Micro-service-based adaptive encryption system and control method

Abstract

The invention discloses a micro-service-based adaptive encryption system and a control method. The system comprises a load monitoring module, an encryption strategy library, an algorithm switching module and a fault-tolerant recovery module. The dynamic adjustment of the encryption strategy is directly driven according to the real-time load data (QPS, the number of concurrent connections and the average response time) of the service gateway, a rapid and lightweight decision-making and execution link can be established, the encryption algorithm and the encryption strength are adjusted in real time according to the load, and the encryption efficiency is improved. According to the method, algorithm switching can be quickly triggered when request flow is sharply increased, system load is too high and service pressure is increased, so that more accurate and more efficient balance between safety and service response speed is realized in a high-concurrency scene, indirect system indexes such as CPU / memory occupation or basic network parameters with relatively low association degree with real service pressure can be abandoned, and the service performance of the system is improved. Therefore, the problem that the correlation degree between the index and the business pressure is insufficient in the prior art is solved, and the delay caused by inaccurate regulation and control opportunity and a complex evaluation model is avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security and micro-service development and management, and particularly relates to a self-adaptive encryption system based on micro-service and a control method. BACKGROUND

[0002] With the continuous expansion of the demand for information security, many industries provide data encryption services through encryption systems. In order to enable the encryption system to operate normally, the performance of the encryption system is usually monitored to ensure the efficiency of encryption and the experience of users.

[0003] Traditional monitoring strategies mainly focus on CPU utilization, memory occupancy, disk IO indicators and other hardware resource usage rates as the main control indicators. For example, a dynamic encryption method, system, computer device and storage medium and process disclosed in Chinese patent application CN117131484A comprehensively adjust the encryption strategy by real-time sensing of system load, network conditions and security threats and other environmental parameters. However, the traditional monitoring strategies do not focus on related business monitoring indicators of system services, such as traffic indicators.

[0004] On this basis, some research has made beneficial exploration in the dynamic adjustment of encryption strategies, but more focuses on control based on data content, user behavior or general environmental parameters. For example, a data security encryption method and system based on high-security machine learning disclosed in Chinese patent application CN120632920A dynamically selects encryption algorithms and key strengths by using machine learning algorithms (such as K-nearest neighbor) to analyze data sensitivity or access behavior. However, the limitation of such a scheme is that it fails to provide a direct, efficient and built-in fault tolerance mechanism solution specifically for the encryption performance bottleneck problem caused by the surge of system load in high-concurrency scenarios. SUMMARY

[0005] In view of the deficiencies of the prior art, the present application aims to provide a self-adaptive encryption system based on micro-service and a control method.

[0006] In order to achieve the above-mentioned purpose, the present application adopts the following technical solutions:

[0007] A self-adaptive encryption system based on micro-service, comprising a load monitoring module, an encryption strategy library, an algorithm switching module and a fault tolerance recovery module;

[0008] The encryption strategy library is used to store the mapping relationship between encryption algorithms of different strengths and load threshold conditions;

[0009] The load monitoring module is configured to collect and analyze load data of the service gateway or the traffic gateway in real time, dynamically perceive the service load pressure borne by the system, and query a preset mapping relationship from an encryption policy library to determine whether the real-time load data exceeds a preset load threshold condition, and when the load data exceeds any preset load threshold condition, send a switching instruction to the algorithm switching module according to the mapping relationship;

[0010] The algorithm switching module is configured to complete data encryption processing by using an encryption algorithm according to a service request, load a default encryption algorithm from an algorithm pool when no switching instruction is received, and switch to load a corresponding encryption algorithm in the algorithm pool according to the switching instruction when the switching instruction is received.

[0011] The fault recovery module is configured to automatically enable a backup scheme and attempt to recover the encryption service when the encryption service is abnormal.

[0012] Further, the load data includes a request rate, a number of concurrent connections and an average response delay, and correspondingly, the load threshold condition includes a request rate threshold, a number of concurrent connections threshold and an average response delay threshold.

[0013] The application further provides an adaptive encryption control method using the system.

[0014] S1, service request arrival and load data collection: when a service request arrives at the service gateway or the traffic gateway, the load monitoring module is first activated and starts to collect load data of the service gateway or the traffic gateway in real time.

[0015] S2, the load monitoring module queries a preset mapping relationship from an encryption policy library to determine whether the real-time load data exceeds a preset load threshold condition.

[0016] S3, when the load data does not exceed any load threshold condition, the algorithm switching module uses a default high-intensity encryption algorithm to complete data encryption of the service request.

[0017] When the load monitoring module determines that the load data exceeds any preset load threshold condition, the algorithm switching module sends a switching instruction to the algorithm switching module according to the mapping relationship, and the algorithm switching module loads a corresponding low-intensity encryption algorithm from the algorithm pool according to the switching instruction.

[0018] S4, if the encryption algorithm switching is successful, the algorithm switching module uses the switched encryption algorithm to process the current service request.

[0019] If the encryption algorithm switching fails, the algorithm switching module notifies the fault recovery module, and the fault recovery module automatically enables a preset backup scheme and attempts to recover the encryption service.

[0020] Furthermore, in step S2, the load monitoring module uses a sliding time window algorithm to calculate the trend of the load data.

[0021] The beneficial effects of this invention are as follows: This invention directly drives the dynamic adjustment of encryption strategies based on real-time load data (QPS, concurrent connections, and average response time) of the business gateway in the microservice system. It can establish a fast and lightweight decision-making and execution link, and adjust the encryption algorithm and encryption strength in real time according to the system load. This ensures that the algorithm can be quickly switched when there is a surge in request traffic, excessive system load, or increased business pressure. Thus, in high-concurrency scenarios, it achieves a more accurate and efficient balance between security and service response speed. It is an adaptive encryption scheme for microservice systems that is more timely and better aligned with business objectives. It can eliminate indirect system indicators that have low correlation with real business pressure, such as CPU / memory usage or basic network parameters, thereby solving the problem of insufficient correlation between indicators and business pressure in existing technologies, avoiding inaccurate timing of adjustment, and avoiding the delay caused by complex evaluation models.

[0022] 2. This invention ensures, through a fault-tolerance mechanism, that a single point of failure will not lead to the unavailability of the entire service. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of the system architecture of Embodiment 1 of the present invention;

[0024] Figure 2 This is a flowchart of the method in Embodiment 2 of the present invention;

[0025] Figure 3 This is a timing diagram of an example of Embodiment 3 of the present invention;

[0026] Figure 4 This is a timing diagram for an example of Embodiment 4 of the present invention. Detailed Implementation

[0027] The present invention will be further described below with reference to the accompanying drawings. It should be noted that this embodiment is based on the present technical solution and provides detailed implementation methods and specific operation processes, but the protection scope of the present invention is not limited to this embodiment.

[0028] Example 1

[0029] This embodiment provides an adaptive encryption system based on microservices, such as Figure 1 As shown, it includes a load monitoring module, an encryption policy library, an algorithm switching module, and a fault tolerance and recovery module.

[0030] The encryption policy library is used to store the mapping relationship between encryption algorithms of different strengths and load threshold conditions.

[0031] The load monitoring module is used to collect and analyze the load data of the service gateway or traffic gateway in real time, dynamically sense the service load pressure borne by the system, query the preset mapping relationship from the encryption policy library, determine whether the real-time load data exceeds the preset load threshold condition, and when the load data exceeds any preset load threshold condition, issue a switching command to the algorithm switching module according to the mapping relationship.

[0032] In this embodiment, the load data includes inbound / outbound request rate (requests per second) (directly reflecting the frequency of current business access), concurrent connections (representing the number of requests processed by the system at the same time, reflecting instantaneous load) and average response latency (the time from receiving a request to starting a response, directly related to user experience). Correspondingly, the load threshold conditions include request rate threshold, concurrent connection threshold, and average response latency threshold.

[0033] The algorithm switching module is used to complete data encryption processing using an encryption algorithm according to business requests. When no switching instruction is received, it loads the default encryption algorithm from the algorithm pool. When a switching instruction is received, it switches and loads the corresponding encryption algorithm from the algorithm pool according to the switching instruction.

[0034] In this way, the system can automatically switch between encryption algorithms of different strengths (such as AES-256 and AES-128) based on the load, to achieve the best balance between security and service response speed. For example, when the load monitoring module detects a surge in request rate, increased concurrency, or increased average response latency, the algorithm switching module switches from a high-strength encryption algorithm to a low-strength encryption algorithm to ensure a good user experience under high concurrency.

[0035] The fault tolerance and recovery module is used to automatically activate a backup plan and attempt to restore the encryption service when the encryption service fails.

[0036] Example 2

[0037] This embodiment provides an adaptive encryption control method using the system described in Embodiment 1, such as... Figure 2 As shown, it includes the following steps:

[0038] S1. Service Request Arrival and Load Data Collection: When a service request arrives at the service gateway or traffic gateway, the load monitoring module is activated first and begins to collect the load data of the service gateway or traffic gateway in real time.

[0039] S2. The load monitoring module queries the encryption policy library for preset mapping relationships to determine whether the real-time load data exceeds the preset load threshold condition. Specifically, the load monitoring module can use a sliding time window algorithm to calculate the trend of the load data.

[0040] S3. When the load data does not exceed any load threshold condition, the algorithm switching module uses the default high-strength encryption algorithm to complete the data encryption business request, ensuring the highest level of security protection when system resources are sufficient.

[0041] When the load monitoring module determines that the load data exceeds any preset load threshold condition, it sends a switching command to the algorithm switching module according to the mapping relationship. The algorithm switching module loads and switches to the corresponding low-strength encryption algorithm from the algorithm pool according to the switching command, prioritizing system performance and response speed while ensuring basic security.

[0042] S4. If the encryption algorithm switch is successful, the algorithm switching module will use the switched encryption algorithm to process the current business request.

[0043] If the encryption algorithm switching fails (e.g., algorithm library loading fails or service becomes unavailable), the algorithm switching module notifies the fault recovery module. The fault recovery module automatically activates a pre-configured backup solution and attempts to restore the encryption service. For example, it might activate a lightweight backup algorithm to attempt to process business requests, while simultaneously logging detailed fault information and sending alerts to operations and maintenance personnel. This process ensures that a single point of failure does not lead to the unavailability of the entire service.

[0044] Example 3

[0045] This embodiment provides application examples of Embodiments 1 and 2 in an instant messaging software system, describing how the system copes with instantaneous traffic surges, ensuring system stability and user experience while guaranteeing communication data security. Figure 3 As shown,

[0046] Step 1: The user starts sending message data, and the data arrives at the service gateway;

[0047] Step 2: The load monitoring module collects load data from the business gateway in real time and calculates the current global requests per second (QPS);

[0048] Step 3: The load monitoring module queries the encryption policy library based on the current QPS data to determine whether the current QPS data exceeds the preset QPS threshold.

[0049] If the current QPS data does not exceed the QPS threshold, the encryption policy library will return the current default encryption policy to the load monitoring module. In this embodiment, the default encryption policy is to use the high-security encryption algorithm AES-256 and implement it with hardware encryption. The algorithm switching module continues to use the default encryption policy to complete the data encryption.

[0050] If the current QPS data value exceeds the QPS threshold, the encryption policy library will return the corresponding encryption policy to the load monitoring module according to the preset mapping relationship, that is, to enable the low-security-strength encryption algorithm AES-128 and the software encryption implementation.

[0051] Step 4: The load monitoring module sends a switching command to the algorithm switching module based on the encryption strategy processing result;

[0052] Step 5: The algorithm switching module calls the algorithm pool and, based on the received switching instruction, enables the new encryption strategy;

[0053] Step 6: After a successful switch, the algorithm switching module notifies the load monitoring module that it is ready;

[0054] Step 7: The algorithm switching module uses the switched encryption algorithm to encrypt the data;

[0055] Step 8: Return the encrypted result;

[0056] Step 9: Message data transmission complete.

[0057] Example 4

[0058] This embodiment provides an application example of Embodiments 1 and 2 in a financial trading system, describing the system's precise adaptive capability under scenarios with high security requirements and drastic load fluctuations, ensuring system stability and user experience. Figure 4 As shown, it includes the following steps:

[0059] Step 1: The trading terminal sends a transaction data stream, which arrives at the risk control gateway;

[0060] Step 2: The load monitoring module collects the load data of the risk control gateway in real time and calculates the current real-time concurrent users;

[0061] Step 3: The load monitoring module queries the encryption policy library based on the real-time concurrency count to determine whether the real-time concurrency count exceeds the preset concurrency threshold.

[0062] If the real-time concurrency does not exceed the concurrency threshold (i.e., real-time concurrency ≤ 45000), the encryption strategy library will return the current default encryption strategy to the load monitoring module. In this embodiment, the default encryption strategy is to use the high-security encryption algorithm RSA4096 and implement it with hardware encryption. The algorithm switching module continues to use the default encryption strategy to complete the data encryption.

[0063] If the real-time concurrent users exceed the concurrency threshold (concurrency > 45000), the encryption policy library will return the corresponding encryption policy to the load monitoring module according to the preset mapping relationship, namely the low-security encryption algorithm RSA-2048 and the software encryption implementation, to reduce the load pressure.

[0064] Step 4: The load monitoring module sends a switching command to the algorithm switching module based on the encryption strategy processing result;

[0065] Step 5: If the switch is successful, the algorithm switching module notifies the load monitoring module that it is ready and uses the switched encryption strategy to complete the data encryption; if the switch fails, the algorithm switching module notifies the fault tolerance and recovery module to trigger the fault tolerance and recovery mechanism, and the fault tolerance and recovery module uses the backup algorithm to complete the data encryption.

[0066] Step 6: Return the encrypted result;

[0067] Step 7: Transaction data processing completed, successful response.

[0068] For those skilled in the art, various corresponding changes and modifications can be made based on the above technical solutions and concepts, and all such changes and modifications should be included within the protection scope of the claims of this invention.

Claims

1. A microservice-based adaptive encryption system, characterized in that, The load monitoring module, the encryption policy library, the algorithm switching module and the fault tolerance recovery module are included. The encryption policy library is used for storing the mapping relationship between encryption algorithms of different strengths and load threshold conditions. The load monitoring module is used for collecting and analyzing load data of a service gateway or a traffic gateway in real time, dynamically sensing the service load pressure borne by the system, querying the preset mapping relationship from the encryption policy library, judging whether the real-time load data exceeds the preset load threshold conditions, and issuing a switching instruction to the algorithm switching module according to the mapping relationship when the load data exceeds any preset load threshold condition. The algorithm switching module is used for completing data encryption processing by using an encryption algorithm according to a service request, loading a default encryption algorithm from an algorithm pool when no switching instruction is received, and switching to load a corresponding encryption algorithm in the algorithm pool according to the switching instruction when the switching instruction is received. The fault tolerance recovery module is used for automatically enabling a backup scheme and attempting to recover the encryption service when the encryption service is abnormal.

2. The system of claim 1, wherein, The load data includes request rate, concurrent connection number and average response delay, and correspondingly, the load threshold conditions include request rate threshold, concurrent connection number threshold and average response delay threshold.

3. An adaptive encryption control method using the system of any one of claims 1-2, characterized by, The method comprises the following steps: S1, service request arrival and load data collection: when a service request arrives at a service gateway or a traffic gateway, the load monitoring module is first activated and starts collecting load data of the service gateway or the traffic gateway in real time; S2, the load monitoring module queries the preset mapping relationship from the encryption policy library and judges whether the real-time load data exceeds the preset load threshold conditions; S3, when the load data does not exceed any load threshold condition, the algorithm switching module uses a default high-strength encryption algorithm to complete data encryption of the service request; When the load monitoring module judges that the load data exceeds any preset load threshold condition, a switching instruction is issued to the algorithm switching module according to the mapping relationship, and the algorithm switching module loads a corresponding low-strength encryption algorithm from the algorithm pool according to the switching instruction; S4, if the encryption algorithm switching is successful, the algorithm switching module uses the switched encryption algorithm to process the current service request; If the encryption algorithm switching fails, the algorithm switching module notifies the fault tolerance recovery module, and the fault tolerance recovery module automatically enables a preset backup scheme and attempts to recover the encryption service.

4. The control method according to claim 3, characterized by The load monitoring module uses a sliding time window algorithm to calculate the trend of the load data.

Images