Secure channel compressed transmission method, apparatus and equipment

Abstract

This application provides a secure channel compressed transmission method, apparatus, and device. In one example of this application, the method includes: for any data block to be processed, extracting multi-dimensional compression-related features of the data block; determining a predicted compression ratio of the data block based on the multi-dimensional compression-related features; determining the uncompressed path prediction time and compressed path prediction time corresponding to the data block based on the predicted compression ratio; determining a compression strategy for the data block based on the uncompressed path prediction time and compressed path prediction time; wherein the compression strategy includes enabling compression or skipping compression; and transmitting each data block to be processed through a secure channel according to the compression strategy of each data block. This method can improve the reliability and rationality of compression decisions and improve transmission efficiency while ensuring security encryption.

Description

Technical Field

[0001] This application relates to the field of computer network communication and information security technology, and in particular to a secure channel compression transmission method, apparatus and equipment. Background Technology

[0002] With the development of 5G, cloud-network convergence, and edge computing, the amount of data transmitted in networks is growing exponentially. Especially in scenarios such as data center interconnection, remote work, and the industrial internet, encrypted channels are widely used to ensure communication security. However, traditional encrypted channels suffer from low bandwidth utilization when processing highly redundant data (such as logs, XML, and JSON).

[0003] How to improve transmission efficiency while ensuring secure encryption has become an urgent technical problem to be solved. Summary of the Invention

[0004] In view of this, this application provides a secure channel compressed transmission method, apparatus and device.

[0005] Specifically, this application is implemented through the following technical solution:

[0006] According to a first aspect of the embodiments of this application, a secure channel compressed transmission method is provided, applied to a data transmitting end device, the method comprising:

[0007] For any data block to be processed, extract the multi-dimensional compression-related features of the data block to be processed;

[0008] Based on the aforementioned multi-dimensional compression-related features, the predicted compression ratio of the data block to be processed is determined;

[0009] Based on the predicted compression ratio, the predicted uncompressed path time and the predicted compressed path time for the data block to be processed are determined; wherein, the predicted uncompressed path time is the predicted time for transmitting the data block to be processed through a secure channel when the compression processing of the data block to be processed is skipped; the predicted compressed path time is the predicted time for transmitting the data block to be processed through a secure channel when the data block to be processed is compressed according to the predicted compression ratio.

[0010] Based on the predicted time of the uncompressed path and the predicted time of the compressed path, a compression strategy for the data block to be processed is determined; wherein, the compression strategy includes enabling compression or skipping compression;

[0011] Based on the compression strategy of each data block to be processed, each data block to be processed is transmitted through a secure channel.

[0012] According to a second aspect of the embodiments of this application, a secure channel compression transmission apparatus is provided, deployed in a data transmitting end device, the apparatus comprising:

[0013] The extraction unit is used to extract the multi-dimensional compression-related features of any data block to be processed.

[0014] The first determining unit is used to determine the predicted compression ratio of the data block to be processed based on the multi-dimensional compression-related features.

[0015] The second determining unit is configured to determine the uncompressed path prediction time and the compressed path prediction time corresponding to the data block to be processed based on the predicted compression ratio; wherein, the uncompressed path prediction time is the predicted time for transmitting the data block to be processed through a secure channel when the compression processing of the data block to be processed is skipped; and the compressed path prediction time is the predicted time for transmitting the data block to be processed through a secure channel when the data block to be processed is compressed based on the predicted compression ratio.

[0016] A compression strategy decision unit is used to determine the compression strategy of the data block to be processed based on the predicted time of the uncompressed path and the predicted time of the compressed path; wherein, the compression strategy includes enabling compression or skipping compression;

[0017] The processing unit is used to transmit each data block to be processed through a secure channel according to the compression strategy of each data block to be processed.

[0018] According to a third aspect of the embodiments of this application, an electronic device is provided, including a processor and a memory, wherein:

[0019] Memory, used to store computer programs;

[0020] The processor, when executing a program stored in memory, implements the method provided in the first aspect.

[0021] The secure channel compression transmission method of this application embodiment extracts multi-dimensional compression-related features of any data block to be processed. Based on the extracted multi-dimensional compression-related features, the predicted compression ratio of the data block to be processed is determined. Based on the predicted compression ratio, the predicted uncompressed path time and the predicted compressed path time corresponding to the data block to be processed are determined. Then, based on the predicted uncompressed path time and the predicted compressed path time, the compression strategy of the data block to be processed is determined. Based on the compression strategy of each data block to be processed, each data block to be processed is transmitted through a secure channel. By performing multi-dimensional feature analysis on the data block to be processed during the compression decision process, the transmission processing time (i.e., the predicted uncompressed path time and the predicted compressed path time) for skipping compression or enabling compression for the data block to be processed is predicted. Based on the predicted transmission processing time, the compression strategy of the data block to be processed is determined, which improves the reliability and rationality of the compression decision and can improve transmission efficiency while ensuring security encryption. Attached Figure Description

[0022] Figure 1 This is a schematic flowchart illustrating a secure channel compressed transmission method as an exemplary embodiment of this application;

[0023] Figure 2 The following is an implementation flow of a secure channel compressed transmission scheme illustrated in an exemplary embodiment of this application;

[0024] Figure 3 This is a schematic diagram illustrating the implementation process of a secure channel compressed transmission scheme, as shown in an exemplary embodiment of this application.

[0025] Figure 4A This is a schematic diagram of the structure of a traditional IPSec data packet;

[0026] Figure 4B This is a schematic diagram illustrating the structure of a data packet as an exemplary embodiment of this application;

[0027] Figure 5 This is a schematic diagram illustrating the structure of a secure channel compressed transmission device, as shown in an exemplary embodiment of this application.

[0028] Figure 6 This is a schematic diagram of the hardware structure of an electronic device as illustrated in an exemplary embodiment of this application. Detailed Implementation

[0029] To enable those skilled in the art to better understand the technical solutions provided in the embodiments of this application, some technical terms involved in the embodiments of this application will be explained below.

[0030] 1. Shannon entropy: A form of information entropy used to measure the randomness of data. The lower the entropy value, the higher the compressibility.

[0031] 2. Lightweight LZ-type sliding window pre-scan: A lightweight preprocessing algorithm for quickly evaluating the intensity of repeating patterns in data blocks. It employs a sliding window technique similar to LZ77, setting a fixed-size sliding window and a forward lookup buffer to quickly scan the data block. The algorithm calculates the ratio of the total length of all matching segments to the total length of the data block, thereby generating a repeating pattern intensity index. This process aims to approximate the compressibility of the data with low computational overhead, without pursuing complete compression.

[0032] 3. The quintuple consists of the source IP address, destination IP address, source port, destination port, and transport layer protocol, used to uniquely identify a network flow.

[0033] 4. IPSec (Internet Protocol Security): A suite of security protocols used to provide data encryption and authentication at the IP layer.

[0034] 5. QAT Hardware: A hardware accelerator used to offload CPU-intensive tasks. It supports symmetric encryption, asymmetric encryption, data compression and decompression, and other operations, aiming to reduce CPU utilization and improve data processing throughput.

[0035] 6. VPP (Vector Packet Processing): A high-performance user-space network protocol stack commonly used in routers and gateway devices.

[0036] To make the above-mentioned objectives, features and advantages of the embodiments of this application more apparent and understandable, the technical solutions of the embodiments of this application will be further described in detail below with reference to the accompanying drawings.

[0037] Please see Figure 1 This is a flowchart illustrating a secure channel compression transmission method provided in an embodiment of this application. For example, this secure channel compression transmission method can be applied to a data sending device, such as... Figure 1 As shown, the secure channel compressed transmission method may include the following steps:

[0038] Step S100: For any data block to be processed, extract the multi-dimensional compression-related features of the data block to be processed.

[0039] For example, the data block to be processed can be obtained by dividing the data stream to be transmitted into data blocks.

[0040] In one example, the data stream to be transmitted can be divided into continuous data blocks according to a preset time window or data size to obtain at least one data block to be processed.

[0041] Among them, the data block to be processed can be used as the basic processing unit for compression decision-making, and each data block to be processed can be processed independently.

[0042] For example, compression-related features used to predict data compressibility may include, but are not limited to, some or all of the following features: information entropy features, repetitive pattern features, and historical behavior features.

[0043] Step S110: Determine the predicted compression ratio of the data block to be processed based on the multi-dimensional compression-related features.

[0044] In this embodiment of the application, the compressibility of the data block to be processed can be evaluated based on the multi-dimensional compression-related characteristics of the data block to be processed, and the compression ratio (the ratio of the compressed data size to the original data size) of the data block to be processed can be predicted.

[0045] In one example, determining the predicted compression ratio of the data block to be processed based on multi-dimensional compression-related features may include:

[0046] Determine the compressibility score corresponding to each dimension of compression-related features;

[0047] Based on the compressibility scores of each dimension, determine the comprehensive compressibility score of the data block to be processed;

[0048] The overall compressibility score is mapped to the predicted compression ratio.

[0049] For example, for any dimension of the compression-related features of the extracted data block to be processed, the score corresponding to that dimension of compression-related features can be determined (which can be called the compressibility score).

[0050] The overall compressibility score of the data block to be processed can be determined based on the compressibility scores of each dimension (i.e., the scores corresponding to the compression-related features of each dimension of the data block to be processed).

[0051] For example, the overall compressibility score of the data block to be processed can be determined by weighted averaging based on the compressibility scores of each dimension.

[0052] Once the overall compressibility score of the data block to be processed is determined, the compression ratio of the data block to be processed can be predicted based on the overall compressibility score (this can be called the predicted compression ratio). This predicted compression ratio is used to assist in deciding whether the data to be processed needs to be compressed.

[0053] Step S120: Based on the predicted compression ratio of the data to be processed, determine the uncompressed path prediction time and the compressed path prediction time corresponding to the data block to be processed; wherein, the uncompressed path prediction time is the predicted time for transmitting the data block to be processed through the secure channel when the compression processing of the data block to be processed is skipped; the compressed path prediction time is the predicted time for transmitting the data block to be processed through the secure channel when the data block to be processed is compressed according to the predicted compression ratio.

[0054] In this embodiment of the application, when the predicted compression ratio of the data block to be processed is determined, on the one hand, the time taken to transmit the data block to be processed through the secure channel when the data block to be processed is compressed according to the predicted compression ratio (which can be called compression path prediction time) can be predicted; on the other hand, the time taken to transmit the data block to be processed through the secure channel when the data block to be processed is not compressed (i.e., the compression process of the data block to be processed is skipped) can be predicted (which can be called uncompressed path prediction time).

[0055] For example, the compression path time may include the predicted compression and encryption time, the predicted transmission processing time, and the predicted decompression and decompression time.

[0056] The predicted time for uncompressed paths can include the predicted time for encryption processing, the predicted time for transmission processing, and the predicted time for decryption processing.

[0057] Step S130: Determine the compression strategy for the data block to be processed based on the predicted time of the uncompressed path and the predicted time of the compressed path; wherein, the compression strategy includes enabling compression or skipping compression.

[0058] In this embodiment of the application, for any data block to be processed, the compression benefit of the data block to be processed can be determined based on the predicted time consumption of the uncompressed path and the predicted time consumption of the compressed path. That is, compared with skipping the compression processing of the data block to be processed, when the data block to be processed is compressed according to the determined predicted compression ratio, the compression strategy of the data block to be processed is determined based on the benefit of the processing time of the data block to be processed, such as enabling compression or skipping compression.

[0059] For example, the compression strategy for the data block to be processed can be determined based on the ratio or difference between the predicted time of the compressed path and the predicted time of the uncompressed path.

[0060] Step S140: Based on the compression strategy of each data block to be processed, transmit each data block to be processed through a secure channel.

[0061] For example, for any data block to be processed, if the compression strategy of the data block to be processed is to enable compression, the data block to be processed can be compressed according to the predicted compression ratio of the data to be processed, and the compressed data block can be encrypted and transmitted through a secure channel.

[0062] If the compression strategy for the data block to be processed is to skip compression, the compression process for the data block to be processed can be skipped (i.e., the data block to be processed is not compressed), the data block to be processed can be encrypted, and the encrypted data block can be transmitted through a secure channel.

[0063] For example, a data block to be processed may include multiple data packets, and the compression strategy of each data packet in a data block to be processed is the same as the compression strategy of the data block to be processed.

[0064] For example, for a block of data to be processed, if the compression strategy of the block of data to be processed is to skip compression, then for any data packet in the block of data to be processed, compression processing can be skipped during the transmission of the data packet through the secure channel.

[0065] It can be seen that, in Figure 1 In the illustrated method, for any data block to be processed, multi-dimensional compression-related features are extracted. Based on these features, the predicted compression ratio is determined. Then, based on the predicted compression ratio, the predicted uncompressed path time and the predicted compressed path time are determined. Finally, based on these times, the compression strategy is determined. And according to the compression strategies, each data block is transmitted via a secure channel. By performing multi-dimensional feature analysis on the data blocks during the compression decision-making process, the transmission processing time (i.e., uncompressed path prediction time and compressed path prediction time) for skipping or enabling compression is predicted for each block. The compression strategy is then determined based on the predicted transmission processing time, improving the reliability and rationality of the compression decision and enhancing transmission efficiency while ensuring secure encryption.

[0066] In some embodiments, where the compressibility score corresponding to the multi-dimensional compression-related features includes the historical behavior feature score, the historical behavior feature score is determined based on the historical compression ratio of the data stream of the target quintuple information; the target quintuple information is the quintuple information of the data block to be processed.

[0067] For example, considering that different data blocks in the same network data stream may have certain correlations in terms of data structure, the compression strategy of historical data blocks in the same data stream can be referenced when making compression decisions for data blocks.

[0068] Accordingly, the compressibility score corresponding to the aforementioned multi-dimensional compression-related features may include the historical behavior feature score.

[0069] For example, for any data block to be processed, the historical behavior feature score of the data block to be processed can be determined based on the historical compression ratio of the same data stream as the five-tuple information of the data block to be processed (which may be referred to as the target five-tuple information).

[0070] Furthermore, considering that even data blocks from the same network data stream may have weaker correlations in terms of data structure and other aspects as the time interval increases, the compression strategies for historical data blocks with longer time intervals are relatively less valuable for reference.

[0071] Accordingly, the historical behavioral feature score can be determined based on the historical compression ratio of the target quintuple information data stream in the following way:

[0072] Based on the target time difference, the time decay factor is determined; where the target time difference is the difference between the current system time and the time of the most recent data compression of the data stream of the recorded target quintuple information, and the value of the time decay factor is negatively correlated with the target time difference;

[0073] The historical behavior feature score is determined by multiplying the most recent actual compression ratio of the recorded target quintuple information data stream by the time decay factor.

[0074] It should be noted that in determining the historical behavior feature score, it is not limited to referring only to the most recent actual compression ratio of the target quintuple information data stream. It can also refer to the most recent actual compression ratios of the target quintuple information data stream. For example, the weighted sum of the most recent actual compression ratios of the target quintuple information data stream can be determined as the reference compression ratio, and the historical behavior feature score can be determined based on the determined reference compression ratio. In the process of determining the reference compression ratio, the weight of the historical actual compression ratio can be negatively correlated with the time interval, that is, the longer the time interval between the historical actual compression ratio and the current system, the lower its weight.

[0075] In some embodiments, determining the uncompressed path prediction time and compressed path prediction time corresponding to the data block to be processed based on the predicted compression ratio may include:

[0076] Using the first end-to-end latency model, based on the current system resource status and link bandwidth, the uncompressed path prediction time for the data block to be processed is determined; and,

[0077] Using the second end-to-end delay model, the compression path prediction time of the data block to be processed is determined based on the current system resource status and link bandwidth.

[0078] For example, in order to more accurately and efficiently determine the processing time of the data block to be processed under different compression strategies, end-to-end delay models for predicting the transmission processing time of the data block to be processed under different compression strategies can be pre-constructed. That is, an end-to-end delay model for predicting the transmission processing time of the data block to be processed under the case of skipping compression (which can be called the first end-to-end delay model) can be constructed, and an end-to-end delay model for predicting the transmission processing time of the data block to be processed under the case of enabling compression (which can be called the second end-to-end delay model) can be constructed.

[0079] The uncompressed path prediction time for the data block to be processed can be determined using the first end-to-end latency model, based on the current system resource status (such as hardware acceleration resource load, CPU load, etc.) and link bandwidth; and,

[0080] Using the second end-to-end delay model, the compression path prediction time of the data block to be processed is determined based on the current system resource status and link bandwidth.

[0081] For example, data compression and encryption (decompression and decompression) processes can be performed in parallel. That is, while encrypting data that has been compressed or whose compression strategy is to skip compression, uncompressed data whose compression strategy is to enable compression can be compressed in parallel. Similarly, while decompressing data that has been decrypted and whose compression strategy is to enable compression, data that has not yet been decrypted can be decrypted in parallel.

[0082] For example, for any data block to be processed, in the process of determining the compression path prediction time of the data block to be processed, the compression and encryption time of the data block to be processed can be the larger of the compression prediction time and the encryption prediction time of the data block to be processed, and the decryption and decompression prediction time of the data block to be processed can be the larger of the decryption prediction time and the decompression prediction time of the data block to be processed.

[0083] For example, during the process of negotiating and establishing a secure channel between the data sending device and the data receiving device, the data receiving device can notify the data sending device of relevant resource information (CPU resources, hardware acceleration resources, etc.) for decryption / decompression processing. Thus, the data sending device can estimate the predicted time for decryption processing of the data block to be processed, or estimate the predicted time for decryption and decompression of the data block to be processed, based on the relevant resource information for decryption / decompression processing of the data receiving device.

[0084] In one example, if the compression prediction time of the data block to be processed is greater than the encryption prediction time, the CPU resources allocated to the compression task will be increased and / or the CPU resources allocated to the encryption task will be reduced.

[0085] If the compression prediction time of the data block to be processed is less than the encryption prediction time, reduce the CPU resources allocated to the compression task and / or increase the CPU resources allocated to the encryption task.

[0086] The total CPU resources allocated to compression tasks and encryption tasks shall not exceed the total available CPU resources.

[0087] For example, in order to balance the resource utilization of encryption and compression and avoid the efficiency of encryption (or compression) being affected by compression (or encryption) processing becoming a bottleneck, the resource allocation of compression and encryption processing can be dynamically adjusted according to the system load.

[0088] For example, if the compression prediction time of the data block to be processed is greater than the encryption prediction time, the current compression processing resources may be insufficient. In this case, the CPU resources allocated to the compression task may be increased and / or the CPU resources allocated to the encryption task may be reduced.

[0089] Similarly, if the compression prediction time of the data block to be processed is less than the encryption prediction time, the CPU resources allocated to the compression task can be reduced and / or the CPU resources allocated to the encryption task can be increased.

[0090] For example, during the dynamic adjustment of CPU resources, the adjustment can be aimed at minimizing the larger of the compression prediction time and the encryption prediction time (i.e., the total time at one end of the pipeline). Specifically, the processing time after resource adjustment can be estimated based on a pre-determined mapping relationship between resources and performance, thereby predicting whether there will be any benefits.

[0091] For example, if the compression prediction time is greater than the encryption prediction time, meaning the compression stage is the current bottleneck, the compression prediction time can be reduced by increasing the CPU resources allocated to the compression task and decreasing the CPU resources allocated to the encryption task. Specifically, this can be achieved by increasing the priority of the compression task or decreasing the priority of the encryption task. Although the encryption prediction time may increase appropriately due to reduced resources, as long as the prediction results obtained through the mapping relationship indicate that the larger of the adjusted compression prediction time and the encryption prediction time is significantly reduced compared to the larger of the original compression prediction time, it is determined that the resource adjustment will bring performance benefits, and thus the resource adjustment will be executed.

[0092] For example, during the dynamic adjustment of CPU resources, the total amount of available CPU resources needs to be used as a constraint to ensure that the sum of the CPU resources allocated to the compression task and the CPU resources allocated to the encryption task does not exceed the total amount of available CPU resources.

[0093] In some embodiments, determining the compression strategy for the data block to be processed based on the uncompressed path prediction time and the compressed path prediction time may include:

[0094] The ratio of the uncompressed path prediction time to the compressed path prediction time is determined as the compression speedup ratio.

[0095] If the compression speedup ratio exceeds a preset threshold, the compression strategy for the data block to be processed is set to enable compression; where the preset threshold is greater than 1.

[0096] If the compression speedup does not exceed the preset threshold, the compression strategy for the data block to be processed is determined to be skip compression.

[0097] For example, for any data block to be processed, the compression benefit of the data block can be determined based on the ratio of the uncompressed path prediction time to the compressed path prediction time. This compression benefit can be used as a decision reference for compression strategies.

[0098] For example, for any data block to be processed, if the uncompressed path prediction time and the compressed path prediction time of the data block to be processed are determined, the ratio of the uncompressed path prediction time to the compressed path prediction time (which can be called the compression speedup ratio) can be compared with a preset threshold (the specific value can be set according to the actual scenario, and its value is greater than 1).

[0099] If the compression speedup ratio exceeds a preset threshold, it can be determined that the benefits (reduced processing time) of compressing the data block to be processed meet the conditions. In this case, it can be determined that the compression strategy for the data block to be processed is to enable compression.

[0100] If the compression speedup ratio does not exceed the preset threshold, it can be determined that the benefits of compressing the data block to be processed do not meet the conditions. In this case, it can be determined that the compression strategy for the data block to be processed is to skip compression.

[0101] In some embodiments, the above-mentioned transmission of each data block to be processed through a secure channel according to the compression strategy of each data block to be processed may include:

[0102] Traverse the first circular buffer in the shared memory; wherein, the first circular buffer is used to store the data blocks to be processed and the compression strategy of the data blocks to be processed;

[0103] For the data block to be processed in the first circular buffer that is currently being traversed, if the compression strategy of the data block to be processed is enabled, the data of the data block to be processed read from the first circular buffer is compressed and the compressed data is saved to the second circular buffer in the shared memory; if the compression strategy of the data block to be processed is skip compression, the data of the data block to be processed read from the first circular buffer is saved to the second circular buffer.

[0104] as well as,

[0105] Read the data from the second circular buffer, encrypt the data from the second circular buffer, and transmit the encrypted data through a secure channel.

[0106] For example, in order to improve data processing throughput and reduce data processing latency, data compression and encryption can be implemented based on a circular buffer.

[0107] For example, for the original data block to be processed, the data block to be processed and its compression strategy can be stored in a first circular buffer of shared memory. For example, each data packet in the data block to be processed can be stored in the first circular buffer, and each data packet has a compression selection header inserted into it. The compression selection header includes the compression strategy of the data packet (such as skip compression or enable compression).

[0108] The compression strategy for each data packet in the data block to be processed can be determined by traversing the first circular buffer in shared memory.

[0109] For example, for any data packet of the data block to be processed cached in the first circular buffer, if the compression policy in the compression selection header of the data packet is enabled, the data packet can be compressed and the compressed data packet can be saved to the second circular buffer in shared memory; if the compression policy in the compression selection header of the data packet is skip compression, the data packet does not need to be compressed and the data packet can be saved to the second circular buffer in shared memory.

[0110] For example, a circular buffer processes data according to read pointers and write pointers.

[0111] For example, while processing the data in the first circular buffer in the manner described above, the data in the second circular buffer can be processed in parallel.

[0112] It can read data from the second circular buffer, encrypt the data from the second circular buffer, and transmit the encrypted data through a secure channel.

[0113] In some embodiments, the above-mentioned transmission of each data block to be processed through a secure channel according to the compression strategy of each data block to be processed may include:

[0114] For any data packet in any block of data to be processed, the compression strategy of the data packet is determined according to the value of the compression enable flag in the compression selection header of the data packet; wherein, if the value of the compression enable flag is the first value, it indicates that the compression strategy is to skip compression; if the value of the compression enable flag is the second value, it indicates that the compression strategy is to enable compression.

[0115] If the compression strategy for this data packet is to skip compression, the data packet is transmitted encrypted through a secure channel.

[0116] If the compression policy for this data packet is enabled, the data packet is compressed and encrypted before transmission via a secure channel.

[0117] The compression selection header also includes a compression algorithm identifier field, which indicates the type of compression algorithm used.

[0118] For example, in order to more accurately determine the compression strategy of the data to be processed, a compression selection header can be added to each data packet in the data block to be processed. The compression selection header includes a compression enable flag to indicate the compression strategy.

[0119] For example, compression strategies may include skipping compression or enabling compression.

[0120] Among them, the compression strategy in the compression selection header of different data packets of the same data block to be processed is the same.

[0121] Accordingly, for any data packet in the data block to be processed, if the data packet needs to be transmitted through a secure channel, the compression strategy of the data packet can be determined according to the compression strategy in the compression selection header of the data packet. If the compression strategy of the data packet is to skip compression, the data packet can be encrypted and transmitted through a secure signal; if the compression strategy of the data packet is to enable compression, the data packet can be compressed and encrypted, and transmitted through a secure signal.

[0122] In one example, the secure channel compression transmission scheme provided in this application embodiment may further include:

[0123] The data stream to be transmitted is divided into continuous data blocks according to a preset time window or data size to obtain at least one data block to be processed.

[0124] The compression selection header is added to each data packet in each data block to be processed; wherein the initial value of the compression enable flag in the compression selection header is the first value;

[0125] After determining the compression strategy for the data block to be processed based on the compression speedup ratio, the following may also be included:

[0126] If it is determined that the compression strategy of the data block to be processed is enabled, the value of the compression enable flag in the compression selection header of each data packet in the data block to be processed is updated to the second value.

[0127] To enable those skilled in the art to better understand the technical solutions provided in the embodiments of this application, the technical solutions provided in the embodiments of this application are described below with reference to specific examples.

[0128] This embodiment proposes a secure channel compression transmission scheme. During the establishment of the encrypted channel, this scheme introduces a "compression selection header" field, supporting dynamic marking of whether compression is enabled on a data block basis. The sending end continuously monitors data stream characteristics and, combined with hardware acceleration resources and CPU resources, establishes a compression speedup model. Compression is enabled when the compression speedup is determined to be greater than a preset threshold.

[0129] In addition, the system adopts a shared memory pipeline architecture to achieve efficient parallel processing of modules such as compression, encryption, and transmission, which significantly improves the transmission efficiency of highly redundant data and avoids ineffective processing of low compressibility data.

[0130] Please see Figure 2This is a schematic diagram of the module division of a secure signal compression and transmission system architecture provided in an embodiment of this application, as shown below. Figure 2 As shown, the architecture of this secure signal compression transmission system may include:

[0131] The channel establishment and segmentation module is used to establish a secure communication tunnel between the two communicating parties that supports encryption and optional compression, and to divide the data stream to be transmitted into continuous data blocks according to a preset time window or data size, which serve as the basic unit for subsequent processing.

[0132] The Compression Selection Header (CSH) module is used to insert a Compression Selection Header (CSH) between the Secure Encapsulation Header and the Inner IP Header during the cryptographic encapsulation process of each data packet in each data block.

[0133] The feature extraction module is used to extract multidimensional compression-related features from the current data block.

[0134] The compression decision module is used to normalize and weightedly fuse the extracted multidimensional features to generate a comprehensive compressibility score, which is then mapped to a predicted compression ratio R. Combining the current compression / encryption throughput and link bandwidth, it models the uncompressed path prediction time t1 and the compressed path prediction time t2, calculates the compression speedup ratio η = t1 / t2, and decides to enable compression if η is greater than a preset threshold; otherwise, it decides to skip compression.

[0135] The resource scheduling module is used to dynamically adjust CPU computing resources based on the compression decision results and the current system load.

[0136] The compression and encryption pipeline module is used to complete data processing through a multi-threaded pipeline architecture in shared memory.

[0137] The historical status table update module is used to record the actual compression ratio after the data block processing is completed, and update the historical status table with a 5-tuple as the index.

[0138] For example, in addition to recording the actual compression ratio of historical data blocks, the historical status update module can also record information such as the actual compression algorithm used by the historical data blocks.

[0139] For example, an exponential decay weighted average mechanism is adopted to make recent performance have a greater impact on subsequent predictions, forming an adaptive feedback loop to continuously optimize and compress decision accuracy.

[0140] Please see Figure 3 This is a schematic diagram illustrating the implementation process of a secure channel compression transmission scheme provided in an embodiment of this application. Figure 3 As shown, the implementation process of this secure channel compressed transmission scheme may include:

[0141] 1. Establishment of secure tunnels and data segmentation.

[0142] For example, a secure communication tunnel (i.e., the aforementioned secure channel) supporting encryption and optional compression can be established between the two communicating parties. The secure communication protocol may include, but is not limited to, IKEv2 / IPSec, TLS, or other encapsulation protocols that support extended headers.

[0143] At the data sending end, the data stream to be transmitted can be divided into continuous data blocks according to a preset time window or data size, serving as the basic processing unit for compression decisions. Each data block is processed independently.

[0144] For example, suppose this is implemented on a VPP-based data plane platform, and the hardware environment includes servers that support QAT accelerator cards (i.e., hardware acceleration resources). The two communicating parties establish an IPSec tunnel via the IKEv2 protocol and use ESP encapsulation mode for secure transmission.

[0145] When a VPP instance is started on the sending end, its built-in IKEv2 plugin can be called to complete the IKE_SA_INIT and IKE_AUTH phases to negotiate with the receiving VPP instance, generating an encryption key, an integrity key, and a security association (SA). The negotiation algorithm suite includes AES-128-GCM encryption, SHA256 integrity verification, etc.

[0146] When the data stream to be transmitted is delivered to the VPP forwarding plane by the upper-layer application, it can be divided into data blocks of fixed duration according to a fixed time window, which can serve as the basic unit for subsequent compression decisions.

[0147] For example, each data block is processed independently and does not affect the others.

[0148] It should be noted that during the process of establishing a secure communication tunnel between the two communicating parties, the receiving end can also send relevant resource information for its own decryption / decompression processing to the sending end, so that the sending end can estimate the decryption processing time of the data block to be processed, or estimate the decryption and decompression processing time of the data block to be processed, based on the relevant resource information for decryption / decompression processing of the receiving end.

[0149] 2. Insert the compression selection header.

[0150] For example, during the encapsulation of each packet in each data block, a compression selection header, which is one byte or a combination of multiple bit fields, can be inserted between the security encapsulation header and the inner IP header.

[0151] For example, a compression selection header may include at least:

[0152] The compression enable flag indicates whether the data block has been compressed.

[0153] The compression algorithm identifier field indicates the type of compression algorithm used;

[0154] The remaining bits are reserved or used for future feature expansion.

[0155] Initially, the compression enable flag is set to "0", indicating that compression is not enabled by default.

[0156] Continuing with the previous example, when dealing with data blocks Before the data packet is encapsulated using IPSec, an 8-bit compressed selection header is inserted between the ESP (Encapsulating Security Payload) header (i.e., the security encapsulation header) and the inner IP header. Its field structure is as follows:

[0157]

[0158] In the initial state, the enable flag is set to "0" and the algorithm identifier field is cleared to zero, indicating that compression is not enabled by default for this data block.

[0159] This compression selection header will be copied to all IP packets corresponding to this data block, ensuring that the receiving end can parse the compression attribute from any single packet.

[0160] For example, the schematic diagrams of traditional IPSec data packets and data packets in the embodiments of this application can be respectively as follows: Figure 4A and Figure 4B As shown.

[0161] 3. Extract the multidimensional compression features of the data blocks.

[0162] For example, for the current data block to be processed, compressibility-related features can be extracted in the following multiple dimensions:

[0163] Information entropy feature: Calculate the Shannon entropy value of a data block to assess its information redundancy;

[0164] Repeating pattern characteristics: A lightweight string matching algorithm is used for fast pre-scanning to count the proportion of matching lengths or dictionary hit rate and generate a repeating pattern strength index.

[0165] Historical behavior characteristics: Query the historical state table indexed by the communication quintuple to obtain the historical compression performance of the data stream, and update the historical compression ratio based on the time decay mechanism.

[0166] The above features together form the basis for a comprehensive understanding of the compressibility of this data block.

[0167] Continuing with the previous example, we can work on the current data block. Perform the following three types of feature extraction operations:

[0168] 1) Information entropy feature calculation.

[0169] Compute data blocks Shannon entropy:

[0170]

[0171] Where C is the set of byte values ​​(0~255), and p(c) is the value of byte c in... The frequency of occurrence in the text. The lower the entropy value, the higher the redundancy, and the more suitable it is for compression.

[0172] in, As an information entropy score.

[0173] 2) Repetition pattern intensity index.

[0174] A lightweight LZ-type sliding window pre-scan is used to estimate the compression ratio, with a window size of 512 bytes and a forward lookup buffer length of 64 bytes. The total length of all matching segments is calculated. The ratio of the length of the data block to the total length L.

[0175]

[0176] M is used as the intensity score of the repetition pattern.

[0177] 3) Update historical behavioral characteristics.

[0178] The system maintains a hash table where the key is a traffic 5-tuple (source IP, destination IP, source port, destination port, protocol number), and the corresponding value includes: the most recent actual compression ratio. The most recent update timestamp .

[0179] After each data block is processed, if compression was enabled for that data block, the system records its actual compression ratio. With update timestamp ,in:

[0180]

[0181] When processing the current system time is T now In the case of a certain quintuple data stream, if there are no historical records, there are no historical behavior feature scores (the actual compression ratio of historical data blocks is 1 by default); if historical records exist, the time decay factor is calculated:

[0182]

[0183] Where λ>0, λ is the attenuation rate parameter, which can be set according to system load or experience (e.g., λ=10). -4 This indicates that the decay rate is approximately 63% every 10 seconds.

[0184] Based on the historical behavior characteristics of exponential decay, K = * .

[0185] K is used as a score for historical behavioral characteristics.

[0186] 4. Integrate features and predict compression gains to decide whether to compress.

[0187] For example, the features extracted in step 3 are normalized and converted into dimensionless sub-scores, and then a comprehensive compressibility score is generated by weighted fusion.

[0188] Based on this rating mapping, the predicted compression ratio R is obtained, which is the ratio of the compressed data size to the original size.

[0189] Based on the current system resource status (such as hardware acceleration resource load, CPU load, etc.) and link bandwidth, construct end-to-end delay models for the two transmission paths:

[0190] Uncompressed path prediction time t1: determined based on encryption processing time, transmission time, and decryption processing time;

[0191] The predicted compression path time t2 is determined based on the compression processing time, encryption processing time, compressed transmission time, decryption processing time, and decompression processing time.

[0192] Calculate the speedup ratio η = t1 / t2. If η is greater than a preset threshold, determine that enabling compression can bring net performance gains and decide to enable compression; otherwise, decide to skip compression.

[0193] Taking the previous example as an example, the three features mentioned above can be... M and K are normalized to dimensionless sub-scores And a comprehensive compressibility score is generated through weighted fusion:

[0194]

[0195] in, The weights are set based on system load or experience. .

[0196] Map the score S to the predicted compression ratio R:

[0197]

[0198] in, For example, if k=0.6, then when S=1, the predicted compression ratio R=0.4 (i.e., compressed to 40% of the original size).

[0199] Next, construct the end-to-end delay model for the two paths:

[0200] 1) Total time t1 for the uncompressed path:

[0201]

[0202] The time required for encryption L is the original data block size. This represents the current encrypted throughput.

[0203] Transmission time B represents the link bandwidth;

[0204] Decryption time , This represents the current decryption throughput.

[0205] 2) Total time t2 for compressed path:

[0206]

[0207] The time required for compression , To compress throughput;

[0208] Encryption time , This refers to the encrypted throughput after compression and encryption resource scheduling;

[0209] Transmission time ;

[0210] Decompression time , For decompression throughput;

[0211] Decryption time , This refers to the decompression throughput after resource scheduling for decompression and decryption.

[0212] It should be noted that, in the embodiments of this application, the pipeline warm-up time can be ignored. Compression and encryption are considered to be executed in parallel at the sending end in a pipelined manner, so the maximum value of the two processing times is taken; decryption and decompression are executed in parallel at the receiving end in a pipelined manner, and the maximum value of the two processing times is also taken.

[0213] Calculate the speedup ratio:

[0214]

[0215] like If (e.g., 1.1) it is determined that enabling compression can bring net performance gains, and the compression process is entered; otherwise, the compression process is skipped.

[0216] 5. Configure the compression selection header and schedule resources.

[0217] For example, if the decision is to enable compression, the compression selection header corresponding to the data block is updated: the compression enable flag is set to "1" and the code of the selected compression algorithm is entered in the algorithm identifier field.

[0218] In addition, based on the current system load, the CPU resources available for compression and encryption tasks are dynamically adjusted to ensure that the throughput of the two processing stages are matched as much as possible, so as to avoid either stage becoming a bottleneck in the processing pipeline. Among them, the compression and encryption functions in the hardware acceleration resources are independent and cannot be interchanged; CPU resources can be flexibly allocated between the two types of tasks.

[0219] Taking the previous example as an example, in In this case, the following operations can be performed:

[0220] 1) Update the compression selection header.

[0221] For example, the compression selection header corresponding to this data block can be:

[0222] The enable flag is set to "1";

[0223] The algorithm identifier field should be filled with the encoding of the corresponding compression algorithm;

[0224] The remaining bits are reserved.

[0225] It should be noted that the above settings will apply to all IP packets within the scope of this data block.

[0226] 2) Trigger the resource scheduling module.

[0227] For example, resource allocation can be dynamically adjusted based on the current system load:

[0228] like If compression becomes the bottleneck, then perform one or more of the following operations:

[0229] Increase the CPU resources (such as the number of CPU threads) allocated to the compression task.

[0230] Reduce the CPU resources used by encryption tasks.

[0231] Conversely, the opposite adjustment is made, and the same method can be used for dynamic resource adjustment during decryption and decompression at the receiving end.

[0232] The dynamic adjustment of resources must meet the following constraints:

[0233]

[0234] in, CPU resources allocated to compression / decompression tasks (compression at the sending end, decompression at the receiving end). CPU resources allocated for encryption / decryption tasks (encryption at the sending end, decryption at the receiving end). This represents the total available CPU processing power.

[0235] 6. Compression and encryption are processed collaboratively through a shared memory pipeline.

[0236] Data processing is performed using a multi-threaded pipeline architecture based on shared memory.

[0237] Write the raw data block (including the compression selection header) into the first circular buffer in shared memory;

[0238] Read data from the first circular buffer, determine whether to perform compression or skip compression based on the value of the compression enable flag in the compression selection header, and write the data to the second circular buffer in shared memory;

[0239] Data is read from the second circular buffer, securely encapsulated (including encryption and integrity protection), and then sent to the network.

[0240] Multithreading is decoupled through a shared memory buffer, supporting asynchronous parallel processing and reducing lock contention and memory copy overhead.

[0241] The receiving end executes the reverse process: first decrypts, then parses the compression selection header; if the flag bit is "1", the corresponding algorithm is called to decompress and finally restore the original data.

[0242] Using the previous example, a multi-threaded pipeline architecture based on shared memory is employed to perform data processing:

[0243] 1) Producer thread: processes the original data blocks Write to the first circular buffer in shared memory; where data blocks Each data packet has a compression selection header inserted;

[0244] 2) Compression thread: Reads data from the first circular buffer and determines whether to enable compression based on the compression selection header in the data packet:

[0245] When compression is enabled, hardware acceleration resources (such as QAT compression resources) and CPU resources are invoked to execute the specified compression algorithm, and the compressed data is written to the second circular buffer in shared memory.

[0246] If compression is skipped, the raw data is written to a second circular buffer in shared memory.

[0247] 3) Encryption thread: Reads data from the second circular buffer, calls hardware acceleration resources (such as QAT encryption / decryption resources) or CPU resources, performs AES-GCM encryption, and transmits it through a secure communication tunnel.

[0248] 7. Update the historical status table to support subsequent decision optimization.

[0249] For example, after the data block is transmitted, feedback information such as its actual compression ratio and compression time can be recorded, and the historical status table indexed by the 5-tuple can be updated.

[0250] For example, an exponential decay weighted average mechanism can be used during the update process, so that recent historical performance has a greater impact on subsequent prediction results, thereby forming an adaptive feedback loop that changes over time and continuously optimizes the accuracy of compression decisions for subsequent data blocks.

[0251] In this embodiment, the receiving end performs the reverse process:

[0252] 1) Receive IP packets, strip the outer IP, ESP header, and compression selection header, and complete the decryption;

[0253] 2) The compression selection header determines whether to decompress the decrypted data;

[0254] 3) If the enable flag is "1", then the corresponding algorithm will be called to decompress;

[0255] For example, if the enable flag is "0", meaning the sender does not compress the data packet, the data decompression process can be skipped.

[0256] 4) Send the raw data to the upper-layer protocol stack.

[0257] As can be seen, in this embodiment, by constructing an intelligent closed-loop mechanism of "perception-prediction-decision-execution-feedback," precise activation, efficient coordination, and resource adaptation of data compression in a secure encrypted channel are achieved. This significantly improves network transmission efficiency and system resource utilization while ensuring communication security. Its main beneficial effects include, but are not limited to, the following:

[0258] 1) Significantly improves the transmission performance of highly redundant data and avoids performance degradation caused by ineffective compression.

[0259] Specifically, by extracting multi-dimensional features such as Shannon entropy, lightweight LZ pre-scan hit rate, and historical compression performance in real time, a comprehensive compressibility score is constructed, and the size of the compressed data is predicted. Compression is enabled when it is predicted that compression will bring net performance gains (i.e., compression speedup η > threshold). This effectively avoids ineffective compression operations on low-entropy, encrypted, or already compressed data, which would either "make the data larger" or "increase overhead unnecessarily," thereby improving the overall system throughput and response speed.

[0260] 2) By using a shared memory pipeline architecture, compression and encryption can be performed in a highly efficient parallel manner, reducing processing latency.

[0261] Specifically, a shared-memory-based circular buffer multi-threaded pipeline architecture is adopted to decouple data writing, compression, and encryption stages, supporting asynchronous parallel processing. This architecture greatly reduces the overhead of memory copying, context switching, and lock contention in traditional serial processing, fully leveraging the parallel processing capabilities of multi-core CPUs and hardware accelerators. It is particularly suitable for high-performance data plane platforms, reducing end-to-end transmission latency.

[0262] 3) The dynamic resource scheduling mechanism ensures pipeline throughput matching and maximizes hardware utilization.

[0263] Specifically, by introducing a resource scheduling module, the number of CPU threads and hardware queue allocation for compression / encryption tasks are dynamically adjusted based on the compression decision results and the real-time system load. This mechanism ensures that the throughput capabilities of the two key stages of compression and encryption are always matched, preventing either stage from becoming a system bottleneck and improving hardware resource utilization.

[0264] 4) The compression selection header design achieves protocol compatibility and single packet parsing, ensuring deployment flexibility and robustness.

[0265] Specifically, a "compression selection header" is inserted into the standard protocol stack to achieve the following:

[0266] Each data block can independently decide whether to compress, without needing to pre-set for the entire connection;

[0267] It can be seamlessly integrated into existing network devices without modifying the underlying protocol specifications;

[0268] Even in scenarios involving packet loss or out-of-order delivery, the receiving end can still accurately restore the compression attributes from any data packet, ensuring the correctness of data decompression and the robustness of the system.

[0269] 5) Historical state table and exponential decay feedback mechanism enable adaptive decision-making for time-dependent evolution.

[0270] Specifically, a historical compression performance table is maintained using the communication quintuple as an index, and updated using an exponential decay weighted average mechanism. The performance of recent data streams has a greater impact on subsequent decisions, improving the accuracy of compression decisions and enabling the system to quickly adapt to dynamic changes in traffic patterns (such as switching from transmitting redundant logs to transmitting encrypted video streams).

[0271] 6. Dynamic speedup model and adaptive threshold mechanism to intelligently maximize performance gains.

[0272] Specifically, the compression speedup η model is not only based on the characteristics of the data block itself, but also dynamically integrates the current system resource status (compression / encryption throughput, link bandwidth, CPU load, etc.). This mechanism ensures that under any load condition, the compression decision aims to "maximize overall performance" rather than "simply pursue a high compression ratio," thereby improving transmission performance.

[0273] 7) It is compatible with mainstream compression algorithms and hardware acceleration platforms, and has wide applicability and scalability.

[0274] Specifically, this solution supports mainstream compression algorithms such as LZ4 and DEFLATE, and can be flexibly integrated with hardware accelerators. Its architecture is compatible with the standard IPSec / TLS protocol stack, and can be seamlessly applied to emerging network scenarios such as data center interconnection, SD-WAN, 5G slicing, and edge computing, providing key technical support for next-generation high-performance, intelligent, and secure network infrastructure.

[0275] The method provided in this application has been described above. The apparatus provided in this application is described below:

[0276] Please see Figure 5 This is a schematic diagram of the structure of a secure channel compression transmission device provided in an embodiment of this application, as shown below. Figure 5 As shown, the secure channel compression transmission device may include:

[0277] The extraction unit is used to extract the multi-dimensional compression-related features of any data block to be processed.

[0278] The first determining unit is used to determine the predicted compression ratio of the data block to be processed based on the multi-dimensional compression-related features.

[0279] The second determining unit is configured to determine the uncompressed path prediction time and the compressed path prediction time corresponding to the data block to be processed based on the predicted compression ratio; wherein, the uncompressed path prediction time is the predicted time for transmitting the data block to be processed through a secure channel when the compression processing of the data block to be processed is skipped; and the compressed path prediction time is the predicted time for transmitting the data block to be processed through a secure channel when the data block to be processed is compressed based on the predicted compression ratio.

[0280] A compression strategy decision unit is used to determine the compression strategy of the data block to be processed based on the predicted time of the uncompressed path and the predicted time of the compressed path; wherein, the compression strategy includes enabling compression or skipping compression;

[0281] The processing unit is used to transmit each data block to be processed through a secure channel according to the compression strategy of each data block to be processed.

[0282] For example, the specific implementation methods of secure channel compressed transmission by each functional unit in the secure channel compressed transmission device can be found in the relevant descriptions in the above method embodiments.

[0283] This application also provides an electronic device, including a processor and a memory, wherein the memory is used to store computer programs; and the processor is used to implement the secure channel compressed transmission method described above when executing the program stored in the memory.

[0284] Please see Figure 6 This is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of this application. The electronic device may include a processor 601 and a memory 602 storing machine-executable instructions. The processor 601 and the memory 602 can communicate via a system bus 603. Furthermore, by reading and executing the machine-executable instructions corresponding to the secure channel compression transmission logic in the memory 602, the processor 601 can execute the secure channel compression transmission method described above.

[0285] The memory 602 mentioned in this document can be any electronic, magnetic, optical, or other physical storage device that can contain or store information such as executable instructions, data, etc. For example, machine-readable storage media can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0286] In some embodiments, a machine-readable storage medium, such as Figure 6The memory 602 in the machine-readable storage medium stores machine-executable instructions, which, when executed by a processor, implement the secure channel compressed transmission method described above. For example, the machine-readable storage medium may be ROM, RAM, CD-ROM, magnetic tape, floppy disk, or optical data storage device.

[0287] This application also provides a computer program product that stores a computer program, and when a processor executes the computer program, it causes the processor to execute the secure channel compressed transmission method described above.

Claims

1. A secure channel compressed transmission method, applied to a data transmitting device, characterized in that, The method includes: For any data block to be processed, extract the multi-dimensional compression-related features of the data block to be processed; Based on the aforementioned multi-dimensional compression-related features, the predicted compression ratio of the data block to be processed is determined; Based on the predicted compression ratio, the predicted uncompressed path time and the predicted compressed path time for the data block to be processed are determined; wherein, the predicted uncompressed path time is the predicted time for transmitting the data block to be processed through a secure channel when the compression processing of the data block to be processed is skipped; the predicted compressed path time is the predicted time for transmitting the data block to be processed through a secure channel when the data block to be processed is compressed according to the predicted compression ratio. Based on the predicted time of the uncompressed path and the predicted time of the compressed path, a compression strategy for the data block to be processed is determined; wherein, the compression strategy includes enabling compression or skipping compression; Based on the compression strategy of each data block to be processed, each data block to be processed is transmitted through a secure channel. The step of determining the compression strategy for the data block to be processed based on the uncompressed path prediction time and the compressed path prediction time includes: The ratio of the uncompressed path prediction time to the compressed path prediction time is determined as the compression speedup ratio. If the compression speedup ratio exceeds a preset threshold, the compression strategy for the data block to be processed is determined to be enabled; wherein the preset threshold is greater than 1. If the compression speedup does not exceed the preset threshold, the compression strategy for the data block to be processed is determined to be skip compression.

2. The method according to claim 1, characterized in that, Determining the predicted compression ratio of the data block to be processed based on the multi-dimensional compression-related features includes: Determine the compressibility score corresponding to each dimension of compression-related features; Based on the compressibility scores of each dimension, determine the comprehensive compressibility score of the data block to be processed; The overall compressibility score is mapped to the predicted compression ratio.

3. The method according to claim 2, characterized in that, When the compressibility score corresponding to the multi-dimensional compression-related features includes a historical behavior feature score, the historical behavior feature score is determined based on the historical compression ratio of the data stream of the target quintuple information; the target quintuple information is the quintuple information of the data block to be processed. The historical behavioral feature score is determined based on the historical compression ratio of the target quintuple information data stream using the following method: Based on the target time difference, a time decay factor is determined; wherein, the target time difference is the difference between the current system time and the time when the data stream of the recorded target quintuple information was last compressed, and the value of the time decay factor is negatively correlated with the target time difference; The historical behavior feature score is determined by multiplying the most recent actual compression ratio of the recorded target quintuple information data stream by the time decay factor.

4. The method according to claim 1, characterized in that, The step of determining the uncompressed path prediction time and compressed path prediction time corresponding to the data block to be processed based on the predicted compression ratio includes: Using the first end-to-end latency model, based on the current system resource status and link bandwidth, the uncompressed path prediction time for the data block to be processed is determined; and, Using the second end-to-end delay model, the compression path prediction time of the data block to be processed is determined based on the current system resource status and link bandwidth. The uncompressed path prediction time includes the encryption processing prediction time, the transmission processing prediction time, and the decryption processing prediction time. The predicted time for the compression path includes the predicted time for compression and encryption, the predicted time for transmission processing, and the predicted time for decryption and decompression. Wherein, the compression and encryption time of the data block to be processed is the larger of the compression prediction time and the encryption prediction time of the data block to be processed, and the decryption and decompression prediction time of the data block to be processed is the larger of the decryption prediction time and the decompression prediction time of the data block to be processed.

5. The method according to claim 4, characterized in that, The method further includes: if the compression prediction time of the data block to be processed is greater than the encryption prediction time, increasing the CPU resources allocated to the compression task and / or decreasing the CPU resources allocated to the encryption task. If the compression prediction time of the data block to be processed is less than the encryption prediction time, reduce the CPU resources allocated to the compression task and / or increase the CPU resources allocated to the encryption task. The total CPU resources allocated to compression tasks and encryption tasks shall not exceed the total available CPU resources.

6. The method according to claim 1, characterized in that, The step of transmitting each data block to be processed through a secure channel according to the compression strategy of each data block to be processed includes: Traverse the first circular buffer in the shared memory; wherein the first circular buffer is used to store the data block to be processed and the compression strategy of the data block to be processed; For the data block to be processed in the first circular buffer that is currently being traversed, if the compression strategy of the data block to be processed is enabled, the data of the data block to be processed read from the first circular buffer is compressed and the compressed data is saved to the second circular buffer in the shared memory; if the compression strategy of the data block to be processed is skip compression, the data of the data block to be processed read from the first circular buffer is saved to the second circular buffer. as well as, Read the data from the second circular buffer, encrypt the data from the second circular buffer, and transmit the encrypted data through a secure channel.

7. The method according to claim 1, characterized in that, The step of transmitting each data block to be processed through a secure channel according to the compression strategy of each data block to be processed includes: For any data packet of any data block to be processed, the compression strategy of the data packet is determined according to the value of the compression enable flag in the compression selection header of the data packet; wherein, if the value of the compression enable flag is the first value, it indicates that the compression strategy is to skip compression; if the value of the compression enable flag is the second value, it indicates that the compression strategy is to enable compression. If the compression strategy for this data packet is to skip compression, the data packet is transmitted encrypted through a secure channel. If the compression policy for this data packet is enabled, the data packet is compressed and encrypted before transmission via a secure channel. The compression selection header further includes a compression algorithm identifier field, which indicates the type of compression algorithm used.

8. The method according to claim 7, characterized in that, The method further includes: The data stream to be transmitted is divided into continuous data blocks according to a preset time window or data size to obtain at least one data block to be processed. The compression selection header is added to each data packet in each data block to be processed; wherein the initial value of the compression enable flag in the compression selection header is the first value; After determining the compression strategy for the data block to be processed based on the compression speedup ratio, the method further includes: If it is determined that the compression strategy of the data block to be processed is enabled, the value of the compression enable flag in the compression selection header of each data packet in the data block to be processed is updated to the second value.

9. A secure channel compression transmission device, deployed at a data transmitting end device, characterized in that, The device includes: The extraction unit is used to extract the multi-dimensional compression-related features of any data block to be processed. The first determining unit is used to determine the predicted compression ratio of the data block to be processed based on the multi-dimensional compression-related features. The second determining unit is configured to determine the uncompressed path prediction time and the compressed path prediction time corresponding to the data block to be processed based on the predicted compression ratio; wherein, the uncompressed path prediction time is the predicted time for transmitting the data block to be processed through a secure channel when the compression processing of the data block to be processed is skipped; and the compressed path prediction time is the predicted time for transmitting the data block to be processed through a secure channel when the data block to be processed is compressed based on the predicted compression ratio. A compression strategy decision unit is used to determine the compression strategy of the data block to be processed based on the predicted time of the uncompressed path and the predicted time of the compressed path; wherein, the compression strategy includes enabling compression or skipping compression; The processing unit is used to transmit each data block to be processed through a secure channel according to the compression strategy of each data block to be processed. The compression strategy decision unit determines the compression strategy for the data block to be processed based on the uncompressed path prediction time and the compressed path prediction time, including: The ratio of the uncompressed path prediction time to the compressed path prediction time is determined as the compression speedup ratio. If the compression speedup ratio exceeds a preset threshold, the compression strategy for the data block to be processed is determined to be enabled; wherein the preset threshold is greater than 1. If the compression speedup does not exceed the preset threshold, the compression strategy for the data block to be processed is determined to be skip compression.

10. An electronic device, characterized in that, Including processor and memory, among which, Memory, used to store computer programs; A processor, when executing a program stored in memory, implements the method described in any one of claims 1-8.

Images