16-bit status word (e.g., 0x0201, where the high byte represents the task status and the low byte represents the path status), which serves as a feedback signal for the completion of the update operation, and the execution results of the encryption task and path update are obtained.

[0080] Please see Figure 5 Step S4 is as follows:

[0081] S411: Based on the execution results of the encryption task and path update, extract the currently active new key configuration, path instruction identifier and corresponding timestamp, perform structure aggregation and data frame rearrangement operations, and generate a synchronous verification packaged dataset.

[0082] Based on the status word 0x0201 in the execution result of the encryption task and path update, the system extracts the currently activated and written new key configuration (version 2.5), path instruction identifier (PATH_A01), and the timestamp when the configuration took effect. According to the predefined data frame format, the system performs structural aggregation, first filling in a 4-byte synchronization header, then sequentially filling in the task ID, key version, path number, effective timestamp, and status word. The entire data frame is then byte-rearranged to network byte order (big-endian mode). The CRC32 check value of the payload data is calculated and appended to the frame tail, constructing a complete data packet for reporting the synchronization status to the cloud, and generating a synchronization check packet dataset.

[0083] S412: Based on the key status and path instruction content in the synchronous verification packaged dataset, read the policy configuration parameters currently registered on the cloud control platform, and perform one-to-one mapping and comparison of the key version and path number to obtain the consistency comparison judgment label.

[0084] Based on the contents of the synchronously verified packaged dataset, the system simulates reading the policy configuration parameters currently registered on the cloud control platform (these parameters are obtained through bidirectional heartbeat messages or queried from the local mirror database). It compares the reported key version 2.5 in the dataset with the latest policy version 2.5 expected by the cloud, and performs string matching between the reported path number PATH_A01 and the planned path number PATH_A01 in the cloud. If the key version values ​​are equal and the path number strings match completely, the consistency comparison is considered successful, and a judgment label containing the "MATCH" status code is generated. If any parameter deviates, for example, if the cloud expects version 2.6, a "MISMATCH" status code is generated, and a consistency comparison judgment label is obtained.

[0085] S413: Based on the consistency comparison, determine the status bit result of the tag. If the tag is in a consistent state, write the confirmation flag. If it is in an inconsistent state, reactivate the configuration push flag and record the processing status, and generate the policy synchronization confirmation result.

[0086] Based on the status bit result of the consistency comparison judgment tag, the system checks the status code content. If the judgment tag is "MATCH" consistent, the system writes the "SYNC_CONFIRMED" confirmation flag to the local log and sends a confirmation message to the cloud. If it is "MISMATCH" inconsistent, the system will reactivate the configuration push flag, set the local status to "SYNC_PENDING", record the number of retries for the current processing failure, trigger the alarm mechanism, and finally generate a record information containing the final confirmation status (ACK or NACK) and the processing timestamp, generating a policy synchronization confirmation result.

[0087] Please see Figure 6 The S5 steps are as follows:

[0088] S511: Based on the policy synchronization confirmation result, if the status is consistent, extract the task control field and the encryption status flag field, execute the task recovery trigger and encryption logic initialization operation, and generate an encryption task restart flag set;

[0089] Based on the consistent state of "SYNC_CONFIRMED" confirmed by the strategy synchronization, the system extracts the task ID and encryption status flag fields from the task control field, changes the encryption status flag from STOPPED to READY, triggers the task recovery logic, calls the initialization function of the encryption algorithm library, passes in the new key context handle, resets the initialization vector (IV) and counter of the encryption algorithm, pre-allocates the buffer resources required for encryption, transitions the task state machine from CONFIGURING to READY, and generates an encryption task restart identifier set containing the task ID and ready status code.

[0090] S512: Based on the task number in the encrypted task restart identifier set, combined with the currently activated new key configuration field and path instruction identifier, parameters are aggregated according to the order of the key field and path field, and a task execution index mapping is established to obtain parameter-driven execution mapping data;

[0091] Based on the task number (e.g., ID: 101) in the encrypted task restart identifier set, combined with the currently activated new key configuration field (256-bit key data corresponding to key version 2.5) and path instruction identifier (PATH_A01), the system loads the key data sequentially into the specified slot (e.g., Slot_0) of the Hardware Security Module (HSM), maps the path identifier to the send queue index of the network interface controller (e.g., Queue_2), and establishes a direct mapping relationship between the task ID and hardware resources, as shown in Table 2. The hardware call parameters during task execution are determined by looking up the table, and the parameter-driven execution mapping data is obtained.

[0092] Table 2 Parameter-Driven Execution Mapping Data Table

[0093] Task Number Logical Resource Identifier Physical resource mapping Configuration parameter values Resource types 101 Key handle_A HSM_Slot_0 Key_V2.5_Data Hardware key slot 101 Path Interface_A Eth0_Queue_2 PATH_A01_Config Network queue 101 Algorithm Engine AES_Core_1 CBC_Mode Computing core

[0094] S513: Based on the key parameter group and path instruction index in the parameter-driven execution mapping data, encrypt the input data stream, perform key invocation, path binding and data packet replacement operations, and perform status recording on the encrypted data frame set to obtain the execution result of edge-cloud collaborative data encryption protection.

[0095] Based on the key parameter group (HSM_Slot_0) and path instruction index (Eth0_Queue_2) determined in the parameter-driven execution mapping data, the system starts a data stream processing thread to intercept the raw input data stream entering the edge node, cut it into 128-bit blocks, call the AES_Core_1 computing core, and use the key in HSM_Slot_0 to perform AES-256 encryption on each data block to generate ciphertext data blocks. Then, a path binding operation is performed to encapsulate the ciphertext data blocks into TCP / IP packets, and replace the routing information corresponding to the destination IP address and port PATH_A01 in the packet header to complete the packet replacement. Finally, the system log records the sequence number, encryption time, and sending status of each encrypted data frame to ensure full traceability and obtain the execution results of edge-cloud collaborative data encryption protection.

[0096] A data encryption protection system based on edge-cloud collaboration includes:

[0097] The encryption instruction acquisition module is used to execute S1: receive encryption task instruction packets from the cloud control platform, extract key lifecycle status information and path identification information, generate key status identifier and path instruction identifier by combining the corresponding time tag, and output key and path instruction information;

[0098] The read and difference judgment module is used to execute S2: read the key status identifier and path instruction identifier of the previous task, compare them with the currently received key and path instruction information, identify key update events and path change events, and generate policy difference judgment results;

[0099] The interruption and policy update module is used to execute S3: based on the policy difference determination result, if a key update event is detected, the current encryption task is terminated and the data encryption operation is stopped; if a path change event is detected, the current data transmission path is interrupted, a new key configuration is activated and a new transmission path is established, and the encryption task and path update execution results are generated.

[0100] The policy confirmation feedback module is used to execute S4: based on the encryption task and path update execution results, the new key configuration, path instruction identifier and timestamp are packaged and sent to the cloud control platform for consistency verification. If the key status and path instruction are completely consistent, the policy update is confirmed to be successful. If they are inconsistent, the configuration is re-pushed and a policy synchronization confirmation result is generated.

[0101] The encryption execution recovery module is used to execute S5: based on the policy synchronization confirmation result, after confirming the successful policy update, the edge node resumes the encryption task, encrypts the data, and generates the execution result of edge-cloud collaborative data encryption protection.

[0102] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A data encryption protection method based on edge cloud collaboration, characterized in that, The method comprises the following steps: S1: receiving an encryption task instruction package from a cloud control platform, extracting key life cycle state information and path identification information, combining corresponding time labels to generate key state identification and path instruction identification, and outputting key and path instruction information; S2: reading the last task key state identification and path instruction identification, comparing them with the current received key and path instruction information, identifying key update events and path change events, and generating a policy difference determination result; S3: according to the policy difference determination result, if a key update event is detected, terminate the current encryption task and stop data encryption operation, if a path change event is detected, interrupt the current data transmission path, activate a new key configuration and establish a new transmission path, and generate an encryption task and path update execution result; S4: according to the encryption task and path update execution result, package the new key configuration, path instruction identification and time stamp and send them to the cloud control platform for consistency check, if the key state and path instruction are completely consistent, confirm that the policy update is successful, if not, re-push the configuration, and generate a policy synchronization confirmation result; S5: according to the policy synchronization confirmation result, after confirming that the policy update is successful, the edge node resumes the encryption task, encrypts the data, and generates an edge-cloud collaborative data encryption protection execution result. 2.The edge cloud collaboration based data encryption protection method of claim 1, wherein: The key life cycle state information represents the version and life cycle stage of the current key, and the path identification information represents the validity period and number of the communication link. 3.The edge cloud collaboration based data encryption protection method of claim 1, wherein: If the key state identification is found to be different from the last one, it is identified as the key update event, and if the path instruction identification is different from the last one, it is identified as the path change event.

4. The method of claim 1, wherein the method further comprises: The key and path instruction information includes key state consistency mark, key effective stage attribute, communication link validity mark, link number attribute, instruction generation time identification, the policy difference determination result includes key state change flag, path configuration change flag, policy consistency judgment mark, change type classification label, the encryption task and path update execution result includes task termination state, path reconstruction state, cache cleaning completion mark, new configuration activation state, execution completion confirmation identification, the policy synchronization confirmation result includes cloud edge configuration consistency check flag, policy update confirmation mark, configuration re-push trigger state, synchronization completion time identification, and the edge-cloud collaborative data encryption protection execution result includes encryption task recovery state, data encryption validity identification, link security stability mark, and collaborative execution completion confirmation state.

5. The method of claim 1, wherein the edge cloud collaboration based data encryption protection method further comprises: The key and path instruction information acquisition step specifically comprises: S111: extracting the key life cycle state information from the encryption task instruction package received from the cloud control platform, and performing field analysis on the key version and life cycle stage, combining the time label to perform index integration operation, and generating a key state identification data unit; S112: extracting the path identification information according to the encryption task instruction package, analyzing the communication link validity period field and path number field, combining the time label to perform number splicing and time section positioning operation, and obtaining a path instruction identification data unit; S113: Based on the key state identification data unit and the path instruction identification data unit, the instruction sequence in the task instruction package is combined as a merging basis to perform field aggregation and format packaging processing, and key and path instruction information is generated.

6. The method of claim 1, wherein the edge cloud collaboration based data encryption protection method further comprises: The policy difference determination result obtaining step specifically is: S211: Based on the data recorded in the edge node storage unit when the last task is executed, the key state identification and the path instruction identification are read, and the content is indexed, extracted and format-separated to establish a historical identification parameter set; S212: Based on the key state identification in the historical identification parameter set, the key version and the life cycle stage are matched field by field in combination with the received key and path instruction information, and if there is any inconsistency, the difference bit is marked as valid to obtain a key update determination mark result; S213: According to the key update determination mark result and the path instruction identification in the historical identification parameter set, the path number and link time limit combination difference discrimination operation is performed, and if there is any field inconsistency, the corresponding field comparison result and the key difference mark are jointly encoded to generate a policy difference determination result.

7. The edge cloud collaboration based data encryption protection method of claim 1, wherein, The encrypted task and path update execution result obtaining step specifically is: S311: Based on the policy difference determination result, the key update event flag bit is extracted and the state is judged, if the flag bit is valid, the task control field and the encryption state field in the current task context are read, the task termination operation and the data encryption stop operation are performed, and the key event termination identification data is generated; S312: According to the state value of the path change event flag bit in the policy difference determination result, if the state value is valid, the old key field and the path instruction field in the edge node storage unit are extracted, the field emptying operation is performed, the received key state identification and path identification data are loaded to establish a configuration reload mapping record set; S313: According to the key event termination identification data and the configuration reload mapping record set, the task state field and the path link field are respectively subjected to state synchronization and path reconstruction operation, and the task control state and the path configuration state are aggregated and encoded to obtain the encrypted task and path update execution result.

8. The edge cloud collaboration based data encryption protection method of claim 1, wherein, The policy synchronization confirmation result obtaining step specifically is: S411: Based on the encrypted task and path update execution result, the newly activated key configuration, the path instruction identification and the corresponding timestamp are extracted, the structure aggregation and data frame rearrangement operation are performed, and a synchronization check packaging data set is generated; S412: According to the key state and path instruction content in the synchronization check packaging data set, the policy configuration parameters currently registered in the cloud control platform are read, and the key version and the path number are one-to-one mapped and compared to obtain a consistency comparison determination label; S413: Based on the state bit result of the consistency comparison determination label, if the determination label is consistent, a confirmation mark is written, and if it is inconsistent, a configuration push identification is reactivated and the processing state is recorded to generate a policy synchronization confirmation result.

9. The edge cloud collaboration based data encryption protection method of claim 1, wherein, The edge cloud collaborative data encryption protection execution result obtaining step specifically is: S511: According to the policy synchronization confirmation result, if it is consistent, the task control field and the encryption state flag field are extracted, the task recovery trigger and the encryption logic initialization operation are performed, and the encrypted task restart identification set is generated; S512: Based on the task number in the encrypted task restart identification set, combined with the current activated new key configuration field and path instruction identification, the parameter aggregation is performed according to the arrangement order of the key field and the path field, and the task execution index mapping is established, and the parameter driven execution mapping data is obtained; S513: According to the key parameter group and the path instruction index in the parameter driven execution mapping data, the input data stream is encrypted, the key calling, path binding and data packet replacement operations are performed, and the state record of the encrypted data frame set is performed, and the edge cloud collaborative data encryption protection execution result is obtained.

10. A data encryption protection system based on edge cloud collaboration, characterized in that, The system is used to realize the data encryption protection method based on edge cloud collaboration of any one of claims 1-9, comprising: The encryption instruction acquisition module is used to execute S1: receiving the encryption task instruction package from the cloud control platform, extracting the key life cycle state information and the path identification information, combining the corresponding time label to generate the key state identification and the path instruction identification, and outputting the key and path instruction information; The reading and difference judgment module is used to execute S2: reading the last task key state identification and path instruction identification, comparing with the current received key and path instruction information, identifying the key update event and the path change event, and generating the policy difference judgment result; The interrupt and policy update module is used to execute S3: according to the policy difference judgment result, if the key update event is detected, the current encryption task is terminated and the data encryption operation is stopped, if the path change event is detected, the current data transmission path is interrupted, the new key configuration is activated and the new transmission path is established, the encryption task and path update execution result is generated; The policy confirmation feedback module is used to execute S4: according to the encryption task and path update execution result, the new key configuration, path instruction identification and time stamp are packaged and sent to the cloud control platform for consistency check, if the key state and path instruction are completely consistent, the policy update is confirmed to be successful, if not, the configuration is pushed again, and the policy synchronization confirmation result is generated; The encryption execution recovery module is used to execute S5: according to the policy synchronization confirmation result, the edge node recovers the encryption task after the policy update is confirmed to be successful, the data is encrypted, and the edge cloud collaborative data encryption protection execution result is generated.

Images