Secure data transmission system based on dynamic encryption authentication

Abstract

According to the secure data transmission system based on dynamic encryption authentication provided by the invention, a trust root which cannot be tampered is established for the whole system through the hardware password module, and continuous derivation and rotation of a session key are realized by the dynamic key management module on the basis, so that the security risk caused by long-term use of a static key is effectively solved. And the secure communication gateway module executes bidirectional authentication and anti-hijacking challenge response by using a dynamic key, so that the real-time credibility and session continuity of the communication process are ensured. And the strategy control engine uniformly coordinates the behaviors of key management and the communication gateway by receiving and compiling the declarative strategy, so that flexible deployment and centralized management and control of the security strategy are realized. According to the system, a cryptographic basis, a dynamic strategy, real-time monitoring and automatic response are deeply fused, a self-adaptive and automatic deep defense system with the capability of continuously resisting advanced threats is constructed, and the overall safety level and the operation efficiency of data transmission are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of communication and information security technology, and in particular to a secure data transmission system based on dynamic encryption authentication. Background Technology

[0002] Existing secure communication systems, such as TLS protocols based on fixed certificates or static key systems, have several inherent flaws. First, the root of trust is usually based on certificates stored in software, and the private key is at risk of being extracted. Second, session keys often remain unchanged for a long time or have long update cycles, lacking forward security, and once the key is leaked, a large number of historical communications may be decrypted. Third, the authentication and encryption processes are isolated from business logic and security operations, forming "static silos" that cannot cope with advanced persistent threats. Summary of the Invention

[0003] In view of this, the present invention provides a secure data transmission system based on dynamic encryption authentication to solve the technical defects existing in the prior art.

[0004] Specifically, the present invention provides a secure data transmission system based on dynamic encryption authentication, including a hardware cryptography module, a dynamic key management module, a secure communication gateway module, a policy control engine, and a security operation and analysis module; The hardware cryptographic module is used to generate and securely store asymmetric root key pairs, and performs all cryptographic operations based on the root key pairs within it; The dynamic key management module is connected to the hardware cryptography module and is used to receive temporary key seeds through a secure channel established based on the root key pair, and to derive and rotate session keys based on the temporary key seeds and session states. The secure communication gateway module connects to the dynamic key management module and is used to perform two-way authentication, anti-hijacking challenge-response, and intelligent compression and encryption of business workloads using session keys; The policy control engine is connected to the dynamic key management module and the secure communication gateway module respectively. It is used to receive declarative policies, compile the declarative policies into configuration instructions and send them to the dynamic key management module and the secure communication gateway module to control their behavior. The security operations and analysis module connects to the security communication gateway module and the policy control engine. It is used to collect logs and event data from the security communication gateway module, perform asset mapping, risk perception, security analysis and threat detection, and trigger automated response actions through the policy control engine when a threat is detected, thereby forming a closed loop of security operations.

[0005] In some implementations, the hardware cryptographic module is also used to generate a physically unclonable function response in each power-on cycle and bind the physically unclonable function response to the root key pair.

[0006] In some implementations, the key rotation strategy in the dynamic key management module adopts a dual threshold triggering mechanism of time threshold and data volume threshold.

[0007] In some implementations, the anti-hijacking challenge-response performed by the secure communication gateway module specifically involves sending a cryptographic random number as a challenge to the communication peer after the session key is rotated, and verifying the message authentication code generated by the communication peer using the newly rotated session key against the cryptographic random number.

[0008] In some implementations, the policy control engine receives declarative policies as rule sets in YAML format.

[0009] In some implementations, the security operations and analysis module uses the isolated forest algorithm to detect point anomalies in the collected log data and a long short-term memory neural network model to identify latent attack behaviors in time series data.

[0010] In some implementations, the security operations and analysis module executes predefined handling scripts when an automated response action is triggered. These handling scripts include issuing access control rules on network devices via application programming interfaces, sending certificate revocation instructions to key management facilities, and creating security incident tickets in the ticketing system.

[0011] In some implementations, when verifying the message authentication code, the secure communication gateway module performs verification by comparing a calculated verification decision value with a verification decision threshold dynamically set by the policy control engine based on device type and network risk. The formula for calculating the verification decision value includes:

[0012] Where V represents the verification decision value; N represents the number of consecutive historical verifications used for decision-making, which is a positive integer whose value is specified by the policy issued by the policy control engine; The message authentication code matching score calculated during the i-th historical verification process is a dimensionless value between zero and one, which is obtained by comparing the authentication code calculated in this verification with the received authentication code bit by bit. Represents N historical verifications The arithmetic mean of the scores; λ represents the dynamic security adjustment coefficient, a dimensionless adjustment parameter greater than zero, whose value is dynamically calculated and distributed by the security operations and analysis module based on the global threat level; The weight of historical behavior anomalies is a dimensionless positive real number, set by the policy control engine based on the device trust level; M represents the total number of data packets exchanged during the challenge-response process, a positive integer, calculated by the secure communication gateway module when the session is established. This represents the challenge value of the j-th data packet, in bytes, which is the length of the cryptographic random number. This represents the expected response value of the j-th data packet, in bytes, and is pre-calculated by the secure communication gateway module based on the session key and algorithm type. It represents a very small positive number, measured in bytes, and is used to prevent the denominator from being zero. This represents the weight of the communication anomaly. It is a dimensionless positive real number that is set by the policy control engine based on the real-time network load.

[0013] In some implementations, the formula for calculating the dynamic safety adjustment factor includes:

[0014] in, This represents the dynamic safety adjustment coefficient, which is a dimensionless adjustment parameter greater than zero. This represents the fundamental safety constant, which is a dimensionless constant greater than zero. The external threat amplification factor is a dimensionless constant greater than zero, used to adjust the contribution of external threat intelligence to the coefficient; P represents the number of currently active threat intelligence sources, a positive integer, which is obtained and counted by the security operations and analysis module from the external threat intelligence platform. The confidence weight of the k-th threat intelligence source is a dimensionless value between zero and one, which is obtained by the security operations and analysis module based on the historical accuracy of the source. This represents the number of relevant threat events reported by the kth threat intelligence source, and is a non-negative integer, collected in real time by the security operations and analysis module. The internal risk amplification factor is a dimensionless constant greater than zero, used to adjust the contribution of internal asset risk dispersion in the coefficient; Q represents the number of monitored internal assets, a positive integer, which is discovered and counted by the asset mapping function of the security operation and analysis module. This represents the real-time risk score of the l-th internal asset, which is a non-negative real number calculated by the security operations and analysis module based on the severity of the asset's vulnerabilities and its network exposure surface. This represents the arithmetic mean of the R_l risk scores for all Q assets; Represents all Q assets Standard deviation of risk scores; It represents a very small positive number, used to prevent the denominator from being zero.

[0015] In some implementations, the dynamic key management module uses a key derivation chain mode for key rotation, that is, using the current session key to encrypt the negotiation parameters of the next session key.

[0016] At least one embodiment of this invention establishes an immutable root of trust for the entire system through a hardware cryptographic module. Based on this, a dynamic key management module continuously generates and rotates session keys, effectively addressing the security risks associated with the long-term use of static keys. The secure communication gateway module utilizes dynamic keys to perform two-way authentication and anti-hijacking challenge response, ensuring real-time reliability and session continuity during communication. The policy control engine receives and compiles declarative policies, unifying and coordinating the behavior of key management and the communication gateway, enabling flexible deployment and centralized control of security policies. Finally, the security operations and analysis module collects end-to-end data for in-depth security analysis and automated response, forming a complete operational closed loop from threat perception and risk detection to response. This system deeply integrates cryptographic fundamentals, dynamic policies, real-time monitoring, and automated response, constructing an adaptive, automated, and continuously advanced threat-resistant defense-in-depth system, significantly improving the overall security level and operational efficiency of data transmission. Attached Figure Description

[0017] Figure 1 This is a structural block diagram of a secure data transmission system based on dynamic encryption authentication provided by the present invention. Detailed Implementation

[0018] Many specific details are set forth in the following description to provide a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this specification. Therefore, this specification is not limited to the specific implementations disclosed below.

[0019] The terminology used in one or more embodiments of this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the one or more embodiments of this specification. The singular forms “a” and “the” as used in one or more embodiments of this specification and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items. The modifications “a” and “a plurality” as used in this disclosure are illustrative and not restrictive, and those skilled in the art will understand that they should be understood as “one or more” unless the context clearly indicates otherwise.

[0020] It should be understood that although the terms first, second, etc., may be used to describe various information in one or more embodiments of this specification, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, first may also be referred to as second without departing from the scope of one or more embodiments of this specification, and similarly, second may also be referred to as first. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to a determination."

[0021] See Figure 1 , Figure 1 This diagram illustrates a structural block diagram of a secure data transmission system based on dynamic encryption authentication, according to some embodiments of this specification. The system includes: a hardware cryptographic module, a dynamic key management module, a secure communication gateway module, a policy control engine, and a security operation and analysis module. The hardware cryptographic module generates and securely stores asymmetric root key pairs and performs all cryptographic operations based on these root key pairs internally. The dynamic key management module is connected to the hardware cryptographic module and receives temporary key seeds through a secure channel established based on the root key pairs, and derives and rounds session keys based on the temporary key seeds and session states. The secure communication gateway module is connected to the dynamic key management module. The policy control engine is used to perform two-way authentication, anti-hijacking challenge-response, and intelligent compression and encryption of business load using the session key. It is connected to both the dynamic key management module and the secure communication gateway module, and receives declarative policies, compiles these policies into configuration instructions, and sends them to both modules to control their behavior. The security operation and analysis module is connected to both the secure communication gateway module and the policy control engine, and collects logs and event data from the secure communication gateway module. It performs asset mapping, risk perception, security analysis, and threat detection, and triggers automated response actions through the policy control engine when a threat is detected, thus forming a closed loop of security operation.

[0022] A hardware cryptographic module can refer to a dedicated hardware device that provides cryptographic operations and securely stores the root key. For example, it might generate an RSA asymmetric root key pair within a secure chip, with all cryptographic operations performed in a hardware-isolated environment, establishing an immutable cryptographic trust foundation for the entire system. An asymmetric root key pair can refer to a combination of cryptographic keys containing a public and a private key, such as a public-private key pair generated using the Elliptic Curve Cryptography (ECC) algorithm. The private key never leaves the hardware cryptographic module and is used to establish secure channels and verify digital signatures. A secure channel can refer to a cryptographically protected communication link, such as establishing a TLS (Transport Layer Security) connection through asymmetric encryption, ensuring the confidentiality and integrity of the temporary key seed during transmission.

[0023] The dynamic key management module can refer to the functional unit responsible for generating, distributing, and rotating session keys. For example, it obtains a temporary key seed through a secure channel established based on the root key and derives the command session key using the KDF algorithm in conjunction with session state parameters, enabling periodic updates of key materials to enhance forward security. The temporary key seed can refer to a random initial value used to derive the session key, such as a 256-bit true random number generated by the hardware cryptographic module, transmitted to the dynamic key management module through a secure channel as the primary input material for the key derivation function. The session state can refer to a dynamic dataset recording the characteristic parameters of the current communication session, such as metadata including session identifiers, timestamps, and the amount of data transmitted, used as additional input to the key derivation function to ensure key uniqueness. The session key can refer to a symmetric key used for encrypting data in a single session, such as an encryption key implemented using the AES-256 algorithm, derived by the dynamic key management module based on the key seed and session state, specifically for data protection in this communication session.

[0024] A secure communication gateway module refers to a network device deployed at the network boundary that executes secure communication protocols. For example, it uses session keys for two-way authentication, implements anti-hijacking challenge-response mechanisms, and intelligently compresses and encrypts the business load, simultaneously ensuring the authenticity of the communicating entities' identities and data transmission efficiency. Two-way authentication refers to the secure process of mutual identity verification between communicating parties. For example, using a certificate-based TLS two-way authentication protocol, the communication gateway exchanges digital certificates with the peer device and verifies signatures to ensure the legitimacy and authenticity of both parties' identities. Anti-hijacking challenge-response refers to a security mechanism to defend against session hijacking attacks. For example, the gateway sends a cryptographic random number challenge to the peer and verifies the MAC message authentication code generated using the correct session key, effectively preventing attackers from hijacking the communication session during key rotation intervals. Business load refers to the actual application data that needs to be transmitted over the network, such as data packets containing valid information like user transaction records or sensor readings. After intelligent compression and encryption, it is transmitted over the network, ensuring both security and improving bandwidth utilization. Intelligent compression and encryption can refer to the process of compressing data first and then encrypting it. For example, business data can be compressed first using the DEFLATE algorithm and then encrypted using AES-GCM mode with a session key, which can reduce the data size while ensuring confidentiality.

[0025] A policy control engine can refer to a policy translator that converts high-level security policies into executable instructions. For example, it receives declarative policies in YAML format and compiles them into specific configuration parameters for each module, enabling unified management and dynamic implementation of security policies. Declarative policies can refer to high-level policy rules describing security requirements, such as access control policies and data protection policies defined in YAML. These are received and parsed by the policy control engine, allowing security administrators to define system security behaviors in an abstract way. Configuration instructions can refer to specific parameter settings for controlling module operation, such as operational parameters including key rotation cycles and authentication timeouts. These are compiled and generated by the policy control engine and distributed to each module for precise control of their operational behavior.

[0026] The security operations and analysis module can refer to an operations center that integrates security monitoring, analysis, and response functions. For example, it collects gateway log data via the Syslog protocol, performs automatic asset discovery, risk scoring, and LSTM (Long Short-Term Memory) network attack detection, forming a closed-loop security operations system from threat awareness to automatic response. Log and event data refers to security information recording the system's operational status, such as structured data including user login records, key operation logs, and network connection events. This data is continuously collected and stored by the security operations module, providing a data foundation for security analysis and auditing. Asset mapping refers to the process of discovering and identifying network assets. For example, it involves proactively discovering online devices and identifying their operating systems and service information using NMAP network scanning tools to build a complete asset inventory and topology diagram. Risk awareness refers to the ability to assess the system's security risk level. For example, it involves calculating asset risk values ​​by combining vulnerability scan results and threat intelligence, dynamically understanding the overall security posture and weaknesses of the system. Security analysis refers to techniques for in-depth analysis of security data. For example, it involves using machine learning algorithms to identify abnormal patterns in log data, discovering potential attack clues from massive amounts of security events. Threat detection refers to technical means of identifying security threats, such as using rule engines to match known attack characteristics and behavioral patterns to promptly detect malicious activities and security incidents in the system. Automated response actions refer to automated handling measures for security incidents, such as predefined operations like automatically isolating infected hosts or revoking compromised certificates. These actions are triggered by the security operations module when a threat is detected, quickly curbing the spread of security incidents. The closed loop of security operations refers to a complete security management cycle, such as a continuous improvement cycle including monitoring, analysis, response, and optimization. Through the collaboration of various modules, a complete link from threat discovery to handling is achieved, improving the overall security operation and maintenance efficiency of the system.

[0027] As a concrete example: In a financial transaction scenario, the hardware cryptography module first generates an RSA-2048 root key pair within the security chip; the dynamic key management module obtains a temporary seed through a TLS secure channel, and combines it with the session ID to rotate the AES-256 session key every 100MB of data transmitted or every hour using the HMAC-SHA256 algorithm; after the key rotation, the secure communication gateway sends a 16-byte random number challenge to the POS terminal to verify the SHA-256 message authentication code returned by the terminal; the policy control engine compiles the "transaction data requires dual authentication" YAML policy into the gateway configuration; the security operations module collects network traffic through the SNMP protocol, uses the isolated forest algorithm to detect abnormal transactions, and automatically triggers firewall rule updates.

[0028] The present invention will be further described below through a detailed embodiment: The beneficial effects of one of the embodiments in this specification include at least the following: A hardware cryptographic module establishes an immutable root of trust for the entire system, and on this basis, a dynamic key management module enables continuous derivation and rotation of session keys, effectively solving the security risks associated with the long-term use of static keys. The secure communication gateway module utilizes dynamic keys to perform two-way authentication and anti-hijacking challenge response, ensuring real-time trustworthiness and session continuity during communication. The policy control engine receives and compiles declarative policies, uniformly coordinating the behavior of key management and communication gateways, achieving flexible deployment and centralized control of security policies. Finally, the security operation and analysis module collects end-to-end data, performs in-depth security analysis and automated response, forming a complete operational closed loop from threat perception, risk detection, and response. This system deeply integrates cryptographic foundations, dynamic policies, real-time monitoring, and automatic response, constructing an adaptive, automated, and continuously advanced threat-resistant defense-in-depth system, significantly improving the overall security level and operational efficiency of data transmission.

[0029] In some implementations, the hardware cryptographic module is also used to generate a physically unclonable function response in each power-on cycle and bind the physically unclonable function response to the root key pair.

[0030] The power-on cycle refers to the complete process of a hardware device going from a power-off state to power-on and initialization, such as the timing phase from power-on until the chip completes its self-test and outputs a ready signal, serving as the timing reference for triggering physically unclonable functional responses. A physically unclonable functional response can refer to an unclonable digital fingerprint generated based on the physical characteristics of the hardware, such as generating a unique binary response code by measuring the frequency offset of a ring oscillator inside the chip, which can build the physical basis for device authentication. A root key pair refers to the asymmetric key combination at the highest level in a cryptographic system, such as a public-private key pair generated using the RSA-2048 algorithm, where the private key is permanently stored within the hardware cryptographic module and used to establish the cryptographic trust chain of the entire system. Binding refers to the technical operation of establishing an inseparable association between two entities, such as using a key derivation function to mix the physically unclonable functional response as an input parameter with the root key seed, which can create a strong association between the key material and a specific hardware device.

[0031] In some implementations, the key rotation strategy in the dynamic key management module adopts a dual threshold triggering mechanism of time threshold and data volume threshold.

[0032] Key rotation strategies can refer to security policies that define key replacement rules. For example, using a dual-threshold condition based on time interval and data transmission volume as a trigger mechanism can balance key usage efficiency and security requirements. A time threshold can refer to a preset time period trigger condition, such as setting a time limit for forcibly replacing the session key after one hour of continuous use, to prevent the key from becoming more vulnerable to cracking due to prolonged use. A data volume threshold can refer to a preset data transmission volume trigger condition, such as setting a data volume limit for immediate rotation after encrypting and transmitting 100 megabytes of data with a single key, effectively limiting the total amount of data exposed by a single key. A dual-threshold trigger mechanism can refer to a collaborative triggering mode based on both time and data volume parameters. For example, when either the session duration or the amount of encrypted data reaches a set limit, the key update process is immediately initiated, establishing a multi-dimensional key update judgment standard.

[0033] As a specific example: In the scenario of encrypted transmission of video surveillance data, the dynamic key management module monitors the usage of session keys. When the session duration reaches the 1-hour time threshold or the amount of encrypted transmitted data reaches the 500MB data volume threshold, the module immediately generates a new session key through the HKDF key derivation function and distributes it to the camera terminal and storage server through a secure channel to achieve seamless key rotation.

[0034] By triggering key updates through the combined effects of time and data volume, a more comprehensive key lifecycle protection mechanism is established, which prevents keys from being brute-forced due to long-term use and avoids the accumulation of risks caused by encrypting large amounts of data with the same key.

[0035] In some implementations, the anti-hijacking challenge-response performed by the secure communication gateway module specifically involves sending a cryptographic random number as a challenge to the communication peer after the session key is rotated, and verifying the message authentication code generated by the communication peer using the newly rotated session key against the cryptographic random number.

[0036] Session key rotation can be a secure process for periodically changing the key used in an encrypted session. For example, it can trigger key updates and notify the communication peer based on time or data volume thresholds, reducing key exposure time and the risk of cracking. The communication peer can refer to the remote device entity that establishes a secure communication connection, such as a client or server establishing a TLS connection with a gateway, serving as the verification object in a challenge-response mechanism. Cryptographic random numbers can refer to randomly generated values ​​that conform to cryptographic security standards, such as a 128-bit random sequence generated using a CSPRNG cryptographically secure pseudo-random number generator, serving as an unpredictable challenge credential in the challenge-response mechanism. Message authentication codes can refer to cryptographic tags that verify message integrity and authenticity, such as authentication codes calculated using the HMAC-SHA256 algorithm based on the cryptographic random number of the new rotation session key pair, used to prove that the communication peer correctly holds the new key. The newly rotated session key can refer to the currently valid encryption key that has just been updated, such as an AES-256 symmetric encryption key generated from the master key material through a key derivation function, serving as the cryptographic basis for generating message authentication codes.

[0037] As a concrete example: In an IoT device communication scenario, after completing the session key rotation, the secure communication gateway sends a 16-byte cryptographic random number generated by a hardware random number generator to the smart sensor as a challenge. The sensor uses the newly rotated AES-256 session key to calculate the message authentication code using the CMAC algorithm and returns it. After the gateway verifies that the authentication code matches, it confirms that the session has not been hijacked.

[0038] By performing challenge-response verification immediately after each key rotation, it effectively detects and prevents session hijacking attacks launched by attackers during key update intervals, ensuring that both communicating parties always maintain key synchronization and a secure connection.

[0039] In some implementations, the policy control engine receives declarative policies as rule sets in YAML format.

[0040] Declarative policies can refer to a high-level set of rules describing the expected security state of a system. For example, a policy file using YAML to define data encryption strength and access control requirements allows administrators to define security needs in an abstract way. YAML format can refer to a human-readable data serialization standard, such as a text format using indentation and colon key-value pairs to represent hierarchical structures, serving as a standardized description language for declarative policies. A rule set can refer to a collection of multiple policy rules, such as a policy combination containing key management rules, access control rules, and auditing rules, used to comprehensively define the system's security control requirements.

[0041] As a concrete example: In a cloud computing multi-tenant environment, the policy control engine receives a YAML-formatted declarative policy describing "financial data processing must use AES-256 encryption and the key must be rotated every hour". The parser compiles this into the key lifecycle configuration of the dynamic key management module and the encryption algorithm configuration of the secure communication gateway module, and distributes it to the corresponding modules for execution via the RESTful API.

[0042] By using the standardized YAML format to describe complex security policies, the readability and maintainability of the policies are greatly improved. At the same time, the policy compilation and automatic distribution mechanism enables accurate and rapid deployment of security policies, reducing the risk of manual configuration errors.

[0043] In some implementations, the security operations and analysis module uses the isolated forest algorithm to detect point anomalies in the collected log data and a long short-term memory neural network model to identify latent attack behaviors in time series data.

[0044] Isolation forest algorithms can refer to a tree-structure-based machine learning method for anomaly detection. For example, it constructs a set of isolated trees by randomly selecting features and partition values ​​to detect anomalies, used for quickly identifying rare abnormal behaviors in log data. Point anomaly detection refers to techniques for identifying single anomalies in a dataset that significantly deviate from normal patterns. For example, it detects anomalous events by calculating anomaly scores for data points and comparing them to thresholds, used for timely detection of sudden security threats in the system. Time series data refers to sequences of observations arranged chronologically, such as time-series records containing hourly network connection counts and daily authentication failures, serving as foundational data for identifying latent attack behaviors. Latent attack behavior identification refers to techniques for detecting slow attack patterns hidden within normal network activity. For example, it discovers advanced persistent threats by analyzing long-term behavioral pattern changes, used to detect covert attacks that are difficult to detect using traditional methods.

[0045] As a concrete example: In the network security monitoring of financial institutions, the security operations and analysis module collects firewall and server logs through the Syslog protocol, uses the isolated forest algorithm to perform point anomaly detection on real-time login events to discover brute-force attacks, and uses the LSTM model to analyze daily network traffic time series data to identify latent attack behaviors such as data leakage.

[0046] By combining the rapid anomaly detection of the Isolation Forest algorithm with the deep analysis of long-term time-series patterns using the LSTM neural network, dual coverage of immediate security threats and covert advanced attacks is achieved, significantly improving the comprehensive detection capability of complex attack chains.

[0047] In some implementations, the security operations and analysis module executes predefined handling scripts when an automated response action is triggered. These handling scripts include issuing access control rules on network devices via application programming interfaces, sending certificate revocation instructions to key management facilities, and creating security incident tickets in the ticketing system.

[0048] A response script can refer to a predefined sequence of security incident response steps, such as a standard operating procedure that includes isolating hosts, revoking certificates, and creating work orders, serving as the basis for automated response execution. An Application Programming Interface (API) can refer to the standardized definition of inter-component calls between software components, such as a network device management API designed based on the REST architectural style, used to achieve programmatic interaction with external systems. Network devices can refer to the hardware devices that make up the network infrastructure, such as data forwarding and control devices including routers, switches, and firewalls, serving as execution nodes for access control rules. Access control rules can refer to a set of rules that define network traffic allow or deny policies, such as filtering rules set based on source IP address, destination port, and protocol type, used to restrict unauthorized network access. A key management facility can refer to a system responsible for the entire lifecycle management of keys, such as a certificate authority using a PKI public key infrastructure architecture, serving as the entity executing certificate revocation operations. A certificate revocation command can refer to a control command that invalidates a digital certificate, such as a certificate revocation request sent to a CA via the OCSP online certificate status protocol, used to immediately terminate the use of a suspicious certificate. A work order system can refer to a software platform used to track and manage workflows, such as an event management system designed based on ITIL standards, which serves as a storage and tracking platform for security incident records. A security incident work order can refer to a tracking document that records details of a security incident, such as a structured record containing an incident description, severity level, and processing progress, used to coordinate and track the security incident handling process.

[0049] As a concrete example: When the security operations and analysis module detects suspicious external connection behavior on a server, it automatically executes a predefined "mining virus handling" script. First, it sends an access control rule to the perimeter firewall via the NETCONF protocol to block the server's IP address. At the same time, it sends a certificate revocation request to the certificate authority via the SCEP Simple Certificate Enrollment Protocol. Finally, it creates an urgent security incident ticket in the JIRA ticketing system and assigns it to the security team.

[0050] By coordinating multiple security components and external systems through predefined handling scripts, an automated response loop from threat detection to handling is achieved, significantly shortening security incident response time and reducing delays and errors caused by human intervention.

[0051] In some implementations, when verifying the message authentication code, the secure communication gateway module performs verification by comparing a calculated verification decision value with a verification decision threshold dynamically set by the policy control engine based on device type and network risk. The formula for calculating the verification decision value includes:

[0052] Where V represents the verification decision value; N represents the number of consecutive historical verifications used for decision-making, which is a positive integer whose value is specified by the policy issued by the policy control engine; The message authentication code matching score calculated during the i-th historical verification process is a dimensionless value between zero and one, which is obtained by comparing the authentication code calculated in this verification with the received authentication code bit by bit. Represents N historical verifications The arithmetic mean of the scores; λ represents the dynamic security adjustment coefficient, a dimensionless adjustment parameter greater than zero, whose value is dynamically calculated and distributed by the security operations and analysis module based on the global threat level; The weight of historical behavior anomalies is a dimensionless positive real number, set by the policy control engine based on the device trust level; M represents the total number of data packets exchanged during the challenge-response process, a positive integer, calculated by the secure communication gateway module when the session is established. This represents the challenge value of the j-th data packet, in bytes, which is the length of the cryptographic random number. This represents the expected response value of the j-th data packet, in bytes, and is pre-calculated by the secure communication gateway module based on the session key and algorithm type. It represents a very small positive number, measured in bytes, and is used to prevent the denominator from being zero. This represents the weight of the communication anomaly. It is a dimensionless positive real number that is set by the policy control engine based on the real-time network load.

[0053] Network risk refers to the degree of security threats faced by the network environment, such as a risk score calculated by combining threat intelligence and vulnerability information, used to dynamically adjust the stringency of security controls. Historical consecutive verification count refers to the total number of recent consecutive verification operations, such as the number of successful or failed challenge-response attempts within a sliding time window, used to assess the stability of verification behavior. Message authentication code matching score refers to a numerical value quantifying the similarity of authentication codes, such as a score obtained by comparing the bit similarity between the authentication code and the received authentication code, used to measure the quality of a single verification. Arithmetic mean refers to the average of a set of values, such as the average obtained by summing the matching scores of multiple verifications and dividing by the number of attempts, used to assess the overall level of verification performance. Dynamic security adjustment coefficient refers to adjustment parameters that change with the security situation, such as variable coefficients dynamically calculated based on threat level and asset risk, used to adapt verification decisions to the real-time security environment. Historical behavior anomaly weight refers to weighting coefficients assigned to historical verification data, such as weighted values ​​set based on the credibility of past device behavior, used to adjust the influence of historical data in decision-making. Total number of data packets refers to the number of data packets transmitted in a single communication session, such as the number of data packets transmitted in a TCP connection, serving as an indicator for assessing the scale of communication. Challenge value size refers to the data length of the challenge message, such as the number of bytes occupied by a cryptographic random number during transmission, serving as a fundamental parameter in the verification process. Expected response value size refers to the data length of the expected response message, such as the theoretical response data volume calculated based on the session key and algorithm type, used to check the compliance of the response data. Anomaly weight of this communication refers to the weighting coefficients assigned to the characteristics of the current session, such as a weighted value set based on real-time network load conditions, used to adjust the importance of current data in decision-making.

[0054] By comprehensively evaluating historical behavioral patterns and current session characteristics through multi-dimensional quantitative assessment, a dynamic and adaptive challenge-response verification mechanism is established, which effectively improves the detection accuracy of man-in-the-middle attacks and session hijacking, while avoiding misjudgments caused by network fluctuations.

[0055] In some implementations, the formula for calculating the dynamic safety adjustment factor includes:

[0056] in, This represents the dynamic safety adjustment coefficient, which is a dimensionless adjustment parameter greater than zero. This represents the fundamental safety constant, which is a dimensionless constant greater than zero. The external threat amplification factor is a dimensionless constant greater than zero, used to adjust the contribution of external threat intelligence to the coefficient; P represents the number of currently active threat intelligence sources, a positive integer, which is obtained and counted by the security operations and analysis module from the external threat intelligence platform. The confidence weight of the k-th threat intelligence source is a dimensionless value between zero and one, which is obtained by the security operations and analysis module based on the historical accuracy of the source. This represents the number of relevant threat events reported by the kth threat intelligence source, and is a non-negative integer, collected in real time by the security operations and analysis module. The internal risk amplification factor is a dimensionless constant greater than zero, used to adjust the contribution of internal asset risk dispersion in the coefficient; Q represents the number of monitored internal assets, a positive integer, which is discovered and counted by the asset mapping function of the security operation and analysis module. This represents the real-time risk score of the l-th internal asset, which is a non-negative real number calculated by the security operations and analysis module based on the severity of the asset's vulnerabilities and its network exposure surface. This represents the arithmetic mean of the R_l risk scores for all Q assets; Represents all Q assets Standard deviation of risk scores; It represents a very small positive number, used to prevent the denominator from being zero.

[0057] Dynamic security adjustment coefficients refer to parameters that adjust in response to changes in the security situation, such as variable coefficients dynamically calculated based on threat levels and asset risks, used to adapt security decisions to the real-time environment. Basic security constants refer to baseline values ​​in security calculations, such as fixed constant values ​​preset by system administrators according to organizational security policies, used to ensure that adjustment coefficients maintain a baseline security level. External threat amplification factors refer to multiplier coefficients that adjust the impact of external threats, such as weighted parameters set by administrators to control the contribution of threat intelligence, used to adjust the influence of external threats in security assessments. Threat intelligence sources refer to services or systems that provide security threat information, such as information sources including commercial threat intelligence platforms and open-source intelligence communities, serving as the basis for obtaining external threat data. Confidence weights refer to weighted values ​​that characterize the reliability of information, such as trust scores calculated based on the historical accuracy of threat intelligence sources, used to differentiate the quality differences between different intelligence sources. The number of threat events refers to the total number of security events detected within a specific time period, such as the count of related attack events reported by threat intelligence sources, serving as a direct indicator of threat activity. Internal risk amplification factor can refer to a multiplier coefficient that adjusts the impact of internal risks. For example, it can be a weighted parameter set by an administrator to control the contribution of asset risk dispersion, used to adjust the importance of internal risks in security assessments. Internal assets can refer to IT resources within an organization that need protection, such as computing devices including servers, network equipment, and terminal hosts, which are the objects of protection in risk assessments. Real-time risk score can refer to a dynamically calculated asset security risk value, such as a quantitative score derived from the combined severity of vulnerabilities and network exposure, used to reflect the immediate security status of assets. Arithmetic mean can refer to the average of a set of values, such as the mean obtained by adding the risk scores of all assets and dividing by the number of assets, used to assess the overall risk level. Standard deviation can refer to a statistical measure of data dispersion, such as the square root of the sum of the squares of the deviations of each asset's risk score from the mean, used to measure the volatility of asset risk.

[0058] As a specific example: In a financial cloud environment, the security operations module obtains data from three threat intelligence sources, assigning them confidence weights of 0.9, 0.7, and 0.5 respectively, and statistically determines the number of threat events from these sources to be 50, 30, and 10. Simultaneously, it monitors 100 internal assets, calculating the arithmetic mean of the real-time risk scores to be 75, with a standard deviation of 25. Based on the preset basic security constant of 0.1, the external threat amplification factor of 0.05, and the internal risk amplification factor of 0.03, a security adjustment coefficient is dynamically generated through calculation.

[0059] By integrating confidence-weighted statistics of external threat intelligence and dispersion analysis of internal asset risks, a dynamic and adaptive security adjustment mechanism is established, enabling the system to adjust the stringency of security policies in real time according to changes in the internal and external security situation, thereby improving its adaptability to complex threat environments.

[0060] In some implementations, the dynamic key management module uses a key derivation chain mode for key rotation, that is, using the current session key to encrypt the negotiation parameters of the next session key.

[0061] A key derivation chain model can refer to a key generation method based on a hierarchical key derivation relationship. For example, it might use the current session key as a key encryption key to protect the negotiation parameters of the next session key, thus establishing a continuous key update chain. The current session key can refer to a valid encryption key currently in use, such as an AES-256 symmetric encryption key generated from master key material through a key derivation function, serving as the cryptographic basis for protecting communication data. The next session key can refer to a reserve encryption key to be used, such as subsequent encryption key material generated through a key negotiation protocol, used to immediately replace the current key after a round-robin is triggered. Negotiation parameters can refer to common parameters exchanged during key negotiation, such as mathematical parameters like generators and moduli in the Diffie-Hellman protocol, serving as the computational basis for generating the shared key.

[0062] As a concrete example: In the end-to-end encryption scenario of a video conferencing system, the dynamic key management module adopts the key derivation chain mode, using the currently active AES-128 session key to encrypt and protect the ECDH elliptic curve Diffie-Hellman negotiation parameters of the next session key, including the elliptic curve type, the coordinates of the generation point, and the temporary public key, ensuring the secure transmission of negotiation parameters during key rotation.

[0063] By establishing a key derivation chain, the negotiated parameters during the key rotation process are securely protected, ensuring forward security while preventing the key negotiation process from being eavesdropped on or tampered with, thus forming a tightly linked key update protection mechanism.

[0064] The preferred embodiments disclosed above are merely illustrative of this specification. The optional embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this invention. These embodiments are selected and specifically described in this specification to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize this specification. This specification is limited only by the claims and their full scope and equivalents.

Claims

1. A secure data transmission system based on dynamic encryption authentication, characterized in that, include: Hardware cryptography module, dynamic key management module, secure communication gateway module, policy control engine, and security operation and analysis module; The hardware cryptographic module is used to generate and securely store asymmetric root key pairs, and to perform all cryptographic operations based on the root key pairs within it. The dynamic key management module is connected to the hardware cryptographic module and is used to receive a temporary key seed through a secure channel established based on the root key pair, and to derive and rotate session keys based on the temporary key seed and session state. The secure communication gateway module is connected to the dynamic key management module and is used to perform two-way authentication, anti-hijacking challenge-response, and intelligent compression and encryption of business load using the session key; The policy control engine is connected to the dynamic key management module and the secure communication gateway module respectively, and is used to receive declarative policies, compile the declarative policies into configuration instructions and send them to the dynamic key management module and the secure communication gateway module to control their behavior; The security operation and analysis module is connected to the security communication gateway module and the policy control engine. It is used to collect logs and event data from the security communication gateway module, perform asset mapping, risk perception, security analysis and threat detection, and trigger automated response actions through the policy control engine when a threat is detected, thereby forming a closed loop of security operation.

2. The system according to claim 1, characterized in that, The hardware cryptographic module is also used to generate a physically unclonable function response in each power-on cycle and bind the physically unclonable function response to the root key pair.

3. The system according to claim 1, characterized in that, The key rotation strategy in the dynamic key management module adopts a dual threshold triggering mechanism of time threshold and data volume threshold.

4. The system according to claim 1, characterized in that, The anti-hijacking challenge-response function executed by the secure communication gateway module is as follows: after the session key is rotated, a cryptographic random number is sent to the communication peer as a challenge, and the communication peer is verified to use the newly rotated session key to generate a message authentication code for the cryptographic random number.

5. The system according to claim 1, characterized in that, The policy control engine receives a declarative policy that is a set of rules in YAML format.

6. The system according to claim 1, characterized in that, The security operation and analysis module uses the isolated forest algorithm to detect point anomalies in the collected log data and a long short-term memory neural network model to identify latent attack behaviors in time series data.

7. The system according to claim 1, characterized in that, When the security operation and analysis module triggers an automated response action, it executes a predefined handling script. The handling script includes issuing access control rules on network devices through an application programming interface, sending certificate revocation instructions to the key management facility, and creating a security event work order in the work order system.

8. The system according to claim 4, characterized in that, When verifying the message authentication code, the secure communication gateway module performs verification by comparing a calculated verification decision value with a verification decision threshold dynamically set by the policy control engine based on device type and network risk. The formula for calculating the verification decision value includes: Where V represents the verification decision value; N represents the number of consecutive historical verifications used for decision-making, which is a positive integer whose value is specified by the strategy issued by the strategy control engine; The message authentication code matching score calculated during the i-th historical verification process is a dimensionless value between zero and one, which is obtained by comparing the authentication code calculated in this verification with the received authentication code bit by bit. Represents the N historical verifications The arithmetic mean of the scores; λ represents the dynamic security adjustment coefficient, a dimensionless adjustment parameter greater than zero, whose value is dynamically calculated and distributed by the security operation and analysis module based on the global threat level; The weight of historical behavior anomalies is a dimensionless positive real number, set by the policy control engine based on the device trust level; M represents the total number of data packets exchanged during the challenge-response process, a positive integer, obtained by the secure communication gateway module when the session is established. This represents the challenge value of the j-th data packet, in bytes, which is the length of the cryptographic random number. This represents the expected response value size of the j-th data packet, in bytes, which is pre-calculated by the secure communication gateway module based on the session key and algorithm type. It represents a very small positive number, measured in bytes, and is used to prevent the denominator from being zero. The abnormal weight of this communication is represented by a dimensionless positive real number, which is set by the policy control engine based on the real-time network load.

9. The system according to claim 8, characterized in that, The formula for calculating the dynamic safety adjustment coefficient includes: in, This represents the dynamic safety adjustment coefficient, which is a dimensionless adjustment parameter greater than zero. This represents the fundamental safety constant, which is a dimensionless constant greater than zero. The external threat amplification factor is a dimensionless constant greater than zero, used to adjust the contribution of external threat intelligence to the coefficient; P represents the number of currently active threat intelligence sources, a positive integer, which is obtained and counted by the security operation and analysis module from the external threat intelligence platform. The confidence weight of the k-th threat intelligence source is a dimensionless value between zero and one, which is obtained by the security operations and analysis module based on the historical accuracy of the source. This represents the number of relevant threat events reported by the kth threat intelligence source, and is a non-negative integer, collected in real time by the security operations and analysis module. The internal risk amplification factor is a dimensionless constant greater than zero, used to adjust the contribution of internal asset risk dispersion in the coefficient; Q represents the number of monitored internal assets, a positive integer, which is discovered and counted by the asset mapping function of the security operation and analysis module. This represents the real-time risk score of the l-th internal asset, which is a non-negative real number calculated by the security operation and analysis module based on the severity of the asset's vulnerabilities and its network exposure surface. This represents the arithmetic mean of the R_l risk scores for all Q assets; Represents all Q assets Standard deviation of risk scores; It represents a very small positive number, used to prevent the denominator from being zero.

10. The system according to claim 1, characterized in that, The dynamic key management module uses a key derivation chain mode for key rotation, that is, it uses the current session key to encrypt the negotiation parameters of the next session key.

Images