Data secure transmission method and device, equipment and storage medium

Abstract

The invention provides a data security transmission method and device, equipment and a storage medium, and the method comprises the steps: obtaining an original data packet and communication equipment information, determining a secrecy level and a protocol type based on the original data packet, converting the original data packet based on a preset intermediate format, obtaining an intermediate data packet, and transmitting the intermediate data packet to a server; if the protocol type is in a preset security protocol white list, determining a corresponding white list encryption strategy based on the confidentiality level and the communication equipment information, performing encryption processing on the intermediate data packet based on the white list encryption strategy to obtain an encrypted data packet, and performing data transmission based on the encrypted data packet; according to the method and the device, the original data packet is acquired, the confidentiality level and the protocol type are determined based on the original data packet, the encryption strategy is dynamically adjusted, the encryption operation can be further optimized in combination with communication equipment information according to the encryption strategy determined according to the data confidentiality level and the protocol type, and the security and the communication efficiency are improved.

Description

Technical Field

[0001] This application relates to the field of data security management, and in particular to a data security transmission method, apparatus, device and storage medium. Background Technology

[0002] The widespread application of IoT technology has enabled a massive number of heterogeneous terminal devices to connect to the network and continuously interact with the cloud. Ensuring the confidentiality, integrity, and availability of data transmitted between terminal devices and the cloud—that is, achieving secure communication—is a significant challenge for IoT systems. As a crucial hub connecting terminal devices and the cloud, IoT edge gateways need to handle data from devices from different manufacturers using various communication protocols. However, existing edge gateways typically employ fixed protocol conversion strategies when handling multiple IoT protocols, which are independent of data encryption, authentication, and other security functions. This results in fragmented security policy deployments, hindering effective integrated security management. Secondly, most existing solutions are designed for specific protocols or single security threats, making it difficult to guarantee the overall integrity and consistency of end-to-end communication security in complex IoT environments. Finally, existing security strategies are mainly pre-configured statically. When device computing power is overloaded, excessive security overhead can impact communication efficiency, or the security protection strength may be insufficient when facing high risks. Summary of the Invention

[0003] The purpose of this application is to provide a data security transmission method, apparatus, device, and storage medium to solve the above-mentioned technical problems.

[0004] This application provides a data security transmission method, which includes: acquiring original data packets and communication device information, and determining a confidentiality level and protocol type based on the original data packets; converting the original data packets based on a preset intermediate format to obtain intermediate data packets; if the protocol type is within a preset security protocol whitelist, determining a corresponding whitelist encryption strategy based on the confidentiality level and communication device information, wherein the whitelist encryption strategy includes at least one of transport layer encryption and hardware encryption; encrypting the intermediate data packets based on the whitelist encryption strategy to obtain encrypted data packets, and transmitting data based on the encrypted data packets.

[0005] In one embodiment of this application, determining the confidentiality level and protocol type based on the original data packet includes: parsing the original data packet to determine confidentiality level labeling information and data packet feature information; determining the confidentiality level of the original data packet based on the confidentiality level labeling information; matching the data packet feature information in a preset protocol fingerprint database to obtain the protocol type of the original data packet; if the data packet feature information has no matching result in the preset protocol fingerprint database, then determining the protocol type most similar to the protocol of the original data packet in the preset protocol fingerprint database based on the edit distance algorithm, and determining the most similar protocol type as the protocol type of the original data packet.

[0006] In one embodiment of this application, determining the corresponding whitelist encryption strategy based on the confidentiality level and communication device information includes: matching an initial encryption strategy according to the confidentiality level; wherein, if the confidentiality level is less than a first preset confidentiality level threshold, the initial encryption strategy includes not performing encryption operations; if the confidentiality level is greater than or equal to the first preset confidentiality level threshold and less than a second preset confidentiality level threshold, the initial encryption strategy includes transport layer encryption or hardware encryption; if the confidentiality level is greater than or equal to the second preset confidentiality level threshold, the initial encryption strategy includes transport layer encryption and hardware encryption; matching a corresponding optimized encryption algorithm combination according to the hardware computing power and network status in the communication device information, and determining a key rotation period according to the security threat level in the communication device information, wherein the security threat level is used to characterize the attack confidence of the current transmission initiator and transmission receiver; adjusting the initial encryption strategy based on the optimized encryption algorithm combination and the key rotation period to obtain a whitelist encryption strategy.

[0007] In one embodiment of this application, after obtaining the intermediate data packet, the method further includes: if the protocol type is not in the preset security protocol whitelist, determining a protocol layer encryption method based on the protocol type; determining a corresponding data transmission encryption strategy according to the confidentiality level and communication device information, and determining the protocol layer encryption method and data transmission encryption strategy as non-whitelist encryption strategies, wherein the data transmission encryption strategy includes at least one of transport layer encryption and hardware encryption; encrypting the intermediate data packet based on the non-whitelist encryption strategy to obtain the encrypted data packet, and transmitting data based on the encrypted data packet.

[0008] In one embodiment of this application, the protocol type includes lightweight communication protocols and high-bandwidth communication protocols. Determining the protocol layer encryption method based on the protocol type includes: if the protocol type is a lightweight communication protocol, then the protocol layer encryption method is determined to be the ASCON algorithm; if the protocol type is a high-bandwidth communication protocol, then the protocol layer encryption method is determined to be a transport layer security protocol that supports authentication encryption.

[0009] In one embodiment of this application, encrypting the intermediate data packet includes: if protocol-level encryption is performed on the intermediate data packet, the target field to be encrypted in the intermediate data packet is determined according to the protocol type, and the target field to be encrypted is encrypted at the protocol level based on a symmetric encryption algorithm; if transport-level encryption is performed on the intermediate data packet, two-way authentication is performed on the transmission initiator and the transmission receiver based on a digital certificate, the two-way authentication including certificate interaction between the transmission initiator and the transmission receiver and the execution of signature verification and revocation status check; if the two-way authentication is successful, an encrypted transmission connection is established, and a session key is generated through a security chip to encrypt and transmit the intermediate data packet; if hardware encryption is performed on the intermediate data packet, the cached intermediate data packet is encrypted and stored at the transmission initiator based on a preset hardware encryption algorithm and stored in a non-volatile memory, the encryption key for the encrypted storage is stored through a security chip.

[0010] In one embodiment of this application, the data secure transmission method further includes: implementing anomaly detection at the protocol layer, and triggering a security response process when an anomaly is detected. The security response process includes: triggering session freezing and device isolation when a protocol violation data packet is detected based on a finite state machine; and executing a dynamic key self-destruction mechanism when a brute-force attack is detected.

[0011] This application embodiment also provides a data security transmission device, which includes: a data transmission parsing module, used to acquire original data packets and communication device information, and determine a confidentiality level and protocol type based on the original data packets; an encryption strategy determination module, used to convert the original data packets based on a preset intermediate format to obtain intermediate data packets; if the protocol type is within a preset security protocol whitelist, then determine a corresponding whitelist encryption strategy based on the confidentiality level and communication device information, wherein the whitelist encryption strategy includes at least one of transport layer encryption and hardware encryption; and a data encryption transmission module, used to encrypt the intermediate data packets based on the whitelist encryption strategy to obtain encrypted data packets, and to transmit data based on the encrypted data packets.

[0012] This application also provides an electronic device, including: one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, enable the electronic device to implement the data secure transmission method as described in any of the above embodiments.

[0013] This application also provides a computer-readable storage medium storing computer-readable instructions that, when executed by a computer's processor, cause the computer to perform the data secure transmission method as described in any of the above embodiments.

[0014] The beneficial effects of this application are as follows: This application provides a data security transmission method, apparatus, device, and storage medium. It acquires original data packets and communication device information, determines the confidentiality level and protocol type based on the original data packets, converts the original data packets according to a preset intermediate format to obtain intermediate data packets, and if the protocol type is within a preset security protocol whitelist, determines a corresponding whitelist encryption strategy based on the confidentiality level and communication device information. The intermediate data packets are then encrypted based on the whitelist encryption strategy to obtain encrypted data packets, which are then used for data transmission. This application dynamically adjusts the encryption strategy by acquiring the original data packets and determining the confidentiality level and protocol type based on them. Furthermore, it optimizes the encryption operation by combining the encryption strategy determined by the data confidentiality level and protocol type with communication device information, thereby improving security and communication efficiency.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings: Figure 1 This is a schematic diagram illustrating an exemplary system architecture as shown in an exemplary embodiment of this application; Figure 2 This is a flowchart illustrating a secure data transmission method in an exemplary embodiment of this application; Figure 3 This is a schematic diagram illustrating a data security transmission device according to an exemplary embodiment of this application; Figure 4 This is a schematic diagram of the structure of a computer system for an electronic device, as illustrated in an exemplary embodiment of this application. Detailed Implementation

[0017] The embodiments of this application will be described below with reference to the accompanying drawings and specific examples. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be understood that the preferred embodiments are only for illustrating this application and are not intended to limit the scope of protection of this application.

[0018] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this application. Therefore, the illustrations only show the components related to this application and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0019] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the present application. However, it will be apparent to those skilled in the art that embodiments of the present application may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the present application.

[0020] The term "and / or" used in this application describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. The character " / " generally indicates that the related objects before and after it are in an "or" relationship.

[0021] In implementing related technologies, traditional IoT edge gateways handle data processing with protocol conversion strategies and security functions independently, using static configuration. This prevents security policies from dynamically adapting to the confidentiality level, protocol type, and real-time status of the original data packets. Specifically, the determination of the confidentiality level and the identification of the protocol type are not linked to the selection of the encryption strategy. Consequently, during data transmission, security strength cannot be optimized based on device hardware computing power, network status, and security threat levels, thus affecting communication efficiency and the integrity of security protection.

[0022] Based on the aforementioned technical problems and characteristics, this application proposes the following technical solution: By acquiring the original data packet and communication device information, and determining the confidentiality level and protocol type based on the original data packet, the original data packet is then converted to obtain an intermediate data packet. If the protocol type is within a preset security protocol whitelist, a corresponding whitelist encryption strategy is determined based on the confidentiality level and communication device information. The intermediate data packet is then encrypted using the whitelist encryption strategy and transmitted. By acquiring the original data packet and determining the confidentiality level and protocol type based on it, the encryption strategy is dynamically adjusted. Furthermore, based on the encryption strategy determined by the data confidentiality level and protocol type, the encryption operation can be further optimized by combining the communication device information, thereby improving security and communication efficiency.

[0023] Please see Figure 1 , Figure 1 This is a schematic diagram illustrating an exemplary system architecture as shown in an exemplary embodiment of this application.

[0024] Reference Figure 1 As shown, the system architecture may include a computer device 110 and a cloud 120. The computer device 110 acquires raw data packets and communication device information, determines the security level and protocol type based on the raw data packets, converts the raw data packets according to a preset intermediate format to obtain intermediate data packets, and if the protocol type is within a preset security protocol whitelist, determines the corresponding whitelist encryption strategy based on the security level and communication device information, encrypts the intermediate data packets according to the whitelist encryption strategy to obtain encrypted data packets, and transmits the data to the cloud 120 based on the encrypted data packets. The computer device 110 refers to a computing power-supporting terminal device that carries the program implementation environment for the data security transmission method, and may be deployed as at least one IoT edge gateway for acquiring and temporarily storing raw data packets, and ultimately transmitting them to the cloud 120. The cloud 120 refers to a server providing cloud services for receiving encrypted data and storing it, including but not limited to clustered servers, large cloud servers, and micro cloud servers.

[0025] This technical solution can be further discussed and analyzed in multiple steps; for specific steps, please refer to [link / reference needed]. Figure 2 , Figure 2 This is a flowchart illustrating an exemplary embodiment of a data secure transmission method. This data secure transmission method can be executed in implementation environments supported by various operating systems, and no specific limitation is made to the implementation environment herein. (Refer to...) Figure 2 As shown in the flowchart, the data secure transmission method includes at least steps S210 to S240, which are described in detail below: In step S210, the original data packet and communication device information are obtained, and the confidentiality level and protocol type are determined based on the original data packet.

[0026] The aforementioned communication equipment information refers to equipment attributes and status data related to data transmission, including but not limited to the terminal device's hardware computing power, current network status, security threat level, and device identifier.

[0027] In one embodiment of this application, the original data packet is parsed to determine the confidentiality level labeling information and data packet feature information, and the confidentiality level of the original data packet is determined based on the confidentiality level labeling information.

[0028] Among them, raw data packets refer to unprocessed raw data units received from IoT terminal devices or the cloud, including but not limited to application layer data, transport layer headers, network layer headers, etc., and their format and content are determined by specific communication protocols; the above-mentioned confidentiality levels are used to characterize the sensitivity and importance of the data content, and can be divided into specific confidentiality levels such as public, internal, secret, and top secret, with different confidentiality levels corresponding to different security protection requirements.

[0029] In some implementation environments, deep packet inspection technology can be used to perform pattern matching and semantic analysis on data packet content to identify relevant annotations and features. After identifying the security level annotation information, the extracted annotation information is converted into specific security levels. Based on a predefined mapping table, specific security level annotations can be mapped to numerical security levels.

[0030] In one embodiment of this application, the protocol type of the original data packet is obtained by matching the data packet feature information with a preset protocol fingerprint database. If no matching result is found in the preset protocol fingerprint database, the protocol type most similar to the original data packet is determined in the preset protocol fingerprint database based on the edit distance algorithm, and this most similar protocol type is determined as the protocol type of the original data packet. The aforementioned protocol type refers to the communication protocol standard followed by the original data packet, including but not limited to MQTT, CoAP, HTTP, TCP, UDP, and other protocol types.

[0031] In one embodiment of this application, the aforementioned preset protocol fingerprint database can store characteristic patterns of common protocols, such as specific port numbers, protocol header fields, or specific byte sequences, and the protocol type can be identified by accurately matching these characteristics. In other implementation environments, a hash algorithm can also be used to hash the data packet characteristic information and look up the corresponding hash value in the fingerprint database to quickly identify the protocol.

[0032] In one embodiment of this application, if the data packet feature information has no matching result in the preset protocol fingerprint database, the data packet feature information can be compared with the features of each protocol in the fingerprint database by string or sequence, the edit distance can be calculated, and the protocol with the smallest distance can be selected as the most similar protocol. Alternatively, the data packet feature information can be converted into a vector representation and the Euclidean distance between it and the feature vector of the protocol in the fingerprint database can be calculated to select the protocol with the closest distance.

[0033] In a specific implementation environment of this application, the deep packet inspection technology includes: capturing raw traffic from the network interface using zero-copy technology; using a Berkeley packet filter to remove non-target protocols such as Address Resolution Protocol (ARP) and Network Control Message Protocol (NCMP); extracting the first 128 bytes of the TCP / UDP transport layer protocol payload as a feature analysis area; and determining the protocol type based on the five-tuple (source IP address, source port, destination IP address, destination port, and transport layer protocol). When determining the protocol type, a fixed identifier detection is first performed, matching feature fields in a preset protocol fingerprint database, such as the Modbus protocol identification function code and the CRC protocol check structure.

[0034] The aforementioned pre-defined protocol fingerprint database includes fixed features of various IoT protocols, such as Modbus function codes and MQTT CONNECT message structures. TLS fingerprinting is performed by extracting extended list / elliptic curve combinations from the ClientHello, generating a hash fingerprint using the JA3 algorithm, and performing context verification to check session continuity and consistency of historical protocol types for the same IP address to avoid protocol spoofing attacks. The JA3 algorithm is a method for generating client fingerprints for TLS encrypted connections. It extracts key features such as version, supported cipher suites, and extensions from the TLS handshake packet, sorts them in a fixed order, and concatenates them symbolically to form a standardized feature string. Finally, an MD5 hash value is calculated on this string to obtain a unique fingerprint.

[0035] If the data packet feature information does not match in the preset protocol fingerprint database, the protocol similarity is calculated based on the Levenshtein edit distance algorithm to adaptively classify the unknown protocol. The Levenshtein algorithm calculates the minimum number of single-character edit operations required to convert one string to another, supporting insertion, deletion, and replacement operations. Specifically, it constructs a two-dimensional distance matrix. The first row and first column of the matrix are initialized to correspond to the number of insertions required to convert an empty string to the target string and the number of deletions required to convert the original string to an empty string, respectively. Then, using dynamic programming, the remaining part of the matrix is ​​gradually filled based on the calculated results. The final value in the lower right corner of the matrix is ​​the minimum edit distance.

[0036] In the embodiments of this application, when encountering an unknown or variant protocol for which there is no direct matching result in the fingerprint database, an edit distance algorithm is further introduced. By calculating the similarity between the data packet feature information and the existing protocol features in the fingerprint database, the most similar protocol type is intelligently inferred, making the determination process of protocol type and confidentiality level more comprehensive. In the face of complex network environments and diverse protocol variants, it can also provide accurate input for subsequent encryption strategy selection, thereby ensuring the security and effectiveness of data transmission.

[0037] In step S220, the original data packet is converted based on a preset intermediate format to obtain an intermediate data packet.

[0038] In one embodiment of this application, a preset intermediate format is used to unify the raw data packets of different protocols. The raw data packets are converted into the intermediate format so that all intermediate data packets have a unified data structure and field definition, which facilitates subsequent encryption processing and transmission.

[0039] In one embodiment of this application, the aforementioned preset intermediate format includes, but is not limited to, JSONSchema format in some implementation processes.

[0040] In step S230, if the protocol type is within the preset security protocol whitelist, the corresponding whitelist encryption strategy is determined based on the confidentiality level and communication device information.

[0041] In one embodiment of this application, the whitelist encryption strategy includes at least one of transport layer encryption and hardware encryption, and the preset security protocol whitelist is a predefined list of trusted protocols.

[0042] In one embodiment of this application, an initial encryption strategy is matched according to the confidentiality level.

[0043] If the security level is less than the first preset security level threshold, the initial encryption strategy includes not performing encryption operations.

[0044] If the security level is greater than or equal to the first preset security level threshold and less than the second preset security level threshold, the initial encryption strategy includes transport layer encryption or hardware encryption. Within this security level range, transport layer encryption or hardware encryption can be selected according to the default configuration or further strategies, or one encryption method can be dynamically selected based on factors such as system load and network environment.

[0045] If the security level is greater than or equal to the second preset security level threshold, the initial encryption strategy includes transport layer encryption and hardware encryption. This includes mandating the simultaneous use of both transport layer encryption and hardware encryption to form a multi-layered protection system.

[0046] In one embodiment of this application, a corresponding optimized encryption algorithm combination is matched based on the hardware computing power and network status in the communication device information, and a key rotation cycle is determined based on the security threat level in the communication device information. The security threat level is used to characterize the confidence that the current transmission initiator and transmission receiver are under attack.

[0047] Hardware computing power can refer to CPU clock speed, encryption coprocessor support, memory size, etc.; network status can refer to bandwidth, latency, packet loss rate, etc. The strength or type of encryption algorithm can be adjusted by monitoring device resource utilization and network quality in real time. The aforementioned security threat level characterizes the confidence level of the current transmission initiator and receiver to be under attack. This information can be obtained through security information and event management systems, intrusion detection systems, or threat intelligence platforms. When the threat level is high, the key rotation cycle is shortened, increasing the difficulty for attackers to crack the key.

[0048] In one embodiment of this application, an initial encryption strategy is adjusted based on an optimized combination of encryption algorithms and a key rotation period to obtain a whitelist encryption strategy. This adjustment may include replacing the default algorithm in the initial strategy with an optimized combination of algorithms and setting a key rotation period; alternatively, it may involve fine-tuning the parameters of the initial strategy based on the optimized combination of algorithms and the key rotation period.

[0049] In some specific implementation processes, the importance of adjusting hardware computing power, network status, and security threat level can also be allocated through adaptive weight allocation. For example, under normal circumstances, the weight ratio of hardware computing power, network status, and security threat level can be preset to 4:3:3; when a high-risk event is reported, the weight of the security threat level is increased in order to adjust the encryption strategy for the biased type.

[0050] In the embodiments of this application, the technical solution of adjusting the encryption strategy based on the communication device information is a different implementation process of the same scheme steps in both whitelist encryption strategy and non-whitelist encryption strategy.

[0051] This application's solution refines the whitelist encryption strategy through a phased and dynamically adjusted approach. Specifically, it optimizes encryption algorithm combinations by matching and optimizing the combinations to ensure that the selected algorithms fully utilize the device's computing resources and adapt to the current network environment, thereby maximizing transmission efficiency while ensuring security. Simultaneously, it dynamically determines the key rotation cycle based on the security threat level, allowing the key update frequency to flexibly respond to changes in the external security landscape and effectively resist potential attack risks.

[0052] In one embodiment of this application, if the protocol type is not in the preset security protocol whitelist, the protocol layer encryption method is determined based on the protocol type; the corresponding data transmission encryption strategy is determined according to the confidentiality level and communication device information, and the protocol layer encryption method and data transmission encryption strategy are determined as non-whitelist encryption strategies. The data transmission encryption strategy includes at least one of transport layer encryption and hardware encryption; the intermediate data packet is encrypted based on the non-whitelist encryption strategy to obtain an encrypted data packet, and data is transmitted based on the encrypted data packet.

[0053] When a protocol type is not covered by a whitelist, additional, more adaptive security measures are needed to ensure that even unknown or non-standard protocols are adequately protected, avoiding security vulnerabilities caused by unrecognized protocol types. In this case, even if the protocol itself does not provide built-in security mechanisms, data confidentiality can be achieved by applying encryption within the protocol data units or on specific fields. Methods for determining this include selecting appropriate symmetric or asymmetric encryption algorithms to encrypt the protocol payload based on the protocol's structural characteristics; or selectively encrypting specific fields of the protocol to minimize the impact on protocol parsing.

[0054] In one embodiment of this application, during data transmission, a combination of encryption measures is employed to ensure data security, comprehensively considering both the data's confidentiality level and the communication equipment information of the communication environment. For high-confidentiality data, even if the protocol layer is already encrypted, additional transport layer encryption or hardware encryption may still be required to provide stronger protection. Communication equipment information, such as the device's computing power, security module support, and network bandwidth, influences the selection of encryption algorithms and the adjustment of encryption strength to achieve a balance between security and performance.

[0055] In the embodiments of this application, by applying a non-whitelist encryption strategy, the data that has been converted into an intermediate data packet format is encrypted to generate an encrypted data packet, ensuring that even data with a non-whitelist protocol can be fully encrypted and protected before transmission, thereby effectively resisting security threats such as eavesdropping and tampering.

[0056] In one embodiment of this application, the protocol type includes a lightweight communication protocol and a high-bandwidth communication protocol. If the protocol type is a lightweight communication protocol, the protocol layer encryption method is determined to be the ASCON algorithm; if the protocol type is a high-bandwidth communication protocol, the protocol layer encryption method is determined to be a transport layer security protocol that supports authentication encryption.

[0057] Lightweight communication protocols refer to protocols characterized by low power consumption, low bandwidth, and small data packet transmission, such as CoAP (Co-AP, Restricted Application Protocol) and MQTT-SN (MQTT Simplified Protocol). High-bandwidth communication protocols refer to protocols with high requirements for throughput and real-time performance, such as HTTP, QUIC, and RTP (Real-Time Transport Protocol). The ASCON algorithm mentioned above is a lightweight authentication and encryption algorithm that can provide authentication and encryption functions in resource-constrained environments. In some other implementation environments, other lightweight authentication and encryption algorithms, such as the SIMON or SPECK algorithms, can also be used. Transport layer security protocols that support authentication and encryption refer to protocols that provide end-to-end secure communication at the transport layer. They not only provide data confidentiality and integrity but also ensure the identity of the communicating parties through authentication mechanisms, such as TLS 1.3 (Transport Layer Security).

[0058] In one specific embodiment, the ASCON algorithm is used for encryption of lightweight protocols such as CoAP, while the TLS1.3+AEAD encryption method is enabled for high-bandwidth protocols such as HTTP.

[0059] In step S240, the intermediate data packets are encrypted based on the whitelist encryption strategy to obtain encrypted data packets, and data is transmitted based on the encrypted data packets.

[0060] In one embodiment of this application, if intermediate data packets are to be encrypted at the protocol layer, the target field to be encrypted in the intermediate data packets is determined according to the protocol type, and the target field to be encrypted is encrypted at the protocol layer based on a symmetric encryption algorithm.

[0061] Protocol layer encryption refers to encrypting specific fields of data packets at the application or presentation layer. It encrypts only sensitive information, thus reducing encryption overhead while ensuring security, and allowing network devices to process non-sensitive fields normally. The target field to be encrypted can be identified through pre-configured protocol parsing rules. The aforementioned symmetric encryption algorithms use the same key for both encryption and decryption. In some feasible environments, protocol layer encryption can be performed using AES or ASCON algorithms.

[0062] In one embodiment of this application, if the intermediate data packet is encrypted at the transport layer, then the transmission initiator and the transmission receiver are mutually authenticated based on digital certificates. The two-way authentication includes certificate interaction between the transmission initiator and the transmission receiver and the execution of signature verification and revocation status check. If the two-way authentication is successful, an encrypted transmission connection is established, and a session key is generated through the security chip to encrypt and transmit the intermediate data packet.

[0063] Transport layer encryption (TLC) refers to encrypting the entire data stream at the transport layer, providing an end-to-end secure communication channel and ensuring the confidentiality, integrity, and authentication of data during transmission. The aforementioned digital certificate, issued by a trusted third party (Certificate Authority, CA), proves the identity of the public key owner and includes the public key, owner information, issuer information, and validity period. The verification process for the digital certificate includes checking the validity of the certificate chain, the correctness of the certificate signature, and whether the certificate has been revoked. The aforementioned security chip includes a TPM chip, which provides functions for generating, storing, and managing encryption keys, as well as hardware acceleration for encryption operations, enhancing key security and preventing keys from being attacked by software or physically stolen.

[0064] In some feasible environments, X.509 certificates are used for two-way authentication. First, the gateway certificate generates a key pair using the ECC algorithm. The private key is securely stored in the TPM chip, and the public key is embedded in the X.509 certificate, which includes the gateway's unique identifier, validity period, and extended fields. The cloud certificate is issued by a CA and contains the service domain name and public key, with a signature algorithm of ECDSA-SHA256, supporting TLS configuration for two-way authentication. Then, two-way certificate verification is performed. During the TLS handshake, the gateway and cloud exchange certificate chains, verify the certificate signature using the CA's public key, and verify the certificate status using OCSP or CRL. Once verification is successful, a TLS 1.3 connection is established to ensure forward security. A session key is derived from the TPM chip and used to encrypt the MQTT payload using the AES-256-GCM encryption algorithm.

[0065] In one embodiment of this application, if the intermediate data packet is hardware encrypted, the cached intermediate data packet is encrypted and stored at the transmission initiator based on a preset hardware encryption algorithm and stored in a non-volatile memory. The encryption key for encryption storage is stored through a security chip.

[0066] Hardware encryption refers to data encryption using encryption chips. The aforementioned preset hardware encryption algorithm refers to an encryption algorithm implemented at the hardware level, such as the AES instruction set. The cached intermediate data packets refer to intermediate data packets temporarily stored in memory before data transmission. Encrypted storage prevents data leakage in the short period before data transmission. The aforementioned non-volatile memory ensures data security during long-term storage. The distribution of encryption keys for encrypted storage is based on an elliptic curve CP-ABE attribute encryption scheme to meet fine-grained access control and ensure data security during storage and access.

[0067] In one embodiment of this application, anomaly detection is implemented at the protocol layer. When an anomaly is detected, a security response process is triggered. The security response process includes: when a protocol violation data packet is detected based on a finite state machine, triggering session freezing and device isolation; and when a brute-force attack is detected, executing a dynamic key self-destruction mechanism.

[0068] Protocol layer anomaly detection refers to real-time monitoring and analysis of data packet content, sequence, and behavioral patterns at the application or presentation layer of the data transmission protocol stack. This identifies any activities that deviate from normal protocol specifications or expected behavior, allowing for the timely detection and prevention of potential security threats before attacks cause substantial damage to the system. Implementation can be based on a predefined set of protocol specifications and security policies; data packets that do not conform to these rules are considered anomalies. When a potential security threat or violation is identified, predefined security response measures are activated.

[0069] In one embodiment of this application, a Finite State Machine (FSM) is used in protocol layer anomaly detection to model the legitimate state transition sequences and packet formats of a specific protocol. When a received packet or protocol interaction sequence does not conform to the legitimate state or transition rules defined by the FSM, it is determined to be a protocol violation packet. Upon detecting an anomaly, the current suspicious communication session is immediately suspended or terminated, preventing further data transmission and interaction. The communication device whose abnormal behavior was detected is logically or physically isolated from the network to prevent it from continuing to pose a threat to other devices or systems.

[0070] In one embodiment of this application, a brute-force attack refers to an attacker trying all possible combinations to guess passwords, keys, or other credentials in order to gain unauthorized access. Upon detecting a brute-force attack or other serious security threat, the currently used session key or short-term key is immediately discarded, and a new key is forcibly generated to prevent attackers from gaining access to encrypted communications by continuously guessing or intercepting expired keys.

[0071] In one embodiment of this application, the aforementioned transmission initiator refers to an Internet of Things (IoT) edge gateway.

[0072] This application provides a data security transmission method that obtains original data packets and communication device information, determines the confidentiality level and protocol type based on the original data packets, converts the original data packets according to a preset intermediate format to obtain intermediate data packets, and if the protocol type is within a preset security protocol whitelist, determines a corresponding whitelist encryption strategy based on the confidentiality level and communication device information, encrypts the intermediate data packets based on the whitelist encryption strategy to obtain encrypted data packets, and then transmits data based on the encrypted data packets. This application dynamically adjusts the encryption strategy by obtaining the original data packets and determining the confidentiality level and protocol type based on them, and can further optimize the encryption operation by combining the encryption strategy determined by the data confidentiality level and protocol type with communication device information, thereby improving security and communication efficiency.

[0073] The following describes an apparatus embodiment of this application, which can be used to execute the data secure transmission method described above in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the data secure transmission method described above in this application.

[0074] Figure 3 This is a schematic diagram illustrating a data security transmission device according to an exemplary embodiment of this application. The device can be applied to… Figure 1 The method described is implemented in a device that has the necessary conditions for execution. This embodiment does not impose specific limitations on the devices to which the device is applicable.

[0075] like Figure 3As shown, the exemplary data security transmission device includes: a data transmission parsing module 301, an encryption strategy determination module 302, and a data encryption transmission module 303.

[0076] The transmission data parsing module 301 is used to acquire the original data packet and communication device information, and determine the confidentiality level and protocol type based on the original data packet; the encryption strategy determination module 302 is used to convert the original data packet based on a preset intermediate format to obtain an intermediate data packet; if the protocol type is within a preset security protocol whitelist, the corresponding whitelist encryption strategy is determined based on the confidentiality level and communication device information, and the whitelist encryption strategy includes at least one of transport layer encryption and hardware encryption; the data encryption transmission module 303 is used to encrypt the intermediate data packet based on the whitelist encryption strategy to obtain an encrypted data packet, and transmit data based on the encrypted data packet.

[0077] Embodiments of this application also provide an electronic device, including: one or more processors; and a storage device for storing one or more programs, which, when executed by one or more processors, enable the electronic device to implement the data secure transmission method provided in the above embodiments.

[0078] Figure 4 This is a schematic diagram illustrating the structure of a computer system for an electronic device, as shown in an exemplary embodiment of this application. It should be noted that... Figure 4 The computer system 400 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0079] like Figure 4 As shown, the computer system 400 includes a Central Processing Unit (CPU) 401, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on programs stored in Read-Only Memory (ROM) 402 or programs loaded from storage into Random Access Memory (RAM) 403. The RAM 403 also stores various programs and data required for system operation. The CPU 401, ROM 402, and RAM 403 are interconnected via a bus. An I / O interface 405 is also connected to the bus 404, where the I / O interface 405 refers to an input / output interface.

[0080] The following components are connected to I / O interface 405: an input section 406 including a keyboard, mouse, etc.; an output section 407 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section performs communication processing via a network such as the Internet. A drive is also connected to I / O interface 405 as needed. Removable media 411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 410 as needed so that computer programs read from them can be installed into storage section 408 as needed.

[0081] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 409, and / or installed from removable medium 411. When the computer program is executed by central processing unit (CPU) 401, it performs various functions defined in the system of this application.

[0082] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0083] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0084] In the corresponding figures of the above embodiments, connecting lines can represent the connection relationship between various components, indicating more constitutive signal paths and / or one or more ends of some lines having arrows to indicate the main information flow direction. Connecting lines are an identifier and are not a limitation on the scheme itself, but rather, using these lines in conjunction with one or more exemplary embodiments helps to more easily connect circuits or logic units. Any signal represented (determined by design requirements or preferences) can actually include one or more signals that can be transmitted in any direction and can be implemented in any suitable type of signal scheme.

[0085] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0086] Another aspect of this application provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the method as described above. This computer-readable storage medium may be included in the electronic device described in the above embodiments, or it may exist independently and not assembled into the electronic device.

[0087] Embodiments of this application also provide a computer program product, including a computer program that, when executed by a processor, implements a data secure transmission method as described in any of the above embodiments.

[0088] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0089] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of this application.

[0090] This application can be used in a wide range of general-purpose or special-purpose computing system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0091] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0092] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A method for secure data transmission, characterized in that, The secure data transmission method includes: Obtain the original data packets and communication device information, and determine the security level and protocol type based on the original data packets; The original data packet is converted based on a preset intermediate format to obtain an intermediate data packet; If the protocol type is within the preset security protocol whitelist, then a corresponding whitelist encryption strategy is determined based on the confidentiality level and communication device information. The whitelist encryption strategy includes at least one of transport layer encryption and hardware encryption. The intermediate data packet is encrypted based on the whitelist encryption strategy to obtain an encrypted data packet, and data is transmitted based on the encrypted data packet.

2. The data secure transmission method according to claim 1, characterized in that, Determining the security level and protocol type based on the original data packet includes: The original data packet is parsed to determine the security level labeling information and data packet characteristic information; The security level of the original data packet is determined based on the security level labeling information; The protocol type of the original data packet is obtained by matching the data packet feature information with a preset protocol fingerprint database. If the data packet feature information has no matching result in the preset protocol fingerprint database, then the protocol type most similar to the original data packet is determined in the preset protocol fingerprint database based on the edit distance algorithm, and the most similar protocol type is determined as the protocol type of the original data packet.

3. The data secure transmission method according to claim 1, characterized in that, Determining the corresponding whitelist encryption strategy based on the aforementioned security level and communication device information includes: The initial encryption strategy is matched according to the confidentiality level; wherein, if the confidentiality level is less than the first preset confidentiality level threshold, the initial encryption strategy includes not performing encryption operation; if the confidentiality level is greater than or equal to the first preset confidentiality level threshold and less than the second preset confidentiality level threshold, the initial encryption strategy includes transport layer encryption or hardware encryption; if the confidentiality level is greater than or equal to the second preset confidentiality level threshold, the initial encryption strategy includes transport layer encryption and hardware encryption. Based on the hardware computing power and network status in the communication device information, a corresponding optimized encryption algorithm combination is matched, and based on the security threat level in the communication device information, the key rotation cycle is determined. The security threat level is used to characterize the attack confidence of the current transmission initiator and transmission receiver. Based on the optimized encryption algorithm combination and key rotation cycle, the initial encryption strategy is adjusted to obtain a whitelist encryption strategy.

4. The data secure transmission method according to claim 1, characterized in that, After obtaining the intermediate data packet, it also includes: If the protocol type is not in the preset security protocol whitelist, then the protocol layer encryption method is determined based on the protocol type; Based on the confidentiality level and communication device information, a corresponding data transmission encryption strategy is determined, and the protocol layer encryption method and data transmission encryption strategy are determined to be non-whitelist encryption strategies. The data transmission encryption strategy includes at least one of transport layer encryption and hardware encryption. The intermediate data packet is encrypted based on the non-whitelist encryption strategy to obtain the encrypted data packet, and data is transmitted based on the encrypted data packet.

5. The data secure transmission method according to claim 4, characterized in that, The protocol types include lightweight communication protocols and high-bandwidth communication protocols. Determining the protocol layer encryption method based on the protocol type includes: If the protocol type is a lightweight communication protocol, then the protocol layer encryption method is determined to be the ASCON algorithm; If the protocol type is a high-bandwidth communication protocol, then the protocol layer encryption method is determined to be a transport layer security protocol that supports authentication encryption.

6. The data secure transmission method according to any one of claims 1-5, characterized in that, Encrypting the intermediate data packet includes: If the intermediate data packet is encrypted at the protocol layer, then the target field to be encrypted in the intermediate data packet is determined according to the protocol type, and the target field to be encrypted is encrypted at the protocol layer based on a symmetric encryption algorithm; If the intermediate data packet is encrypted at the transport layer, then the transmission initiator and the transmission receiver are mutually authenticated based on digital certificates. The two-way authentication includes certificate interaction between the transmission initiator and the transmission receiver and the execution of signature verification and revocation status checks. If the two-way authentication is successful, an encrypted transmission connection is established, and a session key is generated through the security chip to encrypt and transmit the intermediate data packet. If the intermediate data packet is hardware encrypted, the cached intermediate data packet is encrypted and stored at the transmission initiator based on a preset hardware encryption algorithm and stored in a non-volatile memory. The encryption key for the encrypted storage is stored through a security chip.

7. The data secure transmission method according to any one of claims 1-5, characterized in that, The secure data transmission method further includes: Anomaly detection is implemented at the protocol layer. When an anomaly is detected, a security response process is triggered. The security response process includes: When a protocol violation data packet is detected based on a finite state machine, session freezing and device isolation are triggered. When a brute-force attack is detected, a dynamic key self-destruction mechanism is executed.

8. A data security transmission device, characterized in that, The data security transmission device includes: The data transmission parsing module is used to obtain the original data packets and communication device information, and to determine the confidentiality level and protocol type based on the original data packets; The encryption strategy determination module is used to convert the original data packet based on a preset intermediate format to obtain an intermediate data packet; if the protocol type is within a preset security protocol whitelist, then the corresponding whitelist encryption strategy is determined based on the confidentiality level and communication device information, wherein the whitelist encryption strategy includes at least one of transport layer encryption and hardware encryption; The data encryption transmission module is used to encrypt the intermediate data packet based on the whitelist encryption strategy to obtain an encrypted data packet, and to transmit data based on the encrypted data packet.

9. An electronic device, characterized in that, It includes a processor, a memory, and a communication bus; the communication bus is used to connect the processor and the memory; the processor is used to execute a computer program stored in the memory to implement the data secure transmission method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores a computer program that enables the computer to perform the data secure transmission method as described in any one of claims 1-7.

Images