Data key encryption transmission method and system based on lockless message queue

Abstract

The invention relates to a data key encryption transmission method based on a lock-free message queue. The method comprises the following steps: dividing original data to be transmitted into a plurality of data blocks with fixed sizes; generating a unique dynamic encryption key for each data block batch; writing the encrypted data block into a lock-free message queue based on an annular buffer area, and reading, transmitting and performing security verification from the lock-free message queue by a transmission thread; and decrypting the received data block by using the dynamic encryption key, and recombining the received data block into original data according to the identification information. According to the method, lock competition of thread synchronization is eliminated through the lock-free message queue, and the actually measured throughput is improved by more than 40%; end-to-end encryption transmission delay is controlled within 5 milliseconds, and application scenes such as an electric power system and the like which have strict requirements on real-time performance are met; replay attacks and secret key cracking are effectively defended through a dynamic secret key mechanism and a timestamp binding mechanism; the accurate retransmission mechanism and dynamic buffer configuration ensure the reliability of data transmission.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data secure transmission, and particularly relates to a data key encryption transmission method and system based on a lock-free message queue. BACKGROUND

[0002] In the fields of power, finance, Internet of Things and the like which have extremely high requirements for data security and real-time performance, data transmission needs to meet the requirements of high security and low delay at the same time. The traditional method usually adopts a message queue combining a symmetric encryption algorithm with a lock mechanism, but has the following defects: firstly, the lock mechanism will cause fierce lock competition in a high concurrency scenario, resulting in thread blocking and significantly increasing transmission delay; secondly, a fixed key used for a long time is easy to be cracked, and the security risk is high; and finally, the data fragmentation and recombination strategy fails to be deeply adapted to network characteristics and queue mechanisms, and the transmission efficiency is low.

[0003] In addition, a lock-free programming technology such as a ring buffer avoids lock competition through atomic operations and can improve concurrency performance. However, in the prior art, there is a lack of a scheme for deeply fusing the high concurrency performance of a lock-free queue with the high security mechanism of a dynamic key, resulting in difficulty in balancing performance and security. SUMMARY

[0004] To solve the problems of high transmission delay caused by lock competition in a high concurrency scenario and insufficient security caused by a static key in the prior art, a primary purpose of the present application is to provide a data key encryption transmission method based on a lock-free message queue, which has high concurrency performance, ultra-low delay performance, high security and high reliability.

[0005] To achieve the above purpose, the present application adopts the following technical scheme: a data key encryption transmission method based on a lock-free message queue, which comprises the following steps in sequence:

[0006] (1) dividing original data to be transmitted into a plurality of data blocks of a fixed size;

[0007] (2) generating a unique dynamic encryption key for each batch of data blocks, and synchronizing the dynamic encryption key and identification information of the corresponding data block to a receiving end through a secure channel;

[0008] (3) writing the encrypted data blocks into a lock-free message queue based on a ring buffer, and reading, transmitting and security checking the encrypted data blocks from the lock-free message queue by a transmission thread; wherein the writing and reading of the lock-free message queue are implemented by updating pointers through atomic operations, and error handling is performed when data transmission fails;

[0009] (4) decrypting the received data blocks by using the dynamic encryption key at the receiving end, and recombining the data blocks into original data according to the identification information.

[0010] In step (2), the identification information includes a timestamp and a random number, and the dynamic encryption key is bound to the timestamp and random number of the data block.

[0011] In step (3), the capacity of the ring buffer is dynamically configured according to the historical peak traffic of the system.

[0012] In step (3), the error handling refers to triggering a retransmission mechanism based on queue offset when data transmission fails.

[0013] In step (3), the security verification refers to using the timestamp in the identification information to verify validity in order to prevent replay attacks.

[0014] Another object of the present invention is to provide a system for a data key encryption transmission method based on a lock-free message queue, comprising:

[0015] The data segmentation module is used to divide the raw data into data blocks of fixed size;

[0016] The dynamic key management module is used to generate dynamic encryption keys for each data block and manage the distribution and synchronization of keys;

[0017] The lock-free message queue module includes a queue structure built on a circular buffer, which is used to implement lock-free writing and reading of data blocks through atomic operations;

[0018] An encrypted transmission module is used to encrypt data blocks using the dynamic encryption key and control their queuing and network transmission.

[0019] The decryption and reassembly module, located at the receiving end, is used to decrypt data blocks and reassemble them into the original data.

[0020] As can be seen from the above technical solution, the beneficial effects of the present invention are as follows: First, the present invention has high concurrency performance: by eliminating lock contention in thread synchronization through a lock-free message queue, the actual throughput is increased by more than 40%; Second, the present invention has ultra-low latency performance: the end-to-end encrypted transmission latency is controlled within 5 milliseconds, meeting the application scenarios with stringent real-time requirements such as power systems; Third, the present invention has high security: the dynamic key mechanism of "one data block, one key" and the timestamp binding mechanism effectively defend against replay attacks and key cracking; Fourth, the present invention has high reliability: the precise retransmission mechanism and dynamic buffer configuration ensure the reliability of data transmission. Attached Figure Description

[0021] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation

[0022] like Figure 1As shown, a data key encryption transmission method based on a lock-free message queue includes the following steps in sequence:

[0023] (1) Divide the raw data to be transmitted into multiple data blocks of fixed size;

[0024] (2) Generate a unique dynamic encryption key for each data block batch, and synchronize the dynamic encryption key and the corresponding data block identification information to the receiving end through a secure channel;

[0025] (3) The encrypted data block is written to a lock-free message queue based on a circular buffer, and the transmission thread reads, transmits and performs security verification from the lock-free message queue; the writing and reading of the lock-free message queue is implemented by updating the pointer through atomic operations, and error handling is performed when the data transmission fails;

[0026] (4) At the receiving end, the received data block is decrypted using the dynamic encryption key and reassembled into the original data according to the identification information.

[0027] In step (2), the identification information includes a timestamp and a random number, and the dynamic encryption key is bound to the timestamp and random number of the data block.

[0028] In step (3), the capacity of the ring buffer is dynamically configured according to the historical peak traffic of the system.

[0029] In step (3), the error handling refers to triggering a retransmission mechanism based on queue offset when data transmission fails.

[0030] In step (3), the security verification refers to using the timestamp in the identification information to verify validity in order to prevent replay attacks.

[0031] This system includes:

[0032] The data segmentation module is used to divide the raw data into data blocks of fixed size;

[0033] The dynamic key management module is used to generate dynamic encryption keys for each data block and manage the distribution and synchronization of keys;

[0034] The lock-free message queue module includes a queue structure built on a circular buffer, which is used to implement lock-free writing and reading of data blocks through atomic operations;

[0035] An encrypted transmission module is used to encrypt data blocks using the dynamic encryption key and control their queuing and network transmission.

[0036] The decryption and reassembly module, located at the receiving end, is used to decrypt data blocks and reassemble them into the original data.

[0037] Example 1

[0038] Taking power equipment status monitoring as an example:

[0039] (1) Data block division: A substation generates 500KB of status data per second. It is divided into blocks of 1KB each, resulting in 500 data blocks / second.

[0040] (2) Dynamic key generation: A dynamic SM4 key is generated for each data block. The key is bound to the millisecond-level timestamp of the data block and a 16-byte random number. The key is sent to the monitoring center through a pre-established TLS 1.3 secure channel.

[0041] (3) Lock-free queue construction and transmission: Initialize a circular buffer with a capacity of 1024 data blocks. After data encryption, the producer thread updates the write pointer through CAS operation and stores the data in the queue; the independent transmission thread updates the read pointer through CAS operation, retrieves the data and sends it through the power grid. If a transmission failure is detected, the specific data block is retransmitted according to the recorded queue offset.

[0042] (4) Receiving and processing: After receiving the data, the monitoring center decrypts it using the synchronized dynamic key and verifies the timeliness of the timestamp, such as preventing the replay of data from 5 minutes ago. Finally, it reconstructs the original 500KB status data based on the sequence number embedded in the data block.

[0043] In summary, this invention offers the following advantages: High concurrency performance: Lock contention in thread synchronization is eliminated through a lock-free message queue, resulting in a throughput improvement of over 40% in actual tests. Ultra-low latency performance: End-to-end encrypted transmission latency is controlled within 5 milliseconds, meeting the stringent real-time requirements of applications such as power systems. High security: A dynamic key mechanism of "one data block, one key" combined with a timestamp binding mechanism effectively defends against replay attacks and key cracking. High reliability: A precise retransmission mechanism and dynamic buffer configuration ensure reliable data transmission.

[0044] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention. The scope of protection claimed by the appended claims and their equivalents is defined.

Claims

1. A method for data key encryption transmission based on a lock-free message queue, characterized in that: The method comprises the following steps in sequence: (1) dividing the original data to be transmitted into a plurality of fixed-size data blocks; (2) generating a unique dynamic encryption key for each batch of data blocks, and synchronizing the dynamic encryption key and the identification information of the corresponding data block to the receiving end through a secure channel; (3) writing the encrypted data blocks into a lock-free message queue based on a ring buffer, and reading, transmitting and security checking the data blocks from the lock-free message queue by a transmission thread; wherein the writing and reading of the lock-free message queue are realized by updating the pointer through atomic operation, and error handling is performed when data transmission fails; (4) at the receiving end, decrypting the received data blocks using the dynamic encryption key, and recombining them into the original data according to the identification information.

2. The method of claim 1, wherein: In step (2), the identification information includes a timestamp and a random number, and the dynamic encryption key is bound with the timestamp and the random number of the data block.

3. The method of claim 1, wherein: In step (3), the capacity of the ring buffer is dynamically configured according to the historical peak traffic of the system.

4. The lock-free message queue based data key encryption transmission method of claim 1, wherein: In step (3), the error handling refers to triggering a retransmission mechanism based on the queue offset when data transmission fails.

5. The lock-free message queue based data key encryption transmission method of claim 1, wherein: In step (3), the security check refers to validity check using the timestamp in the identification information to prevent replay attacks.

6. A system implementing the data key encryption in transit method based on lock-free message queues according to any one of claims 1 to 5, characterized in that: Comprise: a data block module for dividing the original data into fixed-size data blocks; a dynamic key management module for generating a dynamic encryption key for each data block and managing the distribution and synchronization of the key; a lock-free message queue module comprising a queue structure based on a ring buffer, for realizing lock-free writing and reading of data blocks through atomic operation; an encryption transmission module for encrypting data blocks using the dynamic encryption key and controlling their queuing and network transmission; a decryption and recombination module located at the receiving end for decrypting data blocks and recombining them into the original data.

Images