A method and system for encrypting and transmitting data using national cryptographic algorithms

Abstract

This invention discloses a method and system for encrypted data transmission using Chinese national cryptographic algorithms, comprising: acquiring the data to be encrypted and network parameters; constructing a Bayesian network probabilistic ablation model; absolving the Chinese national cryptographic encryption using Monte Carlo sampling and assessing attack risks to generate a probabilistically secure encryption strategy; based on this, constructing a Long Short-Term Memory (LSTM) network time prediction model and optimizing it using simulated annealing to obtain the optimal encryption parameter configuration sequence. According to this sequence, SM2 generates a key pair, a shared key is established using the elliptic curve Diffie-Hellman protocol, and an SM4 session key is derived using SM3 to establish a hybrid encryption key system; a teacher-student network model is constructed, and multi-threaded scheduling is optimized using adversarial distillation training and retrieval enhancement techniques to generate a multi-threaded parallel encryption architecture; network parameters are monitored in real time, a reinforcement learning adaptive decision engine is constructed, and the strategy is dynamically adjusted to complete adaptive encrypted transmission. This invention achieves an optimal balance between security and efficiency in the encrypted data transmission process.

Description

Technical Field

[0001] This invention relates to the field of network communication security, specifically to a data encryption transmission method and system based on Chinese cryptographic algorithms, which is particularly suitable for data transmission scenarios requiring high security. Background Technology

[0002] With the rapid development of information technology and the booming digital economy, secure data transmission has become a core technological requirement in the field of network communication. As a cryptographic algorithm system independently developed by my country, the national cryptographic algorithm plays a vital role in safeguarding national information security and is increasingly widely used in key areas such as finance, government affairs, and telecommunications.

[0003] Current national cryptographic data encryption transmission technologies primarily employ the SM2 elliptic curve public-key cryptography algorithm for key negotiation, combined with the SM4 block cipher algorithm for data encryption. Typical implementation schemes include SM2-based key exchange protocols and SM4-based data stream encryption technology. Another common approach is to use the SM3 cryptographic hash algorithm for data integrity verification, working in conjunction with SM2 and SM4 algorithms to construct a complete encrypted transmission system.

[0004] The most representative existing technology employs a hybrid encryption mode with fixed parameter configuration. This mode utilizes the asymmetric nature of the SM2 algorithm for secure distribution of session keys, and then uses the efficient symmetric encryption of the SM4 algorithm for batch processing of the actual data. This scheme balances security and performance requirements through preset encryption strength parameters and a fixed thread allocation strategy.

[0005] However, existing technologies have two key problems: First, the encryption parameter configuration lacks adaptability and cannot dynamically adjust the security strategy according to the actual threat environment and network conditions, resulting in insufficient protection capabilities in complex attack scenarios; second, the parallel processing architecture lacks an intelligent coordination mechanism, and the resource competition and synchronization overhead between multiple threads seriously affect the overall encryption performance, making it difficult to meet the needs of large-scale high-speed data transmission. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and system for encrypted data transmission using national cryptographic algorithms. Through innovative technologies such as probabilistic ablation reconstruction mechanism, simulated annealing optimization, hybrid encryption strategy, adversarial distillation retrieval enhancement technology and adaptive transmission protocol, the invention achieves the optimal balance between security and efficiency in the encrypted data transmission process.

[0007] To address the aforementioned technical problems, this invention provides a method for encrypting and transmitting data using a national cryptographic algorithm, comprising:

[0008] The data to be encrypted and transmitted and network environment parameters are obtained. A probabilistic ablation model based on Bayesian network is established. The national cryptographic encryption process is randomly ablated through Monte Carlo sampling and the risk probability under various attack scenarios is evaluated to generate a probabilistic security-assured encryption strategy.

[0009] Based on the encryption strategy with probabilistic security, the Boolean feature set in the encryption process is extracted and a long short-term memory network time prediction model is constructed. The simulated annealing algorithm is used to optimize the model by taking the weighted combination of prediction time and security strength as the objective function, so as to obtain the optimal encryption parameter configuration sequence.

[0010] Based on the optimal encryption parameter configuration sequence, a key pair is generated using the SM2 elliptic curve algorithm and a shared key is established using the elliptic curve Diffie-Hellman protocol. The shared key is then used to generate an SM4 session key through key derivation using the SM3 hash function, thus establishing a hybrid encryption key system.

[0011] Based on the aforementioned hybrid encryption key system, teacher network and student network models are constructed. Multi-threaded scheduling strategies are optimized through adversarial distillation training and retrieval enhancement techniques, an intelligent thread coordination mechanism is established, and a multi-threaded parallel encryption processing architecture is generated.

[0012] Through the aforementioned multi-threaded parallel encryption processing architecture, network bandwidth, latency, and packet loss rate are monitored in real time. An adaptive decision engine based on reinforcement learning is constructed to dynamically adjust the encryption strength and transmission strategy according to network status and data characteristics, thereby completing adaptive encrypted data transmission.

[0013] Furthermore, the establishment of a probabilistic ablation model based on Bayesian networks, which involves performing random ablation operations on the national cryptographic encryption process through Monte Carlo sampling and evaluating the risk probability under various attack scenarios to generate a probabilistically secure encryption strategy, includes:

[0014] Based on the data to be encrypted and the network environment parameters, a Bayesian network is constructed to represent the execution steps of the SM2 and SM4 algorithms as network nodes, and each node is assigned a corresponding probability distribution to establish a probabilistic representation model of the encryption process.

[0015] Using the probabilistic representation model, Monte Carlo sampling is used to randomly select specific steps in the encryption process for ablation operations, including disabling encryption rounds, modifying the key expansion algorithm, and changing the S-box replacement rule, generating a variety of ablation configuration schemes.

[0016] Based on the aforementioned multiple ablation configuration schemes, simulation tests are run to evaluate the security strength under differential cryptanalysis, linear cryptanalysis, and specialized attack methods. The probability of successful attack, required computing resources, and attack time window are calculated to obtain the encryption strategy with probabilistic security assurance.

[0017] Furthermore, the step of extracting the Boolean feature set during the encryption process and constructing a Long Short-Term Memory (LSTM) network time prediction model, employing simulated annealing with a weighted combination of prediction time and security strength as the objective function for optimization, yields the optimal encryption parameter configuration sequence, including:

[0018] Based on the encryption strategy with probabilistic security, Boolean feature vectors including key length selection, encryption round configuration, and parallelism setting are extracted. Long Short-Term Memory Network (LSTM) receiver parameter configuration vector and historical performance data are constructed to establish a prediction model of parameter configuration and encryption time.

[0019] Based on the prediction model, a simulated annealing optimization framework is established, with a weighted combination of prediction time and safety intensity as the objective function. An initial temperature is set and randomness is gradually reduced through a temperature control strategy to search for the optimal variable sorting scheme.

[0020] Based on the optimal variable sorting scheme, a configuration sequence containing parameter adjustment priority guidance is generated. When a performance bottleneck is detected, the parameters are gradually adjusted according to the priority sequence to obtain the optimal encryption parameter configuration sequence.

[0021] Furthermore, the process of generating key pairs using the SM2 elliptic curve algorithm and establishing a shared key using the elliptic curve Diffie-Hellman protocol, then using the shared key to derive an SM4 session key through the SM3 hash function to establish a hybrid encryption key system includes:

[0022] Based on the optimal encryption parameter configuration sequence, elliptic curve parameters are selected and an SM2 key pair is generated using a true random number generator. The two communicating parties generate a temporary key pair and exchange public keys. The shared secret is calculated using the elliptic curve Diffie-Hellman protocol.

[0023] Based on the shared secret, the key is converted into a byte sequence using a standardized point compression algorithm, and the key entropy value is increased by performing multiple rounds of hash operations using the SM3 hash function. This process is used to derive and generate a data encryption key, a message authentication code key, and a key update master key, thereby obtaining the SM4 session key.

[0024] Using the SM4 session key, a key chain technology is established to achieve periodic key updates. The next generation session key is generated using the current session key and a new random number through the SM3 hash algorithm. The current session key is then securely destroyed by overwriting the memory area multiple times, thus establishing the hybrid encryption key system.

[0025] Furthermore, the construction of teacher and student network models, optimization of multi-threaded scheduling strategies through adversarial distillation training and retrieval enhancement techniques, establishment of an intelligent thread coordination mechanism, and generation of a multi-threaded parallel encryption processing architecture include:

[0026] Based on the aforementioned hybrid encryption key system, a teacher network model is constructed. By analyzing historical encryption task execution data, the optimal thread scheduling strategy is learned. A lightweight student network model is designed to be responsible for real-time thread resource allocation and task scheduling. A knowledge distillation and transfer mechanism is established.

[0027] Through the knowledge distillation transfer mechanism, the student network is subjected to adversarial training in a simulated attack environment to generate adversarial samples that simulate hardware failures, network attacks and resource contention, thereby obtaining a robust scheduling strategy.

[0028] Based on the robust scheduling strategy, a feature vector database is established to store historical encryption task features and optimal scheduling schemes. Vector retrieval technology is used to match similar cases within milliseconds to generate the multi-threaded parallel encryption processing architecture.

[0029] Furthermore, it also includes distributed encryption optimization steps based on federated learning:

[0030] Based on the encryption strategy with probabilistic security, a multi-node federated learning network is established. Each node trains a local optimization model based on local encryption task data, generating a distributed model training system.

[0031] Through the distributed model training system, differential privacy protection and homomorphic encryption technology are used to share the local optimized model parameters trained by each node. Under the premise of protecting the privacy of the original encrypted task data, the local models are fused to construct a global thread scheduling optimization strategy.

[0032] Based on the global thread scheduling optimization strategy, a dynamic node management mechanism is established to support the dynamic addition and removal of nodes, evaluate the contribution and trustworthiness of nodes in real time, and achieve collaborative optimization of distributed encryption parameters.

[0033] Furthermore, the established dynamic node management mechanism supports the dynamic joining and leaving of nodes, real-time evaluation of node contribution and trustworthiness, and collaborative optimization of distributed encryption parameters, including:

[0034] Based on the global thread scheduling optimization strategy, a node reputation evaluation algorithm is designed. A multi-dimensional reputation scoring system is established based on historical contribution, data quality, and model performance to generate node credibility evaluation results.

[0035] Based on the node credibility evaluation results, a dynamic weight allocation mechanism is established. The parameter fusion weight of nodes in the global thread scheduling optimization strategy construction process is adjusted according to the node reputation score. A reputation threshold is set to automatically remove low-reputation nodes, ensuring safe and effective federated learning.

[0036] Based on the aforementioned secure and effective federated learning, a node failure detection and recovery mechanism is constructed to monitor node status in real time and automatically reassign tasks when a node fails.

[0037] Furthermore, it also includes an entropy enhancement step based on quantum random numbers:

[0038] Based on the encryption strategy with probabilistic security, a quantum random number generator is integrated to provide a random number source for the national cryptographic algorithm. An entropy pool management mechanism is designed to monitor the quality of random numbers in real time and a quantum random number supply system is established.

[0039] Through the quantum random number supply system, a hybrid strategy of using quantum random numbers and traditional pseudo-random numbers is established. Random number sources are dynamically selected according to security level requirements and hardware costs to achieve cost-controllable random number services.

[0040] Based on the aforementioned random number service, a quantum random number quality assessment system is constructed. Statistical testing methods are used to verify the uniformity, independence, and unpredictability of random numbers, ensuring that the random numbers meet cryptographic security requirements.

[0041] Furthermore, the aforementioned construction of a quantum random number quality assessment system employs statistical testing methods to verify the uniformity, independence, and unpredictability of random numbers, ensuring that the random numbers meet cryptographic security requirements, including:

[0042] Based on the random number service, frequency tests, run length tests, and autocorrelation tests are performed to verify the statistical uniformity and independence of the random number sequence, and a random number quality assessment report is generated.

[0043] The random number quality assessment report is used to evaluate the unpredictability of random numbers using linear complexity tests and general statistical tests. A quality threshold is set for real-time monitoring, and a random number quality assurance mechanism is established.

[0044] Based on the random number quality assurance mechanism, when the quality of the random number is detected to be lower than the preset quality threshold, the system automatically switches to a backup random number source and triggers the recalibration of the quantum random number generator to ensure that the random number meets the cryptographic security requirements.

[0045] Furthermore, it also includes optimization steps for encryption offloading based on edge computing:

[0046] Based on the adaptive encrypted transmission of the data, an edge node encryption capability evaluation model is established to dynamically evaluate the computing resources, storage capacity and security level of each edge node and generate an edge node capability distribution map.

[0047] Based on the edge node capability distribution map, an intelligent task allocation algorithm is designed to allocate encrypted tasks optimally according to data sensitivity and node capabilities, establish a task priority queue, and achieve load-balanced task distribution.

[0048] Based on the load-balanced task distribution, an edge-cloud collaborative key management system is constructed to achieve cross-level secure key distribution and updates, and to establish a load balancing mechanism between edge nodes.

[0049] Furthermore, the establishment of an edge node encryption capability evaluation model, dynamically evaluating the computing resources, storage capacity, and security level of each edge node, and generating an edge node capability distribution map includes:

[0050] Based on the adaptive encrypted transmission of the data, the CPU utilization, memory usage, network bandwidth and encryption processor performance parameters of the edge nodes are collected to establish node hardware resource evaluation indicators.

[0051] By using the node hardware resource evaluation indicators, combined with the node's physical security level, network security configuration, and access control mechanism, the analytic hierarchy process is used to calculate a comprehensive security score and generate a node security level evaluation result.

[0052] Based on the node security level assessment results, a multi-dimensional capability assessment matrix is ​​constructed, a clustering algorithm is used to classify and manage the nodes, the node status information is updated in real time, and the edge node capability distribution map is generated.

[0053] Furthermore, the real-time monitoring of network bandwidth, latency, and packet loss rate, and the construction of an adaptive decision engine based on reinforcement learning, dynamically adjusts the encryption strength and transmission strategy according to network status and data characteristics to complete adaptive encrypted data transmission, including:

[0054] Through the aforementioned multi-threaded parallel encryption processing architecture, bandwidth utilization, round-trip latency, and packet loss rate are collected in real time to analyze data sensitivity, size, and type characteristics, and to establish a network status and data characteristic database.

[0055] Based on the network state and data feature database, a reinforcement learning decision engine is constructed. A deep Q-network is used to learn the mapping relationship between the network state and the optimal transmission strategy. A reward function is set to optimize transmission efficiency and security, and an adaptive transmission decision strategy is generated.

[0056] The adaptive transmission decision strategy dynamically adjusts the number of SM4 encryption rounds, data block size, and transmission concurrency, establishing a transmission performance feedback mechanism to continuously optimize strategy parameters and complete the adaptive encrypted transmission of the data.

[0057] Furthermore, this invention also proposes a national cryptographic algorithm-based data encryption transmission system, comprising:

[0058] The probabilistic ablation reconstruction module is used to obtain the data to be encrypted and transmitted and network environment parameters, establish a probabilistic ablation model based on Bayesian networks, perform random ablation operations on the national cryptographic encryption process through Monte Carlo sampling, evaluate the risk probability under various attack scenarios, and generate a probabilistic security-assured encryption strategy.

[0059] The parameter optimization module is used to extract the Boolean feature set in the encryption process and construct a long short-term memory network time prediction model based on the encryption strategy with probabilistic security guarantee. The simulated annealing algorithm is used to optimize the model by taking the weighted combination of prediction time and security strength as the objective function to obtain the optimal encryption parameter configuration sequence.

[0060] The hybrid encryption module is used to configure the sequence of optimal encryption parameters, generate key pairs using the SM2 elliptic curve algorithm and establish a shared key through the elliptic curve Diffie-Hellman protocol, and derive the shared key from the shared key using the SM3 hash function to generate an SM4 session key, thereby establishing a hybrid encryption key system.

[0061] The parallel processing module is used to construct teacher network and student network models based on the hybrid encryption key system, optimize the multi-threaded scheduling strategy through adversarial distillation training and retrieval enhancement techniques, establish an intelligent thread coordination mechanism, and generate a multi-threaded parallel encryption processing architecture.

[0062] The adaptive transmission module is used to monitor network bandwidth, latency and packet loss rate in real time through the multi-threaded parallel encryption processing architecture, build an adaptive decision engine based on reinforcement learning, and dynamically adjust the encryption strength and transmission strategy according to the network status and data characteristics to complete the adaptive encrypted transmission of data.

[0063] This invention enables refined security assessment of Chinese cryptographic algorithms by establishing a probabilistic ablation model based on Bayesian networks; it achieves intelligent configuration of encryption parameters through simulated annealing and machine learning time prediction techniques; it significantly improves encryption efficiency through the organic combination of hybrid encryption and multi-threaded parallel processing techniques; and it realizes dynamic optimization of encryption transmission strategies through an adaptive decision engine based on reinforcement learning. The comprehensive application of these technologies allows this invention to achieve optimal transmission performance while ensuring high security. Attached Figure Description

[0064] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0065] Figure 1This is a flowchart of a national cryptographic algorithm data encryption transmission method according to the present invention;

[0066] Figure 2 This is a structural diagram of a national cryptographic algorithm data encryption and transmission system according to the present invention. Detailed Implementation

[0067] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0068] like Figure 1 As shown, the present invention provides a method for encrypting and transmitting data using a national cryptographic algorithm, comprising the following steps:

[0069] Step S1: Obtain the data to be encrypted and transmitted and network environment parameters, establish a probabilistic ablation model based on Bayesian network, perform random ablation operation on the national cryptographic encryption process through Monte Carlo sampling and evaluate the risk probability under various attack scenarios, and generate a probabilistic security-assured encryption strategy.

[0070] Step S2: Based on the encryption strategy with probabilistic security, extract the Boolean feature set in the encryption process and construct a long short-term memory network time prediction model. Use simulated annealing algorithm to optimize the model by using a weighted combination of prediction time and security strength as the objective function to obtain the optimal encryption parameter configuration sequence.

[0071] Step S3: Based on the optimal encryption parameter configuration sequence, generate a key pair using the SM2 elliptic curve algorithm and establish a shared key using the elliptic curve Diffie-Hellman protocol. Use the shared key to generate an SM4 session key through the SM3 hash function to establish a hybrid encryption key system.

[0072] Step S4: Based on the hybrid encryption key system, construct teacher network and student network models, optimize the multi-threaded scheduling strategy through adversarial distillation training and retrieval enhancement techniques, establish an intelligent thread coordination mechanism, and generate a multi-threaded parallel encryption processing architecture.

[0073] Step S5: Using the multi-threaded parallel encryption processing architecture, network bandwidth, latency, and packet loss rate are monitored in real time. An adaptive decision engine based on reinforcement learning is constructed to dynamically adjust the encryption strength and transmission strategy according to the network status and data characteristics, thereby completing the adaptive encrypted transmission of data.

[0074] In this embodiment, the data to be encrypted and the network environment parameters are first obtained. A probabilistic ablation model based on a Bayesian network is established. Monte Carlo sampling is used to perform random ablation operations on the national cryptographic encryption process and evaluate the risk probability under various attack scenarios to generate a probabilistic security-assured encryption strategy. In this step, the data information to be encrypted and the parameters of the current network environment are first collected. A Bayesian network is a probabilistic graphical model that represents the conditional dependencies between random variables through a directed acyclic graph. In this invention, it is used to construct a probabilistic representation of the encryption process. The probabilistic ablation model takes each execution step of the SM2 and SM4 algorithms as network nodes, establishes the probabilistic dependencies between them, and forms a complete probabilistic representation of the encryption process. Monte Carlo sampling is a numerical calculation method based on random sampling. In this invention, it is used to randomly select specific steps in the encryption process for "ablation"—that is, to selectively disable or modify certain encryption components, such as disabling specific encryption rounds, modifying the key expansion algorithm, or changing the S-box replacement rule. Through extensive simulation testing, the security performance after ablation under attack methods such as differential cryptanalysis and linear cryptanalysis is evaluated. The probability of attack success, required computational resources, and time window are quantified and calculated to generate a risk probability matrix. Based on these evaluation results, a probabilistic security guarantee encryption strategy is finally generated to guide the selection of key parameters and the configuration of security mechanisms in subsequent encryption processes.

[0075] Secondly, based on the probabilistic security guarantee encryption strategy, a Boolean feature set is extracted from the encryption process, and a Long Short-Term Memory (LSTM) network time prediction model is constructed. Simulated annealing is used to optimize the model by employing a weighted combination of prediction time and security strength as the objective function, thereby obtaining the optimal encryption parameter configuration sequence. The Boolean feature set refers to a collection of binary decision variables, including key length selection, encryption round configuration, and parallelism settings in this invention. These variables collectively determine the encryption performance and security characteristics. Long Short-Term Memory (LSTM) networks are a special type of recurrent neural network that can effectively process sequential data and capture long-term dependencies. This invention utilizes LSTM to construct a time prediction model, with the input being the parameter configuration vector and historical performance data, and the output being the expected encryption processing time. Simulated annealing is a heuristic optimization method that simulates the changes in atomic energy states during metal annealing. By introducing a temperature parameter, it controls the probability of accepting suboptimal solutions during the search process, avoiding getting trapped in local optima. In this invention, the simulated annealing algorithm uses a "weighted combination of prediction time and security strength" as the objective function to search for the optimal configuration in a high-dimensional parameter space. The optimization process sets a high initial temperature to allow for extensive exploration. As iterations proceed, the temperature gradually decreases, and the algorithm's behavior becomes more conservative, eventually converging to the global optimum or near-optimal solution. The optimization results not only include the optimal parameter configuration but also provide a priority sequence for parameter tuning, guiding how to perform the most efficient parameter tuning under resource-constrained conditions.

[0076] Next, based on the optimal encryption parameter configuration sequence, a key pair is generated using the SM2 elliptic curve algorithm, and a shared key is established using the elliptic curve Diffie-Hellman protocol. The shared key is then used to derive an SM4 session key using the SM3 hash function, establishing a hybrid encryption key system. The SM2 elliptic curve algorithm is an elliptic curve public-key cryptography algorithm released by the State Cryptography Administration of China. Based on the computational difficulty of the elliptic curve discrete logarithm problem, it provides high-security public-key cryptography services. Based on the optimized parameter configuration, appropriate elliptic curve parameters are selected, and a high-quality random number generator is used to generate SM2 key pairs. The elliptic curve Diffie-Hellman (ECDH) protocol is a key negotiation protocol that allows two communicating parties to establish a shared key over an insecure channel. During protocol execution, each party generates a temporary key pair and exchanges public keys. Then, by combining the other party's public key and their own private key, they calculate the same shared key. The SM3 hash function is a national standard cryptographic hash algorithm used to generate message digests and derive keys. This method uses SM3 to perform multiple rounds of hashing on the shared key obtained from ECDH, increasing the key entropy and deriving subkeys for different purposes, including the SM4 data encryption key, message authentication code key, and key update master key. SM4 is a block cipher algorithm that provides a 128-bit key length and a 128-bit block size for actual data encryption. This hybrid encryption system, combining asymmetric encryption (SM2) and symmetric encryption (SM4), fully leverages the advantages of both cryptographic techniques: using an asymmetric algorithm to securely establish the key, then using an efficient symmetric algorithm to encrypt large amounts of data, while simultaneously using key chain technology to achieve periodic key updates and prevent the risk of long-term key leakage.

[0077] Next, based on the aforementioned hybrid encryption key system, teacher and student network models are constructed. Multi-threaded scheduling strategies are optimized through adversarial distillation training and retrieval enhancement techniques, an intelligent thread coordination mechanism is established, and a multi-threaded parallel encryption processing architecture is generated. The teacher network is a complex deep neural network model that learns the optimal thread scheduling strategy by analyzing historical encryption task execution data, capturing the complex relationship between thread allocation and performance. The student network is a lightweight neural network model specifically responsible for real-time thread resource allocation and task scheduling decisions, ensuring fast response and low computational overhead. Knowledge distillation is a model compression technique that transfers the "knowledge" of the teacher network to a smaller student network by having the student network mimic the behavior of the teacher network. Adversarial training is a method to improve model robustness by generating adversarial samples—simulating extreme situations such as hardware failures, network attacks, and resource contention—training the student network to make reasonable decisions even under adverse conditions. Retrieval enhancement techniques establish a feature vector database to store the features and optimal scheduling schemes of historical encryption tasks, enabling rapid retrieval of historical cases similar to the current situation, providing reference for decision-making. This combined technology constructs a multi-threaded parallel encryption processing architecture that includes thread pool management, task allocation algorithms, and load balancing mechanisms. It can dynamically adjust the number of threads based on task characteristics and status, optimize task allocation, achieve balanced resource utilization, and reduce thread synchronization overhead through lock-free data structures and atomic operations, thereby maximizing parallel processing efficiency.

[0078] Then, through the aforementioned multi-threaded parallel encryption processing architecture, network bandwidth, latency, and packet loss rate are monitored in real time. An adaptive decision engine based on reinforcement learning is constructed to dynamically adjust encryption strength and transmission strategies according to network status and data characteristics, completing adaptive encrypted data transmission. Network status monitoring continuously collects key network parameters through distributed probes: bandwidth utilization reflects the network link load level; round-trip time (RTT) represents the time delay of data packets in the network; and packet loss rate indicates network quality and reliability. Reinforcement learning is a machine learning method that learns optimal strategies through interaction with the environment. The decision engine uses a Deep Q-Network (DQN) as its core algorithm, taking network status and data characteristics as input to predict the long-term value of different transmission strategies. The reward function design balances multiple objectives such as transmission completion time, resource consumption efficiency, transmission success rate, and security assurance level, and dynamically adjusts security weights based on data sensitivity. Adaptive transmission control dynamically adjusts several key parameters based on the output of the decision engine: the number of SM4 encryption rounds changes dynamically under different security requirements; the data block size is optimized according to network MTU, bandwidth, and latency characteristics; and the transmission concurrency controls the number of connections transmitting data simultaneously. A performance feedback mechanism has also been established to continuously monitor the difference between actual transmission performance and expected targets. When a performance deviation is detected, the strategy parameters are adjusted in real time to form a closed-loop control, ensuring that it can quickly adapt to changes in the network environment and always maintain optimal transmission performance and security.

[0079] Example 1:

[0080] The establishment of a probabilistic ablation model based on Bayesian networks involves performing random ablation operations on the national cryptographic encryption process through Monte Carlo sampling and evaluating the risk probability under various attack scenarios to generate a probabilistically secure encryption strategy, including:

[0081] Based on the data to be encrypted and the network environment parameters, a Bayesian network is constructed to represent the execution steps of the SM2 and SM4 algorithms as network nodes, and each node is assigned a corresponding probability distribution to establish a probabilistic representation model of the encryption process.

[0082] Using the probabilistic representation model, Monte Carlo sampling is used to randomly select specific steps in the encryption process for ablation operations, including disabling encryption rounds, modifying the key expansion algorithm, and changing the S-box replacement rule, generating a variety of ablation configuration schemes.

[0083] Based on the aforementioned multiple ablation configuration schemes, simulation tests are run to evaluate the security strength under differential cryptanalysis, linear cryptanalysis, and specialized attack methods. The probability of successful attack, required computing resources, and attack time window are calculated to obtain the encryption strategy with probabilistic security assurance.

[0084] In this embodiment, Bayesian network construction is the first step. It is a graphical model that uses a directed acyclic graph (DAG) to represent the probabilistic dependencies between variables. For the Bayesian network construction of Chinese cryptographic algorithms, the first step is to identify key execution steps and represent them as network nodes. For the SM2 algorithm, nodes include key steps such as elliptic curve parameter selection, random number generation, key pair generation, signature generation, and verification; for the SM4 algorithm, nodes include steps such as key expansion, initial transformation, round function transformation, and round key addition. The state of each node represents the configuration or execution mode of that step, such as "normal execution," "partial execution," or "no execution." Directed edges between nodes represent execution dependencies; for example, the round function transformation depends on the result of key expansion. A probability distribution is assigned to each node, representing the execution probability of that step under different configurations. These probability values ​​are initialized based on expert knowledge and subsequently continuously optimized and adjusted using historical data. This Bayesian network-based representation method can not only quantify the contribution of each step to overall security but also simulate the interaction effects between steps, providing a theoretical basis for subsequent ablation operations.

[0085] Monte Carlo sampling is a numerical computation method based on random sampling used in probabilistic ablation models to generate diverse ablation configurations. The sampling process first defines a sampling space, encompassing all possible combinations of ablation operations, such as disabling specific rounds, modifying key parameters, and replacing algorithm components. Samples are randomly drawn from this space according to a predefined sampling distribution, with each sample representing a specific ablation configuration. To improve sampling efficiency, importance sampling is employed, adjusting the sampling probability distribution to explore more high-value regions. Ablation operations specifically fall into three categories: first, encryption round ablation, which reduces the standard 32 encryption rounds of the SM4 algorithm or simplifies the dot product operation in SM2; second, key expansion algorithm ablation, such as simplifying the round key generation process in SM4 or reducing the randomness requirement for key generation in SM2; and third, S-box replacement rule ablation, which replaces the standard SM4 S-box or modifies its lookup method. Each ablation configuration is meticulously documented, including the specific ablation steps, parameter modifications, and expected impacts, which will be used for subsequent security assessments.

[0086] Security assessment is a crucial step in verifying the impact of ablation configurations. Each ablation configuration is comprehensively tested by simulating common attack methods. Differential cryptanalysis (DCA) is a chosen-plaintext attack that analyzes the probability distribution of ciphertext differentials corresponding to plaintext differentials, attempting to discover key information; it also involves constructing plaintext pairs with specific differential characteristics and statistically analyzing changes in differential propagation characteristics after ablation. Linear cryptanalysis seeks linear approximations between plaintext, ciphertext, and key bits, evaluating the linearity of the algorithm by calculating linear approximation probabilities. Specialized attack methods against Chinese cryptographic algorithms include power consumption analysis, timing analysis, and cache attacks. These side-channel attack scenarios are simulated to evaluate the ablation configuration's ability to resist side-channel analysis. For each attack method, three key metrics are calculated: attack success probability (representing the likelihood of success under given conditions), required computational resources (such as CPU time and memory consumption), and attack time window (the shortest time required to complete the attack). These metrics together constitute a risk probability matrix, clearly demonstrating the security performance of each ablation configuration under different threats.

[0087] Based on a risk probability matrix, a probabilistic security assurance encryption strategy is ultimately generated—a set of guidelines that dynamically adapt to the threat environment. This strategy does not simply select the most secure configuration, but rather seeks the optimal balance between security and performance. Specifically, the strategy includes the following core elements: First, a priority list for critical component protection, identifying the algorithmic components with the greatest impact on security and ensuring these components are adequately protected even under resource constraints; second, dynamic parameter adjustment rules, automatically adjusting encryption parameters based on the real-time detected threat level, such as increasing the number of encryption rounds when advanced threats are detected; and third, algorithmic component alternatives, providing proven and secure alternatives when standard components fail to function properly. This probabilistic security assurance strategy enables encryption to dynamically adjust security strength according to the environment, achieving optimal resource allocation in different scenarios.

[0088] Example 2:

[0089] The process involves extracting Boolean feature sets from the encryption process and constructing a Long Short-Term Memory (LSTM) network time prediction model. Simulated annealing is then used to optimize this model by employing a weighted combination of prediction time and security strength as the objective function, resulting in an optimal encryption parameter configuration sequence, including:

[0090] Based on the encryption strategy with probabilistic security, Boolean feature vectors including key length selection, encryption round configuration, and parallelism setting are extracted. Long Short-Term Memory Network (LSTM) receiver parameter configuration vector and historical performance data are constructed to establish a prediction model of parameter configuration and encryption time.

[0091] Based on the prediction model, a simulated annealing optimization framework is established, with a weighted combination of prediction time and safety intensity as the objective function. An initial temperature is set and randomness is gradually reduced through a temperature control strategy to search for the optimal variable sorting scheme.

[0092] Based on the optimal variable sorting scheme, a configuration sequence containing parameter adjustment priority guidance is generated. When a performance bottleneck is detected, the parameters are gradually adjusted according to the priority sequence to obtain the optimal encryption parameter configuration sequence.

[0093] In this embodiment, the application of simulated annealing in encryption parameter optimization is a complex multi-objective optimization problem. The challenge lies in finding the optimal solution in a high-dimensional parameter space that guarantees both security strength and performance. The algorithm first defines a Boolean feature vector containing all key decision variables, including the bit length selection of the elliptic curve in the SM2 algorithm, the number of encryption rounds in the SM4 algorithm, the configuration of the number of threads for parallel encryption, and the key update frequency strategy. Each Boolean variable represents a binary decision, such as whether to enable a certain security feature or whether to adopt a specific optimization strategy. This Boolean representation not only simplifies the complexity of the optimization space but also enables the search algorithm to more effectively explore different configuration combinations.

[0094] The time prediction model employs advanced deep learning techniques, particularly a variant of the Long Short-Term Memory (LSTM) network. The network's input layer receives the current parameter configuration vector and historical performance data, while the hidden layers learn the complex nonlinear relationship between parameter configuration and encryption time through multiple LSTM units. The network's training data comes from a large number of real-world encryption task execution records, including performance under different data sizes, network environments, and hardware platforms. To improve prediction accuracy, the model also integrates an attention mechanism that automatically identifies the parameter combinations that have the greatest impact on encryption time, thereby improving prediction precision and interpretability.

[0095] The ultimate goal of variable sorting optimization is to generate a priority sequence that guides encryption in making trade-off decisions under resource constraints or time pressures. The optimization result includes not only the optimal parameter configuration but also guidance on prioritizing configuration adjustments. When a performance bottleneck is detected, it gradually adjusts parameters according to the optimized priority sequence to maximize performance while ensuring basic security requirements are met. This dynamic balancing mechanism enables encryption to adaptively adjust its behavior under different operating environments and load conditions, achieving an optimal balance between security and efficiency.

[0096] Specifically, Boolean feature extraction is a fundamental step in parameter optimization, representing various decision variables in the encryption process as binary (0 or 1) forms to facilitate subsequent mathematical processing and optimization analysis. In this embodiment, Boolean features are extracted from three key dimensions: First, key length selection, where the SM2 key length is represented as a set of Boolean variables, such as using 256 bits, 192 bits, or lower security levels; second, encryption round configuration, where the 32-round encryption process of SM4 is divided into multiple intervals, using Boolean variables to represent whether to use the full number of rounds or a specific combination of rounds; and third, parallelism settings, where Boolean variables represent different levels of parallel processing strategies, such as single-threaded, multi-threaded, or dedicated hardware acceleration. The constraints between these parameters are also considered; for example, a lower key length may require a higher number of encryption rounds to maintain security. Finally, all Boolean variables are combined into a feature vector, comprehensively representing a specific encryption parameter configuration. This Boolean representation not only reduces the complexity of the problem but also allows the differences between different parameter configurations to be intuitively measured through vector distance, laying the foundation for subsequent similarity analysis and optimal solution search.

[0097] Long Short-Term Memory (LSTM) network time prediction models are a special type of recurrent neural network specifically designed to learn long-term dependencies in sequential data. In this case, it is used to predict encryption execution time under different parameter configurations. The core structure of the LSTM network includes an input gate, a forget gate, and an output gate. This gating mechanism allows the network to selectively remember or forget information, effectively avoiding the gradient vanishing problem in traditional recurrent networks. The network input consists of two parts: a parameter configuration vector (i.e., the previously extracted Boolean feature vector) and historical performance data (including execution time records under different hardware environments, data sizes, and network conditions). Internally, the network processes these inputs through multiple layers of LSTM units, learning the complex nonlinear mapping relationship between parameter configuration and execution time. To improve prediction accuracy, the network also integrates an attention mechanism, which can automatically identify the most critical parameter combinations for time prediction, improving the model's interpretability. The training process employs a batch gradient descent optimization algorithm, continuously adjusting the network weights by minimizing the mean squared error between the predicted and actual times. After training, the model can quickly and accurately predict encryption execution time under arbitrary parameter configurations, providing crucial evaluation data for subsequent optimization processes.

[0098] Simulated annealing optimization is a global optimization algorithm inspired by the metal smelting process, capable of finding near-global optimal solutions in a complex multidimensional parameter space. The core idea of ​​the algorithm is to introduce a "temperature" parameter, allowing a certain probability of accepting temporarily poor solutions during the search process, thereby avoiding getting trapped in local optima. In this embodiment, the objective function is a weighted combination of prediction time and safety intensity, expressed as: F(x) = α·T(x) + (1-α)·S(x), where T(x) is the prediction time of the LSTM model, S(x) is the safety intensity score, and α is the weight coefficient, which can be adjusted according to the application scenario. The optimization process first sets a high initial temperature, allowing the algorithm to explore extensively in the solution space; as iterations proceed, the temperature gradually decreases according to a preset cooling strategy (such as exponential decay), and the algorithm becomes more "greedy," tending to accept better solutions. In each iteration, the algorithm randomly selects a new solution in the neighborhood of the current solution, and decides whether to accept this new solution based on the change in the objective function value and the current temperature, according to a certain probability. This "acceptance probability" mechanism is the key difference between simulated annealing and simple greedy algorithms, enabling it to escape local optima and explore a wider solution space. The algorithm eventually converges to a set of parameter configurations that are close to the global optimum, namely the variable sorting scheme, which specifies the priority order and optimal values ​​of each parameter adjustment.

[0099] The transformation and application of the variable ranking scheme is a crucial step in realizing the optimization results. The ranking scheme first sorts all parameter variables according to their importance to the objective function, generating a priority list. For each parameter, its optimal value range and adjustment step size are determined, forming a complete adjustment strategy. This priority-based parameter configuration sequence is particularly suitable for resource-constrained situations in dynamic environments: when a performance bottleneck is detected, the highest priority parameter is adjusted first; if performance is still unsatisfactory, subsequent parameters are adjusted sequentially until performance requirements are met or all possible adjustments have been tried. For example, when network bandwidth is limited, parallelism might be reduced first to decrease bandwidth contention, and then the number of encryption rounds might be adjusted to reduce computational load. To ensure security, a security lower limit is set for each parameter, ensuring that basic security requirements are still met even when performance is optimized to the maximum extent. The final optimal encryption parameter configuration sequence is not a static parameter set, but a dynamically adaptable adjustment strategy that maintains the best security-performance balance under different operating environments and load conditions.

[0100] Example 3:

[0101] The process involves generating key pairs using the SM2 elliptic curve algorithm and establishing a shared key using the elliptic curve Diffie-Hellman protocol. The shared key is then used to derive an SM4 session key using the SM3 hash function, thus establishing a hybrid encryption key system. This includes:

[0102] Based on the optimal encryption parameter configuration sequence, elliptic curve parameters are selected and an SM2 key pair is generated using a true random number generator. The two communicating parties generate a temporary key pair and exchange public keys. The shared secret is calculated using the elliptic curve Diffie-Hellman protocol.

[0103] Based on the shared secret, the key is converted into a byte sequence using a standardized point compression algorithm, and the key entropy value is increased by performing multiple rounds of hash operations using the SM3 hash function. This process is used to derive and generate a data encryption key, a message authentication code key, and a key update master key, thereby obtaining the SM4 session key.

[0104] Using the SM4 session key, a key chain technology is established to achieve periodic key updates. The next generation session key is generated using the current session key and a new random number through the SM3 hash algorithm. The current session key is then securely destroyed by overwriting the memory area multiple times, thus establishing the hybrid encryption key system.

[0105] In this embodiment, the core of the hybrid encryption strategy lies in fully leveraging the respective technical advantages of asymmetric and symmetric encryption to construct a secure and efficient encrypted communication system. The SM2 elliptic curve public-key algorithm has a strong mathematical security foundation, providing extremely high security strength with relatively short key lengths, making it particularly suitable for scenarios requiring public verification, such as key negotiation and digital signatures. However, asymmetric encryption has high computational complexity, and directly using it for large-scale data encryption would severely impact performance. The SM4 symmetric encryption algorithm, on the other hand, features fast computation speed and simple hardware implementation, making it very suitable for handling large-scale batch encryption tasks, but its security depends on key confidentiality, requiring a secure key distribution mechanism. The hybrid strategy achieves an optimal balance between security and performance by having SM2 handle secure key establishment and SM4 handle efficient data encryption.

[0106] Key generation and negotiation are the cornerstones of the entire hybrid encryption system, and their implementation requires strict adherence to the technical specifications of national cryptographic standards. The generation of SM2 key pairs first requires selecting appropriate elliptic curve parameters, including key parameters such as the coefficients of the curve equation, the choice of base points, and the size of the finite field. The quality of the random number generator directly affects the security of the private key; using a true random number generator conforming to national cryptographic standards or a high-quality pseudo-random number generator ensures the unpredictability of the private key. During the execution of the elliptic curve Diffie-Hellman protocol, both communicating parties generate temporary key pairs, exchange public keys, and combine them with their private keys to calculate the shared secret. This process must not only guard against traditional man-in-the-middle attacks but also consider the potential impact of emerging threats such as quantum computing on elliptic curve cryptography.

[0107] The key derivation function uses the SM3 hash function to convert the negotiated shared secret into a session key suitable for the SM4 algorithm. This process involves multiple security considerations. The shared secret is typically a point on an elliptic curve, which needs to be converted into a byte sequence using a standardized point compression algorithm. The SM3 hash function is not only used for key derivation but also serves as a key strengthening function. Through multiple rounds of hash operations, it increases the entropy of the key, making it difficult to derive the complete session key even if some key information is leaked. The key derivation process also generates multiple keys for different purposes, including data encryption keys, message authentication key, and a master key for key updates. The key separation principle ensures the independence of different security functions.

[0108] Specifically, SM2 elliptic curve key pair generation is the starting point of a hybrid encryption system, providing security based on the computational difficulty of the elliptic curve discrete logarithm problem. Based on the optimized parameter configuration, appropriate elliptic curve parameters are first selected, including the curve equation, base point, and finite field size. The SM2 curve recommended by the Chinese national cryptographic standard is an elliptic curve defined over a prime number field, providing a 256-bit security level. The key pair generation process requires a high-quality random number source, employing a true random number generator conforming to the Chinese national cryptographic standard to ensure the unpredictability of the private key. The generated key pair includes a private key (a large integer) and a corresponding public key (a point on the curve). The Elliptic Curve Diffie-Hellman (ECDH) protocol is a secure key negotiation mechanism that allows two parties to establish a shared key over an insecure channel. When executing ECDH, both communicating parties generate temporary key pairs (distinct from identity key pairs) and exchange temporary public keys over the network. After receiving the other party's public key, each party uses its own temporary private key and the other party's temporary public key to calculate the shared point using elliptic curve dot product operations; this point is the shared secret between the two parties. Throughout the entire process, the private key remains confidential, and only the public key is transmitted over the network. Even if an attacker intercepts all communications, they will not be able to calculate the shared secret, thus ensuring the security of key establishment.

[0109] Key derivation is the process of converting a shared secret obtained through the ECDH protocol into a utility key. The shared secret is typically a point on an elliptic curve, which needs to be converted into a byte sequence using a standardized point compression algorithm. The point compression algorithm preserves the sign bits of the x and y coordinates of the point, significantly reducing the number of bytes required to represent the point while ensuring lossless reconstruction of the original point. The resulting byte sequence is used as input to the SM3 hash function for key derivation calculations. SM3 is a national standard cryptographic hash algorithm that outputs a 256-bit hash value, possessing cryptographic security characteristics such as collision resistance and one-way hashing. By increasing the entropy of the key through multiple rounds of hash operations, even if some key information is leaked, it is difficult for an attacker to deduce the complete key. Specifically, the derivation process generates three types of keys: a data encryption key (used for SM4 symmetric encryption), a message authentication key (used for integrity protection), and a key update master key (used to generate subsequent session keys). This key separation principle ensures the independence between different security functions; the leakage of one key will not affect the security of other keys. The derived SM4 session key is a 128-bit symmetric key used for subsequent data encryption operations.

[0110] Keychain technology is a crucial mechanism for ensuring long-term communication security. It reduces the risk and impact of key leakage by periodically updating session keys. The basic principle of a keychain is to generate the next generation key using the current key and new random data, forming an irreversible key sequence. In its implementation, the triggering conditions for key updates are determined according to a preset security policy, such as a time period (updating at fixed intervals), a data volume threshold (updating after encrypting a specific amount of data), or a security event (forced update when a potential threat is detected). The update process uses the SM3 hash function, taking the current session key, the key update master key, and the newly generated random number as inputs to calculate the next generation session key. This design ensures forward security of the keychain: even if the current key is leaked, attackers cannot deduce the previously used key and therefore cannot decrypt previously transmitted data. After the key update is completed, the current session key is securely destroyed to prevent sensitive information from remaining in memory. Secure destruction employs a multiple overwrite technique, using random data to repeatedly overwrite the memory area storing the key, ensuring that even advanced memory forensics techniques cannot recover the original key data.

[0111] This hybrid encryption key system organically combines the advantages of SM2 asymmetric encryption and SM4 symmetric encryption, achieving a balance between security and efficiency. The SM2 algorithm, based on complex mathematical problems, provides strong security guarantees, making it suitable for low-frequency but critical security operations such as key establishment. The SM4 algorithm, with its high computational efficiency, is suitable for encrypting large amounts of data. This hybrid architecture demonstrates several significant advantages in practical applications: First, key management is efficient and secure, solving the key distribution problem in traditional symmetric cryptography through asymmetric cryptography. Second, data processing performance is excellent, employing efficient symmetric encryption algorithms to process large amounts of data, meeting high throughput requirements. Third, security levels are customizable, balancing security strength and performance requirements by adjusting parameter configurations. Fourth, the key update mechanism enhances the security of long-term communication, effectively preventing the risk of key leakage. The entire system complies with national cryptographic standards and can be seamlessly integrated with existing domestic cryptographic infrastructure, providing robust security for sensitive data transmission.

[0112] Example 4:

[0113] The construction of teacher and student network models, optimization of multi-threaded scheduling strategies through adversarial distillation training and retrieval enhancement techniques, establishment of an intelligent thread coordination mechanism, and generation of a multi-threaded parallel encryption processing architecture include:

[0114] Based on the aforementioned hybrid encryption key system, a teacher network model is constructed. By analyzing historical encryption task execution data, the optimal thread scheduling strategy is learned. A lightweight student network model is designed to be responsible for real-time thread resource allocation and task scheduling. A knowledge distillation and transfer mechanism is established.

[0115] Through the knowledge distillation transfer mechanism, the student network is subjected to adversarial training in a simulated attack environment to generate adversarial samples that simulate hardware failures, network attacks and resource contention, thereby obtaining a robust scheduling strategy.

[0116] Based on the robust scheduling strategy, a feature vector database is established to store historical encryption task features and optimal scheduling schemes. Vector retrieval technology is used to match similar cases within milliseconds to generate the multi-threaded parallel encryption processing architecture.

[0117] In this embodiment, adversarial distillation retrieval enhancement technology represents a cutting-edge application of artificial intelligence in encryption optimization. Its core idea is to automatically discover and optimize multi-threaded scheduling strategies through machine learning methods. The construction of the teacher network model is a complex knowledge extraction process, requiring the learning of optimal scheduling patterns from a large amount of historical execution data. This historical data includes thread allocation schemes under different load conditions, performance under various hardware configurations, and responses under various fault scenarios. The teacher network adopts a deep neural network architecture, capable of capturing the complex nonlinear relationship between scheduling decisions and performance. The network training process uses reinforcement learning techniques, continuously optimizing the scheduling strategy through interaction with a simulated environment, ultimately forming an expert capable of making optimal decisions under various conditions.

[0118] The design of the student network model prioritizes real-time performance and lightweight architecture, minimizing computational overhead and response latency while ensuring decision quality. The student network architecture is simpler than the teacher network, but inherits its core capabilities through knowledge distillation. The distillation process not only transmits the final decision result but also the feature representations and attention weights of intermediate layers, enabling the student network to understand the underlying logic of the decision. Real-time scheduling decisions require consideration of multi-dimensional information such as the current resource status, the characteristics of tasks to be processed, and historical execution data. The student network quickly analyzes the current situation through a lightweight feature extraction module and makes thread allocation and task scheduling decisions based on the learned strategies.

[0119] The enhanced retrieval module creates a dynamic knowledge base capable of quickly matching historical best solutions and guiding current decisions. The feature vector database stores a large number of feature descriptions of historical encryption tasks and their corresponding optimal scheduling schemes. Each feature vector includes key attributes such as task type, data size, load, and hardware configuration. The similarity retrieval algorithm employs efficient vector retrieval technology, capable of finding the most similar case to the current situation from massive amounts of historical data within milliseconds. The retrieval results not only provide specific scheduling schemes but also include the applicable conditions and expected performance of the schemes, providing important reference information for decision-making. The knowledge base also has self-updating capabilities, continuously supplementing and optimizing the stored knowledge based on new execution results, ensuring continuous improvement and adaptability.

[0120] Specifically, the construction of the teacher network model is a fundamental step in realizing intelligent thread scheduling. It extracts optimization experience from historical data using deep learning techniques. The teacher network employs a deep neural network architecture, typically containing multiple fully connected layers, convolutional layers, and attention mechanisms, enabling it to handle high-dimensional inputs and capture complex nonlinear relationships. The network inputs include: task characteristics (data size, data type, encryption algorithm parameters, etc.), resource status (CPU utilization, memory usage, I / O load, etc.), and historical performance metrics (execution time, resource consumption, encryption throughput, etc.). Training data comes from long-term collected encryption task execution records, with each record containing task configuration, environment state, thread allocation scheme, and final performance. The training process uses reinforcement learning, modeling the thread scheduling problem as a Markov decision process, continuously optimizing the scheduling strategy through interaction with the environment. Specifically, a deep Q-learning algorithm is used to learn the mapping relationship between the state and the optimal thread allocation, aiming to minimize execution time and resource consumption. After training, the teacher network can predict the optimal thread allocation scheme based on the current task characteristics and state; however, its complex structure leads to a long inference time, making it unsuitable for real-time decision-making scenarios.

[0121] Student network design and knowledge distillation are key technologies for providing real-time decision-making capabilities. A student network is a lightweight neural network model, typically employing fewer network layers and simplified network structures, such as reducing the number of neurons, using linear activation functions, or removing complex attention mechanisms. This simplified design significantly reduces computational complexity, enabling the network to complete inference computations within milliseconds, meeting the demands of real-time scheduling. Knowledge distillation is a model compression technique. Its core idea is to allow a simple student network to learn from a complex teacher network, learning not only the final output but also intermediate representations and decision logic. During distillation, the teacher network's output includes not only the final scheduling decision but also the probability distribution of each option (soft labels). These soft labels contain information about the teacher network's confidence in different choices. The student network is trained by minimizing the difference between its output and the teacher network's output. This training method is more effective than directly using hard labels, preserving more of the teacher network's "knowledge." Furthermore, feature matching distillation allows the student network to learn the intermediate layer representations of the teacher network, further enhancing knowledge transfer. Through knowledge distillation, although the student network has a simple structure, it can approximately reproduce the decision-making capabilities of the teacher network, significantly improving inference speed while maintaining high accuracy.

[0122] Adversarial training is an effective means of improving model robustness, enabling scheduling strategies to function correctly even under adverse conditions. Adversarial examples are carefully designed inputs that cause the model to make incorrect predictions; in this embodiment, they are used to simulate various extreme situations. The example generation process is divided into three directions: hardware failure simulation, constructing anomalous input vectors representing processor core failures, memory errors, or network interface anomalies; network attack simulation, generating scenario data representing security threats such as denial-of-service attacks, packet injection, or man-in-the-middle attacks; and resource contention simulation, creating input conditions representing sudden loads from other applications leading to resource scarcity. These adversarial examples are generated using the gradient ascent method, i.e., adjusting the input to maximize the model's loss function and identify the model's weaknesses. The adversarial training process adds these examples to the training set, forcing the model to learn the correct behavior under extreme conditions. This process can be formalized as a minimax game, where the model attempts to minimize the loss on the most challenging examples. Through multiple rounds of adversarial training, the student network gradually enhances its adaptability to anomalous situations, forming a robust scheduling strategy that can maintain performance under various adverse conditions and avoid catastrophic failures.

[0123] Retrieval enhancement technology is an innovative method to improve decision-making quality and response speed. It achieves case matching and decision reference by establishing a feature vector database. The feature vector database stores a large number of historical encryption task feature descriptions and corresponding optimal scheduling schemes. Each feature vector contains multi-dimensional information: task characteristics (such as data size, encryption algorithm type, security level requirements, etc.), state characteristics (such as the number of available processor cores, memory load, current network status, etc.), and environmental characteristics (such as time period, user priority, number of concurrent tasks, etc.). Vector retrieval is an efficient similarity search technology that quickly finds the most similar records by calculating the distance between vectors (such as Euclidean distance, cosine similarity, etc.). A multi-level index structure is used to improve retrieval efficiency, including techniques such as locality-sensitive hashing, KD-trees, or product quantization, enabling similarity searches to be completed in milliseconds even among millions of records. The real-time decision-making process consists of three steps: feature extraction, which converts the current task and state into standardized feature vectors; similarity search, which retrieves the most similar historical cases in the database; and decision generation, which combines the historical optimal scheme and the prediction results of the student network to generate the final scheduling decision. The search results not only provide specific thread allocation schemes, but also the applicable conditions and historical performance data of the schemes, providing a strong reference for the decision engine.

[0124] The multi-threaded parallel encryption processing architecture is the culmination of the integrated application of the aforementioned technologies, providing a highly efficient parallel computing framework and maximizing throughput. This architecture mainly consists of four parts: a thread pool management module, responsible for creating, destroying, and maintaining thread resources, dynamically adjusting the thread pool size based on load to achieve elastic resource allocation; a task decomposition module, which divides large encryption tasks into subtasks suitable for parallel processing, optimizing the decomposition strategy considering data dependencies and access patterns; a scheduling and execution module, which allocates execution resources based on real-time decisions and retrieval results from the student network, manages task queues and priorities, and ensures that critical tasks are processed first; and a result aggregation module, which collects the execution results of each subtask, performs necessary merging processing, and ensures the consistency and integrity of the final output. The architecture design places particular emphasis on reducing inter-thread synchronization overhead, employing lock-free data structures and atomic operations to minimize the use of mutex locks, significantly improving parallel efficiency. It also implements an adaptive load balancing mechanism, capable of monitoring the load status of each thread in real time and automatically adjusting the task allocation strategy when an imbalance is detected, ensuring full utilization of resources. This intelligent multi-threaded architecture not only improves encryption processing efficiency but also enhances scalability and fault tolerance. It can linearly increase processing power as hardware resources increase, providing strong support for large-scale data encryption.

[0125] Example 5:

[0126] Based on the encryption strategy with probabilistic security, a multi-node federated learning network is established. Each node trains a local optimization model based on local encryption task data, generating a distributed model training system.

[0127] Through the distributed model training system, differential privacy protection and homomorphic encryption technology are used to share the local optimized model parameters trained by each node. Under the premise of protecting the privacy of the original encrypted task data, the local models are fused to construct a global thread scheduling optimization strategy.

[0128] Based on the global thread scheduling optimization strategy, a dynamic node management mechanism is established to support the dynamic addition and removal of nodes, evaluate the contribution and trustworthiness of nodes in real time, and achieve collaborative optimization of distributed encryption parameters.

[0129] In this embodiment, federated learning technology provides an effective collaborative framework for encryption optimization in a multi-node environment. Each node trains its optimization model based on local data, without sharing the original data with a central server or other nodes. This distributed training system protects data privacy while utilizing the large amount of training data distributed across nodes, resulting in a more robust and general-purpose optimization model. While the local model training on each node follows a unified initial architecture, it is individually adjusted based on the characteristics of the local data, forming specialized models adapted to different scenarios.

[0130] Model parameter sharing is a crucial step in federated learning. Differential privacy and homomorphic encryption techniques allow for the secure sharing of model knowledge without revealing the original data. Differential privacy adds carefully designed noise to the model parameters, ensuring that even with partial information, the original data cannot be inferred. Homomorphic encryption allows for direct computation on the data in an encrypted state, guaranteeing the security of the parameter aggregation process. This combination of techniques achieves a balance between privacy protection and knowledge sharing, enabling nodes to contribute their expertise without fear of sensitive information leakage.

[0131] The global thread scheduling optimization strategy involves weighted fusion of the local models of each node to form a comprehensive scheduling strategy. The fusion process considers factors such as data quality, computing power, and historical contributions of each node, assigning different weights to the models of different nodes. This weighted fusion mechanism considers the specialization of each node while mitigating the impact of data bias from individual nodes, resulting in a final strategy with wider applicability and higher robustness.

[0132] Specifically, federated learning networks are an innovative distributed machine learning framework that allows multiple nodes to collaboratively train models without sharing raw data, making them particularly suitable for data privacy-sensitive cryptographic optimization. In this embodiment, the network consists of multiple cryptographic processing nodes, each representing an independent cryptographic service instance or device with its own local data and computing resources. Network establishment begins by defining the federated learning protocol, including communication rules, model update strategies, and node role definitions, typically employing a centralized structure (coordinated by a central server) or a decentralized structure (direct communication between nodes). Each node trains a locally optimized model based on locally collected cryptographic task data, including task features, states, configuration parameters, and execution results. The local model adopts a unified initial architecture but is customized according to the characteristics of the local data, forming a specialized model adapted to specific scenarios. The training process uses standard optimization algorithms such as batch gradient descent to gradually adjust model parameters with the goal of minimizing prediction error. Nodes exchange model update information through secure communication channels but do not transmit raw data, ensuring data privacy protection. This distributed training system makes full use of the large amount of training data scattered across various nodes, while respecting data ownership and privacy protection requirements, and can train more robust and general-purpose optimization models.

[0133] Privacy-preserving parameter sharing is a crucial aspect of federated learning, with differential privacy and homomorphic encryption ensuring the security of model updates. Differential privacy is a mathematically rigorous privacy protection mechanism that adds carefully calibrated random noise to data or computation results, ensuring that even attackers with background knowledge cannot identify the involvement of individual data. In model parameter sharing, differential privacy adds noise to gradient updates using Laplacian or Gaussian mechanisms, preventing observers from back-engineering the original training data. The noise level is controlled by the privacy budget parameter ε; a smaller ε provides stronger privacy protection but may reduce model accuracy. Homomorphic encryption is another core technology that allows computation directly on data in an encrypted state, with the decrypted result equivalent to the same computation on the original data. In federated learning, nodes encrypt their local model parameters using homomorphic encryption schemes (such as Paillier encryption or lattice-based encryption) and then send them to the aggregation server. The server can aggregate these encrypted parameters without decryption, generating an encrypted global model, which is then sent back to each node for decryption and use. This technology ensures that even if the aggregation server is attacked, attackers cannot obtain the model parameters of any node. By combining differential privacy and homomorphic encryption, a balance between privacy protection and knowledge sharing is achieved, enabling each node to contribute its expertise without worrying about the leakage of sensitive information.

[0134] Global model fusion is a crucial step in integrating the knowledge of each node. A weighted average algorithm is used to fuse local models, generating a global thread scheduling optimization strategy. The fusion process first ensures the structural compatibility of each local model, typically requiring all nodes to use the same basic model architecture, such as the same number of neural network layers and neurons per layer, so that parameters can correspond one-to-one. In weight allocation, several factors are considered: data quality, assessing the diversity and representativeness of node data, with nodes receiving higher weights for high-quality data; computational power, considering the processing speed and resource levels of nodes to ensure that low-capacity nodes do not slow down the overall training; and historical contribution, recording the quality of model updates contributed by nodes in the past, rewarding nodes that consistently provide high-quality updates. The weight allocation formula is usually a weighted combination of these factors, and the weight calculation parameters are periodically adjusted to adapt to network changes. The fused global model not only includes scheduling decision strategies but also uncertainty estimation, indicating in which situations predictions may be unreliable and require more cautious decision-making. The global model is periodically distributed to each node as the starting point for the next round of local training, ensuring that each node can share the learning results of the entire network while retaining the professional contribution of its own data.

[0135] The dynamic node management mechanism enhances the adaptability and robustness of federated learning networks, supporting flexible node addition and removal while ensuring network security. Node reputation evaluation is the core component of this mechanism, comprehensively assessing the reliability and contribution value of nodes through multi-dimensional indicators. Evaluation indicators include: historical contribution, examining the continuity and stability of a node's participation in federated learning; model update quality, analyzing the impact of node-provided model updates on global model convergence; and behavioral consistency, monitoring whether node behavior patterns conform to expectations and detecting potential malicious behavior. Based on these indicators, a comprehensive reputation score is calculated for each node and used for dynamic weight allocation: high-reputation nodes receive higher fusion weights for their model parameters, while the influence of low-reputation nodes is correspondingly weakened. A reputation threshold is set; when a node's score falls below this threshold, it is temporarily or permanently excluded from the federated learning network, effectively preventing malicious nodes from disrupting the global model by providing incorrect model parameters. For newly added nodes, a progressive trust mechanism is adopted, initially assigning lower weights, and gradually increasing their influence in model fusion as they prove their reliability. This dynamic node management mechanism enables federated learning networks to operate securely in open environments, maintaining overall stability and reliability even in the face of node anomalies or malicious behavior.

[0136] Node fault detection and recovery mechanisms are key technologies for ensuring continuous distributed operation, automatically identifying and handling node anomalies. Fault detection employs a multi-layered monitoring strategy: heartbeat signal monitoring, requiring nodes to periodically send liveness signals; failure to receive a signal within a timeout indicates a potential fault; response time analysis, monitoring the time for task execution and request response, with abnormal delays potentially indicating node overload or partial failure; and data consistency checks, verifying whether the model updates provided by the node conform to the expected distribution, with significant deviations potentially indicating computational errors or tampering. When a node fault is detected, a fault recovery process is immediately triggered, including task reassignment, redistributing tasks originally assigned to the faulty node to other healthy nodes; model parameter backup and restoration, reinitializing the node model using previously saved model checkpoints; and incremental update synchronization, providing the missed model update sequence after node recovery to quickly catch up to the current model state. For nodes that have been offline for extended periods, their information is permanently removed and the network structure is adjusted to ensure overall performance is not affected by waiting for unresponsive nodes. This automated fault handling mechanism significantly enhances fault tolerance, ensuring the entire distributed encrypted optimization network continues to operate stably, providing continuous service and constantly improving optimization strategies even with partial node failures.

[0137] Example 6:

[0138] The established dynamic node management mechanism supports the dynamic addition and removal of nodes, real-time evaluation of node contribution and trustworthiness, and collaborative optimization of distributed encrypted parameters, including:

[0139] Based on the global thread scheduling optimization strategy, a node reputation evaluation algorithm is designed. A multi-dimensional reputation scoring system is established based on historical contribution, data quality, and model performance to generate node credibility evaluation results.

[0140] Based on the node credibility evaluation results, a dynamic weight allocation mechanism is established. The parameter fusion weight of nodes in the global thread scheduling optimization strategy construction process is adjusted according to the node reputation score. A reputation threshold is set to automatically remove low-reputation nodes, ensuring safe and effective federated learning.

[0141] Based on the aforementioned secure and effective federated learning, a node failure detection and recovery mechanism is constructed to monitor node status in real time and automatically reassign tasks when a node fails.

[0142] In this embodiment, the node reputation evaluation algorithm is the foundation of dynamic node management. It comprehensively evaluates the reliability and contribution value of each node through multi-dimensional indicators. Historical contribution evaluation examines the persistence and stability of a node's participation in federated learning; nodes with long-term stable participation receive higher historical contribution scores. Data quality evaluation analyzes the impact of model updates provided by nodes on the convergence of the global model, including factors such as the consistency of update direction and the appropriateness of gradient size. Model performance evaluation examines the performance of the node's model on the validation dataset and its expertise in specific tasks. The multi-dimensional scoring system comprehensively considers these factors to generate a comprehensive reputation score that reflects the overall credibility of the node.

[0143] The dynamic weight allocation mechanism adjusts the influence of nodes in the global model fusion based on their reputation scores. Nodes with high reputations receive higher fusion weights, enhancing their guiding role in the global model; while the influence of low-reputation nodes is correspondingly weakened, mitigating potential negative impacts. A reputation threshold is set; when a node's reputation score falls below this threshold, it is temporarily or permanently excluded from the federated learning network. This mechanism effectively prevents malicious nodes from disrupting the global model by providing incorrect model parameters, ensuring the security and effectiveness of the federated learning process.

[0144] Enhanced node fault detection and recovery mechanisms improve robustness, enabling the network to handle anomalies such as node failures or network fluctuations. The fault detection module monitors the operational status of each node in real time through heartbeat signals, response time monitoring, and data consistency checks. When a node failure is detected, a fault recovery process is immediately triggered, including task reassignment and model parameter backup and restoration. For nodes experiencing temporary failures, their position in the network is retained, awaiting rejoining after recovery; for nodes that are offline for extended periods, their information is permanently removed, and the network structure is adjusted. This mechanism ensures that the entire federated learning network continues to operate normally even if some nodes fail, improving fault tolerance and service availability.

[0145] Specifically, the node reputation evaluation algorithm is the foundation of distributed secure operation, distinguishing between trustworthy and untrustworthy nodes through a scientific evaluation mechanism. This algorithm employs a multi-dimensional indicator system to comprehensively measure the reliability and value of nodes. Historical contribution evaluation focuses on the long-term behavior of nodes, including participation indicators (such as active time ratio and task completion rate) and stability indicators (such as connection reliability and response consistency). A time decay function is used to process historical data, giving more weight to recent behavior than long-term behavior, reflecting the current state of the node. Data quality evaluation analyzes the characteristics of the training data provided by the nodes, including diversity score (the scope of scenarios covered by the data), novelty score (the degree of difference from existing data), and accuracy score (the correctness of data labeling). These scores are automatically calculated through statistical analysis and outlier detection algorithms without accessing the original data, protecting data privacy. Model performance evaluation examines the performance of the node model on the validation dataset, with indicators including prediction accuracy, convergence speed, and generalization ability. The model updates submitted by each node are periodically tested on the global validation set to ensure they conform to the overall optimization direction. In particular, the algorithm also incorporates an anomaly detection mechanism, using covariance analysis and distribution shift detection to identify potential malicious behaviors (such as model poisoning attacks). All evaluation dimensions are comprehensively calculated using weighted averaging or analytic hierarchy process to generate a comprehensive reputation score between 0 and 100, intuitively reflecting the overall trustworthiness of the node.

[0146] Dynamic weight allocation is a key control measure to ensure the quality of federated learning, intelligently adjusting the influence of each node in the global model construction based on its reputation score. This mechanism first establishes a weight mapping function, converting reputation scores into fusion weights. It typically employs a non-linear mapping (such as the sigmoid function or piecewise functions) to ensure that high-reputation nodes receive significantly higher weights than low-reputation nodes. To enhance adaptability, the weight calculation formula includes adaptive parameters that dynamically adjust based on the current network state (such as the number of nodes and the overall reputation distribution) to maintain an appropriate weight difference. A reputation threshold is set as the minimum requirement for participating in global model fusion. When a node's reputation score falls below this threshold, its model parameters are completely excluded from the fusion process. This "hard cut-off" mechanism effectively prevents obviously unreliable or malicious nodes from polluting the global model. For newly added nodes, a conservative strategy is adopted, initially assigning low weights and setting an observation period. During this period, the weights are gradually adjusted based on the node's performance until a sufficient trust foundation is established. The weight allocation results are visible to all nodes, providing transparent reputation feedback and encouraging nodes to maintain good behavior to gain higher influence. In addition, a weight fluctuation protection mechanism has been implemented to limit the maximum change in weights within a single update cycle, prevent excessive weight adjustments due to temporary fluctuations, and ensure overall stability.

[0147] Node fault detection is crucial for the continuous operation of distributed systems, enabling timely identification of anomalies and triggering appropriate response measures. This system employs a multi-layered detection strategy to provide comprehensive fault awareness. The proactive detection mechanism includes periodic heartbeat checks and health status polling, requiring nodes to respond to liveness queries at preset intervals and report their load status, resource usage, and task execution progress. The passive detection mechanism monitors node communication patterns and performance metrics, such as response latency, throughput fluctuations, and error rate changes, identifying abnormal patterns through statistical analysis. Context-aware detection is also implemented, considering network environment factors (such as regional network congestion and server maintenance windows) to distinguish between temporary communication problems and genuine node failures. The detection algorithm uses machine learning methods, training a classification model based on historical fault data to identify subtle pre-failure indicators and provide early warnings of faults. When a potential node failure is detected, it is handled according to severity: for minor anomalies, a warning is sent and monitoring frequency is increased; for confirmed failures, the node is immediately marked as unavailable, triggering task reallocation and recovery processes.

[0148] The fault recovery mechanism ensures service continuity and data consistency even in the event of node failure. When a node is confirmed to be faulty, task reallocation is first performed, transferring encryption tasks originally assigned to the faulty node to other healthy nodes. The task migration process considers load balancing and resource matching to avoid overloading individual nodes. For ongoing tasks, a decision is made based on task characteristics and completion status to determine whether to restart or recover from a checkpoint. State synchronization is a critical step in the recovery process; when a node comes back online, it provides the latest global model and missed update sequences, helping the node quickly reintegrate into the network. To prevent recurring failures, a progressive recovery strategy is implemented, initially assigning only lightweight tasks to recovering nodes, gradually restoring their normal workload as stable operation time increases. For persistently faulty nodes, a node replacement process is triggered, dynamically adjusting the network topology to maintain overall service capability. Furthermore, a self-learning optimization mechanism is established to record and analyze fault modes and recovery effects, continuously optimizing fault detection thresholds and recovery strategies to improve long-term stability and self-healing capabilities. Through this comprehensive fault management mechanism, distributed encryption can maintain stable operation in complex environments with dynamically changing nodes, providing reliable services to users.

[0149] Example 7:

[0150] Based on the encryption strategy with probabilistic security, a quantum random number generator is integrated to provide a random number source for the national cryptographic algorithm. An entropy pool management mechanism is designed to monitor the quality of random numbers in real time and a quantum random number supply system is established.

[0151] Through the quantum random number supply system, a hybrid strategy of using quantum random numbers and traditional pseudo-random numbers is established. Random number sources are dynamically selected according to security level requirements and hardware costs to achieve cost-controllable random number services.

[0152] Based on the aforementioned random number service, a quantum random number quality assessment system is constructed. Statistical testing methods are used to verify the uniformity, independence, and unpredictability of random numbers, ensuring that the random numbers meet cryptographic security requirements.

[0153] In this embodiment, quantum random number generation technology utilizes the inherent uncertainty of quantum physics phenomena to generate truly random numbers, providing a higher-quality source of randomness for cryptographic algorithms. The integrated quantum random number generator generates an unpredictable stream of random bits based on quantum phenomena (such as the quantum uncertainty of photon path selection or electron tunneling). An entropy pool management mechanism is responsible for collecting, storing, and distributing these random bits, ensuring that sufficient high-quality random numbers are available at any given time. This mechanism monitors the fill status of the entropy pool in real time, automatically triggering the entropy collection process when the entropy value falls below a threshold, guaranteeing the continuous availability of the random number source.

[0154] The hybrid approach balances security requirements with practical cost constraints, flexibly selecting random number sources based on the needs of different scenarios. In high-security applications, such as key generation, quantum random numbers are prioritized to achieve the highest security. Conversely, in scenarios with lower randomness requirements, such as initialization vector generation, well-validated pseudo-random number generation algorithms can be used to save hardware resources and computational costs. This dynamic selection mechanism, through security level classification and cost-benefit analysis, achieves optimal allocation of random number resources, controlling overall costs while ensuring basic security requirements.

[0155] The quality assessment system employs a series of rigorous statistical tests to ensure that the random numbers used meet the high standards required for cryptographic applications. Assessment methods include standardized tests such as frequency testing, block frequency testing, run-length testing, and sequence complexity testing, as well as quantum statistical tests specifically targeting the characteristics of quantum random numbers. Real-time quality monitoring is performed not only during the random number generation phase but also periodically, retrospectively evaluating the random numbers stored in the entropy pool to ensure long-term stability of randomness. When anomalies in randomness indicators are detected, the system automatically switches to a backup random number source and triggers an alarm indicating possible hardware failure or external interference, ensuring the reliability and security of the random number service.

[0156] Specifically, a quantum random number generator (QRNG) is a device that generates truly random numbers based on quantum physical phenomena. It utilizes the inherent randomness of quantum mechanics to provide a high-quality entropy source. Unlike traditional pseudo-random number generators (PRNGs), QRNGs are based on unpredictable quantum events rather than deterministic algorithms, thus enabling the generation of theoretically unpredictable truly random numbers. The QRNG used in this embodiment is based on the quantum properties of photons, specifically implemented using photon path bifurcation technology: photons emitted from a laser source pass through a half-lens, with a 50% probability of being reflected and a 50% probability of being transmitted. The final path of the photon reflects quantum randomness. The photon's position is detected by a photodetector, and the result is converted into binary bits of 0 or 1. This method has the advantages of high speed and simple implementation, achieving a speed of generating hundreds of megabits per second. Another quantum random source—phase noise QRNG—is also integrated. It utilizes the quantum phase noise of the laser, converting phase fluctuations into measurable intensity changes through self-heterodyne detection technology, and then converting them into a random number stream through a high-speed analog-to-digital converter and post-processing circuitry. This method can provide a higher random number generation rate, suitable for high-throughput encryption requirements. To ensure the reliability of the quantum source, real-time quantum property monitoring was implemented. Interferometry and photon statistical analysis were used to verify the normal operation of the quantum source and to identify possible hardware failures or degradation in a timely manner.

[0157] The entropy pool management mechanism is a key component for ensuring the quality and availability of random numbers. It is responsible for collecting, storing, and distributing high-quality random bits. The entropy pool is a dynamically maintained buffer of random bits, collecting randomness from multiple entropy sources and managing it centrally. The core design of the entropy pool includes a three-layer structure: an input entropy pool, which directly collects raw entropy values ​​from quantum random sources for initial verification and preprocessing; an intermediate entropy pool, which stores the pre-processed entropy values ​​for entropy estimation and quality assessment; and an output entropy pool, which provides high-quality random bits that have undergone thorough mixing and post-processing for use by encryption algorithms. Entropy estimation is the core technology of entropy pool management, evaluating the actual randomness content of the entropy source through information entropy analysis, compression testing, and statistical models. Non-parametric entropy estimation methods, such as minimum entropy estimators and context tree weighted (CTW) estimators, are employed to provide conservative entropy assessment results. Real-time monitoring continuously tracks the entropy pool status, including entropy level, refresh rate, and quality metrics. When a decrease in entropy level or quality anomaly is detected, an alarm is automatically triggered and a recovery mechanism is initiated. The recovery mechanism includes switching to a backup entropy source, adjusting collection parameters, or pausing high-security operations in extreme cases. To prevent entropy depletion attacks (attacks attempting to consume entropy resources), an entropy reservation strategy and priority allocation mechanism are implemented to ensure that critical security operations (such as key generation) always have sufficient high-quality entropy available. The entropy pool also implements a secure erasure function, immediately removing used entropy values ​​from the pool to prevent security risks caused by reuse. This complete entropy pool management mechanism provides a continuous and stable supply of high-quality random numbers for national cryptographic algorithms, maintaining basic functionality even when some entropy sources fail.

[0158] Hybrid random number generation is a practical approach that balances security and cost, allowing for flexible selection of random number sources based on application scenarios. This strategy is based on a key observation: not all cryptographic operations require the highest quality true random numbers; well-designed pseudo-random numbers can suffice in certain scenarios. Cryptographic operations are categorized into three security levels: the highest security level, including critical operations such as key generation, one-time ciphers, and random number seed generation, which must use quantum random numbers; the high security level, including operations such as initialization vector generation, key derivation, and session parameter negotiation, which preferentially use quantum random numbers, but can use enhanced pseudo-random numbers when resources are limited; and the standard security level, including non-critical padding, temporary identifiers, and general protocol parameters, which can use random numbers generated by standard pseudo-random number generators. An intelligent scheduler is implemented to dynamically allocate random number resources based on current security requirements, resource availability, and cost constraints. The scheduling algorithm considers multiple factors: operation type and security level to determine random number quality requirements; entropy pool state to assess the number of available quantum random bits; hardware resource state, considering the availability and performance of QRNG devices; and cost constraints to minimize resource consumption while meeting security requirements. To ensure the quality of pseudo-random numbers, an enhanced PRNG design is employed. This design uses quantum random numbers as seeds and combines cryptographic hash functions (such as SM3) with block cipher-based generation patterns (such as CTR_DRBG) to construct a secure pseudo-random number generator. Specifically, an automatic reseeding mechanism is implemented, periodically refreshing the PRNG state with new quantum random bits to prevent potential prediction risks from long-term use. This hierarchical, hybrid random number strategy significantly reduces the demand for quantum randomization hardware while ensuring the security of critical operations, achieving a high-quality random number service at a controllable cost.

[0159] A random number quality assessment system is a scientific guarantee for ensuring the security of random numbers. It verifies that randomness meets cryptographic requirements through comprehensive testing methods. The assessment system consists of three levels: real-time monitoring, performing rapid quality checks during the random number generation process; periodic in-depth assessment, conducting comprehensive testing on accumulated random number samples regularly; and external independent verification, inviting third-party professional institutions to conduct random number quality audits. Statistical testing is the core method of the assessment, implementing multiple authoritative test suites, including the SP800-22 test suite from the National Institute of Standards and Technology (NIST) in the United States, covering 15 statistical tests such as frequency testing, run-length testing, and matrix rank testing; the AIS-31 test method from the German Federal Office for Information Security (BSI), specifically for random number testing in cryptographic applications; and independently developed test items targeting quantum randomness, such as photon anti-beaming testing and quantum interference consistency testing. The uniformity test verifies that each possible value in the random number sequence has an equal probability of occurrence, primarily through chi-square tests, frequency tests, and entropy analysis. The independence test ensures that each value in the random number sequence is unrelated to its preceding and following values, using methods such as autocorrelation analysis, runs test, and linear complexity test. The unpredictability test assesses whether the next value in the random number sequence can be predicted, including compression tests, general statistical tests, and next-bit prediction tests. Quantum-specific tests are also implemented to verify whether the random source exhibits true quantum properties, such as the Bell's inequality test and interference visibility test. Test results are converted into quality indicators through a comprehensive scoring mechanism and compared with preset thresholds. When a quality degradation is detected, alarms are automatically triggered and processes are adjusted. All test processes and results are meticulously recorded, forming a complete quality audit trail that meets the compliance requirements of cryptographic modules. This rigorous quality assessment system ensures that the provided random numbers meet the security requirements of national cryptographic algorithms such as SM2, SM3, and SM4, providing a solid foundation of randomness for cryptographic applications.

[0160] Post-processing of quantum random numbers is a crucial step in improving the quality of raw quantum random numbers, eliminating potential biases and defects through algorithmic processing. Raw quantum signals typically contain certain physical biases and hardware defects, requiring post-processing to convert them into cryptographically usable uniform random bits. A multi-stage post-processing workflow was implemented: The first step is bias removal, using a von Neumann extractor or entropy extraction algorithm to eliminate 0-1 biases in the bit distribution. The von Neumann extractor maps random bit pairs "01" to 1 and "10" to 0, discarding "00" and "11," which is simple and effective but reduces output efficiency. The advanced entropy extractor uses hash functions or strong encryption algorithms to compress the raw bits, preserving core randomness while improving output efficiency. The second step is randomization enhancement, using cryptographic mixing techniques to enhance randomness. This primarily employs the SM4 block cipher structure to shuffle the random numbers, ensuring that even if the original entropy source has partial correlation, the output still exhibits good randomness. Finally, secure encapsulation involves encrypting the processed random numbers, adding integrity check codes and timestamps to ensure that the random numbers are not tampered with or replayed during distribution and use. It also implements an adaptive post-processing mechanism that dynamically adjusts post-processing parameters based on real-time quality assessment results. When low initial randomness is detected, the processing intensity is increased; when the initial quality is good, the processing flow is simplified to improve efficiency. This complete post-processing technology can transform physical quantum randomness into high-quality cryptographic random numbers, meeting the most stringent security application requirements.

[0161] The quantum-based random number management architecture is a high-level solution integrating the aforementioned components, providing complete lifecycle management of random number services. The architecture adopts a layered design, including: a hardware layer integrating various quantum random number generation devices and traditional entropy sources, providing raw random bits through standard interfaces; a management layer, which manages the entropy pool, monitors quality, and schedules resources, serving as the core control center; a service layer providing standardized random number service interfaces, supporting random number requests of different security levels and formats; and an application layer integrating with national cryptographic algorithms such as SM2 / SM4 to ensure the acquisition of a suitable amount of high-quality random numbers. It supports horizontal scaling, allowing the addition of quantum devices to increase capacity as needed, and vertical integration of multiple security levels to meet the requirements of different scenarios. In terms of operation and management, it implements comprehensive monitoring and alarm mechanisms, displaying entropy pool status, quality indicators, and resource usage through a visual dashboard; automated operation and maintenance tools support device health checks, performance optimization, and fault recovery; complete audit logs record all random number operations, supporting security compliance reviews. A disaster recovery plan ensures that basic random number services can still be provided in extreme situations, including backup entropy source activation, service degradation strategies, and emergency random number reserves. This comprehensive management architecture enables the provision of reliable, secure, and economical random number services for national cryptographic algorithms, meeting the needs of various application scenarios from embedded devices to large data centers.

[0162] Example 8:

[0163] The aforementioned quantum random number quality assessment system employs statistical testing methods to verify the uniformity, independence, and unpredictability of random numbers, ensuring that the random numbers meet cryptographic security requirements, including:

[0164] Based on the random number service, frequency tests, run length tests, and autocorrelation tests are performed to verify the statistical uniformity and independence of the random number sequence, and a random number quality assessment report is generated.

[0165] The random number quality assessment report is used to evaluate the unpredictability of random numbers using linear complexity tests and general statistical tests. A quality threshold is set for real-time monitoring, and a random number quality assurance mechanism is established.

[0166] Based on the random number quality assurance mechanism, when the quality of the random number is detected to be lower than the preset quality threshold, the system automatically switches to a backup random number source and triggers the recalibration of the quantum random number generator to ensure that the random number meets the cryptographic security requirements.

[0167] In this embodiment, frequency testing is the primary method for evaluating the basic uniformity of random numbers. It examines whether the frequency of 0s and 1s in a random sequence conforms to the statistical characteristics of ideal random numbers. The single-bit frequency test is the most basic test. It calculates the proportion of 1s in a given random sequence and compares it to the ideal value of 0.5, using statistical hypothesis testing to assess whether the deviation is within an acceptable range. The implementation method first calculates the absolute value of the difference between the number of 1s and the number of 0s in the sequence, then normalizes this difference according to the sequence length, calculates a statistical value, and compares it with a preset significance level to determine whether the test passes. The block frequency test divides the random sequence into multiple fixed-size blocks, calculates the proportion of 1s in each block, and then examines whether the distribution of these proportions conforms to expectations. This test can detect local deviations and helps to discover changes in randomness over time. The advantage of frequency testing is its simplicity, intuitiveness, and suitability for real-time monitoring; however, it can only detect the most basic randomness characteristics and needs to be used in conjunction with other tests. This paper implements an adaptive block size selection algorithm that dynamically adjusts the block size based on the length of the random sequence and real-time computing resources, optimizing computational efficiency while ensuring test sensitivity. For critical applications, more rigorous multi-scale frequency testing is performed, repeating frequency analysis over sliding windows of different lengths to comprehensively evaluate the uniformity of the sequence across various time scales. Test results are converted into a quality index of 0-100 through standardized scoring, intuitively reflecting the level of uniformity, and recorded in the quality assessment report.

[0168] Run testing is an important method for examining the continuity of random sequences, assessing the statistical characteristics of consecutive occurrences of the same value within a sequence. A run is defined as a sequence of consecutive identical values ​​in a random sequence; for example, "000" is a run of length 3 with a value of 0, and "1111" is a run of length 4 with a value of 1. In an ideal random sequence, the frequency of runs of different lengths should conform to a specific theoretical distribution. Run testing first counts the number of 0-value and 1-value runs of various lengths in the sequence, then compares them with the theoretical expected values, calculating the significance of the deviation. The test is divided into two levels: total run count test, which checks whether the total number of runs in the sequence is within a reasonable range; too many run counts indicate frequent switching, while too few run counts indicate the presence of long sequences with the same value; and run length distribution test, which analyzes the frequency of occurrence of runs of different lengths and uses a chi-square test to assess the degree of matching between the actual and theoretical distributions. This paper enhances the traditional run test by incorporating conditional run analysis to study the characteristics of runs following specific patterns, enabling the detection of more complex sequence dependencies. Run length testing is particularly effective at detecting oscillation faults and stuck faults, two common physical defects in quantum random number generators: oscillation faults manifest as an overly regular alternation of 0s and 1s, while stuck faults manifest as an abnormally persistent occurrence of the same value. For truly random sequences, short runs should be more common than long runs, and the distributions of 0-value runs and 1-value runs should be similar. A run length monitoring alarm threshold is set, triggering an alarm immediately when an abnormally long run is detected; this is an early indicator of potentially serious problems with the random number generator. Combining run length test results with frequency test results provides a complete picture of the temporal structure of the random sequence, forming a complementary uniformity assessment dimension in the quality evaluation report.

[0169] Autocorrelation testing is a key method for evaluating the independence of random numbers. It checks whether values ​​in a sequence are statistically correlated with values ​​at other positions. In an ideal random sequence, the value at any position should be statistically independent of the values ​​at all other positions in the sequence, with no predictable correlation patterns. The autocorrelation function is the core tool of this test; it calculates the correlation coefficient between the sequence and its shifted version, reflecting the sequence dependency under different lags. The test process consists of three steps: First, the original sequence is preprocessed, typically by converting binary values ​​0 to -1 and keeping 1 unchanged, so that the sequence mean is close to 0; second, the autocorrelation coefficients are calculated for different lag values ​​(usually from 1 to 10% of the sequence length); finally, the distribution of the autocorrelation coefficients is analyzed to check whether it is within the statistical significance range. This paper implements multi-scale autocorrelation analysis, examining not only the correlation between adjacent positions but also long-distance correlations, and can discover periodic patterns and long-range dependencies. In particular, a rapid decay verification is added, requiring the autocorrelation function to decay rapidly to the statistical noise level at small lag values, which is an important characteristic of high-quality random numbers. To improve detection sensitivity, cross-correlation analysis was also implemented to compare the correlation between different random number streams, which helps to discover common-mode interference in multi-channel quantum random number generators. Autocorrelation test results are presented in the form of correlation plots and statistical significance reports, intuitively demonstrating the independence characteristics of the sequences. For spectral-sensitive applications, Fourier transform analysis is also provided to convert the autocorrelation results to the frequency domain, more effectively identifying periodic features and spectral anomalies. The autocorrelation test, together with the aforementioned uniformity test, constitutes the foundational layer of quality assessment, providing the necessary prerequisite for subsequent, more complex unpredictability analyses.

[0170] Linear complexity testing is a high-level method for evaluating the unpredictability of random sequences, analyzing their intrinsic complexity and compressibility. Linear complexity is defined as the length of the shortest linear feedback shift register (LFSR) capable of generating a given sequence, reflecting its complexity and internal structure. A truly random sequence should have a linear complexity close to half its length; sequences significantly lower than this may exhibit inherent patterns and be easily predicted or reconstructed. The test implementation uses the Berlekamp-Massey algorithm, which efficiently computes the linear complexity and corresponding LFSR of binary sequences. The test process consists of three phases: calculating the linear complexity of the entire sequence; dividing the sequence into multiple fixed-length blocks, calculating the linear complexity of each block and analyzing its distribution; and calculating the growth rate of the linear complexity, analyzing how the complexity changes as the sequence length increases. The linear complexity of an ideal random sequence should grow linearly with the block size, and the growth curve should be close to n / 2 (where n is the block size). This paper enhances the traditional linear complexity test by incorporating jump analysis to study abrupt changes in complexity within the sequence, which typically reflect significant structural changes. It also implements linear complexity spectral analysis, plotting complexity variation curves for different lengths to provide a more intuitive complexity assessment. To accommodate the characteristics of quantum random numbers, nonlinear complexity assessment is added, using a nonlinear feedback shift register model to analyze sequence structure, enabling the detection of complex patterns that might be missed by the linear model. The linear complexity test results are presented through complexity scores and block distribution analysis, providing in-depth insights into the sequence structure complexity for the quality assessment report.

[0171] General statistical tests are a comprehensive method for evaluating the unpredictability of random numbers. They examine whether a sequence possesses various statistical properties of an ideal random sequence. Unlike tests targeting specific properties, general statistical tests aim to discover various possible non-random patterns, making them a "universal" testing strategy. Two main types of general tests are implemented: entropy tests and compression tests. Entropy tests, based on information theory principles, calculate the information entropy of a sequence to assess its uncertainty and information content. Implementation methods include: approximate entropy tests, which analyze the frequency distribution of overlapping patterns in the sequence and compare the conditional entropy of patterns of different lengths; cumulative sum tests, which convert binary sequences into random walks and analyze their statistical properties; and discrete Fourier transform tests, which detect periodic components in the sequence's spectrum. Compression tests, based on lossless compression algorithms, attempt to compress random sequences and analyze the compression ratio; ideal random sequences should be almost incompressible. Multiple compression algorithms (such as Lempel-Ziv and Huffman coding) are used for cross-validation to improve test reliability. In particular, context-based prediction-based sequence analysis is implemented, using an adaptive model to predict the next bit of the sequence and evaluating the prediction success rate, which directly reflects the predictability of the sequence. To enhance the comprehensiveness of the test, Markov model analysis and state transition matrix tests are integrated to evaluate the randomness of the sequence from a probabilistic model perspective. General statistical test results are presented as a comprehensive score and multidimensional analysis report, fully reflecting the unpredictable characteristics of the sequence. An adaptive quality threshold based on historical data analysis is set, which can dynamically adjust the acceptance criteria according to the security requirements of different application scenarios, ensuring the practicality and applicability of the test results.

[0172] Quality threshold management and real-time monitoring are key mechanisms to ensure that random numbers continuously meet security requirements. Scientific quality thresholds are set for each test, determined based on three sources: theoretical benchmarks, calculated using mathematical models of cryptographic randomness and statistical significance levels; security standards, referencing random number quality requirements published by authoritative institutions such as the State Cryptography Administration and NIST; and historical performance, analyzing long-term operational data to establish a baseline and identify normal fluctuation ranges. The threshold system is divided into three levels: warning thresholds, indicating potential quality degradation and triggering enhanced monitoring; action thresholds, indicating significant quality deterioration and triggering automatic intervention measures; and failure thresholds, indicating unacceptable random number quality and immediately switching to a backup source. Real-time monitoring implements a multi-layered monitoring architecture: the first layer is rapid monitoring, using computationally efficient simplified tests (such as truncated frequency tests and run-length tests) to achieve millisecond-level quality checks; the second layer is routine monitoring, periodically executing complete test suites to comprehensively evaluate random number quality; and the third layer is in-depth analysis, performed when anomalies are detected or during routine maintenance, including long-sequence tests and special scenario tests. Monitoring results are integrated through a unified quality score to generate a comprehensive quality index of 0-100, which is displayed in real-time on the management console. It also implements an intelligent alarm mechanism that can identify and classify abnormal patterns, distinguishing between temporary fluctuations and persistent declines, reducing false alarms while ensuring that real problems are addressed promptly. Quality data is stored in a time-series database, supporting trend analysis and historical comparisons to help operations personnel identify long-term changes and potential problems. Through this complete quality threshold management and real-time monitoring system, the random number service can maintain consistently high-quality output, providing reliable assurance for cryptographic applications.

[0173] Fault response and automatic switching are the last line of defense for ensuring the continuity of random number services, ensuring that qualified random numbers can be provided even when hardware or software problems occur. When monitoring detects that the quality of random numbers is below the action threshold, a series of orderly response measures are automatically triggered. First, cause diagnosis is performed, analyzing the specific manifestations and possible causes of the quality degradation, distinguishing between hardware failure, environmental interference, or software anomalies. Based on the diagnostic results, different levels of intervention are implemented: for minor problems, self-healing measures are attempted, such as adjusting quantum source parameters, reinitializing the post-processing module, or clearing the entropy pool; for problems that cannot be quickly repaired, the random source switching process is initiated. The switching process is highly automated: first, available backup random sources are evaluated, including backup quantum sources, independent physical random sources, and high-intensity pseudo-random sources; then, the best alternative is selected based on the application's security requirements and source availability; finally, a smooth switch is performed to ensure service continuity and random number quality. After the switch is completed, the diagnosis and recovery process for the original faulty source is immediately initiated. For quantum random number generators, recalibration is a critical recovery step, including optical path calibration, detector sensitivity adjustment, and noise baseline reconstruction. The calibration process utilizes automated testing equipment and reference standards, employing multiple rounds of iterative optimization to restore the equipment to its optimal operating state. A fault isolation mechanism is also implemented to ensure that a failure in one component does not cascade onto other parts, maintaining overall stability. All fault events and response actions are meticulously logged for subsequent analysis and improvement. This comprehensive fault response and automatic failover mechanism maintains the quality and availability of the random number service under various adverse conditions, providing a stable and reliable foundation for cryptography's randomness.

[0174] Security auditing and compliance verification are crucial components of the random number quality assurance system, ensuring compliance with relevant standards and regulations. A complete audit trail has been established, recording the entire process of random number generation, testing, and use, including: quality test results, detailing parameters, sample data, and test results for each test; device status logs, recording the quantum random number generator's operating parameters and status changes; fault and switchover logs, detailing quality anomalies, source switching, and recovery processes; and usage statistics, recording the allocation and use of random numbers, including requesters, purposes, and quantities. These records are stored in a secure audit database, protected by encryption and access controls to ensure the integrity and confidentiality of the audit data itself. Multiple compliance verification methods are supported: automatic compliance report generation, automatically integrating audit data according to different standard requirements to generate standardized reports; third-party verification interfaces, allowing authorized external auditors to access necessary audit data and testing functions through secure channels; and regular compliance assessments, periodically conducting comprehensive self-assessments to check whether all components comply with the latest security standards and best practices. Special attention is paid to compliance with cryptographic module-related standards, such as the random number requirements of the State Cryptography Administration, the NIST SP800-90 series standards, and the FIPS 140-3 cryptographic module security requirements. This comprehensive audit and compliance mechanism not only demonstrates that random number quality meets requirements but also enables continuous improvement of security practices to adapt to evolving security standards and threat environments.

[0175] Example 9:

[0176] Based on the adaptive encrypted transmission of the data, an edge node encryption capability evaluation model is established to dynamically evaluate the computing resources, storage capacity and security level of each edge node and generate an edge node capability distribution map.

[0177] Based on the edge node capability distribution map, an intelligent task allocation algorithm is designed to allocate encrypted tasks optimally according to data sensitivity and node capabilities, establish a task priority queue, and achieve load-balanced task distribution.

[0178] Based on the load-balanced task distribution, an edge-cloud collaborative key management system is constructed to achieve cross-level secure key distribution and updates, and to establish a load balancing mechanism between edge nodes.

[0179] In this embodiment, the edge node encryption capability evaluation model is a multi-dimensional computational framework used to quantify and analyze the ability of edge devices to perform encryption tasks. The model primarily evaluates three core dimensions: computing resources, storage capacity, and security level. Computing resource evaluation includes measurements of processor performance metrics (such as CPU clock speed and number of cores) and dedicated encryption hardware features (such as security coprocessors). An evaluation agent is deployed on each edge node to calculate throughput and latency performance metrics for algorithms such as SM2, SM4, and SM3 by performing standardized encryption benchmark tests. Storage capacity evaluation analyzes available memory space, cache size, and storage I / O performance, which directly relate to big data encryption and key storage capabilities. Security level evaluation examines the implementation of the Hardware Security Module (HSM), Trusted Execution Environment (TEE), and physical security measures, classifying nodes into high, medium, and low security levels. The model employs a weighted scoring method, dynamically adjusting the weights of each dimension according to the needs of different application scenarios to generate a comprehensive capability score.

[0180] Dynamic evaluation is the process of continuously monitoring changes in the state of edge nodes and updating the evaluation results. A distributed monitoring agent is deployed to collect real-time resource usage data, including CPU utilization, memory usage, and encrypted operation queue length. The evaluation employs a dual-time-window mechanism: a short-term window (5-15 minutes) captures immediate fluctuations, while a long-term window (several hours to several days) identifies performance trends. Data is processed using a weighted moving average algorithm to balance the impact of current state and historical performance. Evaluation results are stored in a time-series database, supporting trend analysis and anomaly detection. When a significant change in node performance is detected, a re-evaluation is automatically triggered, updating the capability score.

[0181] The edge node capability distribution map is a visual representation of encrypted resources, transforming multi-dimensional evaluation data into a network topology view. The distribution map employs a hierarchical architecture: the device layer displays detailed information for each node; the region layer aggregates resource distribution within specific regions; and the global layer provides a macroscopic view of the entire network. Nodes use color coding to represent security levels (red for high security, yellow for medium security, and green for basic security), size to represent computing power, and line width to represent network bandwidth. The distribution map also includes a load heatmap function, visually displaying the hotspots of encrypted load distribution in the current network, helping to identify potential performance bottlenecks.

[0182] The intelligent task allocation algorithm makes optimal decisions on the allocation of encryption tasks based on data characteristics and node capabilities. This algorithm employs a multi-objective optimization framework, balancing factors such as task execution time, energy efficiency, network overhead, and security level matching. The core implementation uses reinforcement learning techniques to model task allocation as a Markov decision process. The algorithm pays particular attention to matching data sensitivity with node security levels, achieving a fine-grained security hierarchy: the most sensitive data (such as key materials) is only allocated to high-security nodes with hardware security modules; moderately sensitive data can be processed on moderately secure nodes; general data can be processed on any node, but nodes with lighter loads are given priority. The algorithm also implements an adaptive encryption degradation mechanism, appropriately reducing the encryption strength of non-critical data when resources are scarce, ensuring that core business operations are not affected.

[0183] A task priority queue is a data structure that manages the execution order of encrypted tasks, ensuring that resources are prioritized for critical tasks. The queue employs a multi-level priority model, categorizing tasks into four levels: urgent, high, medium, and low. Urgent tasks are used for security operations requiring real-time processing, such as key updates; high-priority tasks are used for critical business data; medium-priority tasks are used for routine business data; and low-priority tasks are used for non-real-time tasks. Within each priority level, tasks are ordered according to their arrival time and expected execution time. To prevent low-priority tasks from starving, a dynamic priority promotion mechanism is implemented, automatically increasing the priority of a task if its waiting time exceeds a threshold. The queue manager maintains a global task view and local queues for each node, supporting task splitting and merging.

[0184] Load balancing is a mechanism to ensure that encryption tasks are distributed reasonably across available nodes. A multi-strategy load balancing framework is implemented: the minimum load priority strategy assigns tasks to the node with the lightest current load; the weighted round-robin strategy allocates tasks proportionally based on node capabilities; the response time priority strategy allocates tasks based on historical response times; and the data locality strategy prioritizes tasks assigned to nodes that already hold the relevant data. The load balancer monitors node status through a health check mechanism, periodically sending probe requests to assess node responsiveness and availability. A two-tiered load balancing system is implemented: a global balancer manages task distribution across regions; and a local balancer optimizes task allocation within a single region.

[0185] An edge-cloud collaborative key management system is the infrastructure for ensuring distributed encryption security. This system adopts a layered architecture: the cloud-based key center is the root of trust, responsible for the generation and management of the root key; regional key managers are responsible for key distribution and synchronization within specific geographical areas; and edge key agents are deployed on each node, responsible for the secure storage and use of local keys. Key distribution employs a tiered strategy: long-term master keys are securely distributed from the cloud, while session keys can be derived locally from regional managers or secure edge nodes. An adaptive key update mechanism is implemented, automatically adjusting the update cycle based on key usage frequency, sensitivity, and potential risks. To handle network instability, an offline operation mode is supported, with nodes pre-caching necessary key materials to continue secure operation during network outages.

[0186] Cross-level secure key distribution employs a multi-level key encapsulation mechanism with a hierarchical key protection structure: a root protection key (RPK), a key encryption key (KEK), and a data encryption key (DEK) protected by the KEK. The distribution process uses a hybrid encryption scheme, combining SM2 to protect session keys and SM4 for efficient transmission of bulk key data. Key fragmentation technology is implemented, dividing important keys into multiple fragments and transmitting them through different paths to improve security. For resource-constrained devices, a lightweight key negotiation protocol is implemented to optimize computational complexity and communication overhead.

[0187] The load balancing mechanism among edge nodes solves the bottleneck problem of traditional centralized key distribution in edge environments. It implements a decentralized key distribution network, enabling high-security edge nodes to act as key distribution points for other nodes within the region, forming a multi-level distribution tree structure. The load balancer dynamically monitors the load and response time of each distribution node and adjusts the distribution path according to the network topology. An adaptive caching strategy is implemented, pre-caching frequently used keys on appropriate nodes to reduce real-time requests. To ensure availability, a dynamic master-slave mechanism is adopted, assigning multiple backups to each distribution node and automatically switching when the master node fails. Load balancing considers request type and computational complexity, allocating suitable processing nodes for different types of key operations, achieving fine-grained resource optimization.

[0188] Example 10:

[0189] The establishment of an edge node encryption capability assessment model dynamically evaluates the computing resources, storage capacity, and security level of each edge node, generating an edge node capability distribution map, including:

[0190] Based on the adaptive encrypted transmission of the data, the CPU utilization, memory usage, network bandwidth and encryption processor performance parameters of the edge nodes are collected to establish node hardware resource evaluation indicators.

[0191] By using the node hardware resource evaluation indicators, combined with the node's physical security level, network security configuration, and access control mechanism, the analytic hierarchy process is used to calculate a comprehensive security score and generate a node security level evaluation result.

[0192] Based on the node security level assessment results, a multi-dimensional capability assessment matrix is ​​constructed, a clustering algorithm is used to classify and manage the nodes, the node status information is updated in real time, and the edge node capability distribution map is generated.

[0193] In this embodiment, hardware resource assessment is the foundational layer for edge node capability evaluation. Resource status information of nodes is acquired through real-time monitoring and data collection. CPU utilization monitoring not only focuses on overall utilization but also analyzes core allocation and processor queue length to assess the node's computational load level and available computing power. Memory monitoring includes the usage of physical and virtual memory, as well as performance metrics such as memory access speed and cache hit rate. These factors directly affect the execution efficiency of encryption algorithms, especially advanced encryption algorithms that require significant memory operations. Network bandwidth monitoring assesses the node's data transmission capabilities, including upload and download speeds, network latency, and packet loss rate. For nodes equipped with dedicated encryption processors or security chips, performance parameters of these hardware accelerators are also collected, such as encryption throughput, supported algorithm types, and hardware security levels. This data is standardized to form unified hardware resource assessment metrics, providing an objective basis for subsequent node capability evaluation.

[0194] The security score comprehensively evaluates the physical and logical security characteristics of a node to generate a security level assessment result. The physical security assessment examines the node's physical deployment environment, including physical access control, environmental monitoring, and power supply protection measures. The network security configuration assessment focuses on the node's network protection mechanisms, such as firewall rules, intrusion detection, and network isolation measures. The access control mechanism assessment analyzes the node's authentication, permission management policies, and audit logging functions. The Analytic Hierarchy Process (AHP) uses weighted calculations based on the importance of these security factors to form a comprehensive security score. The scoring process considers the interrelationships and complementary effects between different security factors; for example, strong encryption algorithms may compensate for some deficiencies in physical security, but cannot completely replace it. The security score result is quantified into multiple security levels, each corresponding to the highest level of data sensitivity the node can handle.

[0195] The multi-dimensional capability assessment matrix integrates hardware resource and security score results to form a comprehensive representation of node capabilities. Each element in the matrix represents a node's performance in a specific capability dimension, including computing power, storage capacity, network performance, encryption efficiency, and security level. A clustering algorithm is used to automatically classify all edge nodes, grouping nodes with similar capability characteristics into the same category, simplifying node management and task allocation. The classification results are not static; they are continuously updated based on real-time collected status information to ensure that the classification always reflects the current state of the nodes. The capability distribution map visualizes the resource distribution of the entire edge network, intuitively showing the geographical distribution, quantity ratio, and connectivity of nodes with different capabilities. This provides administrators with a global overview of network resources and a decision-making basis for automated task allocation algorithms.

[0196] Specifically, edge node hardware resource acquisition is a fundamental step in evaluating encryption capabilities. This is achieved through deploying resource monitoring agents to obtain key performance indicators in real time. CPU utilization, a core metric for measuring processor load, is defined as the percentage of time the processor spends executing non-idle tasks. The acquisition process utilizes performance counter technology, reading processor registers or accessing provided interfaces to obtain time statistics for each CPU core. For accurate evaluation of encryption performance, special attention is paid to CPU instruction set support related to cryptographic computation, such as AVX and AES-NI extensions, which significantly improve the execution efficiency of encryption algorithms. Memory usage monitoring assesses the node's data processing capabilities and ability to support concurrent encryption tasks by collecting data on physical and virtual memory usage. Network bandwidth acquisition, based on interface traffic statistics, calculates data throughput per unit time while monitoring network latency and packet loss rate, directly impacting the efficiency and reliability of encrypted data transmission. For edge nodes equipped with dedicated encryption processors, performance parameters of the Hardware Security Module (HSM) or Trusted Platform Module (TPM) are also collected, including encryption operation throughput, key processing capabilities, and the number of concurrent sessions supported. All collected data is transmitted to the central analysis platform through a secure channel. After preprocessing to remove outliers and noise, it is converted into standardized evaluation metrics.

[0197] The node hardware resource evaluation index system is a structured representation of raw performance data, used to quantify and analyze the encryption processing capabilities of edge nodes. This index system is based on a weighted scoring model, comprehensively considering the contribution of different hardware resources to encryption performance. Computational resource indicators mainly include: CPU Performance Index (CPI), calculated by combining processor clock speed, number of cores, and encryption instruction support; Encryption Speedup Ratio (EAR), evaluating the performance improvement factor of dedicated encryption hardware over standard software implementations; and Computational Stability Index (CSI), analyzing the performance fluctuation of the processor under sustained load. Storage resource indicators include: Memory Capacity Score (MCS), based on the ratio of available memory to typical encryption task requirements; Storage Speed ​​Index (SSI), evaluating the support capability of memory and storage I / O for encryption operations; and Cache Efficiency Index (CEI), analyzing the impact of cache hit rate on encryption algorithm performance. Network resource indicators include: Bandwidth Adequacy Ratio (BSR), calculated as the ratio of available bandwidth to expected encrypted data traffic; Connection Stability Index (CSI), evaluating the reliability and consistency of network connections; and Transmission Delay Score (TLS), analyzing the impact of network latency on encryption protocol efficiency. These metrics are normalized and converted into standard scores of 0-100, facilitating cross-node comparisons and comprehensive evaluations. An adaptive weighting mechanism is employed to dynamically adjust the importance of each metric based on the needs of different application scenarios. For example, processing performance is given higher weight in real-time encryption applications, while storage performance is given higher weight in big data encryption scenarios.

[0198] Physical security level is an indicator for assessing the ability of edge nodes to resist physical attacks, and is graded based on the device deployment environment and hardware protection measures. The assessment adopts a multi-level classification framework, referencing the equipment security grading standards of the State Cryptography Administration, classifying nodes into three main levels: A (high security), B (medium security), and C (basic security). Level A devices possess dedicated protective facilities, such as tamper-proof shells, intrusion detection sensors, and physical access control, effectively resisting professional-level physical attacks. Level B devices have basic physical security measures, such as tamper-proof tags and locked cabinets, resisting general physical contact. Level C devices mainly rely on security mechanisms provided by operating and application software, with limited physical protection capabilities. The assessment process is based on on-site inspections and configuration verification, using standardized checklists to record the implementation of various physical security measures, and generating a physical security score through a weighted scoring method. Special attention is paid to the physical protection of sensitive information, such as isolation measures for key storage areas, data destruction mechanisms, and side-channel attack protection capabilities, as these factors directly impact the overall security of cryptography. The physical security level assessment result, as an important component of the comprehensive security score, directly affects the sensitivity level of the data that the node can process.

[0199] Network security configuration is an indicator for evaluating the network communication protection capabilities of edge nodes, focusing on the node's ability to resist attacks and protect data transmission at the network layer. The evaluation includes three core aspects: network boundary protection, examining firewall rule configuration, intrusion detection deployment, and network isolation measures; transmission encryption strength, assessing communication protocol security, encryption algorithm strength, and key management mechanisms; and network authentication, analyzing access control policies, certificate management, and authentication mechanisms. A security baseline comparison method is used for evaluation, checking the compliance of the actual configuration against a predefined security configuration baseline (such as the network security configuration requirements of the information security compliance standard). The evaluation process uses automated scanning tools combined with manual review to generate a network security configuration score. Particular attention is paid to key transmission protection mechanisms, checking whether secure key exchange protocols, transport layer encryption, and key update policies are implemented, as these mechanisms directly affect the overall security of encryption. The network security configuration evaluation not only focuses on static configuration but also verifies the actual protection effect through simulated attack tests to ensure that the evaluation results reflect the true security level.

[0200] Access control mechanisms are a core component for ensuring the secure operation of edge nodes. The evaluation focuses on three dimensions: authentication, authorization management, and audit trails. Authentication assessment analyzes the strength and implementation of authentication factors, including password policies, two-factor authentication, and the application of biometric technologies. Special attention is paid to privileged access control for encryption operations, examining access restrictions for key management operations, encryption configuration changes, and security audit functions. Authorization management assessment analyzes the implementation of permission allocation models and the principle of least privilege, examining role definitions, separation of duties, and permission review mechanisms. Audit trail assessment focuses on the integrity, immutability, and analytical capabilities of log records, verifying whether they effectively record all critical security events and support post-incident investigations. Scenario testing is used to evaluate the effectiveness of access controls by simulating different user roles performing various operations to verify permission boundaries and control enforcement. The evaluation results of access control mechanisms directly impact the security level assessment of nodes, especially for applications that handle highly sensitive data.

[0201] The Analytic Hierarchy Process (AHP) is a multi-criteria decision-making method used in this paper to calculate the comprehensive security score of edge nodes. The AHP method decomposes the security assessment problem into a hierarchical structure: the top layer is the overall goal (comprehensive security score), the middle layer consists of assessment criteria (hardware resources, physical security, network security, access control), and the bottom layer consists of specific indicators (such as CPU performance, anti-tampering measures, firewall configuration, authentication mechanisms, etc.). The assessment process consists of four main steps: First, a hierarchical model is established, clarifying the elements of each layer and their relationships; second, a pairwise comparison matrix is ​​constructed, and security experts determine the relative importance of each criterion and indicator; third, a weight vector is calculated, obtaining the weights of each criterion and indicator by solving eigenvalue equations or approximation algorithms; finally, the comprehensive security score is calculated, synthesizing the weights of each layer from bottom to top to obtain the final security score of the node. A dynamic adjustment mechanism for AHP weights is implemented, automatically adjusting the weights of each criterion according to the security requirements and threat models of different application scenarios. For example, the weight of physical security is increased for edge nodes deployed in public areas, while the importance of network security configuration is emphasized for nodes in core network areas. To improve the objectivity and consistency of the assessment, a multi-expert evaluation mechanism was introduced, which integrates the judgments of multiple security experts to reduce the impact of personal bias.

[0202] The node security level assessment results are a comprehensive judgment of the security capabilities of edge nodes, used to guide the allocation of encryption tasks and data processing permissions. Based on the comprehensive security score, nodes are divided into three main levels: High Security (HS), Medium Security (MS), and Basic Security (BS), corresponding to different data processing permissions and encryption task types. High-security nodes score above 85 points, possessing robust hardware security modules, strict physical protection, and comprehensive access control, allowing the processing of the most sensitive data and key materials. Medium-security nodes score between 60 and 85 points, providing sufficient security for processing general business data, but are not suitable for directly managing master keys or processing particularly sensitive information. Basic security nodes score below 60 points, suitable only for processing non-sensitive data or performing computationally intensive encryption tasks, such as hash calculations or data encryption (using remotely provided keys). The assessment results are presented in the form of a security report, detailing the scores of each assessment dimension, major security risks, and improvement suggestions. It also implements over-the-time tracking of security level changes, periodically reassessing the node security status, recording trends in security scores, and promptly identifying security capability degradation issues. The evaluation results serve as the core basis for node classification management and task allocation, directly affecting the functional positioning and resource allocation strategies of nodes in the entire edge network.

[0203] The multi-dimensional capability assessment matrix is ​​a structured data model used to comprehensively express the performance and security characteristics of edge nodes, providing a mathematical foundation for subsequent node classification and task allocation. This matrix represents each node as a multi-dimensional vector, with each dimension corresponding to an assessment metric, including hardware performance metrics (such as CPU score, memory score, and network score) and security metrics (such as physical security score, network security score, and access control score). The matrix construction process first performs data normalization, converting metrics with different dimensions into a unified scoring scale; then, dimensionality reduction techniques such as Principal Component Analysis (PCA) are applied to extract the most distinctive feature combinations, reducing data redundancy and improving computational efficiency; finally, an n×m assessment matrix is ​​formed, where n is the number of nodes and m is the number of key assessment dimensions. A real-time update mechanism is implemented, dynamically adjusting the assessment values ​​of the corresponding rows when the node status changes, ensuring that the matrix reflects the latest node capability status. To enhance the matrix's expressive power, a time dimension is also introduced to record the historical trends of assessment metrics, supporting predictive analysis and anomaly detection. The multi-dimensional capability assessment matrix is ​​not only a static data structure but also a dynamic analysis tool, providing mathematical decision support for edge network resource management.

[0204] Clustering algorithms are unsupervised machine learning methods used in this paper to automatically classify edge nodes based on a multidimensional capability evaluation matrix. Two main algorithms, K-means and hierarchical clustering, are implemented, with the most suitable method dynamically selected based on data characteristics and classification requirements. K-means clustering divides nodes into k categories. The algorithm finds the optimal category partition by iteratively optimizing the sum of squared intra-cluster distances. The implementation process includes: initializing k cluster centers; assigning each node to the nearest cluster center; recalculating the cluster centers; and repeating the above steps until the category partitioning is stable. An improved k-means++ initialization method is used, selecting initial cluster centers through a probability distribution to improve clustering stability and convergence speed. Hierarchical clustering constructs a clustering tree based on the similarity between nodes, gradually merging the most similar categories from bottom to top to form a multi-level category structure. A dynamic category number determination mechanism is used, automatically selecting the optimal number of categories based on evaluation metrics such as the silhouette coefficient, adapting to edge networks of different sizes and characteristics. The clustering results are used for hierarchical management of nodes. Different resource management and security strategies are assigned to nodes of different categories. For example, high-performance security nodes serve as regional key management nodes, while low-performance basic security nodes only perform basic cryptographic computation tasks. Online clustering updates are also implemented, dynamically adjusting the clustering results when new nodes are added or the status of existing nodes changes, without having to re-execute the complete clustering process.

[0205] Real-time status updates are a key mechanism to ensure the continuous accuracy of edge node capability assessments. A multi-level monitoring architecture is employed to dynamically track node status. Each edge node deploys a lightweight monitoring agent that periodically collects resource usage and performance metrics. Only changed status data is transmitted via incremental updates, reducing network overhead. Monitoring frequency is dynamically adjusted based on node importance and the frequency of status changes, with higher sampling frequencies used for critical nodes and nodes with high load fluctuations. A status change detection algorithm is implemented, using a statistical model to identify significant performance fluctuations and security configuration changes. Assessment updates are triggered only when significant changes are detected, balancing real-time performance and overhead. Status updates employ a tiered processing mechanism: minor changes only update the corresponding assessment metrics; moderate changes trigger partial clustering updates; and major changes (such as hardware upgrades or security incidents) trigger a complete assessment and classification process. Special attention is paid to changes in security status, and a security incident response mechanism is implemented. When a security degradation event (such as access control failure or network attack) is detected, the node's security level score is immediately lowered, and corresponding protective measures are triggered. All status updates are recorded in a time-series database, supporting historical tracing and trend analysis to help identify long-term performance degradation and cyclical fluctuation patterns.

[0206] The edge node capability distribution map is a visual representation of the evaluation results, transforming complex multidimensional data into an intuitive graphical interface to support rapid understanding and decision-making by operations and maintenance personnel. The distribution map employs a multi-layered visualization design, including three core presentation formats: geographic view, topology view, and matrix view. The geographic view displays node distribution based on actual geographic coordinates, using heatmaps to represent resource density and performance levels in different regions, helping to identify regional performance differences and uneven resource distribution. The topology view displays the logical connections between nodes, using graph theory visualization techniques to express communication paths and dependencies between nodes; node size represents performance capability, color represents security level, and connection line width represents communication bandwidth. The matrix view uses parallel coordinates technology to intuitively display the distribution of multidimensional evaluation metrics across different nodes, facilitating the identification of performance bottlenecks and abnormal nodes. The distribution map implements various interactive functions, such as view zooming, node filtering, metric highlighting, and historical playback, supporting in-depth analysis of the status of specific nodes or regions by operations and maintenance personnel. It also provides an early warning visualization function, using visual elements such as color flashing and shape changes to highlight changes in the status of nodes requiring attention, such as performance degradation, security threats, or resource exhaustion. The distribution map automatically generates periodic reports, recording significant changes and long-term trends in network status, supporting capacity planning and security governance. Through this comprehensive visualization, the edge node capability distribution map is not only a status monitoring tool but also a decision support tool, providing an intuitive and powerful basis for encryption task allocation and resource planning.

[0207] Example 11:

[0208] The system monitors network bandwidth, latency, and packet loss rate in real time, constructs an adaptive decision engine based on reinforcement learning, and dynamically adjusts encryption strength and transmission strategy according to network status and data characteristics to complete adaptive encrypted data transmission, including:

[0209] Through the aforementioned multi-threaded parallel encryption processing architecture, bandwidth utilization, round-trip latency, and packet loss rate are collected in real time to analyze data sensitivity, size, and type characteristics, and to establish a network status and data characteristic database.

[0210] Based on the network state and data feature database, a reinforcement learning decision engine is constructed. A deep Q-network is used to learn the mapping relationship between the network state and the optimal transmission strategy. A reward function is set to optimize transmission efficiency and security, and an adaptive transmission decision strategy is generated.

[0211] The adaptive transmission decision strategy dynamically adjusts the number of SM4 encryption rounds, data block size, and transmission concurrency, establishing a transmission performance feedback mechanism to continuously optimize strategy parameters and complete the adaptive encrypted transmission of the data.

[0212] In this embodiment, network status monitoring forms the perceptual foundation for adaptive encrypted transmission, deploying distributed detectors to continuously collect three key metrics. Bandwidth utilization is obtained through network interface counters, calculating the ratio of data transmission volume per unit time to the theoretical link capacity, reflecting the current network congestion level. A sliding window averaging method is used to process the raw data, reducing the impact of instantaneous fluctuations and obtaining a more stable bandwidth trend. Round-trip time (RTT) is measured through active probing, sending special probe packets and recording response times, reflecting the latency characteristics of network transmission. Simultaneously, the average latency and jitter are monitored to comprehensively assess network stability. Packet loss rate is calculated through sequence number tracking, comparing the number of sent and received packets to reflect network reliability. For encrypted transmission, packet loss not only affects efficiency but can also lead to decryption failures, thus this metric receives special attention. The sampling frequency of these network metrics is dynamically adjusted according to network volatility, ranging from multiple times per second to once per minute, increasing the sampling rate when network conditions change drastically. All monitoring data undergoes outlier filtering and standardization, and is stored in a time-series database to provide a foundation for subsequent analysis.

[0213] Data feature analysis is the process of assessing the attributes of transmitted content, influencing the formulation of encryption strategies. Data sensitivity is a key feature; through content scanning and metadata tagging, data is categorized into high, medium, and low sensitivity levels. High-sensitivity data, such as key materials and personally identifiable information, requires the strongest encryption protection; medium-sensitivity data, such as business data, requires standard encryption; and low-sensitivity data, such as publicly available information, can be encrypted using lightweight encryption. Data size affects the chunking strategy; analyzing file size distribution automatically adopts larger block sizes and parallelism for large data. Data type characteristics are identified through file extensions and content headers, and different types are optimized for different processing: structured data, such as database records, is suitable for field-level encryption; streaming media data is suitable for real-time encryption pipelines; and static files are suitable for chunked batch processing. The timeliness of the data is also analyzed, prioritizing low latency for real-time interactive data and high throughput for batch-processed data. This feature information is stored in association with data objects, forming a data feature index that guides the encryption decision engine in formulating targeted strategies.

[0214] The network status and data feature database is a structured knowledge base that stores historical monitoring data and feature information, providing learning materials for the decision engine. The database employs a hybrid storage architecture: network status data uses a time-series database to optimize time-series queries and trend analysis; data features use key-value storage to support fast feature retrieval. The database implements automatic archiving and compression, aggregating long-term data into statistical summaries to reduce storage overhead while retaining valuable information. Multi-dimensional indexes are built to accelerate complex queries, such as "finding the best strategy for handling highly sensitive data under specific network conditions." To support real-time decision-making, the database uses memory caching and pre-computation techniques, keeping key data and frequently used query results resident in memory to ensure millisecond-level response times. The database also implements abnormal pattern recognition, detecting and labeling atypical network conditions and data patterns to provide the decision engine with reference data for specific scenarios.

[0215] The reinforcement learning decision engine is the core of the system's intelligence, responsible for selecting the optimal transmission strategy based on the environmental state. This engine is based on a Markov Decision Process (MDP) model, formalizing the encrypted transmission process as an interactive sequence of states, actions, and rewards. The state space consists of network metrics (bandwidth, latency, packet loss rate) and data characteristics (sensitivity, size, type); the action space includes adjustable transmission parameters such as the number of SM4 rounds, block size, and concurrency; the reward function comprehensively evaluates transmission completion time, resource consumption, and security strength, balancing efficiency and security. A Deep Q-Network (DQN) algorithm is used to approximate the value function, employing a deep neural network to learn the mapping relationship between states and action values. The network structure includes four fully connected layers, using ReLU activation and batch normalization to enhance training stability. To accelerate the learning process, an experience replay technique is employed, storing historical interaction samples and randomly sampling them for batch updates, breaking sample correlation and improving data utilization efficiency. A target network mechanism is also implemented, using slowly updated network copies to generate learning targets, reducing training instability. The decision engine employs an ε-greedy strategy to balance exploration and utilization. Initially, it randomly attempts actions with a higher probability, but as learning progresses, it gradually leans towards known high-value actions.

[0216] Reward function design is crucial for reinforcement learning, directly impacting the quality of learning objectives and policies. A composite reward function was designed to balance three core objectives: transmission efficiency, resource consumption, and security level. Transmission efficiency rewards are calculated based on completion time, with shorter times resulting in higher rewards and higher weighting for real-time data. Resource consumption rewards consider CPU utilization, memory usage, and energy consumption, encouraging resource conservation while meeting performance requirements. Security level rewards are assessed based on the matching degree between encryption strength and data sensitivity, with higher rewards given for using strong encryption for highly sensitive data. A dynamic weight adjustment mechanism was implemented, automatically adjusting the importance of each component according to business priority; for example, increasing efficiency weights during network congestion and increasing security weights when processing financial data. Reward calculation also considers long-term value, using a discount factor to balance immediate gains and future potential, avoiding short-sighted decision-making. Through this multi-objective reward design, the optimal trade-off strategy can be learned under different conditions.

[0217] The adjustment of the number of SM4 encryption rounds is a key technology to meet different security requirements. SM4 is a block cipher algorithm of the Chinese national standard. The standard specifies 32 rounds of transformation, but in actual applications, it can be flexibly adjusted according to security requirements. It supports dynamic configuration of the number of rounds between 16 and 32: 32 rounds are used for highly sensitive data to ensure the highest security strength; 24 rounds can be used for moderately sensitive data to improve performance while maintaining sufficient security; 16 - 20 rounds can be used for low - sensitive data to significantly improve the encryption speed. The adjustment of the number of rounds is achieved by modifying the number of iterations of the encryption algorithm. Each reduction of one round approximately increases the processing speed by 3 - 5%. The coordinated adjustment of the number of rounds and the key length is realized. For scenarios with a reduced number of rounds, a longer session key or more frequent key updates are used to maintain the security level. The change in the number of rounds is recorded in the data header to ensure that the receiving party uses matching decryption parameters. This flexible encryption strength adjustment mechanism enables the maximization of the balance between security and efficiency under different network conditions.

[0218] The adjustment of data block size and transmission concurrency is an important means to optimize network adaptability. The block size refers to the size of splitting large data into smaller units, which affects the transmission efficiency and error recovery ability. It supports dynamic adjustment of the block size within the range of 4KB to 1MB: large blocks (512KB - 1MB) are used in high - bandwidth and low - latency networks to reduce the header overhead and improve the throughput; small blocks (4KB - 64KB) are used in unstable networks to reduce the retransmission cost and improve the responsiveness. The concurrency refers to the number of data streams transmitted simultaneously, which affects the bandwidth utilization rate and resource consumption. The optimal number of concurrent streams is automatically calculated according to the network bandwidth and processing capacity, with a typical range of 4 - 32. In high - latency networks, increasing the concurrency fills the bandwidth - delay product; in high - packet - loss environments, reducing the concurrency reduces congestion. An adaptive coordination mechanism for block size and concurrency is realized. For example, a small - block and high - concurrency strategy is adopted in the mobile network environment, while a large - block and medium - concurrency strategy is adopted inside the data center. This multi - parameter linkage adjustment enables adaptation to various network environments and maintains efficient transmission.

[0219] The transmission performance feedback mechanism is a crucial link in closed-loop optimization, collecting actual execution results and guiding strategy adjustments. After each transmission, key performance indicators are recorded: effective throughput, end-to-end latency, encryption processing time, and resource usage. These data are compared with the expected results at the time of decision-making to calculate prediction accuracy and strategy effectiveness. Feedback data is first used for immediate adjustments, such as immediately reducing block size when network congestion intensifies; secondly, it is used for model updates, periodically retraining the decision model to improve prediction accuracy; and finally, it is used for long-term strategy optimization, identifying the optimal parameter combinations for specific scenarios and forming an optimization rule base. A hierarchical feedback processing system is implemented: micro-feedback provides immediate adjustments for single transmissions; macro-feedback analyzes transmission patterns and trends to guide strategy evolution. To address feedback latency issues, a predictive adjustment mechanism is employed, making preliminary adjustments based on partial observations and historical patterns before obtaining complete feedback. Through this continuous feedback learning mechanism, decision-making strategies can be continuously improved to adapt to changes in the network environment and emerging data patterns.

[0220] Example 12:

[0221] like Figure 2 As shown, the present invention also provides a national cryptographic algorithm data encryption transmission system, comprising:

[0222] The probabilistic ablation reconstruction module 10 is used to acquire the data to be encrypted and transmitted and network environment parameters, establish a probabilistic ablation model based on Bayesian network, perform random ablation operation on the national cryptographic encryption process through Monte Carlo sampling and evaluate the risk probability under various attack scenarios, and generate a probabilistic security guarantee encryption strategy.

[0223] The parameter optimization module 20 is used to extract the Boolean feature set in the encryption process and construct a long short-term memory network time prediction model based on the encryption strategy with probabilistic security guarantee. The simulated annealing algorithm is used to optimize the model by taking the weighted combination of prediction time and security strength as the objective function to obtain the optimal encryption parameter configuration sequence.

[0224] The hybrid encryption module 30 is used to configure the optimal encryption parameters according to the sequence, generate key pairs using the SM2 elliptic curve algorithm and establish a shared key through the elliptic curve Diffie-Hellman protocol, and derive the shared key from the shared key through the SM3 hash function to generate an SM4 session key, thereby establishing a hybrid encryption key system.

[0225] Parallel processing module 40 is used to construct teacher network and student network models based on the hybrid encryption key system, optimize multi-threaded scheduling strategy through adversarial distillation training and retrieval enhancement techniques, establish an intelligent thread coordination mechanism, and generate a multi-threaded parallel encryption processing architecture.

[0226] The adaptive transmission module 50 is used to monitor network bandwidth, latency and packet loss rate in real time through the multi-threaded parallel encryption processing architecture, build an adaptive decision engine based on reinforcement learning, and dynamically adjust the encryption strength and transmission strategy according to the network status and data characteristics to complete the adaptive encrypted transmission of data.

[0227] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for encrypting and transmitting data using a national cryptographic algorithm, characterized in that, include: The data to be encrypted and transmitted and network environment parameters are obtained. A probabilistic ablation model based on Bayesian network is established. The national cryptographic encryption process is randomly ablated through Monte Carlo sampling and the risk probability under various attack scenarios is evaluated to generate a probabilistic security-assured encryption strategy. Based on the encryption strategy with probabilistic security, the Boolean feature set in the encryption process is extracted and a long short-term memory network time prediction model is constructed. The simulated annealing algorithm is used to optimize the model by taking the weighted combination of prediction time and security strength as the objective function, so as to obtain the optimal encryption parameter configuration sequence. Based on the optimal encryption parameter configuration sequence, a key pair is generated using the SM2 elliptic curve algorithm and a shared key is established using the elliptic curve Diffie-Hellman protocol. The shared key is then used to generate an SM4 session key through key derivation using the SM3 hash function, thus establishing a hybrid encryption key system. Based on the aforementioned hybrid encryption key system, teacher network and student network models are constructed. Multi-threaded scheduling strategies are optimized through adversarial distillation training and retrieval enhancement techniques, an intelligent thread coordination mechanism is established, and a multi-threaded parallel encryption processing architecture is generated. Through the aforementioned multi-threaded parallel encryption processing architecture, network bandwidth, latency, and packet loss rate are monitored in real time. An adaptive decision engine based on reinforcement learning is constructed to dynamically adjust the encryption strength and transmission strategy according to network status and data characteristics, thereby completing adaptive encrypted data transmission.

2. The method according to claim 1, characterized in that, The establishment of a probabilistic ablation model based on Bayesian networks involves performing random ablation operations on the national cryptographic encryption process through Monte Carlo sampling and evaluating the risk probability under various attack scenarios to generate a probabilistically secure encryption strategy, including: Based on the data to be encrypted and the network environment parameters, a Bayesian network is constructed to represent the execution steps of the SM2 and SM4 algorithms as network nodes, and each node is assigned a corresponding probability distribution to establish a probabilistic representation model of the encryption process. Using the probabilistic representation model, Monte Carlo sampling is used to randomly select specific steps in the encryption process for ablation operations, including disabling encryption rounds, modifying the key expansion algorithm, and changing the S-box replacement rule, generating a variety of ablation configuration schemes. Based on the aforementioned multiple ablation configuration schemes, simulation tests are run to evaluate the security strength under differential cryptanalysis, linear cryptanalysis, and specialized attack methods. The probability of successful attack, required computing resources, and attack time window are calculated to obtain the encryption strategy with probabilistic security assurance.

3. The method according to claim 1, characterized in that, The process involves extracting Boolean feature sets from the encryption process and constructing a Long Short-Term Memory (LSTM) network time prediction model. Simulated annealing is then used to optimize this model by employing a weighted combination of prediction time and security strength as the objective function, resulting in an optimal encryption parameter configuration sequence, including: Based on the encryption strategy with probabilistic security, Boolean feature vectors including key length selection, encryption round configuration, and parallelism setting are extracted. Long Short-Term Memory Network (LSTM) receiver parameter configuration vector and historical performance data are constructed to establish a prediction model of parameter configuration and encryption time. Based on the prediction model, a simulated annealing optimization framework is established, with a weighted combination of prediction time and safety intensity as the objective function. An initial temperature is set and randomness is gradually reduced through a temperature control strategy to search for the optimal variable sorting scheme. Based on the optimal variable sorting scheme, a configuration sequence containing parameter adjustment priority guidance is generated. When a performance bottleneck is detected, the parameters are gradually adjusted according to the priority sequence to obtain the optimal encryption parameter configuration sequence.

4. The method according to claim 1, characterized in that, The process involves generating key pairs using the SM2 elliptic curve algorithm and establishing a shared key using the elliptic curve Diffie-Hellman protocol. The shared key is then used to derive an SM4 session key using the SM3 hash function, thus establishing a hybrid encryption key system. This includes: Based on the optimal encryption parameter configuration sequence, select elliptic curve parameters and generate SM2 key pairs using a true random number generator. The two communicating parties generate temporary key pairs and exchange public keys, and calculate the shared key through the elliptic curve Diffie-Hellman protocol. Based on the shared key, it is converted into a byte sequence through a standardized point compression algorithm, and the key entropy value is increased by multiple rounds of hashing operations using the SM3 hash function. The data encryption key, message authentication code key and key update master key are then derived to obtain the SM4 session key. Using the SM4 session key, a key chain technology is established to achieve periodic key updates. The next generation session key is generated using the current session key and a new random number through the SM3 hash algorithm. The current session key is then securely destroyed by overwriting the memory area multiple times, thus establishing the hybrid encryption key system.

5. The method according to claim 1, characterized in that, The construction of teacher and student network models, optimization of multi-threaded scheduling strategies through adversarial distillation training and retrieval enhancement techniques, establishment of an intelligent thread coordination mechanism, and generation of a multi-threaded parallel encryption processing architecture include: Based on the aforementioned hybrid encryption key system, a teacher network model is constructed. By analyzing historical encryption task execution data, the optimal thread scheduling strategy is learned. A lightweight student network model is designed to be responsible for real-time thread resource allocation and task scheduling. A knowledge distillation and transfer mechanism is established. Through the knowledge distillation transfer mechanism, the student network is subjected to adversarial training in a simulated attack environment to generate adversarial samples that simulate hardware failures, network attacks and resource contention, thereby obtaining a robust scheduling strategy. Based on the robust scheduling strategy, a feature vector database is established to store historical encryption task features and optimal scheduling schemes. Vector retrieval technology is used to match similar cases within milliseconds to generate the multi-threaded parallel encryption processing architecture.

6. The method according to claim 1, characterized in that, It also includes distributed cryptographic optimization steps based on federated learning: Based on the encryption strategy with probabilistic security, a multi-node federated learning network is established. Each node trains a local optimization model based on local encryption task data, generating a distributed model training system. Through the distributed model training system, differential privacy protection and homomorphic encryption technology are used to share the local optimized model parameters trained by each node. Under the premise of protecting the privacy of the original encrypted task data, the local models are fused to construct a global thread scheduling optimization strategy. Based on the global thread scheduling optimization strategy, a dynamic node management mechanism is established to support the dynamic addition and removal of nodes, evaluate the contribution and trustworthiness of nodes in real time, and achieve collaborative optimization of distributed encryption parameters.

7. The method according to claim 6, characterized in that, The established dynamic node management mechanism supports the dynamic addition and removal of nodes, real-time evaluation of node contribution and trustworthiness, and collaborative optimization of distributed encrypted parameters, including: Based on the global thread scheduling optimization strategy, a node reputation evaluation algorithm is designed. A multi-dimensional reputation scoring system is established based on historical contribution, data quality, and model performance to generate node credibility evaluation results. Based on the node credibility evaluation results, a dynamic weight allocation mechanism is established. The parameter fusion weight of nodes in the global thread scheduling optimization strategy construction process is adjusted according to the node reputation score. A reputation threshold is set to automatically remove low-reputation nodes, ensuring safe and effective federated learning. Based on the aforementioned secure and effective federated learning, a node failure detection and recovery mechanism is constructed to monitor node status in real time and automatically reassign tasks when a node fails.

8. The method according to claim 1, characterized in that, It also includes entropy enhancement steps based on quantum random numbers: Based on the encryption strategy with probabilistic security, a quantum random number generator is integrated to provide a random number source for the national cryptographic algorithm. An entropy pool management mechanism is designed to monitor the quality of random numbers in real time and a quantum random number supply system is established. Through the quantum random number supply system, a hybrid strategy of using quantum random numbers and traditional pseudo-random numbers is established. Random number sources are dynamically selected according to security level requirements and hardware costs to achieve cost-controllable random number services. Based on the aforementioned random number service, a quantum random number quality assessment system is constructed. Statistical testing methods are used to verify the uniformity, independence, and unpredictability of random numbers, ensuring that the random numbers meet cryptographic security requirements.

9. The method according to claim 8, characterized in that, The aforementioned quantum random number quality assessment system employs statistical testing methods to verify the uniformity, independence, and unpredictability of random numbers, ensuring that the random numbers meet cryptographic security requirements, including: Based on the random number service, frequency tests, run length tests, and autocorrelation tests are performed to verify the statistical uniformity and independence of the random number sequence, and a random number quality assessment report is generated. The random number quality assessment report is used to evaluate the unpredictability of random numbers using linear complexity tests and general statistical tests. A quality threshold is set for real-time monitoring, and a random number quality assurance mechanism is established. Based on the random number quality assurance mechanism, when the quality of the random number is detected to be lower than the preset quality threshold, the system automatically switches to a backup random number source and triggers the recalibration of the quantum random number generator to ensure that the random number meets the cryptographic security requirements.

10. The method according to claim 1, characterized in that, It also includes edge computing-based encryption offloading optimization steps: Based on the adaptive encrypted transmission of the data, an edge node encryption capability evaluation model is established to dynamically evaluate the computing resources, storage capacity and security level of each edge node and generate an edge node capability distribution map. Based on the edge node capability distribution map, an intelligent task allocation algorithm is designed to allocate encrypted tasks optimally according to data sensitivity and node capabilities, establish a task priority queue, and achieve load-balanced task distribution. Based on the load-balanced task distribution, an edge-cloud collaborative key management system is constructed to achieve cross-level secure key distribution and updates, and to establish a load balancing mechanism between edge nodes.

11. The method according to claim 10, characterized in that, The establishment of an edge node encryption capability assessment model dynamically evaluates the computing resources, storage capacity, and security level of each edge node, generating an edge node capability distribution map, including: Based on the adaptive encrypted transmission of the data, the CPU utilization, memory usage, network bandwidth and encryption processor performance parameters of the edge nodes are collected to establish node hardware resource evaluation indicators. By using the node hardware resource evaluation indicators, combined with the node's physical security level, network security configuration, and access control mechanism, the analytic hierarchy process is used to calculate a comprehensive security score and generate a node security level evaluation result. Based on the node security level assessment results, a multi-dimensional capability assessment matrix is ​​constructed, a clustering algorithm is used to classify and manage the nodes, the node status information is updated in real time, and the edge node capability distribution map is generated.

12. The method according to claim 1, characterized in that, The system monitors network bandwidth, latency, and packet loss rate in real time, constructs an adaptive decision engine based on reinforcement learning, and dynamically adjusts encryption strength and transmission strategy according to network status and data characteristics to complete adaptive encrypted data transmission, including: Through the aforementioned multi-threaded parallel encryption processing architecture, bandwidth utilization, round-trip latency, and packet loss rate are collected in real time to analyze data sensitivity, size, and type characteristics, and to establish a network status and data characteristic database. Based on the network state and data feature database, a reinforcement learning decision engine is constructed. A deep Q-network is used to learn the mapping relationship between the network state and the optimal transmission strategy. A reward function is set to optimize transmission efficiency and security, and an adaptive transmission decision strategy is generated. The adaptive transmission decision strategy dynamically adjusts the number of SM4 encryption rounds, data block size, and transmission concurrency, establishing a transmission performance feedback mechanism to continuously optimize strategy parameters and complete the adaptive encrypted transmission of the data.

13. A data encryption transmission system based on national cryptographic algorithms, characterized in that, include: The probabilistic ablation reconstruction module is used to obtain the data to be encrypted and transmitted and network environment parameters, establish a probabilistic ablation model based on Bayesian networks, perform random ablation operations on the national cryptographic encryption process through Monte Carlo sampling, evaluate the risk probability under various attack scenarios, and generate a probabilistic security-assured encryption strategy. The parameter optimization module is used to extract the Boolean feature set in the encryption process and construct a long short-term memory network time prediction model based on the encryption strategy with probabilistic security guarantee. The simulated annealing algorithm is used to optimize the model by taking the weighted combination of prediction time and security strength as the objective function to obtain the optimal encryption parameter configuration sequence. The hybrid encryption module is used to configure the sequence of optimal encryption parameters, generate key pairs using the SM2 elliptic curve algorithm and establish a shared key through the elliptic curve Diffie-Hellman protocol, and derive the shared key from the shared key using the SM3 hash function to generate an SM4 session key, thereby establishing a hybrid encryption key system. The parallel processing module is used to construct teacher network and student network models based on the hybrid encryption key system, optimize the multi-threaded scheduling strategy through adversarial distillation training and retrieval enhancement techniques, establish an intelligent thread coordination mechanism, and generate a multi-threaded parallel encryption processing architecture. The adaptive transmission module is used to monitor network bandwidth, latency and packet loss rate in real time through the multi-threaded parallel encryption processing architecture, build an adaptive decision engine based on reinforcement learning, and dynamically adjust the encryption strength and transmission strategy according to the network status and data characteristics to complete the adaptive encrypted transmission of data.

Images