Data transmission method and system based on information security
By employing an enhanced secure transmission framework and multimodal biometric data acquisition, this approach addresses the privacy leaks, centralized trust issues, and future security concerns inherent in existing end-to-end secure data transmission protocols, achieving efficient, dynamic data transmission security and resistance to quantum attacks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- GUANGDONG VOCATIONAL & TECHNICAL COLLEGE
- Filing Date
- 2026-02-10
- Publication Date
- 2026-05-12
AI Technical Summary
Existing end-to-end secure data transmission protocols suffer from privacy leakage risks, centralized trust bottlenecks, rigid identity authentication, lack of future security, and static authentication states. Furthermore, current research has failed to systematically integrate zero-knowledge proofs, blockchain identity, and post-quantum cryptography.
An enhanced secure transmission framework is adopted, which combines a zero-knowledge proof generation module, a distributed identity resolution module, a post-quantum cryptography module, and a continuous authentication monitor to achieve identity verification, decentralized trust management, and resistance to quantum attacks. Continuous authentication is achieved through hybrid key exchange, double signature, and multimodal biometric collection.
It achieves confidentiality, integrity, identity privacy, and resistance to quantum attacks in untrusted network environments, reduces reliance on centralization, and provides dynamic authentication and efficient security response.
Smart Images
Figure CN122027166A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology, and specifically to a data transmission method and system based on information security. Background Technology
[0002] Current mainstream end-to-end secure data transmission (such as the TLS / SSL protocol) heavily relies on traditional Public Key Infrastructure (PKI) for authentication. This system has the following inherent flaws:
[0003] Privacy risk: The certificate contains plaintext such as server domain name and organizational information, which can be easily used by eavesdroppers to build user profiles.
[0004] Centralized trust bottleneck: Relying on a few trusted Certificate Authorities (CAs), a single point of failure or a CA being compromised will lead to a collapse of global trust.
[0005] Rigid identity authentication: It only uses binary verification of "yes / no", which cannot support fine-grained and selective attribute declarations (such as "proving that the user is over 18 years old without revealing the specific age").
[0006] Lack of future security: Existing asymmetric encryption algorithms (such as RSA and ECC) cannot withstand attacks from future quantum computers.
[0007] Static authentication state: After authentication during the handshake phase, there is a lack of continuous verification of the user's identity throughout the entire session.
[0008] While some research has attempted to introduce zero-knowledge proofs, blockchain identity, or post-quantum cryptography, most of these are isolated solutions that have failed to be systematically integrated into a complete data transmission protocol stack, and they are inadequate in terms of efficiency, compatibility, and user experience. Summary of the Invention
[0009] To address the aforementioned issues, this invention provides a data transmission method and system based on information security, aiming to ensure the confidentiality, integrity, identity privacy, and resistance to quantum attacks in untrusted network environments.
[0010] To achieve the above objectives, the present invention provides the following technical solution:
[0011] On one hand, embodiments of the present invention provide a data transmission method based on information security, the method comprising the following steps:
[0012] S100: Obtain the client's zero-knowledge proof capability declaration, distributed identity identifier, and data to be transmitted;
[0013] S200, the zero-knowledge proof capability declaration, distributed identity identifier and data to be transmitted are input into the enhanced secure transmission framework. During the handshake phase, based on the zero-knowledge proof capability declaration, an identity verification certificate is generated by the zero-knowledge proof generation module. The identity verification certificate is used to verify that the client meets the preset policy and has the private key corresponding to the long-term identity commitment.
[0014] S300, the distributed identity resolution module verifies the matching between the public key corresponding to the distributed identity identifier and the handshake signature, and queries the verifiable credential registry on the blockchain to confirm that the distributed identity identifier holds a specific qualification credential;
[0015] S400 performs hybrid key exchange and double signature operations through the post-quantum cryptography module to generate session keys;
[0016] S500: During the data transmission phase, user behavior characteristics are collected and a trust score is calculated by a continuous authentication monitor. Based on the comparison result of the trust score and a dynamic threshold, a corresponding security response strategy is executed, and the data to be transmitted is transmitted through an encrypted channel.
[0017] Optionally, in S200, generating the authentication certificate through the zero-knowledge proof generation module includes:
[0018] S210, obtain the random number challenge sent by the server and the strategy that requires client proof;
[0019] S220, Invoke the local zero-knowledge proof prover to generate proof data. The proof data is used to verify that the client knows the attribute value that satisfies the policy, and that the attribute value corresponds to the long-term identity commitment. At the same time, the client has a private key bound to the identity.
[0020] S230, the proof data and the digital signature of the random number challenge are sent to the server together, so that the server can verify the digital signature and verify the proof data using a zero-knowledge proof verifier.
[0021] Optionally, in S300, verifying the matching between the public key corresponding to the distributed identity identifier and the handshake signature through the distributed identity resolution module includes:
[0022] S310, obtain the distributed identity identifier sent by the client and its corresponding distributed identity document Uniform Resource Locator;
[0023] S320, obtain the distributed identity document corresponding to the Uniform Resource Locator of the distributed identity document through the distributed identity resolver, wherein the distributed identity document contains a public key and an authentication method;
[0024] S330, verify whether the public key in the distributed identity document matches the handshake signature, and query the revocation status contract on the blockchain to confirm the certificate revocation status of the distributed identity identifier.
[0025] Optionally, in S400, the step of performing hybrid key exchange and double signature operations through the post-quantum cryptography module includes:
[0026] S410, obtain classical algorithm key pairs and post-quantum algorithm key pairs;
[0027] S420 uses both the Elliptic Curve Digital Signature Algorithm and the Crystal Dilution Algorithm to double-sign the key handshake message, and the receiver verifies both signatures at the same time.
[0028] S430, perform elliptic curve Diffie-Hellman-based key exchange and crystal Kiber-based key encapsulation, and derive the session key from the shared secret based on elliptic curve Diffie-Hellman and the encapsulated key based on crystal Kiber.
[0029] Optionally, in S500, the step of collecting user behavior characteristics and calculating trust scores through a continuous authentication monitor includes:
[0030] S510, acquire user interaction features, the user interaction features including keystroke dynamics features, mouse movement pattern features and device grip posture features;
[0031] S520, extract the feature vector corresponding to the user interaction features, compare the feature vector with the pre-stored user behavior baseline model, and calculate the similarity value as the trust score.
[0032] Optionally, in S500, executing the corresponding security response strategy based on the comparison result of the trust score and the dynamic threshold includes:
[0033] S530, acquire data sensitivity parameters and network environment risk parameters, and calculate the dynamic threshold based on the data sensitivity parameters and the network environment risk parameters;
[0034] S540, when the trust score is lower than the dynamic threshold, a secondary authentication request is triggered or a sensitive operation request is rejected;
[0035] S550, when the trust score is higher than or equal to the dynamic threshold, maintain the current session state and continue to execute S600.
[0036] Optionally, prior to S200, it also includes:
[0037] S110, Obtain the attribute commitment that the client has pre-registered with the identity provider, the attribute commitment being used to verify the correspondence between the attribute value and the long-term identity commitment during the zero-knowledge proof verification process;
[0038] S120 adds a zero-knowledge proof assertion extension to the handshake client greeting message of the transport layer security protocol, declaring that the client supports zero-knowledge proofs and provable property types.
[0039] On the other hand, embodiments of the present invention provide a data transmission system based on information security, including:
[0040] At least one processor;
[0041] At least one memory for storing at least one program;
[0042] When the at least one program is executed by the at least one processor, the at least one processor performs the method described above.
[0043] On the other hand, embodiments of the present invention provide a computer-readable storage medium storing a processor-executable program, which, when executed by a processor, is used to perform the above-described method.
[0044] The beneficial effects of this invention are as follows: This invention discloses a data transmission method and system based on information security. This invention achieves minimal information disclosure through zero-knowledge proof, effectively preventing identity information from being collected by irrelevant parties during transmission; it constructs a decentralized trust model through distributed identity, reducing dependence on centralized certificate authorities; it ensures long-term confidentiality of transmission through a post-quantum cryptography scheme; and it detects and prevents unauthorized continuous access after credential theft, such as session hijacking and man-in-the-middle attacks, through a continuous authentication mechanism. This method improves security while ensuring protocol efficiency and good compatibility with existing infrastructure. Attached Figure Description
[0045] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0046] Figure 1 This is a flowchart illustrating a data transmission method based on information security in an embodiment of the present invention;
[0047] Figure 2 This is a framework diagram of a data transmission system based on information security in an embodiment of the present invention. Detailed Implementation
[0048] The following will provide a clear and complete description of the concept, specific structure, and technical effects of the present invention in conjunction with embodiments and accompanying drawings, so as to fully understand the purpose, solution, and effects of the present invention. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.
[0049] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all ways consistent with the embodiments of this invention; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this invention as detailed in the appended claims.
[0050] It is understood that the terms “first,” “second,” etc., used in this invention may be used herein to describe various concepts, but unless specifically stated otherwise, these concepts are not limited by these terms. These terms are used only to distinguish one concept from another. For example, first information may also be referred to as second information without departing from the scope of embodiments of the invention, and similarly, second information may also be referred to as first information. Depending on the context, the words “if” or “when” as used herein may be interpreted as “when…” or “in response to determination.”
[0051] The terms “at least one,” “multiple,” “each,” “any,” etc., used in this invention, “at least one” includes one, two, or more than two; “multiple” includes two or more than two; “each” refers to each of the corresponding multiple; and “any” refers to any one of the multiple.
[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein is for the purpose of describing embodiments of the invention only and is not intended to limit the invention.
[0053] Secure transmission protocols in related technologies have limitations in terms of privacy protection, decentralized trust, resistance to quantum attacks, and continuous authentication. Although some research has attempted to introduce zero-knowledge proofs, blockchain identity, or post-quantum cryptography, these are mostly isolated solutions and have failed to be systematically integrated into a complete data transmission protocol stack.
[0054] Inspired by these observations, this invention proposes a data transmission method and system based on information security. It aims to ensure the confidentiality, integrity, identity privacy, and resistance to quantum attacks of data transmission in untrusted network environments by introducing an enhanced transport layer security protocol stack, a zero-knowledge proof generation module, a distributed identity resolution module, a post-quantum cryptography module, and a continuous authentication monitor. The key contributions of the proposed enhanced secure transmission framework are as follows:
[0055] To achieve strong identity authentication without exposing specific identity information, we propose a privacy handshake protocol based on zero-knowledge proofs to minimize information disclosure.
[0056] To build a decentralized, censorship-resistant identity trust model, we introduced an integrated mechanism of distributed identity and blockchain verification to reduce reliance on centralized certificate authorities.
[0057] To provide security protection for the post-quantum computing era, we designed a hybrid post-quantum cryptography scheme to ensure long-term confidentiality of transmissions.
[0058] To achieve dynamic identity assurance throughout the entire session, from connection to disconnection, we introduce a continuous authentication mechanism based on multimodal biometrics.
[0059] refer to Figure 1 ,like Figure 1 The figure shown is a data transmission method based on information security provided by an embodiment of the present invention. The method includes the following steps:
[0060] S100: Obtain the client's zero-knowledge proof capability declaration, distributed identity identifier, and data to be transmitted;
[0061] S200, the zero-knowledge proof capability declaration, distributed identity identifier and data to be transmitted are input into the enhanced secure transmission framework. During the handshake phase, based on the zero-knowledge proof capability declaration, an identity verification certificate is generated by the zero-knowledge proof generation module. The identity verification certificate is used to verify that the client meets the preset policy and has the private key corresponding to the long-term identity commitment.
[0062] S300, the distributed identity resolution module verifies the matching between the public key corresponding to the distributed identity identifier and the handshake signature, and queries the verifiable credential registry on the blockchain to confirm that the distributed identity identifier holds a specific qualification credential;
[0063] S400 performs hybrid key exchange and double signature operations through the post-quantum cryptography module to generate session keys;
[0064] S500: During the data transmission phase, user behavior characteristics are collected and a trust score is calculated by a continuous authentication monitor. Based on the comparison result of the trust score and a dynamic threshold, a corresponding security response strategy is executed, and the data to be transmitted is transmitted through an encrypted channel.
[0065] In the embodiments provided by this invention, the zero-knowledge proof generation module can verify the client's identity without exposing specific attribute values, effectively protecting user privacy. The distributed identity resolution module verifies identity credentials through blockchain, avoiding the single point of failure risk of traditional public key infrastructure. The post-quantum cryptography module adopts a hybrid mode of classical and post-quantum algorithms, ensuring current security while providing protection against future quantum computing threats. The continuous authentication monitor calculates trust scores by collecting user behavior characteristics, achieving dynamic risk assessment and real-time response. This series of processing steps not only enhances the security of data transmission but also improves the robustness and adaptability of the system, providing reliable protection for network communications with high security requirements.
[0066] In some embodiments, S200, generating the authentication certificate through the zero-knowledge proof generation module includes:
[0067] S210, obtain the random number challenge sent by the server and the strategy that requires client proof;
[0068] S220, Invoke the local zero-knowledge proof prover to generate proof data. The proof data is used to verify that the client knows the attribute value that satisfies the policy, and that the attribute value corresponds to the long-term identity commitment. At the same time, the client has a private key bound to the identity.
[0069] S230, the proof data and the digital signature of the random number challenge are sent to the server together, so that the server can verify the digital signature and verify the proof data using a zero-knowledge proof verifier.
[0070] In this embodiment, by introducing random number challenges and policy proof mechanisms, replay attacks can be effectively prevented and fine-grained attribute verification can be supported. The zero-knowledge proof feature ensures that the client can meet policy requirements without exposing specific attribute values, achieving selective disclosure.
[0071] In some embodiments, in S300, verifying the matching between the public key corresponding to the distributed identity identifier and the handshake signature through the distributed identity resolution module includes:
[0072] S310, obtain the distributed identity identifier sent by the client and its corresponding distributed identity document Uniform Resource Locator;
[0073] S320, obtain the distributed identity document corresponding to the Uniform Resource Locator of the distributed identity document through the distributed identity resolver, wherein the distributed identity document contains a public key and an authentication method;
[0074] S330, verify whether the public key in the distributed identity document matches the handshake signature, and query the revocation status contract on the blockchain to confirm the certificate revocation status of the distributed identity identifier.
[0075] In this embodiment, decentralized identity management is achieved through distributed identity documents and a blockchain verification mechanism. Compared to traditional online certificate status protocols, blockchain queries provide near real-time revocation status checks without relying on a centralized certificate authority.
[0076] In some embodiments, S400, the execution of hybrid key exchange and double signature operations via the post-quantum cryptography module includes:
[0077] S410, obtain classical algorithm key pairs and post-quantum algorithm key pairs;
[0078] S420 uses both the Elliptic Curve Digital Signature Algorithm and the Crystal Dilution Algorithm to double-sign the key handshake message, and the receiver verifies both signatures at the same time.
[0079] S430, perform elliptic curve Diffie-Hellman-based key exchange and crystal Kiber-based key encapsulation, and derive the session key from the shared secret based on elliptic curve Diffie-Hellman and the encapsulated key based on crystal Kiber.
[0080] In this embodiment, by using a hybrid approach of classical and post-quantum algorithms, both compatibility with existing systems and long-term security against quantum attacks are ensured. The dual-signature mechanism ensures that even if one algorithm is compromised, the other algorithm still provides security.
[0081] In some embodiments, S500, the step of collecting user behavior characteristics and calculating trust scores through a continuous authentication monitor includes:
[0082] S510, acquire user interaction features, the user interaction features including keystroke dynamics features, mouse movement pattern features and device grip posture features;
[0083] S520, extract the feature vector corresponding to the user interaction features, compare the feature vector with the pre-stored user behavior baseline model, and calculate the similarity value as the trust score.
[0084] In this embodiment, through multimodal biometric data collection and behavioral analysis, identity verification can be continuously performed without interfering with normal user operation. This lightweight authentication method effectively compensates for the shortcomings of the one-time authentication during the traditional handshake phase.
[0085] In some embodiments, S500, executing the corresponding security response strategy based on the comparison result of the trust score and the dynamic threshold includes:
[0086] S530, acquire data sensitivity parameters and network environment risk parameters, and calculate the dynamic threshold based on the data sensitivity parameters and the network environment risk parameters;
[0087] S540, when the trust score is lower than the dynamic threshold, a secondary authentication request is triggered or a sensitive operation request is rejected;
[0088] S550, when the trust score is higher than or equal to the dynamic threshold, maintain the current session state and continue to execute S600.
[0089] In this embodiment, a risk-adaptive security strategy is implemented through a dynamic threshold mechanism. The system can adjust security requirements in real time based on data sensitivity and network environment, optimizing user experience while ensuring security.
[0090] In some embodiments, prior to S200, the method further includes:
[0091] S110, Obtain the attribute commitment that the client has pre-registered with the identity provider, the attribute commitment being used to verify the correspondence between the attribute value and the long-term identity commitment during the zero-knowledge proof verification process;
[0092] S120 adds a zero-knowledge proof assertion extension to the handshake client greeting message of the transport layer security protocol, declaring that the client supports zero-knowledge proofs and provable property types.
[0093] In this embodiment, backward compatibility with standard transport layer security protocols is achieved through an attribute commitment mechanism and protocol extension design. Progressive deployment is supported, and the enhancement modules can be flexibly combined and activated according to actual security needs.
[0094] The following are specific embodiments provided by the present invention:
[0095] The following describes the implementation process of the present invention using a typical enterprise remote access scenario.
[0096] Scenario: Employees remotely access company internal applications containing trade secrets via public Wi-Fi.
[0097] Implementation steps:
[0098] Step 1: Initial Configuration
[0099] Employees register in the company's identity management system and receive a verifiable credential issued by the company, proving their "employee" status and department. The hash of this verifiable credential is stored on the company's private blockchain.
[0100] An employee's device generates a pair of distributed identity keys and the attribute commitments required for zero-knowledge proofs, and binds them to the company identity.
[0101] Company server configuration policy: Access to core R&D documents requires the user to be an employee and belong to the R&D department, and continuous authentication must be enabled.
[0102] Step 2: Connection Establishment and Enhanced Handshake
[0103] The employee client initiates a Hypertext Transfer Security (HTTP) connection. During the transport layer security handshake process:
[0104] Send a client greeting message containing a statement of its distributed identity and zero-knowledge proof capabilities.
[0105] The server requires a zero-knowledge proof assertion that proves the employee's identity and that the department is the R&D department.
[0106] The client generates zero-knowledge proof data and attaches a signature of the handshake digest using its distributed identity private key.
[0107] The server: a) verifies the signature via a distributed identity resolver; b) queries the blockchain to verify the validity of the verifiable credential status; c) verifies the zero-knowledge proof data. After all verifications are successful, the server performs hybrid key exchange and double signature operations using the quantum cryptography module, generates a session key, and completes the handshake. Simultaneously, the server distributes the lightweight behavior collection agent configuration required for continuous authentication.
[0108] Step 3: Secure Data Transmission and Continuous Monitoring
[0109] Employees begin work. The behavior collection agent records their work patterns (such as the specific rhythm of code editing and mouse movement characteristics when browsing documents) with extremely low resource overhead.
[0110] The collected features are encrypted and sent to the server's continuous authentication engine, where they are compared with the pre-stored baseline of the employee's behavior, and the trust score is maintained at 0.9 (out of 1.0).
[0111] Suddenly, the trust score plummeted to 0.3 within a short period (possibly due to session hijacking or user abandonment). The policy center, recognizing the currently accessed document as highly sensitive, immediately triggered a dynamic response.
[0112] Step 4: Dynamic Risk Response
[0113] The server sends a lightweight challenge to the client (such as pushing a prompt that requires quick confirmation over an established encrypted channel).
[0114] The client interface pops up a secondary authentication request, requiring employees to verify their fingerprints.
[0115] Employees complete fingerprint verification within 5 seconds. Upon successful verification, the trust score is reset to 1.0, the session continues, and data is transmitted via an encrypted channel. If verification fails or times out, the server will immediately terminate the session, freeze the account, and alert security personnel.
[0116] Step 5: Post-Quantum Security Assurance
[0117] In all the communications described above, the session key used for symmetric encryption is derived from both the classical elliptic curve Diffie-Hellman key and the crystal-encapsulated key. All key signatures are generated using both elliptic curve digital signature algorithms and crystal dilution. Even if the communication data is intercepted and stored until the era of practical quantum computing, attackers will still be unable to decipher or forge it.
[0118] Through the above implementation methods, the present invention provides end-to-end security protection for remote access scenarios with high security requirements that far exceeds traditional virtual private networks or standard transport layer security protocols. This protection is privacy-friendly, continuously reliable, and future-oriented.
[0119] refer to Figure 2 This invention also provides a data transmission system based on information security, comprising:
[0120] At least one processor;
[0121] At least one memory for storing at least one program;
[0122] When the at least one program is executed by the at least one processor, the at least one processor performs the method described above.
[0123] The content of the above method embodiments is applicable to this embodiment. The specific functions implemented in this embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments. Therefore, they will not be repeated here.
[0124] This invention also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described above. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.
[0125] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.
[0126] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.
[0127] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.
[0128] This invention also provides a computer program product, including a computer program or computer instructions, which are stored in a memory. A processor of a computer device reads the computer program or computer instructions from the memory and executes the computer program or computer instructions, causing the computer device to perform the above-described method.
[0129] It is understood that the content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.
[0130] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
[0131] It will be understood by those skilled in the art that all or some of the steps and systems in the methods disclosed above can be implemented as software, firmware, hardware, and suitable combinations thereof. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, as is known to those skilled in the art, communication media typically include computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.
[0132] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.
Claims
1. A data transmission method based on information security, characterized in that, The method includes the following steps: S100: Obtain the client's zero-knowledge proof capability declaration, distributed identity identifier, and data to be transmitted; S200, the zero-knowledge proof capability declaration, distributed identity identifier and data to be transmitted are input into the enhanced secure transmission framework. During the handshake phase, based on the zero-knowledge proof capability declaration, an identity verification certificate is generated by the zero-knowledge proof generation module. The identity verification certificate is used to verify that the client meets the preset policy and has the private key corresponding to the long-term identity commitment. S300, the distributed identity resolution module verifies the matching between the public key corresponding to the distributed identity identifier and the handshake signature, and queries the verifiable credential registry on the blockchain to confirm that the distributed identity identifier holds a specific qualification credential; The S400 performs hybrid key exchange and double signature operations through the post-quantum cryptography module to generate a session key; S500: During the data transmission phase, user behavior characteristics are collected and a trust score is calculated by a continuous authentication monitor. Based on the comparison result of the trust score and a dynamic threshold, a corresponding security response strategy is executed, and the data to be transmitted is transmitted through an encrypted channel.
2. The method according to claim 1, characterized in that, In S200, the generation of authentication proof through the zero-knowledge proof generation module includes: S210, obtain the random number challenge sent by the server and the strategy that requires client proof; S220, Invoke the local zero-knowledge proof prover to generate proof data. The proof data is used to verify that the client knows the attribute value that satisfies the policy, and that the attribute value corresponds to the long-term identity commitment. At the same time, the client has a private key bound to the identity. S230, the proof data and the digital signature of the random number challenge are sent to the server together, so that the server can verify the digital signature and verify the proof data using a zero-knowledge proof verifier.
3. The method according to claim 1, characterized in that, In S300, the step of verifying the matching between the public key corresponding to the distributed identity identifier and the handshake signature through the distributed identity resolution module includes: S310, obtain the distributed identity identifier sent by the client and its corresponding distributed identity document Uniform Resource Locator; S320, Obtain the distributed identity document corresponding to the Uniform Resource Locator of the distributed identity document through the distributed identity resolver, wherein the distributed identity document contains a public key and an authentication method; S330, verify whether the public key in the distributed identity document matches the handshake signature, and query the revocation status contract on the blockchain to confirm the certificate revocation status of the distributed identity identifier.
4. The method according to claim 1, characterized in that, In S400, the execution of hybrid key exchange and double signature operations through the post-quantum cryptography module includes: S410, obtain classical algorithm key pairs and post-quantum algorithm key pairs; S420 uses both the Elliptic Curve Digital Signature Algorithm and the Crystal Dilution Algorithm to double-sign the key handshake message, and the receiver verifies both signatures at the same time. S430, perform elliptic curve Diffie-Hellman-based key exchange and crystal Kiber-based key encapsulation, and derive the session key from the shared secret based on elliptic curve Diffie-Hellman and the encapsulated key based on crystal Kiber.
5. The method according to claim 1, characterized in that, In S500, the step of collecting user behavior characteristics and calculating trust scores through a continuous authentication monitor includes: S510, acquire user interaction features, the user interaction features including keystroke dynamics features, mouse movement pattern features and device grip posture features; S520, extract the feature vector corresponding to the user interaction features, compare the feature vector with the pre-stored user behavior baseline model, and calculate the similarity value as the trust score.
6. The method according to claim 5, characterized in that, In S500, the step of executing the corresponding security response strategy based on the comparison result of the trust score and the dynamic threshold includes: S530, acquire data sensitivity parameters and network environment risk parameters, and calculate the dynamic threshold based on the data sensitivity parameters and the network environment risk parameters; S540, when the trust score is lower than the dynamic threshold, a secondary authentication request is triggered or a sensitive operation request is rejected; S550, when the trust score is higher than or equal to the dynamic threshold, maintain the current session state and continue to execute S600.
7. The method according to claim 1, characterized in that, Prior to S200, it also included: S110, Obtain the attribute commitment that the client has pre-registered with the identity provider, the attribute commitment being used to verify the correspondence between the attribute value and the long-term identity commitment during the zero-knowledge proof verification process; S120 adds a zero-knowledge proof assertion extension to the handshake client greeting message of the transport layer security protocol, declaring that the client supports zero-knowledge proofs and provable property types.
8. A data transmission system based on information security, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method as described in any one of claims 1 to 7.
9. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.