Security system for dynamic encryption transmission and transmission method

Abstract

The invention discloses a security system for dynamic encryption transmission and a transmission method, relates to the technical field of memory encryption, and aims to solve the problems of static encryption defects, insufficient key management and dynamic protection deficiency in a memory encryption process. Comprising a host system, an intelligent memory scheduling module, a dynamic key management module, a protocol stack encryption engine and an anti-attack protection module. Wherein the host system generates original data; the security policy scheduling module classifies the original data; the intelligent memory scheduling module divides the memory and receives classification data; the dynamic key management module dynamically generates a session key; the protocol stack encryption engine encrypts transmission data by using the session key, and sends an encrypted data packet through a physical network; and the anti-attack protection module provides attack protection for a system encryption transmission full link. According to the invention, the dynamic nature of the secret key and the intellectualization of memory management are realized, the anti-attack capability is improved by means of the anti-attack protection module, and the security of the system is greatly improved.

Description

Technical Field

[0001] This invention relates to a security system and transmission method for dynamic encrypted transmission, belonging to the field of memory encryption technology. Background Technology

[0002] In the field of memory encryption technology, traditional static encryption methods have exposed many problems. First, static encryption has inherent flaws. Its use of fixed keys or full memory encryption not only increases the risk of key leakage but also causes significant performance degradation, often proving ineffective against real-time attacks such as side-channel analysis and replay attacks. For example, full memory encryption technology achieves full memory encryption through a hardware encryption engine, but lacks a dynamic key rotation mechanism. Its key generation relies on Physical Unclonable Functions (PUFs), but this is not effectively linked to access control, which to some extent affects the security and flexibility of the encryption.

[0003] Secondly, there are shortcomings in key management. Most existing solutions rely on centralized key storage, which is highly vulnerable to attacks. Whether it's a physical probe attack or key theft due to software vulnerabilities, it poses a significant threat to system security. For example, virtualized memory encryption technology isolates sensitive data based on a trusted execution environment, offering advantages in data isolation. However, it cannot defend against physical side-channel attacks such as electromagnetic analysis, threatening sensitive data in memory.

[0004] Finally, the lack of dynamic protection mechanisms means the system lacks the ability to dynamically monitor memory access patterns and cannot adjust the encryption granularity according to the running status. For example, it is difficult to achieve precise encryption by process or memory page. Summary of the Invention

[0005] The purpose of this invention is to provide a security system and transmission method for dynamic encrypted transmission. By implementing dynamic key management and constructing a multimodal collaborative protection system, a highly secure dynamic encrypted transmission system is established, thereby effectively ensuring the security of data transmission.

[0006] To achieve the above objectives, the present invention is implemented using the following technical solution.

[0007] In a first aspect, the present invention provides a security system for dynamic encrypted transmission, including a host system, an intelligent memory scheduling module, a dynamic key management module, and a protocol stack encryption engine; The host system is used to generate the raw data to be transmitted and initiate data transmission requests; The security policy scheduling module communicates with the host system, analyzes the data in real time according to preset rules, and classifies the raw data based on encryption policy decisions. The intelligent memory scheduling module communicates with the security policy scheduling module and divides the memory into a secure area and a regular area, and is used to receive classification data from the security policy scheduling module. The dynamic key management module is communicatively connected to the intelligent memory scheduling module and is used to dynamically generate session keys according to the transmission requests of the host system and output the session keys to the protocol stack encryption engine. The protocol stack encryption engine, located inside the network card, communicates with the intelligent memory scheduling module and the dynamic key management module. It is used to encrypt the transmitted data using the session key and send the encrypted data packet through the physical network.

[0008] The security system for dynamic encrypted transmission provided by this invention rationally allocates data through a security policy scheduling module and an intelligent memory scheduling module. Based on a machine learning model, it analyzes memory access patterns and dynamically adjusts the size of the encryption area and the key update frequency. The dynamic key management module updates keys in real time, effectively resisting attacks such as replay attacks and solving the key source security problem. The protocol stack encryption engine deeply encrypts the transmission protocol, using different keys generated from the context hash value for data from different processes, achieving strict data isolation. The collaboration of these three components enables the system to adapt to different security requirements and application scenarios, maintaining high efficiency while ensuring high data security.

[0009] Furthermore, the security policy scheduling module uses encryption policy decisions to divide the original data into sensitive data and ordinary data; the intelligent memory scheduling module analyzes memory access patterns based on machine learning models to realize dynamic memory partitioning, allocates the sensitive data to the secure area transmission channel, allocates the ordinary data to the regular area transmission channel, and uses hardware page tables to implement access control for the secure area, wherein the secure area transmission channel uses white-box encryption technology, and the regular area transmission channel uses a dynamic selection algorithm.

[0010] The aforementioned further solution, based on fine-grained access control using hardware page tables, enables precise management of memory access while maintaining system performance. Furthermore, it employs machine learning-driven approaches, utilizing an LSTM traffic analysis model to learn normal traffic patterns, accurately identify abnormal behavior, and achieve autonomous optimization of security policies.

[0011] Furthermore, the dynamic key management module includes: The PUF root key module is used to generate a non-clonable root key using physically non-clonable functions; The hash chain derivation module is communicatively connected to the PUF root key module. When a trigger signal is received, the root key is sent as the initial input to the hierarchical hash function to generate a session key N. When the next trigger signal is received, the hierarchical hash function is called again with the session key N as the input to generate a session key N+1, thereby realizing the forward expansion of the hash chain. The session key module is communicatively connected to the hash chain derivation module and the protocol stack encryption engine, and is used to transmit the latest first-level derived key directly as the session key to the protocol stack encryption engine.

[0012] The above-mentioned further scheme generates the root key through the hardware characteristics of PUF, and its non-cloning physical characteristics fundamentally solve the security problem of the key source; at the same time, the hash chain design ensures the one-way evolution of the key, so even if an attacker obtains the current session key, they cannot deduce the historical key, thus achieving true forward security.

[0013] Furthermore, the trigger signal is generated through a context-aware derivation mechanism, which includes event-driven derivation and environment-aware enhancement.

[0014] The above-mentioned further scheme achieves a deep binding between the key and the current network state and environmental conditions through a dual mechanism of event-driven derivation and environment-aware enhancement, so that each key update has a unique contextual relevance.

[0015] Furthermore, the protocol stack encryption engine includes a programmable encryption coprocessor and an encryption algorithm library. The encryption coprocessor calls the algorithms in the encryption algorithm library to encrypt data that enters the network card through direct memory access, thereby achieving zero-copy encryption.

[0016] The aforementioned further solution supports dynamic algorithm switching through a programmable encryption coprocessor architecture, which can intelligently select the optimal algorithm based on data characteristics, enabling seamless integration of dedicated algorithms in power system scenarios. Zero-copy encryption is implemented directly on the network interface card controller, eliminating data movement overhead.

[0017] Furthermore, it also includes an anti-attack protection module, which sends abnormal signals to the dynamic key management module to provide attack protection for the entire encrypted transmission link of the system.

[0018] Furthermore, the anti-attack protection module includes a defense module and a collaborative response system. When the defense module receives an attack test, it sends an attack alarm signal to the collaborative response system.

[0019] Furthermore, the defense module employs a defense detection mechanism, including a physical layer and an algorithm layer, which are used to detect physical attacks and side-channel attacks, respectively.

[0020] Furthermore, the collaborative response system includes: An attack alarm interface is used to receive attack alarm signals from the defense module. The security control center is connected to the attack alarm interface and is configured to trigger a three-level circuit breaker response protocol based on the attack alarm signal, in order to realize the functions of erasing session keys, switching channels, and destroying keys.

[0021] The above-mentioned further solution adopts a three-level circuit breaker response protocol, and takes differentiated measures according to the severity of the attack, so as to maintain business continuity to the maximum extent while ensuring security.

[0022] Secondly, this invention proposes a transmission method based on a security system oriented towards dynamic encrypted transmission, comprising: Obtain the raw data to be transmitted and the data transmission request; In response to the data transmission request, the original data to be transmitted is divided into sensitive data and ordinary data based on the encryption strategy decision; The memory is divided into a secure area and a regular area. The sensitive data is allocated to the secure area transmission channel and white-box encryption technology is used. The ordinary data is allocated to the regular area transmission channel and a dynamic selection algorithm is used. It can receive either event-driven or environment-aware enhanced input and output the session key through the hash chain derivation module; For data entering the network card via direct memory access, the network card uses a pre-stored session key to call an encryption algorithm library to encrypt the data and generate a data packet. The encrypted data packet is identified and sent over the physical network.

[0023] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: This invention employs dynamic encryption and a dual-channel isolation mechanism, enhancing both the security and flexibility of encryption. Simultaneously, it utilizes an anti-attack protection mechanism to achieve proactive, in-depth defense from "detection" to "response," forming the final, robust line of defense for ensuring system security. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of the overall system architecture and dynamic encryption process; Figure 2 Flowchart for key derivation and intelligent memory management; Figure 3 A detailed diagram illustrating the anti-attack protection mechanism. Detailed Implementation Example 1

[0025] This embodiment proposes a security system for dynamic encrypted transmission, whose overall system architecture and dynamic encryption process are as follows: Figure 1 As shown, it includes a host system, an intelligent memory scheduling module, a dynamic key management module, and a protocol stack encryption engine; The host system is used to generate the raw data to be transmitted and initiate data transmission requests; The security policy scheduling module communicates with the host system, analyzes data in real time according to preset rules, and classifies raw data based on encryption policy decisions. The intelligent memory scheduling module communicates with the security policy scheduling module and divides the memory into a secure area and a regular area, and is used to receive classified data from the security policy scheduling module. The dynamic key management module communicates with the intelligent memory scheduling module and is used to dynamically generate session keys according to the transmission requests of the host system and output the session keys to the protocol stack encryption engine. The protocol stack encryption engine, located inside the network card, communicates with the intelligent memory scheduling module and the dynamic key management module. It is used to encrypt the data to be transmitted using the session key and send the encrypted data packet through the physical network.

[0026] The encryption strategy categorizes raw data into sensitive and ordinary data. The intelligent memory scheduling module analyzes memory access patterns based on a machine learning model, dynamically adjusting memory partition size and key update frequency. Specifically, it employs machine learning-driven LSTM traffic analysis to learn normal traffic patterns, accurately identify abnormal behavior, and autonomously optimize the security strategy.

[0027] In the above embodiments, the intelligent memory scheduling module allocates sensitive data to the secure zone transmission channel and ordinary data to the regular zone transmission channel. It utilizes hardware page tables to implement access control for the secure zone, achieving precise management of memory access while maintaining system performance. Specifically, the secure zone transmission channel employs white-box encryption technology, which is a white-box modification of the national standard SM4 algorithm. Its core lies in converting the algorithm's computation process into a randomized operation based on a lookup table, thereby hiding the key in untrusted environments. The regular zone transmission channel uses a dynamic selection algorithm, which is based on the national standard algorithm system (SM2 / SM3 / SM4 / SM9, etc.) and incorporates identification and processing strategies for power-specific protocols (such as vertical encryption authentication) and business scenarios (such as PMU data streams).

[0028] In the above embodiments, the dynamic key management module is as follows: Figure 2 As shown, it includes: The PUF root key module is used to generate a non-clonable root key using physically non-clonable functions; The hash chain derivation module communicates with the PUF root key module. When a trigger signal is received, the root key is used as the initial input to the hierarchical hash function to generate a session key N. When the next trigger signal is received, the hierarchical hash function is called again with the session key N as the input to generate a session key N+1, thereby realizing the forward expansion of the hash chain. The session key module communicates with the hash chain derivation module and the protocol stack encryption engine, and is used to transmit the latest first-level derivation key directly as the session key to the protocol stack encryption engine.

[0029] In the above embodiments, the trigger signal is generated through a context-aware derivation mechanism, which includes event-driven derivation and environment-aware enhancement. Event-driven derivation includes automatically triggering key updates in response to network transmission events (such as new connection establishment, protocol switching, data sensitivity changes, etc.). Environment-aware enhancement includes integrating temperature and voltage sensor data as key derivation factors to dynamically resist physical environment attacks.

[0030] In the above embodiments, the protocol stack encryption engine includes a programmable encryption coprocessor and an encryption algorithm library. The encryption coprocessor calls the encryption algorithm library's algorithm to encrypt data that bypasses the operating system kernel and directly accesses memory into the network card, achieving zero-copy encryption. The algorithm encryption library automatically selects the optimal algorithm (SM4 / power-specific encryption algorithm) based on data characteristics (type, size, sensitivity), enabling dynamic algorithm switching. The encrypted data packets are sent through the physical network for secure transmission. Example 2

[0031] Based on the above embodiments, this embodiment adds an attack protection module, such as... Figure 3 As shown. When subjected to physical or side-channel attacks, the system can activate a multi-layered collaborative protection mechanism, forming the last solid line of defense to ensure system security.

[0032] In this embodiment, the anti-attack protection module is communicatively connected to the dynamic key management module and the security policy scheduling module, and sends anomaly signals to the dynamic key management module and the security policy scheduling module to provide attack protection for the entire encrypted transmission link of the system. The anti-attack protection module includes a defense module and a collaborative response system. When the defense module receives an attack test, it sends an attack alarm signal to the collaborative response system.

[0033] Typical attack methods include physical attacks and side-channel attacks. Physical attacks generally include laser detection and electromagnetic injection, while side-channel attacks include power consumption analysis and timing analysis. The defense module employs a defense detection mechanism, including a physical layer and an algorithm layer, used to detect physical attacks and side-channel attacks, respectively. The physical layer deploys a grid of photosensitive sensors on the surface of the memory chip to monitor laser micro-probes or electromagnetic injection attacks in real time, triggering a key self-destruction fuse mechanism and switching to a backup encryption module. Simultaneously, dual redundant computing units are used to cross-verify critical operations, shielding against erroneous physical injection attacks caused by voltage / clock failures. The algorithm layer uses differential masking technology to split sensitive data into random fragments (e.g., (3,5) threshold secret sharing), merges the results after computation, and eliminates the correlation between power consumption and electromagnetic characteristics. Random clock jitter (e.g., ±20%) is injected through a dynamic voltage-frequency regulation (DVFS) circuit to disrupt the algorithm execution timing and resist differential power consumption analysis (DPA) and electromagnetic analysis (EMA).

[0034] When the collaborative response system receives an attack alert, the alert signal is uploaded to the security control center. The control center initiates a three-level circuit breaker response protocol, erasing the session key from the volatile memory, switching the communication channel (e.g., from the primary NIC to the backup NIC), and in extreme cases, triggering "key storage unit self-destruction" to permanently destroy the root key. Simultaneously, the side-channel defense mechanism continues to operate at the algorithm execution level, actively counteracting the effectiveness of the attack. Example 3

[0035] This embodiment proposes a transmission method based on a security system oriented towards dynamic encrypted transmission, including: Obtain the raw data to be transmitted and the data transmission request; In response to data transmission requests, the raw data to be transmitted is divided into sensitive data and ordinary data based on encryption policy decisions; The memory is divided into a secure area and a regular area. Sensitive data is allocated to the secure area transmission channel and white-box encryption technology is used, while ordinary data is allocated to the regular area transmission channel and a dynamic selection algorithm is used. It can receive either event-driven or environment-aware enhanced input and output the session key through the hash chain derivation module; For data entering the network card via direct memory access, the network card uses a pre-stored session key to call an encryption algorithm library to encrypt the data and generate a data packet. The encrypted data packet is identified and sent over the physical network.

Claims

1. A security system for dynamic encrypted transmission, characterized in that, This includes the host system, intelligent memory scheduling module, dynamic key management module, and protocol stack encryption engine; The host system is used to generate the raw data to be transmitted and initiate data transmission requests; The security policy scheduling module communicates with the host system, analyzes the data in real time according to preset rules, and classifies the raw data based on encryption policy decisions. The intelligent memory scheduling module communicates with the security policy scheduling module and divides the memory into a secure area and a regular area, and is used to receive classification data from the security policy scheduling module. The dynamic key management module is communicatively connected to the intelligent memory scheduling module and is used to dynamically generate session keys according to the transmission requests of the host system and output the session keys to the protocol stack encryption engine. The protocol stack encryption engine, located inside the network card, communicates with the intelligent memory scheduling module and the dynamic key management module. It is used to encrypt the transmitted data using the session key and send the encrypted data packet through the physical network.

2. The security system for dynamic encrypted transmission according to claim 1, characterized in that, The security policy scheduling module uses encryption policy decisions to divide the original data into sensitive data and ordinary data; the intelligent memory scheduling module analyzes memory access patterns based on machine learning models to realize dynamic memory partitioning, allocates the sensitive data to the secure area transmission channel, and allocates the ordinary data to the regular area transmission channel, and uses hardware page tables to implement access control for the secure area, wherein the secure area transmission channel uses white-box encryption technology, and the regular area transmission channel uses a dynamic selection algorithm.

3. The security system for dynamic encrypted transmission according to claim 1, characterized in that, The dynamic key management module includes: The PUF root key module is used to generate a non-clonable root key using physically non-clonable functions; The hash chain derivation module is communicatively connected to the PUF root key module. When a trigger signal is received, the root key is sent as the initial input to the hierarchical hash function to generate a session key N. When the next trigger signal is received, the hierarchical hash function is called again with the session key N as the input to generate a session key N+1, thereby realizing the forward expansion of the hash chain. The session key module is communicatively connected to the hash chain derivation module and the protocol stack encryption engine, and is used to transmit the latest first-level derived key directly as the session key to the protocol stack encryption engine.

4. The security system for dynamic encrypted transmission according to claim 1, characterized in that, The trigger signal is generated through a context-aware derivation mechanism, which includes event-driven derivation and enhanced environment awareness.

5. The security system for dynamic encrypted transmission according to claim 1, characterized in that, The protocol stack encryption engine includes a programmable encryption coprocessor and an encryption algorithm library. The encryption coprocessor calls the algorithms in the encryption algorithm library to encrypt data that enters the network card through direct memory access, thereby achieving zero-copy encryption.

6. The security system for dynamic encrypted transmission according to claim 1, characterized in that, It also includes an anti-attack protection module, which is communicatively connected to the dynamic key management module and the security policy scheduling module, and is used to provide attack protection for the entire encrypted transmission link of the system.

7. The security system for dynamic encrypted transmission according to claim 6, characterized in that, The anti-attack protection module includes a defense module and a collaborative response system. When the defense module receives an attack test, it sends an attack alarm signal to the collaborative response system.

8. The security system for dynamic encrypted transmission according to claim 7, characterized in that, The defense module employs a defense detection mechanism, including a physical layer and an algorithm layer, which are used to detect physical attacks and side-channel attacks, respectively.

9. The security system for dynamic encrypted transmission according to claim 7, characterized in that, The collaborative response system includes: An attack alarm interface is used to receive attack alarm signals from the defense module. The security control center is connected to the attack alarm interface and is configured to trigger a three-level circuit breaker response protocol based on the attack alarm signal, in order to realize the functions of erasing session keys, switching channels, and destroying keys.

10. A transmission method based on a security system for dynamic encrypted transmission, characterized in that, include: Obtain the raw data to be transmitted and the data transmission request; In response to the data transmission request, the original data to be transmitted is divided into sensitive data and ordinary data based on the encryption strategy decision; The memory is divided into a secure area and a regular area. The sensitive data is allocated to the secure area transmission channel and white-box encryption technology is used. The ordinary data is allocated to the regular area transmission channel and a dynamic selection algorithm is used. It can receive either event-driven or environment-aware enhanced input and output the session key through the hash chain derivation module; For data entering the network card via direct memory access, the pre-stored session key is used to call the encryption algorithm library to complete the encryption and generate data packets; The encrypted data packet is identified and sent over the physical network.

Images