A dynamic encryption method and system for secure transmission

Abstract

This invention relates to the field of data encryption transmission technology, specifically disclosing a dynamic encryption method and system for secure transmission. The method includes: first, acquiring input parameters of the data to be transmitted and generating an initial encryption key; processing the data to be transmitted in blocks and determining the importance level of each data block; performing layered initial encryption transmission on each data block according to its importance level; collecting dynamic status parameters of the transmission link to generate key update parameters, adjusting the current encryption key to obtain an updated encryption key; detecting whether there are security risks in the transmission link, and if so, using an upgraded encryption algorithm and an updated encryption key to re-encrypt the incomplete data blocks and continue transmission through a backup encryption link; finally, decrypting the encrypted data blocks to obtain the original data blocks and performing integrity verification. This invention effectively solves the problems of easy key leakage, insufficient security, and low encryption efficiency in traditional static encryption methods.

Description

Technical Field

[0001] This invention relates to the field of data encryption transmission technology, and in particular to a dynamic encryption method and system for secure transmission. Background Technology

[0002] In the digital age, the security of data transmission is receiving increasing attention. Encryption technology, as a core technology for ensuring data transmission security, encrypts data to prevent unauthorized users from accessing the true content of the data, thereby guaranteeing the confidentiality and integrity of the data.

[0003] Traditional data transmission encryption methods often employ static encryption, which uses a fixed encryption key and algorithm to encrypt data. However, this static encryption method has several drawbacks: firstly, once the fixed encryption key is leaked, attackers can easily decrypt all transmitted data, resulting in extremely low security; secondly, fixed encryption algorithms cannot adapt to complex and changing transmission environments, failing to flexibly adjust encryption strategies when the transmission link faces attacks of varying strengths, leading to poor encryption effectiveness. Furthermore, traditional encryption methods typically encrypt the entire dataset uniformly, without considering the differences in data importance, resulting in low encryption efficiency and wasted system resources.

[0004] To address the aforementioned issues, some dynamic encryption solutions have emerged in the existing technology. However, these solutions still have shortcomings. For example, some solutions only implement simple periodic key updates without dynamically adjusting based on the real-time status of the transmission link and data attributes, thus the rationality and security of key updates need to be improved. Some solutions do not perform hierarchical encryption of data, making it difficult to balance encryption efficiency and security. Furthermore, some solutions lack effective security monitoring mechanisms, making it impossible to detect security risks during transmission in a timely manner and hindering the rapid adjustment of encryption strategies.

[0005] Therefore, how to design an encryption method and system that can dynamically adjust the encryption strategy according to the transmission environment and data attributes, while having real-time security monitoring capabilities, in order to improve the security, flexibility and efficiency of data transmission, has become an urgent technical problem to be solved. Summary of the Invention

[0006] The purpose of this invention is to provide a dynamic encryption method and system for secure transmission, which improves the security, flexibility and efficiency of data transmission through dynamic key generation and updating, hierarchical data encryption and real-time security monitoring.

[0007] To achieve the above objectives, the present invention provides a dynamic encryption method and system for secure transmission, comprising the following steps: S1. Obtain the input parameters of the data to be transmitted and generate the initial encryption key; S2. Divide the data to be transmitted into blocks and determine the importance level of each data block; S3. Based on the initial encryption key, each data block is initially encrypted and transmitted in layers according to its importance level; S4. Collect dynamic status parameters of the transmission link to generate key update parameters, adjust the current encryption key, and obtain the updated encryption key; S5. Detect whether there are security risks in the transmission link. If so, proceed to S6. S6. Using the upgraded encryption algorithm and updated encryption key, the incomplete data block is re-encrypted and the transmission continues through the backup encryption link; S7. Decrypt the encrypted data block to obtain the original data block and verify its integrity.

[0008] Preferably, in S1, the input parameters include the attribute information of the data to be transmitted, the initial state parameters of the transmission link, and the current timestamp; The attribute information of the data to be transmitted includes data type, data size, and data importance level; The initial state parameters of the transmission link include link bandwidth, link delay, and link signal-to-noise ratio; The input parameters are fed into the pre-trained key generation model to generate the initial encryption key. The construction process of the pre-trained key generation model is as follows: S11. Collect data attribute information samples, link status parameter samples, and timestamp samples during the historical data transmission process, and simultaneously collect the security key samples corresponding to each set of samples. S12. Perform classification and preprocessing operations on the collected sample data; S13. Divide the preprocessed sample data into a training set and a test set. Use the training set to train the initial machine learning model to obtain the initial key generation model. S14. Test the initial key generation model using a test set. If the key generation accuracy reaches the preset threshold, then the model is determined to be the final key generation model. If it does not reach the preset threshold, adjust the model parameters and retrain until the preset threshold is reached.

[0009] Preferably, in S12, the preprocessing operation specifically includes: Sa1. Remove samples with missing or outlier values. Outlier handling is determined using the Z-score method, with the formula as follows: ; In the formula, These are the standardized sample values. For a single sample value, The mean of the samples containing outliers. For the standard deviation of samples containing outliers, when Values ​​greater than 3 are considered outliers and removed. For missing values ​​in structured data, statistical values ​​of the corresponding data type are used to fill in the missing values, including the median for numerical data, the mode for text data, and interpolation between adjacent times for date data; for missing values ​​in unstructured data, interpolation methods based on generative adversarial networks (GANs) are used to fill in the missing values. Sa2. Perform min-max normalization on the numerical data in the structured data, using the following formula: ; In the formula, The normalized value. It is the minimum value in the numerical data. This represents the maximum value in the numerical data, and after normalization, the data is mapped to the interval [0,1]. Sa3. After standardizing the format of the unstructured data, the image data is preprocessed by first denoising with Gaussian filtering, then converting to grayscale, and finally using the HOG algorithm to extract feature vectors. For audio data, pre-emphasis, frame segmentation, Hanning windowing, and short-time Fourier transform (STFT) are performed sequentially to obtain the spectrum. Then, the Mel frequency cepstral coefficients (MFCC) are extracted as feature vectors. For video data, the data is divided into frames according to the frame rate to obtain single-frame images. Image preprocessing steps are performed on each frame image. Then, inter-frame motion features are extracted using optical flow. The single-frame features and motion features are fused to obtain the video feature vector. For document or log data, the Bag-of-Words (BoW) model is used for text segmentation and stop word removal, and word vectors are extracted as features. Sa4. After unifying the dimensions of the feature vectors of structured and unstructured data, they are concatenated to obtain the final sample feature vector.

[0010] Preferably, in S2, the block processing specifically involves: The sliding window block method is used to divide time series data into blocks for processing; A fixed-size block method is used to divide structured numerical data into blocks according to a fixed amount of data. Based on the content boundary segmentation method, unstructured data documents are segmented by paragraph or chapter boundaries, videos are segmented by shot transition boundaries, and audio is segmented by silent segment boundaries. Based on the semantic similarity segmentation method, the semantic similarity of adjacent data units in text and image data is calculated, and segmentation is performed when the similarity is lower than a preset threshold.

[0011] Preferably, in S2, the importance level of each data block is determined according to a preset data importance assessment rule, specifically as follows: S21. Constructing a system including data sensitivity. Business Value and transmission priority The evaluation index system, among which, Used to reflect the severity of the harm caused by a data breach; Used to reflect the supporting value of data for business operations; Used to reflect the urgency of data transmission; S22. The weights of each indicator are determined using the analytic hierarchy process (AHP), and the weights of each indicator satisfy the following: ; in, For data sensitivity The weight, For business value The weight, Transmission priority The weights; S23. Each indicator is scored using a 10-point scale: Sensitivity to data 10 points for core confidential data, 8 points for important sensitive data, 6 points for general sensitive data, 4 points for low-sensitivity data, and 2 points for no sensitive data. For business value 10 points for core business support data, 8 points for important business support data, 6 points for general business support data, 4 points for auxiliary business data, and 2 points for data with no direct business value. For transmission priority 10 points for real-time emergency transmission, 8 points for high-priority transmission, 6 points for medium-priority transmission, 4 points for low-priority transmission, and 2 points for non-emergency transmission. S24. Determine the importance level of each data block based on the comprehensive scoring formula, which is as follows: ; In the formula, The data block is given a comprehensive score, with a maximum score of 10 points. Based on comprehensive score Importance levels of data block division: like 8. Determine that the data block is a level 1 data block; like 8. Determine that the data block is a secondary data block; like 6. Determine that the data block is a level 3 data block.

[0012] Preferably, S3 is as follows: Based on the initial encryption key and the matching encryption algorithm, each data block is initially encrypted in layers according to its importance level to obtain encrypted data blocks; The encrypted data block is transmitted to the receiving end through the transmission link, and the importance level information and encryption algorithm information of the data block are transmitted to the receiving end simultaneously. Asymmetric encryption algorithm is used for first-level data blocks, symmetric encryption algorithm is used for second-level data blocks, and hash encryption algorithm is used for third-level data blocks.

[0013] Preferably, S4 is as follows: The collected dynamic state parameters are input into the key update algorithm to generate key update parameters. The dynamic state parameters include link bandwidth fluctuation value, link delay change amount and link interference intensity. The current encryption key is adjusted based on the generated key update parameters to obtain the updated encryption key; The key update cycle is dynamically adjusted based on the stability of the transmission link, specifically as follows: Link stability is assessed by calculating the variance of link bandwidth fluctuations and latency variations. If the variance is less than the preset stability threshold, the link is stable, and the first update cycle is set; if the variance is greater than or equal to the preset stability threshold, the link is unstable, and the second update cycle is set, with the first update cycle being longer than the second update cycle.

[0014] Preferably, in S5, an intrusion detection algorithm is used to detect whether there are abnormal data interactions, unauthorized access, and key theft in the transmission link. If a security risk is detected, an emergency encryption upgrade mechanism is triggered. Intrusion detection algorithms employ a combination of anomaly detection and feature detection to detect security risks, specifically: Anomaly detection is performed by comparing real-time data transmission behavior with feature models. If the deviation value exceeds a preset deviation threshold, it is determined to be abnormal. The system performs feature detection by matching real-time data transmission behavior with features in the attack behavior feature database. If a match is found, the system is determined to be at risk of security breach.

[0015] The present invention also provides a dynamic encryption system for secure transmission, comprising: The key dynamic generation module is used to obtain the attribute information of the data to be transmitted, the initial state parameters of the transmission link and the current timestamp, and generate the initial encryption key through the preset key generation model; The data block encryption module is used to divide the data to be transmitted into blocks, determine the importance level of each data block, match the corresponding encryption algorithm according to the importance level, and encrypt each data block using the generated encryption key. The security monitoring module is used to monitor the dynamic status parameters of the transmission link in real time and detect the security status of the transmission link through intrusion detection algorithms; if a security risk is detected, an emergency encryption upgrade mechanism is triggered. The emergency encryption module is used to respond to the emergency encryption upgrade mechanism and re-encrypt data blocks that have not been fully transmitted; The data transmission module is used to transmit encrypted data blocks to the receiving end via a backup encrypted link; The decryption and verification module, located at the receiving end, is used to obtain the encryption key according to the key synchronization mechanism, decrypt the encrypted data block, verify the integrity of the decrypted original data block, and concatenate the verified original data blocks to obtain the complete data.

[0016] Preferably, the key dynamic generation module includes a key generation unit, a key update unit, and a key storage unit. The key generation unit is used to build and run a key generation model to generate an initial encryption key; the key update unit is used to run a key update algorithm to generate an updated encryption key; and the key storage unit is used to encrypt and store the generated encryption key. The data block encryption module includes a block division unit, a level evaluation unit, and an encryption unit. The block division unit uses a sliding window algorithm to divide the data into blocks. The level evaluation unit uses the analytic hierarchy process (AHP) to determine the importance level of the data blocks based on a preset evaluation index system. The encryption unit has a built-in library of multiple encryption algorithms and automatically matches the corresponding encryption algorithm according to the importance level of the data blocks. The security monitoring module includes a status acquisition unit, an intrusion detection unit, and a risk warning unit. The status acquisition unit is used to collect dynamic status parameters of the transmission link in real time; the intrusion detection unit detects the security status of the link through an intrusion detection algorithm; and the risk warning unit is used to detect security risks, send warning information to management personnel, and trigger an emergency encryption upgrade mechanism.

[0017] Therefore, the present invention employs the above-mentioned dynamic encryption method and system for secure transmission, and the beneficial effects are as follows: (1) The present invention generates an initial encryption key by combining the attribute information of the data to be transmitted, the status parameters of the transmission link and the timestamp. Compared with the traditional fixed key generation method, the initial key has stronger randomness and uniqueness, reducing the risk of the key being cracked.

[0018] (2) The present invention divides the data into blocks and matches different encryption algorithms and encryption strengths according to the importance level, thereby realizing hierarchical encryption of the data. While ensuring the security of core data, it improves encryption efficiency and reduces system resource consumption.

[0019] (3) The present invention sets up a real-time security monitoring module and adopts an intrusion detection algorithm that combines anomaly detection and feature detection, which can promptly detect security risks in the transmission link; after triggering the emergency encryption upgrade mechanism, it can quickly respond to security risks by increasing encryption strength, shortening the key update cycle and enabling backup links, thereby further ensuring the security of data transmission.

[0020] (4) The key generation model and key update algorithm of the present invention are trained by machine learning model, which can continuously optimize the key generation and update strategy through historical data, improve the adaptability and security of the key, and enable the encryption method to have self-optimization capability and adapt to different transmission scenarios.

[0021] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0022] Figure 1 This is an overall flowchart of an embodiment of a dynamic encryption method for secure transmission according to the present invention; Figure 2 This is a flowchart illustrating the construction of a preset key generation model in an embodiment of a dynamic encryption method for secure transmission according to the present invention; Figure 3 This is an overall block diagram of an embodiment of a dynamic encryption system for secure transmission according to the present invention. Detailed Implementation

[0023] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0024] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects.

[0025] like Figure 1 As shown, this embodiment provides a dynamic encryption method for secure transmission, including the following steps: S1. Obtain the input parameters of the data to be transmitted and generate the initial encryption key, specifically: The sending end obtains the input parameters of the data to be transmitted. The input parameters include the attribute information of the data to be transmitted, the initial state parameters of the transmission link, and the current timestamp. The input parameters are then input into a preset key generation model to generate an initial encryption key.

[0026] The attribute information of the data to be transmitted includes data type, data size and data importance level, and the initial state parameters of the transmission link include link bandwidth, link delay and link signal-to-noise ratio.

[0027] The data types are clearly defined, including structured and unstructured data. Structured data includes text data, numerical data (sensor monitoring values, transaction amounts, raw link parameter values), date-time data (data generation time, transmission start time), and Boolean data (data encryption identifiers, transmission completion identifiers, etc.). Unstructured data includes image data, audio data, video data, document data (unstructured documents such as PDF and Word documents), and log text data (device operation logs without a fixed format) and web page source code data. Data importance is preset to Level 1, Level 2, and Level 3, with Level 1 being the highest level.

[0028] The sending end collects the initial state parameters of the transmission link through the link monitoring tool, including link bandwidth, link delay and link signal-to-noise ratio; and obtains the current timestamp.

[0029] like Figure 2 As shown, the construction process of the preset key generation model in this embodiment is as follows: S11. Collect 10,000 sets of data attribute information samples, link status parameter samples, and timestamp samples from the data transmission process over the past year, and collect the security key sample corresponding to each set of samples. S12. Perform preprocessing operations on the collected sample data according to structured and unstructured categories, specifically: Sa1. Remove samples with missing or outlier values; outlier handling is determined using the Z-score method, with the formula as follows: ; In the formula, These are the standardized sample values. For a single sample value, The mean of the samples containing outliers. For the standard deviation of samples containing outliers, when Values ​​greater than 3 are considered outliers and removed.

[0030] For missing values ​​in structured data, statistical values ​​of the corresponding data type are used to fill in the missing values, including the median for numerical data, the mode for text data, and interpolation between adjacent times for date data; for missing values ​​in unstructured data, interpolation methods based on generative adversarial networks (GANs) are used to fill in the missing values.

[0031] Sa2. Perform min-max normalization on the numerical data in the structured data, using the following formula: ; In the formula, The normalized value. It is the minimum value in the numerical data. This represents the maximum value in the numerical data, and after normalization, the data is mapped to the interval [0,1].

[0032] Sa3. Standardize the format of unstructured data, unifying the resolution of images to 256×256, the sampling rate of audio to 16kHz, and the frame rate of video to 25fps.

[0033] For image data preprocessing, first, Gaussian filtering with a kernel size of 3×3 is used for noise reduction, then grayscale conversion is performed, and finally the HOG algorithm is used to extract feature vectors. The HOG feature dimension is 7×7×12=588.

[0034] For audio data, the following steps are performed sequentially: pre-emphasis (pre-emphasis coefficient is 0.97), frame segmentation (frame length 20ms, frame shift 10ms), Hanning windowing, and short-time Fourier transform (STFT) to obtain the spectrum. Then, the Mel frequency cepstral coefficients (MFCCs) are extracted as feature vectors, with MFCCs having a 13-dimensional dimension.

[0035] For video data, the data is divided into frames according to the frame rate to obtain single-frame images. Image preprocessing steps are performed on each frame image, and then inter-frame motion features are extracted using optical flow. The single-frame features and motion features are fused to obtain the video feature vector.

[0036] For document or log data, the Bag-of-Words (BoW) model is used for text segmentation and stop word removal, and word vectors are extracted as features.

[0037] Sa4. After unifying the dimensions of the feature vectors of structured and unstructured data, they are concatenated to obtain the final sample feature vector.

[0038] S13. Divide the preprocessed sample data into a training set and a test set in a 7:3 ratio. Use the training set to train the initial machine learning model. In this embodiment, the initial machine learning model is a CNN-LSTM hybrid model. Set the loss function of the model to the cross-entropy loss function, the optimizer to the Adam optimizer, the learning rate to 0.001, and the number of training rounds to 100 rounds to obtain the initial key generation model.

[0039] S14. Test the initial key generation model using a test set and calculate the key generation accuracy of the model (i.e., the degree of matching between the generated key and the optimal key). If the key generation accuracy of the model reaches 95%, it is determined as the final key generation model. If it does not reach 95%, adjust the model's learning rate, hidden layer neurons and other parameters and retrain until the preset threshold of 95% is reached.

[0040] S2. Divide the data to be transmitted into blocks and determine the importance level of each data block.

[0041] The specific steps for this block-based processing are as follows: The sliding window block method is used to divide time-series data such as text and audio streams into blocks. The sliding window size is set to 1MB and the window step size is 1MB to obtain several data blocks. When the last data block is less than 1MB, it is divided according to the actual size.

[0042] The fixed-size block method is used to divide structured numerical data into blocks according to a fixed data volume. The formula is as follows: ; In the formula, The number of blocks, This represents the total number of records in the structured data. For each block, a fixed number of records are required. This indicates rounding up to the nearest integer.

[0043] Based on the content boundary segmentation method, unstructured data documents are segmented by paragraph or chapter boundaries, videos are segmented by shot transition boundaries, and audio is segmented by silent segment boundaries.

[0044] Based on semantic similarity-based block segmentation, the semantic similarity of adjacent data units in text and image data is calculated. Block segmentation is performed when the similarity is lower than a preset threshold. Cosine similarity is used for calculation, and the formula is: ; In the formula, These are the feature vectors of adjacent data units. Represents the dot product. This represents the L2 norm.

[0045] In S2, the importance level of each data block is determined according to the preset data importance assessment rules, specifically as follows: S21. Constructing a system including data sensitivity. Business Value and transmission priority The evaluation index system, among which, Used to reflect the severity of the harm caused by a data breach; Used to reflect the supporting value of data for business operations; Used to reflect the urgency of data transmission.

[0046] S22. The weights of each indicator are determined using the analytic hierarchy process (AHP), and the weights of each indicator satisfy the following: ; in, For data sensitivity The weight, For business value The weight, Transmission priority The weights; in this embodiment, the weights are set. =0.4, =0.3, =0.3.

[0047] S23. Each indicator is scored using a 10-point scale, corresponding to scores from 1 to 10: Sensitivity to data 10 points for core confidential data, 8 points for important sensitive data, 6 points for general sensitive data, 4 points for low-sensitivity data, and 2 points for no sensitive data.

[0048] Among them, core confidential data includes user privacy and algorithm data; important sensitive data includes core business parameters; generally sensitive data includes ordinary user information; and non-sensitive data includes publicly advertised information.

[0049] For business value Data supporting core business is worth 10 points, data supporting important business is worth 8 points, data supporting general business is worth 6 points, data supporting auxiliary business is worth 4 points, and data without direct business value is worth 2 points.

[0050] Core business support data includes transaction data; important business support data includes user behavior data; general business support data includes operational statistics; auxiliary business data includes log auxiliary data; and data without direct business value includes test data.

[0051] For transmission priority 10 points for real-time emergency transmission, 8 points for high-priority transmission, 6 points for medium-priority transmission, 4 points for low-priority transmission, and 2 points for non-emergency transmission.

[0052] The data transmitted in real time for emergency purposes includes emergency response data; the data transmitted with high priority includes core business interaction data; the data transmitted with medium priority includes routine business data; the data transmitted with low priority includes backup data; and the data transmitted without emergency purposes includes archived data.

[0053] S24. Determine the importance level of each data block based on the comprehensive scoring formula, which is as follows: ; In the formula, The data block is given a comprehensive score, with a maximum score of 10 points. Based on comprehensive score Importance levels of data block division: like 8. The data block is determined to be a Level 1 data block, the highest level; like 8. Determine that the data block is a secondary data block; like 6. Determine that the data block is a level 3 data block.

[0054] S3. Based on the initial encryption key, each data block is initially encrypted and transmitted in a layered manner according to its importance level, specifically as follows: The sending end performs layered initial encryption on each data block according to its importance level based on the initial encryption key and the matching encryption algorithm, resulting in encrypted data blocks. The encrypted data blocks are then transmitted to the receiving end through the transmission link, and the importance level information and encryption algorithm information of the data blocks are transmitted to the receiving end simultaneously.

[0055] In this embodiment, an asymmetric encryption algorithm, such as the RSA algorithm, with a key length of 2048 bits is used for the first-level data blocks; a symmetric encryption algorithm, such as the AES algorithm, with a key length of 128 bits is used for the second-level data blocks; and a hash encryption algorithm, such as the SHA-256 algorithm, is used for the third-level data blocks.

[0056] S4. During data transmission, the sending end collects dynamic status parameters of the transmission link in real time through a link monitoring tool. The collection frequency is 1 time / second. The dynamic status parameters include link bandwidth fluctuation value, link delay change amount and link interference intensity.

[0057] The dynamic state parameters are input into the key update algorithm to generate key update parameters. Based on the generated key update parameters, the current encryption key is adjusted to obtain the updated encryption key.

[0058] The key update cycle is dynamically adjusted based on the stability of the transmission link: Link stability is assessed by calculating the variance of link bandwidth fluctuations and latency variations. If the variance is less than the preset stability threshold, such as bandwidth fluctuation variance < 0.5 and delay change variance < 1, then the link is stable and a first update cycle is set; if the variance is greater than or equal to the preset stability threshold, then the link is unstable and a second update cycle is set. The first update cycle is greater than the second update cycle. In this embodiment, the first update cycle is 10 seconds and the second update cycle is 3 seconds.

[0059] S5. Detects for abnormal data interaction, unauthorized access, and key theft in the transmission link using intrusion detection algorithms. If a security risk is detected, it sends an early warning to relevant management personnel and triggers an emergency encryption upgrade mechanism.

[0060] Intrusion detection algorithms employ a combination of anomaly detection and feature detection to detect security risks, specifically: By collecting data interaction frequency, data transmission volume, and link connection number during historical normal data transmission processes, a feature model of normal data transmission behavior (using Gaussian mixture model) is established. The real-time data transmission behavior is compared with the feature model to detect anomalies. If the deviation value exceeds the preset deviation threshold of 5, it is judged as an anomaly.

[0061] A preset attack behavior feature library is established, which includes common network attack behavior features (such as packet features of DDoS attacks, port access features of key theft attacks, etc.). Real-time data transmission behavior is matched with features in the attack behavior feature library for feature detection. If the match is successful, it is determined that there is a security risk, and the process proceeds to S6.

[0062] S6. Increase the key length of the encryption algorithm for the first-level data block to 4096 bits, the key length of the encryption algorithm for the second-level data block to 256 bits, and use the SHA-512 hash encryption algorithm for the third-level data block. Shorten the key update cycle to 1 second.

[0063] Enable the backup encrypted link, check the connection status of the preset backup encrypted link (using a VPN dedicated link), if the backup link is normal, switch the uncompleted data blocks to the backup encrypted link for transmission; if the backup link is abnormal, re-establish the backup encrypted link before transmission.

[0064] The sending end uses the upgraded encryption algorithm and updated encryption key to re-encrypt the incomplete data blocks and continues to transmit them to the receiving end through the backup encrypted link.

[0065] S7. The receiving end decrypts the encrypted data block and obtains the corresponding encryption key by using a key negotiation protocol, such as the Diffie-Hellman protocol, based on the encryption algorithm information synchronously transmitted by the sending end and the preset key synchronization mechanism.

[0066] The encrypted data block is decrypted using a decryption algorithm matched to that of the encryption end to obtain the original data block. Integrity verification is then performed on the decrypted original data block: the hash value of each original data block is calculated and compared with the hash value synchronously transmitted by the sending end; if they match, the integrity verification passes; if they do not match, the data block is considered corrupted, and a retransmission request is sent to the sending end, requesting the sending end to retransmit the data block.

[0067] All the verified raw data blocks are concatenated in block order to obtain the complete data to be transmitted.

[0068] like Figure 3 As shown, this embodiment provides a dynamic encryption system for secure transmission, used to implement a dynamic encryption method for secure transmission, including: The key dynamic generation module is set at the sending end and is used to obtain the attribute information of the data to be transmitted, the initial state parameters of the transmission link and the current timestamp, and generate an initial encryption key through a preset key generation model; it is also used to generate an updated encryption key based on the dynamic state parameters of the transmission link through a key update algorithm.

[0069] In this embodiment, the key dynamic generation module includes a key generation unit, a key update unit, and a key storage unit. The key generation unit is used to build and run a key generation model to generate an initial encryption key. The key generation model is a trained deep learning model with high key generation accuracy.

[0070] The key update unit is used to collect dynamic status parameters of the transmission link in real time during data transmission, input them into the key update algorithm to generate an updated encryption key, and dynamically adjust the key update cycle according to the stability of the link.

[0071] The key storage unit uses the AES encryption algorithm to encrypt and store the generated encryption keys, and employs an access control mechanism to restrict access to the keys and prevent key leakage.

[0072] The data block encryption module is set at the sending end and is used to divide the data to be transmitted into blocks, determine the importance level of each data block, match the corresponding encryption algorithm according to the importance level, and encrypt each data block using the generated encryption key.

[0073] The data block encryption module in this embodiment includes a block division unit, a level evaluation unit, and an encryption unit. The block division unit uses a sliding window algorithm to divide the data into blocks. The level evaluation unit uses the analytic hierarchy process (AHP) to determine the importance level of the data blocks based on a preset evaluation index system, namely data sensitivity, business value, and transmission priority.

[0074] The encryption unit has a built-in library of multiple encryption algorithms, including AES symmetric encryption algorithm, RSA asymmetric encryption algorithm and / or SHA-256 / SHA-512 hash encryption algorithm, and automatically matches the corresponding encryption algorithm according to the importance level of the data block.

[0075] The security monitoring module is used to monitor the dynamic status parameters of the transmission link in real time and detect the security status of the transmission link through intrusion detection algorithms; if a security risk is detected, an emergency encryption upgrade mechanism is triggered.

[0076] The security monitoring module in this embodiment includes a status acquisition unit, an intrusion detection unit, and a risk warning unit. The status acquisition unit uses sensors and link monitoring tools such as Wireshark and Netflow Analyzer to collect dynamic status parameters of the transmission link in real time, including bandwidth fluctuations, latency changes, and interference intensity. The intrusion detection unit uses intrusion detection algorithms to detect the link security status and whether there is unauthorized access, key theft, data tampering, etc.

[0077] If the risk warning unit detects a security risk, it will send a warning message to the administrator via SMS, email, system pop-up, etc., and trigger an emergency encryption upgrade mechanism.

[0078] An emergency encryption module is set at the sending end to respond to the emergency encryption upgrade mechanism, improve the encryption algorithm strength, shorten the key update cycle, and enable the backup encryption link to re-encrypt data blocks that have not been fully transmitted.

[0079] The data transmission module is used to transmit encrypted data blocks to the receiving end through a backup encrypted link, and also to realize the transmission of key synchronization and retransmission requests between the sending end and the receiving end.

[0080] The decryption and verification module is located at the receiving end. It is used to obtain the encryption key according to the key synchronization mechanism, decrypt the encrypted data block, verify the integrity of the decrypted original data block, and concatenate the verified original data blocks to obtain the complete data.

[0081] The decryption verification module includes a key acquisition unit, a decryption unit, and an integrity verification unit. The key acquisition unit synchronizes the key with the sending end based on the encryption algorithm information synchronously transmitted by the sending end and the preset key negotiation protocol, and obtains the corresponding encryption key.

[0082] The decryption unit calls the decryption algorithm that matches the encryption end, and uses the obtained encryption key to decrypt the encrypted data block to obtain the original data block.

[0083] The integrity verification unit calculates the hash value of each original data block and compares it with the hash value synchronously transmitted by the sender. If the comparison matches, the integrity verification is deemed successful. If the comparison does not match, a retransmission request is sent to the data transmission module, requesting the sender to retransmit the corresponding encrypted data block.

[0084] Therefore, the present invention adopts the above-mentioned dynamic encryption method and system for secure transmission, which relies on the core mechanism of dynamic encryption and real-time security monitoring, takes into account the differentiated security needs of various scenarios, ensures the confidentiality and integrity of data transmission in multiple scenarios, and significantly improves the universality and practical value of the invention.

[0085] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A dynamic encryption method for secure transmission, characterized in that, Includes the following steps: S1. Obtain the input parameters of the data to be transmitted and generate the initial encryption key; S2. Divide the data to be transmitted into blocks and determine the importance level of each data block; S3. Based on the initial encryption key, each data block is initially encrypted and transmitted in layers according to its importance level; S4. Collect dynamic status parameters of the transmission link to generate key update parameters, adjust the current encryption key, and obtain the updated encryption key; S5. Detect whether there are security risks in the transmission link. If so, proceed to S6. S6. Using the upgraded encryption algorithm and updated encryption key, the incomplete data block is re-encrypted and the transmission continues through the backup encryption link; S7. Decrypt the encrypted data block to obtain the original data block and verify its integrity.

2. The dynamic encryption method for secure transmission according to claim 1, characterized in that, In S1, the input parameters include the attribute information of the data to be transmitted, the initial state parameters of the transmission link, and the current timestamp; The attribute information of the data to be transmitted includes data type, data size, and data importance level; The initial state parameters of the transmission link include link bandwidth, link delay, and link signal-to-noise ratio; The input parameters are fed into the pre-trained key generation model to generate the initial encryption key. The construction process of the pre-trained key generation model is as follows: S11. Collect data attribute information samples, link status parameter samples, and timestamp samples during the historical data transmission process, and simultaneously collect the security key samples corresponding to each set of samples. S12. Perform classification and preprocessing operations on the collected sample data; S13. Divide the preprocessed sample data into a training set and a test set. Use the training set to train the initial machine learning model to obtain the initial key generation model. S14. Test the initial key generation model using a test set. If the key generation accuracy reaches the preset threshold, then the model is determined to be the final key generation model. If it does not reach the preset threshold, adjust the model parameters and retrain until the preset threshold is reached.

3. The dynamic encryption method for secure transmission according to claim 2, characterized in that, In S12, the preprocessing operation is as follows: Sa1. Remove samples with missing or outlier values. Outlier handling is determined using the Z-score method, with the formula as follows: ； In the formula, These are the standardized sample values. For a single sample value, The mean of the samples containing outliers. The standard deviation of samples containing outliers, when Values ​​greater than 3 are considered outliers and removed. For missing values ​​in structured data, statistical values ​​of the corresponding data type are used to fill in the missing values, including the median for numerical data, the mode for text data, and interpolation between adjacent times for date data; for missing values ​​in unstructured data, interpolation methods based on generative adversarial networks (GANs) are used to fill in the missing values. Sa2. Perform min-max normalization on the numerical data in the structured data, using the following formula: ； In the formula, The normalized value. It is the minimum value in the numerical data. This represents the maximum value in the numerical data, and after normalization, the data is mapped to the interval [0,1]. Sa3. After standardizing the format of the unstructured data, the image data is preprocessed by first denoising with Gaussian filtering, then converting to grayscale, and finally using the HOG algorithm to extract feature vectors. For audio data, pre-emphasis, frame segmentation, Hanning windowing, and short-time Fourier transform (STFT) are performed sequentially to obtain the spectrum. Then, the Mel frequency cepstral coefficients (MFCC) are extracted as feature vectors. For video data, the data is divided into frames according to the frame rate to obtain single-frame images. Image preprocessing steps are performed on each frame image. Then, inter-frame motion features are extracted using optical flow. The single-frame features and motion features are fused to obtain the video feature vector. For document or log data, the Bag-of-Words (BoW) model is used for text segmentation and stop word removal, and word vectors are extracted as features. Sa4. After unifying the dimensions of the feature vectors of structured and unstructured data, they are concatenated to obtain the final sample feature vector.

4. The dynamic encryption method for secure transmission according to claim 1, characterized in that, In S2, the block processing is specifically as follows: The sliding window block method is used to divide time series data into blocks for processing; A fixed-size block method is used to divide structured numerical data into blocks according to a fixed amount of data. Based on the content boundary segmentation method, unstructured data documents are segmented by paragraph or chapter boundaries, videos are segmented by shot transition boundaries, and audio is segmented by silent segment boundaries. Based on the semantic similarity segmentation method, the semantic similarity of adjacent data units in text and image data is calculated, and segmentation is performed when the similarity is lower than a preset threshold.

5. The dynamic encryption method for secure transmission according to claim 4, characterized in that, In S2, the importance level of each data block is determined according to the preset data importance assessment rules, specifically as follows: S21. Constructing a system including data sensitivity. Business Value and transmission priority The evaluation index system, among which, Used to reflect the severity of the harm caused by a data breach; Used to reflect the supporting value of data for business operations; Used to reflect the urgency of data transmission; S22. The weights of each indicator are determined using the analytic hierarchy process (AHP), and the weights of each indicator satisfy the following: ； in, For data sensitivity The weight, For business value The weight, Transmission priority The weights; S23. Each indicator is scored using a 10-point scale: Sensitivity to data 10 points for core confidential data, 8 points for important sensitive data, 6 points for general sensitive data, 4 points for low-sensitivity data, and 2 points for no sensitive data. For business value 10 points for core business support data, 8 points for important business support data, 6 points for general business support data, 4 points for auxiliary business data, and 2 points for data with no direct business value. For transmission priority 10 points for real-time emergency transmission, 8 points for high-priority transmission, 6 points for medium-priority transmission, 4 points for low-priority transmission, and 2 points for non-emergency transmission. S24. Determine the importance level of each data block based on the comprehensive scoring formula, which is as follows: ； In the formula, The data block is given a comprehensive score, with a maximum score of 10 points. Based on comprehensive score Importance levels of data block division: like 8. Determine that the data block is a level 1 data block; like 8. Determine that the data block is a secondary data block; like 6. Determine that the data block is a level 3 data block.

6. The dynamic encryption method for secure transmission according to claim 5, characterized in that, S3 specifically refers to: Based on the initial encryption key and the matching encryption algorithm, each data block is initially encrypted in layers according to its importance level to obtain encrypted data blocks; The encrypted data block is transmitted to the receiving end through the transmission link, and the importance level information and encryption algorithm information of the data block are transmitted to the receiving end simultaneously. Asymmetric encryption algorithm is used for first-level data blocks, symmetric encryption algorithm is used for second-level data blocks, and hash encryption algorithm is used for third-level data blocks.

7. The dynamic encryption method for secure transmission according to claim 6, characterized in that, S4 specifically refers to: The collected dynamic state parameters are input into the key update algorithm to generate key update parameters. The dynamic state parameters include link bandwidth fluctuation value, link delay change amount and link interference intensity. The current encryption key is adjusted based on the generated key update parameters to obtain the updated encryption key; The key update cycle is dynamically adjusted based on the stability of the transmission link, specifically as follows: Link stability is assessed by calculating the variance of link bandwidth fluctuations and latency variations. If the variance is less than the preset stability threshold, the link is stable, and the first update cycle is set; if the variance is greater than or equal to the preset stability threshold, the link is unstable, and the second update cycle is set, with the first update cycle being longer than the second update cycle.

8. The dynamic encryption method for secure transmission according to claim 7, characterized in that, In S5, an intrusion detection algorithm is used to detect whether there are abnormal data interactions, unauthorized access and key theft in the transmission link. If a security risk is detected, an emergency encryption upgrade mechanism is triggered. Intrusion detection algorithms employ a combination of anomaly detection and feature detection to detect security risks, specifically: Anomaly detection is performed by comparing real-time data transmission behavior with feature models. If the deviation value exceeds a preset deviation threshold, it is determined to be abnormal. The system performs feature detection by matching real-time data transmission behavior with features in the attack behavior feature database. If a match is found, the system is determined to be at risk of security breach.

9. A dynamic encryption system for secure transmission, used to implement the method according to any one of claims 1-8, characterized in that, include: The key dynamic generation module is used to obtain the attribute information of the data to be transmitted, the initial state parameters of the transmission link and the current timestamp, and generate the initial encryption key through the preset key generation model; The data block encryption module is used to divide the data to be transmitted into blocks and determine the importance level of each data block. The corresponding encryption algorithm is matched according to the importance level, and the generated encryption key is used to encrypt each data block. The security monitoring module is used to monitor the dynamic status parameters of the transmission link in real time and detect the security status of the transmission link through intrusion detection algorithms. If a security risk is detected, an emergency encryption upgrade mechanism will be triggered; The emergency encryption module is used to respond to the emergency encryption upgrade mechanism and re-encrypt data blocks that have not been fully transmitted; The data transmission module is used to transmit encrypted data blocks to the receiving end via a backup encrypted link. The decryption and verification module, located at the receiving end, is used to obtain the encryption key according to the key synchronization mechanism, decrypt the encrypted data block, verify the integrity of the decrypted original data block, and concatenate the verified original data blocks to obtain the complete data.

10. A dynamic encryption system for secure transmission according to claim 9, characterized in that, The key dynamic generation module includes a key generation unit, a key update unit, and a key storage unit. The key generation unit is used to build and run the key generation model and generate the initial encryption key. The key update unit is used to run the key update algorithm and generate the updated encryption key. A key storage unit is used to encrypt and store the generated encryption keys. The data block encryption module includes a block division unit, a level evaluation unit, and an encryption unit. The block division unit uses a sliding window algorithm to divide the data into blocks. The level evaluation unit uses the analytic hierarchy process (AHP) to determine the importance level of the data blocks based on a preset evaluation index system. The encryption unit has a built-in library of multiple encryption algorithms, which automatically matches the corresponding encryption algorithm according to the importance level of the data block. The security monitoring module includes a status acquisition unit, an intrusion detection unit, and a risk warning unit. The status acquisition unit is used to collect dynamic status parameters of the transmission link in real time. The intrusion detection unit detects the security status of the link through intrusion detection algorithms; The risk warning unit is used to detect security risks, send warning information to managers, and trigger an emergency encryption upgrade mechanism.

Images