Data security encryption method and system

Abstract

The invention relates to the technical field of data encryption, and discloses a data security encryption method and system, and the method comprises the steps: obtaining and segmenting an input data stream, calculating the information entropy value of each data segment in real time, and analyzing the distribution; and marking a low-entropy / high-entropy fragment by comparing the calculated mean value deviation with a preset threshold value. Respectively generating nonlinear transformation sequences for the two types of fragments, and retrieving matching transformation operators to form a transformation rule set; performing enhanced transformation on the low-entropy fragment, enhancing byte scrambling dispersion, and breaking bit skewness to obtain a uniformly distributed preliminary ciphertext; and dynamically adjusting the protection strength of the high-entropy fragment by referring to the initial ciphertext distribution characteristics and combining with the system resource load, and generating an optimized ciphertext. And overall verification is carried out on the optimized ciphertext, and secondary scrambling is carried out when a local regularity feature is detected, so that irregular ciphertext data can be obtained. And finally, integrating all irregular ciphertexts, eliminating identifiable rules in an encryption process, and forming a complete data stream ciphertext. The method can solve the problem of insufficient encryption capability.

Description

Technical Field

[0001] This invention relates to the field of data encryption technology, and in particular to a data security encryption method and system. Background Technology

[0002] Currently, data security encryption technology is a key means of protecting core assets in the information age. Especially in scenarios where massive amounts of data flow in real time, data security is directly related to business continuity and user trust. Any leakage may lead to serious consequences. Therefore, building an efficient and reliable encryption system with data security at its core has become an urgent need that all industries must face.

[0003] In one existing technology, a fixed byte substitution table and round function parameters are generated through a pre-configured static key. The transformation rules include shift operations with fixed step sizes and XOR operations with preset masks. The real-time received data stream is split into fixed block sizes, and the same strength encryption operation is performed on all data blocks. First, the byte positions within the block are rearranged through the byte substitution table, then XOR and obfuscation operations are performed for 10 rounds of fixed round functions, and finally all encrypted blocks are concatenated to generate complete ciphertext, which is then transmitted to the target node.

[0004] However, in existing technologies, regardless of whether the data stream is a high-sensitivity, high-entropy segment or a low-sensitivity, low-entropy segment, the same 10-round encryption and fixed permutation rules are used. This results in over-encryption of low-entropy data and insufficient protection of high-entropy sensitive data due to the fixed rules. The generation of the transformation sequence relies solely on a preset key and is not coupled with the random characteristics of the data itself. The ciphertext still retains traces of the original data in some parts, and the correlation between bytes is not completely broken. Attackers can gradually restore the plaintext information through differential analysis. In summary, existing technologies have insufficient encryption capabilities. Summary of the Invention

[0005] This invention provides a data security encryption method and system to solve the problem of insufficient encryption capabilities in the prior art.

[0006] Firstly, in order to solve the above-mentioned technical problems, the present invention provides a data security encryption method, comprising: The input data stream is acquired and segmented to obtain data segments. The corresponding information entropy value is calculated in real time for each data segment. The information entropy distribution of the data segment is analyzed based on the information entropy value to obtain the information entropy distribution result. Based on the information entropy distribution results, the mean deviation of the data segment is calculated. If the mean deviation is lower than a preset deviation threshold, it is marked as a low-entropy segment; if the mean deviation is higher than the preset deviation threshold, it is marked as a high-entropy segment. Based on the low-entropy segment and the high-entropy segment, corresponding nonlinear transformation sequences are generated respectively. Based on the nonlinear transformation sequences, matching transformation operators are retrieved to generate a set of transformation rules. The low-entropy fragment is transformed according to the set of transformation rules to enhance the dispersion of byte scrambling in the low-entropy fragment, break the skewed characteristics of bit distribution in the low-entropy fragment, and obtain a uniformly distributed preliminary ciphertext fragment. Analyze the distribution characteristics of the initial ciphertext fragment, transform the high-entropy fragment, adjust the protection level of the high-entropy fragment, and obtain the optimized ciphertext fragment; The optimized ciphertext segment is subjected to overall verification, and the corresponding bit distribution is analyzed. If the bit distribution is found to exhibit local regularity, a second scrambling operation is performed to obtain irregular ciphertext data. The irregular ciphertext data of each data segment is integrated, and the identifiable patterns of the encryption process are eliminated to form a complete data stream ciphertext.

[0007] Secondly, the present invention provides a data security encryption system, comprising: The data acquisition module is used to acquire the input data stream, segment the input data stream to obtain data segments, calculate the corresponding information entropy value for the data segments in real time, analyze the information entropy distribution of the data segments based on the information entropy value, and obtain the information entropy distribution result. The segment labeling module is used to calculate the mean deviation of the data segment based on the information entropy distribution result. If the mean deviation is lower than a preset deviation threshold, it is labeled as a low-entropy segment; if the mean deviation is higher than the preset deviation threshold, it is labeled as a high-entropy segment. The sequence generation module is used to generate corresponding nonlinear transformation sequences based on the low-entropy segment and the high-entropy segment, respectively, and to retrieve matching transformation operators based on the nonlinear transformation sequences to generate a set of transformation rules. The fragment transformation module is used to transform the low-entropy fragment according to the set of transformation rules, enhance the dispersion of byte scrambling in the low-entropy fragment, break the skewed characteristics of bit distribution in the low-entropy fragment, and obtain a uniformly distributed preliminary ciphertext fragment. The feature analysis module is used to analyze the distribution characteristics of the preliminary ciphertext fragment, transform the high-entropy fragment, adjust the protection strength of the high-entropy fragment, and obtain the optimized ciphertext fragment. The fragment verification module is used to perform overall verification on the optimized ciphertext fragment, analyze the corresponding bit distribution, and if the bit distribution is found to exhibit local regularity, a second scrambling operation is performed to obtain irregular ciphertext data. The data integration module is used to integrate the irregular ciphertext data of each data segment and eliminate the identifiable patterns in the encryption process to form a complete data stream ciphertext.

[0008] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention analyzes the information entropy distribution of data fragments and marks them as low-entropy or high-entropy types. For low-entropy fragments, the byte scrambling operation is strengthened, while for high-entropy fragments, the encryption strength is dynamically adjusted. In this way, encryption measures can be implemented according to the differences in the sensitivity of the data itself, avoiding the waste of resources caused by over-encryption of low-sensitivity data, while ensuring that high-sensitivity data receives sufficient protection.

[0009] (2) This invention transforms low-entropy segments to break the skewed characteristics of their bit distribution and generate uniformly distributed intermediate ciphertext. After optimizing and encrypting high-entropy segments, the entire ciphertext is verified, and a secondary scrambling operation is performed on the local regularities. This aims to completely eliminate the statistical regularities and identifiable traces remaining in the ciphertext, thereby effectively improving the encryption result's ability to resist attacks such as statistical analysis and differential analysis.

[0010] (3) The present invention generates a corresponding nonlinear transformation sequence based on the entropy characteristics of the data fragment, so that the encryption transformation is closely related to the inherent randomness of the data; this design not only eliminates the original distribution characteristics of low-entropy data, but also further destroys any potential correlation between bytes through subsequent secondary scrambling; ultimately, the ciphertext is completely free from any shadow of the plaintext, greatly reducing the possibility of attackers reconstructing plaintext information by analyzing local ciphertext fragments. Attached Figure Description

[0011] Figure 1 This is a schematic diagram of the data security encryption method provided in the first embodiment of the present invention; Figure 2 This is a schematic diagram of the data security encryption system structure provided in the second embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] Reference Figure 1 The first embodiment of the present invention provides a data security encryption method, including the following steps: S11, acquire the input data stream, segment the input data stream to obtain data segments, calculate the corresponding information entropy value for the data segments in real time, analyze the information entropy distribution of the data segments based on the information entropy value, and obtain the information entropy distribution result; S12, based on the information entropy distribution result, calculate the mean deviation of the data segment. If the mean deviation is lower than a preset deviation threshold, it is marked as a low-entropy segment; if the mean deviation is higher than the preset deviation threshold, it is marked as a high-entropy segment. S13, Generate corresponding nonlinear transformation sequences based on the low-entropy segment and the high-entropy segment respectively, retrieve matching transformation operators based on the nonlinear transformation sequences, and generate a set of transformation rules; S14, transform the low-entropy segment according to the set of transformation rules to enhance the dispersion of byte scrambling in the low-entropy segment, break the skewed characteristics of bit distribution in the low-entropy segment, and obtain a uniformly distributed preliminary ciphertext segment. S15, Analyze the distribution characteristics of the preliminary ciphertext fragment, transform the high-entropy fragment, adjust the protection strength of the high-entropy fragment, and obtain the optimized ciphertext fragment; S16, perform overall verification on the optimized ciphertext segment, analyze the corresponding bit distribution, and if the bit distribution is found to exhibit local regularity, perform a second scrambling operation to obtain irregular ciphertext data; S17, integrate the irregular ciphertext data of each data segment, and eliminate the identifiable patterns in the encryption process to form a complete data stream ciphertext.

[0014] In step S11, the process of acquiring an input data stream, segmenting the input data stream to obtain data fragments, calculating the corresponding information entropy value for each data fragment in real time, and analyzing the information entropy distribution of the data fragments based on the information entropy values ​​to obtain the information entropy distribution result includes: The input data stream is loaded into a sliding time window for interception, generating data segments; The frequency of occurrence of bytes within the data segment is counted, the probability of occurrence of each byte is calculated, and a probability density function is constructed based on the occurrence probabilities. The local Shannon entropy is obtained by performing a logarithmic operation on the occurrence probability based on the probability density function. The local Shannon entropy is arranged in time to construct an entropy value time series. If the value in the entropy value time series exceeds the benchmark fluctuation threshold, a randomness intensity indicator is generated. Based on the randomness intensity identifier, a feature mapping matrix is ​​constructed by mapping the entropy value time series. The entropy value distribution is then analyzed based on the feature mapping matrix to obtain the information entropy distribution result.

[0015] It should be noted that the window length for the sliding time is set to 256 bytes (to adapt to the efficiency of real-time data stream processing and the accuracy of entropy calculation, balancing latency and accuracy); the sliding step size is set to 128 bytes (using an overlapping truncation method to avoid data fragmentation leading to entropy calculation deviation, with an overlap ratio of 50%); when the input data stream buffer reaches 80% of the window length (204 bytes), the first truncation is initiated, and subsequent data fragments are continuously generated according to the sliding step size; if the remaining bytes at the end of the data stream are insufficient for the window length, they are padded with 0x00 to 256 bytes. Each data fragment contains "fragment ID-timestamp-original byte sequence-length identifier", where the length identifier indicates the actual number of valid bytes (excluding padding bytes), and a data fragment is generated.

[0016] Traverse the 256 bytes of the data segment, count the occurrence frequency of 256 bytes from 0x00 to 0xFF, and generate a frequency statistics table; the probability of a single byte is equal to the frequency of that byte divided by the number of valid bytes in the data segment, and the sum of the probabilities of all bytes is 1; use a discrete probability density function, with the domain defined as the range of byte values ​​(0x00-0xFF) and the range of the corresponding byte occurrence probability [0,1]; generate a probability density function table in key-value pair form with byte value as the x-axis and occurrence probability as the y-axis, in the format of "byte value - occurrence probability".

[0017] First, perform a base-2 logarithmic operation on the probability of occurrence of each byte (using binary logarithms, which conforms to the definition of information entropy). Then, multiply this by the probability of occurrence of each byte and take the negative value. Finally, sum all the results to obtain the local Shannon entropy. If all bytes have equal probability of occurrence, the local Shannon entropy is 8.00 (theoretical maximum entropy). If the data segment is a single byte repetition (e.g., all 0x00), the local Shannon entropy is 0.00 (theoretical minimum entropy). According to the generation order of the data segments, store the local Shannon entropy of each segment into the sequence in sequence. The sequence length grows dynamically, and the entropy values ​​of the 10 most recent segments are retained in real time (sliding window storage to avoid excessive memory usage). Construct an entropy time sequence using "timestamp-local Shannon entropy" as the element.

[0018] The baseline fluctuation threshold is based on the statistical analysis of historical data stream entropy values ​​and is set to 1.5 (i.e., when the absolute value of the difference between two adjacent entropy values ​​in the entropy time series is ≥1.5, it is judged as excessive fluctuation). If the difference in entropy values ​​of two consecutive segments is ≥1.5, a "high fluctuation" label is generated (indicating a sudden change in the randomness of the data stream). If the difference in entropy values ​​of three consecutive segments is <0.5, a "low fluctuation" label is generated (indicating that the randomness of the data stream is stable). In other cases, a "medium fluctuation" label is generated, and the label is bound to the entropy value of the corresponding segment for storage.

[0019] Based on the entropy time series of the most recent 10 segments, a 3×10 feature mapping matrix is ​​constructed, with each row corresponding to one type of feature. The first row corresponds to the original entropy value (local Shannon entropy is directly filled in); the second row corresponds to the normalized entropy value; and the third row corresponds to the fluctuation identifier encoding (high fluctuation = 2, medium fluctuation = 1, low fluctuation = 0). The mean, variance, maximum, and minimum values ​​of the original entropy values ​​in the feature mapping matrix are statistically analyzed to reflect the overall entropy level. The slope of the change in the normalized entropy value is used to determine whether the entropy value is rising, falling, or stable. The proportion of high / medium / low fluctuation identifiers is statistically analyzed. The structured output of "entropy value statistical indicators + trend judgment + fluctuation proportion" generates the information entropy distribution result.

[0020] In step S12, the mean deviation of the data segment is calculated based on the information entropy distribution result. If the mean deviation is lower than a preset deviation threshold, it is marked as a low-entropy segment; if the mean deviation is higher than the preset deviation threshold, it is marked as a high-entropy segment.

[0021] It should be noted that the local Shannon entropy statistics are based on 1000 historical data streams of different types (text, binary, and sensor data), with a reference mean of 4.0 (covering medium entropy levels in most scenarios and conforming to industry standard statistical benchmarks); the target entropy value is selected as the local Shannon entropy of the current data segment in S11 (retaining two decimal places); the mean deviation is the absolute difference between the local Shannon entropy of the current data segment and the reference mean; the encryption effect is verified based on historical data streams (the calibration dataset contains 200 sets of text data, 200 sets of binary data, and 100 sets of sensor data, covering low / medium / high entropy scenarios), taking into account... Regarding classification accuracy and encryption efficiency, the calibration dataset should cover as many data types (high entropy, low entropy, and mixed entropy) as possible in the application scenario. The encryption process is run on this dataset, and security and performance metrics, such as resistance to differential analysis and throughput, are evaluated to iteratively optimize various thresholds and parameters. Those skilled in the art can construct a representative calibration dataset based on their specific application environment to complete this process. A preset deviation threshold of 1.8 is set (after calibration, the classification accuracy reaches 94.3%, the false negative rate is 2.1%, and the false positive rate is 3.6%, effectively distinguishing between low and high random segments). The threshold is a fixed baseline value, which can be fine-tuned according to actual application scenarios (such as high security requirements or high real-time requirements), with an adjustment range of 1.5-2.2. For high security requirements, the threshold can be lowered to 1.5 (expanding the range of high-entropy segment judgment and strengthening protection), while for high real-time requirements, the threshold can be raised to 2.2 (narrowing the range of high-entropy segment judgment and improving efficiency).

[0022] It should be further explained that the setting of the reference mean and the preset deviation threshold can be determined based on offline analysis of typical data streams in the target application domain. Specifically, a large number of representative plaintext data samples are collected, such as text logs, sensor readings, database transaction streams, etc., and the local Shannon entropy of the sliding window of each sample is calculated to draw an entropy distribution statistical chart. The reference mean can be the median or mean of this distribution to reflect the overall entropy level of the dataset. The preset deviation threshold can be adjusted by balancing classification accuracy and encryption efficiency. Different thresholds are set to simulate classification and evaluate the overall security strength of the system after encrypting simplified low-entropy fragments, such as the resistance to ciphertext statistical attacks and processing latency. The threshold that can minimize the average encryption time within an acceptable range of security strength reduction is selected. Those skilled in the art can repeat this process to obtain applicable parameters based on their actual data characteristics.

[0023] If the mean deviation is less than 1.8, it indicates that the entropy value of the data segment is close to or low compared to the reference mean, with weak randomness and a tendency for bit distribution to be skewed. It is marked as a "low-entropy segment" and a flag bit "01" is added. If the mean deviation is ≥ 1.8, it indicates that the entropy value of the data segment deviates significantly from the reference mean and is high, with strong randomness and high information density. It is marked as a "high-entropy segment" and a flag bit "10" is added. If the local Shannon entropy is equal to 0.0 (purely repeated bytes), it is directly marked as a "low-entropy segment (extremely low point)" with a flag bit "00". If the local Shannon entropy is equal to 8.0 (theoretical maximum entropy), it is directly marked as a "high-entropy segment (extremely high point)" with a flag bit "11", and the corresponding encryption strategy is executed first. The marking result of each data segment is bound to "segment ID-timestamp-local Shannon entropy" in S11, and the structured output is "segment ID-timestamp-local Shannon entropy-mean deviation-segment type-flag bit".

[0024] In step S13, the process of generating corresponding nonlinear transformation sequences based on the low-entropy segment and the high-entropy segment, retrieving matching transformation operators based on the nonlinear transformation sequences, and generating a set of transformation rules includes: Based on the low-entropy segment and the high-entropy segment, calculate the byte clustering degree value, and construct a byte distribution feature vector based on the byte clustering degree value; The byte distribution feature vector is mapped to the chaotic attractor space to determine the initial state value and bifurcation control parameters. The initial state values ​​and the bifurcation control parameters are constructed to generate an initial nonlinear sequence, and numerical diffusion or position permutation is performed on the initial nonlinear sequence to obtain a transformation sequence; Extract the sequence complexity features of the transformed sequence, retrieve matching transformation operators, and generate a set of transformation rules.

[0025] It should be noted that byte clustering reflects the degree of clustering of identical bytes within a data segment. It is calculated using the Simpson index, a common metric in cryptography. Byte clustering equals the sum of the squares of the probabilities of occurrence of all bytes calculated in S11. For low-entropy segments, an additional "longest consecutive identical byte length" is calculated as an auxiliary indicator of clustering. For high-entropy segments, a "probability variance" is calculated to reflect the dispersion of the byte probability distribution, improving feature recognition. A 5-dimensional fixed-dimensional feature vector is constructed, with vector elements arranged in a fixed order: ([Local Shannon Entropy, Byte Clustering, Mean Deviation, Auxiliary Indicator, Segment Type Identifier]). In the auxiliary indicator, the longest consecutive identical byte length is filled in for low-entropy segments, and the probability variance is filled in for high-entropy segments. In the segment type identifier, low-entropy segments are marked as 0, and high-entropy segments are marked as 1. All vector elements are mapped to the interval [0,1].

[0026] The classic Logistic mapping is used as the core model for generating chaotic sequences. The normalized 5-dimensional byte distribution feature vector is mapped to the initial state value of the Logistic mapping through weighted summation. The weight coefficients are calibrated to [0.2, 0.3, 0.2, 0.2, 0.1] based on historical encryption effects (byte clustering has the highest weight, which meets the transformation requirements). The initial state value is equal to the sum of the feature vector elements multiplied by their corresponding weight coefficients. The bifurcation control parameters are dynamically adjusted based on the fragment type. Low-entropy fragments are set to 3.99 (located in the fully chaotic region of the Logistic mapping, generating the most random sequence, used to enhance scrambling); high-entropy fragments are set to 3.75 (located in the weakly chaotic region, generating a slightly more regular sequence, avoiding excessive transformation and wasting resources). The initial state value and the bifurcation control parameters are bound to a "chaotic parameter pair" and stored in association with the ID of the corresponding data fragment.

[0027] It should be noted that when mapping the byte distribution feature vector to a chaotic attractor, such as the Logistic mapping, the weight coefficients of each feature dimension reflect the priority of different features in contributing to the randomness of the final sequence. This weight can be initially determined through feature importance analysis, for example, by using a regression model based on a large number of data fragments, with the measured randomness index of the generated chaotic sequence, such as the pass rate of the NIST test suite, as the target, and backfitting the weights of each feature. The selection of bifurcation control parameters, such as 3.99 for low entropy and 3.75 for high entropy, is related to the desired degree of sequence chaos. Low-entropy fragments require stronger pseudo-randomness to mask the original pattern, so the parameters of the fully chaotic region of the mapping are used. High-entropy fragments already have randomness, and using slightly lower parameters can reduce computational complexity while ensuring a certain degree of randomness. Specific parameter values ​​can be selected based on the complexity and periodicity of the output sequence by scanning tests in the range [3.57, 4.0].

[0028] Based on the chaotic parameter pairs, substitute them into the Logistic mapping iterative formula. ,in Let r be the bifurcation control parameter (r=3.99 for low-entropy segments, r=3.75 for high-entropy segments), and let the number of iterations be consistent with the data segment length (256 bytes) to ensure the nonlinearity and ergodicity of the chaotic sequence. The iterations are performed with the number of iterations matching the data segment length (256 times, adapting to a 256-byte data segment). The resulting chaotic state value sequence is converted into an integer sequence (i.e., the initial nonlinear sequence), and each iteration state value is multiplied by... (Maximum value of a 32-bit unsigned integer), after rounding, modulo 256, we get an integer sequence with values ​​in the range [0, 255].

[0029] The low-entropy segment performs "numerical diffusion and full-position permutation" to enhance the nonlinearity and dispersion of the sequence and break the byte clustering characteristic of the low-entropy segment. The numerical diffusion adds Gaussian noise (variance equal to 0.01, mean equal to 0) to each element in the initial nonlinear sequence, and then rounds and moduloes it to avoid continuous repetition of values ​​in the sequence. The full-position permutation uses a random shuffling algorithm to shuffle the entire position of the diffused sequence, further enhancing the irregularity of the sequence. The high-entropy segment only performs "local numerical diffusion" without position permutation, balancing the transformation intensity and computational efficiency. The local numerical diffusion only adds Gaussian noise to three or more consecutive identical elements in the sequence, while the remaining elements remain unchanged, avoiding excessive transformation that leads to resource waste. Finally, a nonlinear transformation sequence with the same length as the data segment (256 bits) is generated. The low-entropy segment sequence has higher complexity, while the high-entropy segment sequence has moderate complexity, which is precisely matched with the characteristics of the segment.

[0030] Three core complexity features of nonlinear transformation sequences are extracted as the matching criteria for operator retrieval: sequence entropy (calculated using the Shannon entropy formula, reflecting the randomness of the sequence); variance of the difference between adjacent elements; and length of the longest non-repeating subsequence. A pre-defined transformation operator library is first constructed, containing three types of core transformation operators suitable for real-time data stream encryption. Each operator has clearly defined core functions, suitable sequence complexity feature ranges, and corresponding target data segment types, ensuring efficient and accurate retrieval matching.

[0031] Specifically, the transformation operator library is established based on statistical analysis of typical data encryption scenarios, covering various data types such as text, images, and sensor data. The operator library contains three core operators: a byte substitution operator that rearranges byte positions using a preset substitution table; an XOR obfuscation operator that performs an XOR operation between a dynamically generated mask value and the data bytes; and a bit flip operator that flips specified bits according to preset rules. The operator library's update mechanism includes periodically evaluating the encryption effect of each operator under the current data characteristics and dynamically adjusting operator parameters to adapt to changes in data distribution. The specific operator selection threshold is determined based on historical encryption effect statistics to ensure the matching accuracy between operators and data characteristics.

[0032] The first type is the byte substitution operator, whose core function is to shuffle the byte order within a data segment. By reconstructing the byte order, it breaks down the byte relationships in the original data. This operator is suitable for nonlinear transformation sequences with entropy in the range of [6.0, 8.0]. Due to the strong randomness of the sequence, it is more suitable for enhanced scrambling of low-entropy segments to break the inherent byte clustering and bit skewness characteristics of low-entropy segments. The second type is the XOR obfuscation operator, whose core function is to perform a bitwise XOR operation between the bytes of the data segment and the corresponding elements of the nonlinear transformation sequence to achieve byte value obfuscation and encryption. This operator is suitable for sequences with entropy in the range of [4.0, 6.0]. Nonlinear transformation sequences have moderate sequence complexity and only require a single operator to meet the encryption requirements of high-entropy segments, while avoiding the waste of computational resources caused by excessive transformation, thus balancing encryption security and system operating efficiency. The third type is the bit flipping operator, whose core function is to accurately flip specified bits in the bytes of a data segment according to the corresponding values ​​of the nonlinear transformation sequence, further refining the bit distribution within the byte. This operator is suitable for nonlinear transformation sequences with sequence entropy in the range of [2.0, 4.0] and is mainly used for supplementary encryption of special low-entropy segments. As an auxiliary means of byte substitution operators, it improves the encryption dispersion in extreme low-entropy scenarios.

[0033] The extracted sequence complexity features are matched with feature intervals in the operator library, and 1-2 transformation operators with the highest fit are selected (2 operators for low-entropy segments and 1 operator for high-entropy segments). The transformation rule set for each data segment contains "operator type-operator parameter-transformation sequence-execution order", where the operator parameters are generated by nonlinear transformation sequences (such as the permutation table of byte permutation operators and the mask value of XOR confusion operators). A transformation rule set is then generated.

[0034] In step S14, the transformation of the low-entropy segment according to the set of transformation rules enhances the dispersion of byte scrambling in the low-entropy segment, breaks the skewed characteristics of bit distribution in the low-entropy segment, and obtains a uniformly distributed preliminary ciphertext segment, including: The low-entropy segment is subjected to iterative operations using a set of transformation rules to construct an intermediate data stream. If there is a bit cluster in the intermediate data stream, then perform XOR and shift operations on the intermediate data stream to obtain a scrambled data block; Calculate the distribution difference value of the scrambled data block, and perform nonlinear permutation based on the distribution difference value to generate a reconstructed data sequence; A chi-square test is performed on the recombined data sequence. If the result of the chi-square test meets the preset uniformity threshold, the recombined data sequence is used to eliminate bit skewness features, and a uniformly distributed preliminary ciphertext fragment is output.

[0035] It should be noted that for low-entropy fragments, the transformation rule set generated by S13 is called (which by default matches two core operators: a byte permutation operator and a bit flipping operator). An iterative execution order of "permutation first, then flipping" is adopted to complete two rounds of progressive transformation. The first step executes the byte permutation operator, using the nonlinear transformation sequence in the transformation rule set as the byte permutation table. The 256 bytes of the low-entropy fragment are rearranged according to their corresponding positions in the permutation table. For example, if the value of the i-th bit in the permutation table is j, the i-th byte and the j-th byte of the fragment are swapped, completing the first round of scrambling. The second step executes the bit flipping operator, extracting the preset flipped bits from the transformation rule set (fixed selection of bits 3, 5, and 7, adapted to a single-byte 8-bit structure). The element value of the nonlinear transformation sequence is used as the flipping trigger (flipping the corresponding bit when the element value is odd, and remaining unchanged when it is even). The permuted bytes are precisely flipped bit by bit, completing the second round of obfuscation. After completing the two rounds of operator operations, a structured intermediate data stream is directly output. The data stream format is consistent with the original low-entropy fragment (256 bytes), and the fragment ID and transformation log are bound.

[0036] First, iterate through all bytes of the intermediate data stream and count the longest consecutive identical value (0 or 1) on each of the 8 bits. Set the clustering threshold to 16 (that is, when 16 consecutive 0s or 1s appear on a certain bit, it is determined that there is a bit clustering). At the same time, count the overall bit distribution ratio. If the ratio of 0 or 1 exceeds 60%, it is also determined that there is a bit clustering and a correction operation needs to be performed. The nonlinear transformation sequence generated by S13 is selected as the XOR mask. The intermediate data stream is XORed byte by byte with the mask (byte i XOR mask sequence i) to break the clustering trend of consecutive identical bits. The XOR operation adopts standard binary bit-by-bit XOR logic to ensure the uniformity of numerical confusion. Differentiated cyclic shift operation is performed on the XORed data stream. The low byte (0x00-0xFF first 128 bytes) is shifted left by 2 bits, and the high byte (0x80-0xFF last 128 bytes) is shifted right by 3 bits. The part exceeding 8 bits after shifting is cyclically padded to the other end of the byte to avoid the loss of bit information. After the XOR and shift operations are completed, a scrambled data block is generated with a length of 256 bytes. The clustering correction log (marking the clustering position and correction operation type) is recorded synchronously.

[0037] The distribution difference value is used to measure the degree of deviation of the scrambled data block from the uniform distribution. The core calculation logic is to first calculate the probability of occurrence of each byte in the scrambled data block, and then calculate the sum of squares of the difference between this probability and the theoretical uniform probability (1 / 256). If the distribution difference value is >0.01 (preset permutation threshold, calibrated to meet the optimization requirements of low-entropy segments), then nonlinear permutation is performed; if the distribution difference value is ≤0.01, this step can be skipped directly and proceed to the subsequent chi-square test. The nonlinear permutation adopts a group permutation strategy based on chaotic sequences. The scrambled data block is divided into 8 groups of 32 bytes each. The corresponding length of the nonlinear transformation sequence generated by S13 is used as the group permutation key. Byte nonlinear rearrangement is performed within each group. The rearrangement logic follows the iterative law of Logistic mapping to ensure that the byte distribution within the group after permutation is more uniform. The 8 groups that have completed nonlinear permutation are spliced ​​together in the original order to generate a 256-byte recombined data sequence. The distribution difference value after permutation is calculated simultaneously, and the trend of the value change is recorded.

[0038] Pearson's chi-square test is used as the core verification method to determine whether the bit distribution of the reconstructed data sequence is uniform. This conforms to the conventional uniformity verification standards in statistics and data encryption, and is used to verify whether the reconstructed data sequence has eliminated bit skewness. The degrees of freedom of the chi-square test are set to 255 (256-1 for the number of byte types), and the preset uniformity threshold is 300 (based on calibration using encrypted data from historical low-entropy fragments; at this threshold, the uniformity compliance rate is ≥95%). First, the observed frequency (the actual number of times each byte appears in the reconstructed data sequence) and the expected frequency (the theoretical number of times each byte appears under uniform distribution; the expected frequency equals the number of effective bytes in the data fragment divided by the number of byte types, i.e., 256×1 / 256=1) are constructed. Substituting these values ​​into the chi-square statistic formula, the chi-square statistic equals the square of the difference between the observed frequency and the expected frequency divided by the expected frequency. The frequency is used to calculate the chi-square test result. If the chi-square test result is ≤300 (meets the preset uniformity threshold), it indicates that the reconstructed data sequence has eliminated the bit distribution skewness and the byte scrambling dispersion meets the standard. The reconstructed data sequence is directly output as a preliminary ciphertext fragment, and the fragment ID, uniformity check result, and all transformation operation logs are bound. If the chi-square test result is >300 (does not meet the uniformity threshold), the XOR and shift operations are re-executed (adjusting the shift bits, shifting left by 3 bits and right by 2 bits) until the chi-square test result meets the threshold requirement, and a uniformly distributed preliminary ciphertext fragment is obtained.

[0039] It should be noted that the uniformity threshold for the chi-square test must be linked to the selected significance level. For example, for 255 degrees of freedom, if a significance level of 0.05 is set, the corresponding theoretical chi-square critical value can be obtained by looking up a table or by calculation. The preset uniformity threshold of 300 is an empirical critical value corresponding to a significance level slightly lower than 0.05 under 255 degrees of freedom. This value has been experimentally calibrated and can ensure the uniformity of the ciphertext while avoiding unnecessary repeated transformation operations due to overly strict testing. Similarly, local regularity judgment thresholds, such as consecutive identical bit lengths ≥32 and maximum theoretical entropy value of 7.8, can be obtained by statistical analysis of known secure ciphertexts and ciphertexts with weaknesses. For example, by analyzing the outputs of various successful cryptographic algorithms and statistically analyzing the maximum consecutive identical bit lengths that will not occur, this can be used as a reference for security thresholds. The maximum theoretical entropy value of 7.8 is slightly lower than 8 because, under a finite-length window, the theoretical entropy value of a completely uniform distribution cannot actually reach 8. Based on the window size, such as 512 bytes, a typical maximum value that is close to and achievable is determined through simulation as the threshold.

[0040] In step S15, analyzing the distribution characteristics of the initial ciphertext fragment, transforming the high-entropy fragment, and adjusting the protection strength of the high-entropy fragment to obtain an optimized ciphertext fragment includes: Obtain the resource consumption index of the current system load; Analyze the byte distribution statistical characteristics of the preliminary encrypted fragment, and calculate the local entropy deviation of the high-entropy fragment based on the byte distribution statistical characteristics; If the resource consumption index is higher than the preset resource load threshold, then the transformation iteration depth is set according to the local entropy deviation and a rule transformation is performed to generate an intermediate high-entropy sequence. A dynamic balance mask is generated by combining the byte distribution statistical characteristics of the intermediate high-entropy sequence and the preliminary ciphertext fragment. The dynamic balance mask is then used to perform a weighted correction on the intermediate high-entropy sequence to obtain an optimized ciphertext fragment.

[0041] It should be noted that the resource consumption index is used to quantify the real-time operating load of the system, avoiding excessive resource consumption by high-entropy fragment encryption which could lead to increased overall encryption latency. Three core monitorable indicators are selected for weighted calculation: CPU utilization (weight coefficient 0.5, with the greatest impact on encryption operations); memory utilization (weight coefficient 0.3); and disk I / O throughput (normalized to [0, 100%] with the system's maximum I / O throughput as 100%) (weight coefficient 0.2). The resource consumption index equals CPU utilization multiplied by its corresponding weight coefficient, plus memory utilization multiplied by its corresponding weight coefficient, plus disk I / O throughput multiplied by its corresponding weight coefficient. It is collected in real time through the system's underlying API (supporting mainstream Windows / Linux operating systems). The resource consumption index of the last 5 collections is retained, and the average value is taken as the current valid index.

[0042] Three core byte distribution statistical features of the initial ciphertext fragment output by S14 are extracted: byte distribution mean (arithmetic mean of all byte values ​​in the initial ciphertext fragment); byte distribution variance (reflecting the dispersion of byte values ​​in the initial ciphertext fragment); and overall Shannon entropy (calculated using the Shannon entropy formula in S11, reflecting the overall randomness of the initial ciphertext fragment). Local entropy deviation is used to measure the deviation between the entropy value of the high-entropy fragment and the overall entropy value of the initial ciphertext fragment, serving as the core basis for setting the transformation iteration depth. The specific calculation process is as follows: extract the local Shannon entropy of the high-entropy fragment (derived from the S11 calculation results); calculate the absolute difference between the local and overall Shannon entropy values ​​of the initial ciphertext fragment; map the local entropy deviation to the [0,1] interval (maximum value is 8, corresponding to the theoretical range of Shannon entropy), thus obtaining the local entropy deviation.

[0043] Based on the performance calibration of the real-time encryption system (500 sets of tests under different load scenarios), the preset resource load threshold is 70.0 (at this threshold, the system still retains sufficient resources to support encryption operations without significant latency increases). The threshold buffer is set to [65.0, 75.0] to avoid frequent switching of transformation strategies. The transformation iteration depth, i.e., the number of rounds of transformation operators executed in high-entropy segments, is dynamically set based on "resource consumption index R plus normalized local entropy deviation". If the resource consumption index > 70.0 (high system load), lightweight transformation is initiated; if the resource consumption index ≤ 70.0 (low / medium system load), standard transformation is initiated.

[0044] In high-load scenarios (resource consumption index > 70.0), the iteration depth is set to 1 (only one round of core transformation is performed to save resources). The transformation depth is linked to the local entropy deviation. When the local entropy deviation is > 0.2, the "XOR scrambling operator" is selected. When the local entropy deviation is ≤ 0.2, the rule transformation is skipped directly, and the original high-entropy fragment is used as the intermediate high-entropy sequence. In low / medium-load scenarios (resource consumption index ≤ 70.0), the iteration depth is set to 2 (two rounds of progressive transformation are performed to strengthen protection). The fixed order of "XOR scrambling first, then local bit flipping" is adopted, where bit flipping only applies to the 2nd and 6th bits of the byte (to avoid excessive scrambling). The high-entropy fragment transformation rule set generated by S13 is called (the default is to match the XOR scrambling operator). The nonlinear transformation sequence is used as the operator parameter, and the transformation is performed according to the set iteration depth. After completion, a 256-byte intermediate high-entropy sequence is output, which is consistent with the format of the initial ciphertext fragment.

[0045] A dynamic balancing mask is used to eliminate the distribution difference between the intermediate high-entropy sequence and the initial ciphertext fragment. Based on the byte distribution statistical characteristics of the initial ciphertext fragment and the byte distribution characteristics of the intermediate high-entropy sequence, a basic mask sequence (256 bytes in length) is constructed. The basic mask value is equal to the difference between the byte distribution mean and the byte distribution variance of the initial ciphertext fragment minus the byte distribution variance of the intermediate high-entropy sequence, multiplied by a random factor (the random factor is taken from the S13 nonlinear transformation sequence and normalized to [0,1]). The basic mask sequence is then weighted and adjusted in conjunction with the local entropy deviation. The final mask value is equal to the basic mask value multiplied by 1 plus the sum of the local entropy deviation. The final mask value is converted into an 8-bit unsigned integer (modulo 256) to generate a dynamic balancing mask (256 bytes) with the same length as the data fragment, ensuring that byte-by-byte operations can be performed with the intermediate high-entropy sequence.

[0046] The intermediate high-entropy sequence and the dynamically balanced mask are subjected to a byte-by-byte weighted summation operation. The operation rule is: the corrected byte value equals the intermediate sequence byte value multiplied by 0.7 plus the mask byte value multiplied by 0.3, where the weighting coefficient is 0.7:0.3 (intermediate high-entropy sequence:mask). After calibrating through 500 sets of tests, the consistency of the distribution between the corrected ciphertext and the initial ciphertext (entropy difference ≤ 0.5) is ensured, with a compliance rate of ≥ 93%. At the same time, the original random characteristics of the high-entropy segment are preserved (sequence entropy ≥ 7.5). The integer part is then modulo 256 to retain the original characteristics of the high-entropy segment. The randomness is matched with the distribution characteristics of the initial ciphertext; the overall Shannon entropy of the corrected sequence is quickly calculated to ensure that the difference between it and the overall Shannon entropy of the initial ciphertext fragment is ≤0.5 (preset distribution consistency threshold), so as to avoid over-correction that would reduce the randomness of high-entropy fragments; if the distribution consistency requirement is met, the corrected sequence is directly output as the optimized ciphertext fragment, and the fragment ID, iteration depth, resource consumption index and distribution consistency verification result are bound; if not, the weighting coefficients of the dynamic balance mask are readjusted and the correction process is repeated until the standard is met.

[0047] In step S16, the optimized ciphertext segment is subjected to overall verification, and the corresponding bit distribution is analyzed. If the bit distribution is found to exhibit local regularity, a second scrambling operation is performed to obtain irregular ciphertext data, including: The optimized ciphertext fragment set is mapped to a binary data stream, the global bit state flip rate of the binary data stream is calculated, and the binary data stream is divided into fixed windows according to the global bit state flip rate to construct a bit distribution feature matrix. If a window in the bit distribution feature matrix is ​​detected to exhibit local regularity, the logical address range where the local regularity is located is locked. Extract the bit sequence within the logical address range, generate a dynamic scrambling seed, and use the dynamic scrambling seed to generate a secondary scrambling mapping table for the logical address range; A secondary scrambling operation is performed on the logical address range according to the secondary scrambling mapping table to obtain irregular ciphertext data.

[0048] It should be noted that all processed optimized ciphertext fragments (including the initial ciphertext derived from low entropy and the optimized ciphertext derived from high entropy) are concatenated in order of fragment ID and timestamp to form a complete global ciphertext sequence. Then, a binary mapping conversion is performed to convert each byte (8-bit unsigned integer) into standard 8-bit two's complement form, padding with 0s at the high bits if less than 8 bits. This generates a continuous, unseparated binary data stream in the format of a character sequence (or binary array) composed of "0 / 1", with a length equal to the number of bytes in the global ciphertext sequence × 8. The global bit state flip rate is used to measure the drastic change of adjacent bits in the binary data stream. Its core definition is the proportion of the number of times two adjacent bits have different values ​​(0→1 or 1→0) to the total number of adjacent bit pairs. The flip rate is equal to the difference between the number of flips divided by the length of the binary data stream minus 1, and the value range is [0,1]. The closer the value is to 0.5, the more random the bit distribution and the weaker the regularity.

[0049] Using the global bit state flip rate as a reference, the binary data stream is divided into fixed windows to construct a bit distribution feature matrix. The fixed window length is 128 bits (adapting to real-time detection efficiency and local pattern recognition accuracy, balancing computational load and accuracy), and the sliding step size is 64 bits (overlap ratio of 50% to avoid missed detections due to local bit fragmentation). Three core features are extracted from each window as row elements of the feature matrix, including the proportion of 0 / 1 bits within the window (the ratio of the number of 0s to the number of 1s in the window); the length of the longest consecutive identical bits within the window; and the local flip rate within the window (calculated using the same formula as the global flip rate, only for bit data within the window). A 3×N bit distribution feature matrix is ​​constructed with the window index as the column and the core features of the window as the row (N is the total number of windows).

[0050] Based on the conventional requirements for judging the statistical regularity of ciphertext in the field of cryptography, three local regularity judgment thresholds are preset. If any two or more of them are met, it is judged that there are local regularity features, including the ratio of 0 / 1 bits in the window being greater than 3:1 or less than 1:3 (that is, the proportion of a certain bit exceeds 75%, and there is obvious skewness). The longest consecutive identical bit length of the window is ≥32 (32 consecutive 0s or 1s, with obvious clustering characteristics); the local flip rate of the window is <0.2 or >0.8 (bit flips are too sparse or too dense, deviating from random distribution); the judgment threshold has been tested and calibrated with 500 sets of ciphertext data, and the pattern recognition accuracy is ≥96%, which can effectively capture statistical traces that attackers can use.

[0051] When a local regularity is detected in a window, the logical address range corresponding to that regularity is locked. The logical address starts at address 0 of the binary data stream and increments sequentially, with each bit corresponding to a unique logical address. Based on the window number, window length, and sliding step, the logical address range of the binary data stream corresponding to that window is calculated. The starting address equals the difference between the window number and 1, multiplied by the sliding step, and the ending address equals the starting address plus the window length minus 1. If adjacent windows detect a regular feature and their address ranges overlap, address range merging is performed to generate a continuous logical address range. A structured binding of "window number - regular feature type - starting logical address - ending logical address - merge flag" is used to lock the logical address range.

[0052] The dynamic scrambling seed is used to generate a unique secondary scrambling mapping table, ensuring that the rules for each secondary scrambling are different, avoiding residual fixed transformation patterns. The generation logic is deeply bound to the encryption process, possessing unpredictability. Seed extraction generates the dynamic scrambling seed by fusing three types of core data: the locked logical address range information (start address plus end address plus address length); the local Shannon entropy of the bit sequence within this address range (calculated using the same Shannon entropy formula as S11); and a segment of the corresponding length in the nonlinear transformation sequence generated by S13 (a segment of the sequence with the same address length is extracted). The above three types of data are weighted and summed, and then hashed using the SHA-256 hash algorithm. The first 32 bits of the hash value are extracted as the dynamic scrambling seed (32-bit unsigned integer, with a value range of 0 to 2^32-1).

[0053] The secondary scrambling map is the core basis for implementing local bit sequence scrambling. It employs a permutation table construction logic based on a pseudo-random number generator. The pseudo-random number generator used is the MersenneTwister (MT19937) pseudo-random number generator (a common choice in the cryptographic field, possessing good randomness and period length), with a dynamic scrambling seed as the initial seed. The MT19937 generator is initialized by inputting the dynamic scrambling seed, completing seed loading. A pseudo-random integer sequence with the same length as the locked logical address range is generated (e.g., 192 pseudo-random numbers are generated for an address length of 192). The pseudo-random integer sequence is sorted, and the original index position of each element is recorded, generating key-value pairs of "original index - new index". Based on these key-value pairs, a secondary scrambling map is constructed, with the map length matching the logical address range. Each position corresponds to the target position of the scrambled bit sequence. The sequence entropy of the map is calculated to ensure its Shannon entropy is ≥7.0 (close to the theoretical maximum entropy), avoiding any inherent regularity in the map itself and ensuring the effectiveness of the secondary scrambling.

[0054] For the locked logical address range, precise local secondary scrambling is performed based on the secondary scrambling mapping table, correcting only abnormal regions. The bit sequence within the locked logical address range is extracted from the binary data stream as the bit sequence to be scrambled. According to the "original index-new index" correspondence in the secondary scrambling mapping table, each bit of the bit sequence to be scrambled is mapped to a new position, completing the rearrangement of the local bit sequence. The scrambled bit sequence is then filled back into the corresponding logical address range of the original binary data stream, replacing the original abnormal bit sequence, while maintaining the overall length of the binary data stream and other regions unchanged. The "fragment ID-logical address range-bit distribution characteristics before scrambling-bit distribution characteristics after scrambling" is bound.

[0055] After completing the secondary scrambling of all locked regions, the final irregular ciphertext data is generated. The specific process is as follows: For the backfilled complete binary data stream, the global bit state flip rate is recalculated, and the presence of new local regularity features is detected. If they exist, the detection of local regularity features is repeated. If local regularity features are still detected after 3 times, the dynamic scrambling seed is automatically adjusted (by appending 8 bits after the current timestamp), the mapping table is regenerated, and scrambling is performed to ensure that infinite loops are avoided. The qualified binary data stream is split into groups of 8 bits and converted into corresponding bytes (8-bit unsigned integers) to form complete byte stream ciphertext. The byte stream ciphertext is segmented and encapsulated according to the original data fragment format and bound to "global ciphertext ID - generation timestamp - uniformity check result - secondary scrambling log" as irregular ciphertext data output.

[0056] In step S17, integrating the irregular ciphertext data of each data segment and eliminating the discernible patterns in the encryption process to form a complete data stream ciphertext includes: Extract the logical sequence index values ​​of the irregular ciphertext data and construct a fragment recombination sequence table; According to the fragment recombination sequence list, the fragments of the irregular ciphertext data are encapsulated into ciphertext units, and the gaps between adjacent ciphertext units are filled to obtain an initial aggregated ciphertext stream; The initial aggregated ciphertext stream is divided into multiple fixed-length windows, and the entropy value of each window is calculated. For windows whose entropy value is significantly lower than the preset maximum theoretical value, a local XOR mask operation is performed to obtain the corrected aggregated ciphertext stream. A complete checksum is added to the end of the corrected aggregated ciphertext stream, and the final data stream ciphertext is output.

[0057] It should be noted that, in order to avoid leaving segmentation patterns when reassembling ciphertext fragments in the original timestamp / ID order (attackers can associate fragment order with the original data stream features), it is necessary to extract the hidden logical sequence index value in the fragments of irregular ciphertext data as the core basis for reassembly. The index value contains unique identification information generated by S11-S16 (fragment ID, timestamp, hash digest of local Shannon entropy value) at the beginning of each fragment of irregular ciphertext data. The last 8 bits of the hash digest are extracted as the logical sequence index value (the value range is 0~255). Since the hash digest is unique, the corresponding logical sequence index value can effectively distinguish different ciphertext fragments and avoid fragment confusion during reassembly. The logical sequence index value is obtained.

[0058] The fragment reassembly order table is used to break the original order of ciphertext fragments and eliminate any residual order patterns that may remain during the "segmentation-encryption-reassembly" process. The construction process involves using the logical sequence index value as the key, sorting in ascending order (which can also be configured as descending, supporting scenario-based adjustments), and reordering all fragments of irregular ciphertext data to avoid following the fragment order of the original data stream. A two-dimensional reassembly order table is constructed, containing five core fields: "sorting number - ciphertext fragment ID - logical sequence index value - start offset - end offset." The "start / end offset" is used to mark the position of the fragment in the final aggregated ciphertext (facilitating subsequent gap filling and index tracing). The reassembly order table is encrypted and cached (using the S13 XOR obfuscation operator) to prevent table structure leakage from breaking the ciphertext fragment order, thus improving overall security.

[0059] To improve the integrity and traceability of ciphertext fragments, the sorted, irregular ciphertext data fragments are encapsulated into standardized ciphertext units. The unit structure adopts a three-segment structure of "header identifier, encrypted text data, and tail checksum". The header identifier (16 bytes) includes the ciphertext fragment ID, logical sequence index value, and fragment length, which is used for fragment identification during subsequent decryption and encapsulation. The ciphertext data (variable length, default 256 bytes) is the irregular ciphertext data itself, which is kept consistent with the original fragment length. The tail checksum (4 bytes) uses the CRC16 algorithm to calculate the checksum value of the ciphertext data, which is used to verify whether data tampering or loss has occurred during the encapsulation process. The structure of all ciphertext units is consistent to avoid statistical patterns left due to differences in unit format.

[0060] Since the length of the ciphertext unit is fixed (default 276 bytes), but adjacent units may have slight gaps (or overlaps) due to offset calculations after reassembly, a gap-filling operation needs to be performed. The fragment reassembly order table is traversed, and the "end offset" of the adjacent ciphertext unit is compared with the "start offset" of the next unit. The gap length is calculated (the gap length is equal to the start offset of the next unit minus the end offset of the current unit minus 1). Pseudo-random padding data is used to fill the gaps. The padding data comes from the nonlinear transformation sequence generated by S13 (a segment corresponding to the gap length is extracted) to avoid leaving regular features by using fixed padding values. If unit overlap occurs (the gap length is negative), only the complete data of the previous unit is retained, the overlapping part of the next unit is trimmed, and the offset of the reassembly order table is updated to ensure that the aggregated ciphertext stream has no redundant data. All encapsulated ciphertext units are spliced ​​according to the reassembly order table, and gap filling is completed to generate a continuous and unseparated initial aggregated ciphertext stream with a length equal to the sum of the length of all ciphertext units and the length of the padding data. The padding log (marking the gap position, padding length, and padding data source) is recorded synchronously to generate the initial aggregated ciphertext stream.

[0061] To detect whether there are residual low-entropy regions in the initial aggregated ciphertext stream (which may become a breakthrough point for attackers), fixed window division and entropy calculation are required. The fixed window length is 512 bytes (adapting to the efficiency of global entropy detection and the accuracy of identifying local low-entropy regions, balancing computational load and accuracy), and the sliding step size is 256 bytes (with an overlap ratio of 50% to avoid missing local low-entropy regions). For each window, the local Shannon entropy is calculated using the same Shannon entropy formula as S11, with a value range of 0 to 8. The preset maximum theoretical value is 7.8 (close to the theoretical maximum value of 8.0 for single-byte Shannon entropy, which can effectively identify low-entropy abnormal regions after calibration). If the local Shannon entropy of a window is <7.8 (significantly lower than the preset maximum theoretical value), it is determined to be a low-entropy abnormal window, and a local XOR mask operation is required for correction. If the local Shannon entropy of a window is ≥7.8, it is determined to be a normal window, and no additional processing is required.

[0062] For low-entropy abnormal windows, a local XOR mask operation is used to increase their entropy value and eliminate local regularity features. The specific process is as follows: the XOR mask is generated using the local Shannon entropy H_w of the low-entropy window and the window's starting offset as seeds. The Logistic chaotic mapping of S13 is called to generate a chaotic XOR mask with the same length as the window (512 bytes), ensuring the randomness and uniqueness of the mask and avoiding the presence of patterns left by fixed masks. The ciphertext data of the low-entropy abnormal window is XORed byte by byte with the chaotic XOR mask. The local Shannon entropy of the corrected window is recalculated to ensure that the local Shannon entropy is ≥7.8 (meeting the preset maximum theoretical value requirement). If it is not met, the XOR mask is regenerated (adjusting the bifurcation control parameters of the Logistic mapping), and the XOR correction operation is repeated until the standard is met. All normal windows and the corrected windows are concatenated in the original order to generate a continuous and unseparated corrected aggregated ciphertext stream, and the correction log is recorded synchronously (marking the low-entropy window position, the entropy value before correction, the entropy value after correction, and the mask seed).

[0063] To ensure that the final encrypted data stream is not tampered with or lost during transmission and storage, a complete global checksum is added. The checksum uses the SHA-256 hash algorithm (a common choice in cryptography, known for its high strength and collision resistance). The corrected aggregated ciphertext stream is taken as the complete input data and passed to the SHA-256 hash function. The SHA-256 hash operation generates a 256-bit (32-byte) hash digest, which is the complete checksum. The checksum corresponds one-to-one with the content of the corrected aggregated ciphertext stream. If any minor modification occurs to the ciphertext stream, the checksum will change significantly, effectively verifying the integrity and authenticity of the data.

[0064] The complete checksum and the corrected aggregated ciphertext stream are integrated to generate the final ciphertext data stream. The encapsulation structure adopts the structure of "corrected aggregated ciphertext stream plus checksum header identifier plus complete checksum". The checksum header identifier (8 bytes) is used to mark the starting position of the checksum, which is used to facilitate the rapid extraction of the checksum for verification during decryption. The integrated ciphertext data is converted into a standard binary byte stream format, supporting mainstream data transmission protocols (such as TCP / IP, CAN bus) and storage formats (such as binary files, database BLOB fields). The structured binding of "final ciphertext ID - generation timestamp - ciphertext length - complete checksum - encryption process log (all operation records of S11-S16)" is used as the final ciphertext data stream output to complete the entire adaptive encryption process. A simplified decryption guide (including the reconstructed sequence table decryption key, checksum extraction rules, and XOR mask inverse operation logic) is output synchronously to ensure that the decryption end can restore the original data stream normally. After the decryption end extracts the checksum, it recalculates the SHA-256 hash of the corrected aggregated ciphertext stream. If the hash values ​​are inconsistent, a 'data tampering warning' is immediately output and the decryption process is terminated; if they are consistent, the fragment reconstructing and decryption operations continue.

[0065] In summary, this invention uses information entropy distribution analysis to mark low-entropy / high-entropy segments, strengthens byte scrambling for low-entropy segments (increasing dispersion), and adjusts the protection level of high-entropy segments as needed (avoiding over-encryption). This achieves a precise match of "high sensitivity, high protection; low sensitivity, high efficiency," eliminating resource waste and ensuring the strength of sensitive data protection. This invention breaks the bit distribution skewness of low-entropy segments, generating a uniformly distributed initial ciphertext. After optimizing and transforming high-entropy segments, it further detects local regularities through overall verification and performs secondary scrambling, ultimately eliminating all identifiable traces in the ciphertext. This prevents attackers from capturing decryption clues through statistical analysis and differential analysis, improving the anti-attack capability of the encryption system. This invention's scheme, through the design of "entropy feature matching nonlinear transformation sequence," deeply binds byte scrambling with the random characteristics of the data itself. This not only breaks the bit skewness of low-entropy segments but also further disperses potential correlations between bytes through secondary scrambling, completely eliminating the shadow of the original data in the ciphertext and reducing the possibility of attackers reconstructing the plaintext through local segments.

[0066] Reference Figure 2 The second embodiment of the present invention provides a data security encryption system, comprising: The data acquisition module is used to acquire the input data stream, segment the input data stream to obtain data segments, calculate the corresponding information entropy value for the data segments in real time, analyze the information entropy distribution of the data segments based on the information entropy value, and obtain the information entropy distribution result. The segment labeling module is used to calculate the mean deviation of the data segment based on the information entropy distribution result. If the mean deviation is lower than a preset deviation threshold, it is labeled as a low-entropy segment; if the mean deviation is higher than the preset deviation threshold, it is labeled as a high-entropy segment. The sequence generation module is used to generate corresponding nonlinear transformation sequences based on the low-entropy segment and the high-entropy segment, respectively, and to retrieve matching transformation operators based on the nonlinear transformation sequences to generate a set of transformation rules. The fragment transformation module is used to transform the low-entropy fragment according to the set of transformation rules, enhance the dispersion of byte scrambling in the low-entropy fragment, break the skewed characteristics of bit distribution in the low-entropy fragment, and obtain a uniformly distributed preliminary ciphertext fragment. The feature analysis module is used to analyze the distribution characteristics of the preliminary ciphertext fragment, transform the high-entropy fragment, adjust the protection strength of the high-entropy fragment, and obtain the optimized ciphertext fragment. The fragment verification module is used to perform overall verification on the optimized ciphertext fragment, analyze the corresponding bit distribution, and if the bit distribution is found to exhibit local regularity, a second scrambling operation is performed to obtain irregular ciphertext data. The data integration module is used to integrate the irregular ciphertext data of each data segment and eliminate the identifiable patterns in the encryption process to form a complete data stream ciphertext.

[0067] It should be noted that the data security encryption system provided in this embodiment of the invention is used to execute all the process steps of the data security encryption method in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0068] It should be noted that the system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the system embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0069] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A data security encryption method, characterized in that, include: The input data stream is acquired and segmented to obtain data segments. The corresponding information entropy value is calculated in real time for each data segment. The information entropy distribution of the data segment is analyzed based on the information entropy value to obtain the information entropy distribution result. Based on the information entropy distribution results, the mean deviation of the data segment is calculated. If the mean deviation is lower than a preset deviation threshold, it is marked as a low-entropy segment; if the mean deviation is higher than the preset deviation threshold, it is marked as a high-entropy segment. Based on the low-entropy segment and the high-entropy segment, corresponding nonlinear transformation sequences are generated respectively. Based on the nonlinear transformation sequences, matching transformation operators are retrieved to generate a set of transformation rules. The low-entropy fragment is transformed according to the set of transformation rules to enhance the dispersion of byte scrambling in the low-entropy fragment, break the skewed characteristics of bit distribution in the low-entropy fragment, and obtain a uniformly distributed preliminary ciphertext fragment. Analyze the distribution characteristics of the initial ciphertext fragment, transform the high-entropy fragment, adjust the protection level of the high-entropy fragment, and obtain the optimized ciphertext fragment; The optimized ciphertext segment is subjected to overall verification, and the corresponding bit distribution is analyzed. If the bit distribution is found to exhibit local regularity, a second scrambling operation is performed to obtain irregular ciphertext data. The irregular ciphertext data of each data segment is integrated, and the identifiable patterns of the encryption process are eliminated to form a complete data stream ciphertext.

2. The data security encryption method according to claim 1, characterized in that, The process of acquiring an input data stream, segmenting the input data stream to obtain data fragments, calculating the corresponding information entropy value for each data fragment in real time, analyzing the information entropy distribution of the data fragments based on the information entropy values, and obtaining the information entropy distribution result includes: The input data stream is loaded into a sliding time window for interception, generating data segments; The frequency of occurrence of bytes within the data segment is counted, the probability of occurrence of each byte is calculated, and a probability density function is constructed based on the occurrence probabilities. The local Shannon entropy is obtained by performing a logarithmic operation on the occurrence probability based on the probability density function. The local Shannon entropy is arranged in time to construct an entropy value time series. If the value in the entropy value time series exceeds the benchmark fluctuation threshold, a randomness intensity indicator is generated. Based on the randomness intensity identifier, a feature mapping matrix is ​​constructed by mapping the entropy value time series. The entropy value distribution is then analyzed based on the feature mapping matrix to obtain the information entropy distribution result.

3. The data security encryption method according to claim 1, characterized in that, The process involves generating corresponding nonlinear transformation sequences based on the low-entropy segment and the high-entropy segment, retrieving matching transformation operators based on the nonlinear transformation sequences, and generating a set of transformation rules, including: Based on the low-entropy segment and the high-entropy segment, calculate the byte clustering degree value, and construct a byte distribution feature vector based on the byte clustering degree value; The byte distribution feature vector is mapped to the chaotic attractor space to determine the initial state value and bifurcation control parameters. The initial state values ​​and the bifurcation control parameters are constructed to generate an initial nonlinear sequence, and numerical diffusion or position permutation is performed on the initial nonlinear sequence to obtain a transformation sequence; Extract the sequence complexity features of the transformed sequence, retrieve matching transformation operators, and generate a set of transformation rules.

4. The data security encryption method according to claim 1, characterized in that, The transformation of the low-entropy fragment according to the set of transformation rules enhances the dispersion of byte scrambling in the low-entropy fragment, breaks the skewed characteristics of bit distribution in the low-entropy fragment, and obtains a uniformly distributed preliminary ciphertext fragment, including: The low-entropy segment is subjected to iterative operations using a set of transformation rules to construct an intermediate data stream. If there is a bit cluster in the intermediate data stream, then perform XOR and shift operations on the intermediate data stream to obtain a scrambled data block; Calculate the distribution difference value of the scrambled data block, and perform nonlinear permutation based on the distribution difference value to generate a reconstructed data sequence; A chi-square test is performed on the recombined data sequence. If the result of the chi-square test meets the preset uniformity threshold, the recombined data sequence is used to eliminate bit skewness features, and a uniformly distributed preliminary ciphertext fragment is output.

5. The data security encryption method according to claim 1, characterized in that, The process of analyzing the distribution characteristics of the initial ciphertext fragment, transforming the high-entropy fragment, and adjusting the protection level of the high-entropy fragment to obtain an optimized ciphertext fragment includes: Obtain the resource consumption index of the current system load; Analyze the byte distribution statistical characteristics of the preliminary encrypted fragment, and calculate the local entropy deviation of the high-entropy fragment based on the byte distribution statistical characteristics; If the resource consumption index is higher than the preset resource load threshold, then the transformation iteration depth is set according to the local entropy deviation and a rule transformation is performed to generate an intermediate high-entropy sequence. A dynamic balance mask is generated by combining the byte distribution statistical characteristics of the intermediate high-entropy sequence and the preliminary ciphertext fragment. The dynamic balance mask is then used to perform a weighted correction on the intermediate high-entropy sequence to obtain an optimized ciphertext fragment.

6. The data security encryption method according to claim 1, characterized in that, The optimized ciphertext segment is subjected to overall verification, and the corresponding bit distribution is analyzed. If the bit distribution is found to exhibit local regularity, a second scrambling operation is performed to obtain irregular ciphertext data, including: The optimized ciphertext fragment set is mapped to a binary data stream, the global bit state flip rate of the binary data stream is calculated, and the binary data stream is divided into fixed windows according to the global bit state flip rate to construct a bit distribution feature matrix. If a window in the bit distribution feature matrix is ​​detected to exhibit local regularity, the logical address range where the local regularity is located is locked. Extract the bit sequence within the logical address range, generate a dynamic scrambling seed, and use the dynamic scrambling seed to generate a secondary scrambling mapping table for the logical address range; A secondary scrambling operation is performed on the logical address range according to the secondary scrambling mapping table to obtain irregular ciphertext data.

7. The data security encryption method according to claim 1, characterized in that, The process of integrating the irregular ciphertext data from each data segment and eliminating any discernible patterns in the encryption process to form a complete data stream ciphertext includes: Extract the logical sequence index values ​​of the irregular ciphertext data and construct a fragment recombination sequence table; According to the fragment recombination sequence list, the fragments of the irregular ciphertext data are encapsulated into ciphertext units, and the gaps between adjacent ciphertext units are filled to obtain an initial aggregated ciphertext stream; The initial aggregated ciphertext stream is divided into multiple fixed-length windows, and the entropy value of each window is calculated. For windows whose entropy value is significantly lower than the preset maximum theoretical value, a local XOR mask operation is performed to obtain the corrected aggregated ciphertext stream. A complete checksum is added to the end of the corrected aggregated ciphertext stream, and the final data stream ciphertext is output.

8. A data security encryption system, characterized in that, include: The data acquisition module is used to acquire the input data stream, segment the input data stream to obtain data segments, calculate the corresponding information entropy value for the data segments in real time, analyze the information entropy distribution of the data segments based on the information entropy value, and obtain the information entropy distribution result. The segment labeling module is used to calculate the mean deviation of the data segment based on the information entropy distribution result. If the mean deviation is lower than a preset deviation threshold, it is labeled as a low-entropy segment; if the mean deviation is higher than the preset deviation threshold, it is labeled as a high-entropy segment. The sequence generation module is used to generate corresponding nonlinear transformation sequences based on the low-entropy segment and the high-entropy segment, respectively, and to retrieve matching transformation operators based on the nonlinear transformation sequences to generate a set of transformation rules. The fragment transformation module is used to transform the low-entropy fragment according to the set of transformation rules, enhance the dispersion of byte scrambling in the low-entropy fragment, break the skewed characteristics of bit distribution in the low-entropy fragment, and obtain a uniformly distributed preliminary ciphertext fragment. The feature analysis module is used to analyze the distribution characteristics of the preliminary ciphertext fragment, transform the high-entropy fragment, adjust the protection strength of the high-entropy fragment, and obtain the optimized ciphertext fragment. The fragment verification module is used to perform overall verification on the optimized ciphertext fragment, analyze the corresponding bit distribution, and if the bit distribution is found to exhibit local regularity, a second scrambling operation is performed to obtain irregular ciphertext data. The data integration module is used to integrate the irregular ciphertext data of each data segment and eliminate the identifiable patterns in the encryption process to form a complete data stream ciphertext.

Images