Method and apparatus for dynamic encryption of communication channels

Abstract

The application relates to the technical field of network communication, and discloses a communication channel dynamic encryption method and device, which comprises the following steps: collecting communication scene related information and security state related information to obtain an evaluation result; selecting a corresponding encryption scheme based on the evaluation result to establish an encryption link; transmitting an updated key library by using the encryption link to complete seamless updating of the key library; and binding the encryption scheme and session information and optimizing session parameters based on the encryption link and the updated key library to obtain encrypted transmission of communication data. The communication channel dynamic encryption method and device are characterized in that, through three-dimensional evaluation of data sensitivity, network security level and historical interaction security record and dynamic adaptation of the encryption scheme, high-sensitivity data, dangerous network environment and other scenes can be subjected to high-intensity encryption with high pertinence, low-sensitivity data and safe network environment can be subjected to moderate encryption strength, transmission efficiency caused by excessive encryption is avoided, and security risks caused by insufficient encryption strength are reduced.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and more specifically to a method and apparatus for dynamic encryption of communication channels. Background Technology

[0002] In the field of network communication, secure data transmission between clients and servers is a core requirement, widely applied in scenarios such as financial payments, enterprise offices, and privacy data exchange. With the upgrading of network attack techniques, security threats such as malicious interception, data tampering, and identity forgery are becoming increasingly prominent, making communication channel encryption a crucial means of ensuring data security. While existing dynamic encryption technologies for communication channels achieve random allocation of encryption schemes, they have revealed core flaws in practical applications, making it difficult to simultaneously guarantee encryption security and communication continuity. Current technologies allocate encryption schemes solely through "random selection," failing to dynamically adapt encryption strength based on the sensitivity of the communication scenario and the state of network security. Furthermore, keystore updates can easily lead to communication interruptions. Firstly, the selection of encryption schemes lacks specificity. Using the same encryption strength for highly sensitive data (such as payment passwords and trade secrets) and ordinary data (such as routine notifications) results in either over-encryption leading to low transmission efficiency or insufficient encryption strength causing security risks. Simultaneously, differences in network environment security levels (such as public Wi-Fi and corporate intranets) are not considered. Using conventional encryption schemes in dangerous network environments makes them vulnerable to cracking. Secondly, keystore updates require disconnecting the current communication connection and re-establishing the encrypted link, causing data transmission interruptions. This is particularly problematic in scenarios such as large file transfers and real-time communication, severely impacting user experience and business continuity.

[0003] In summary, existing technologies cannot meet the high-security and uninterrupted communication requirements in complex scenarios due to the lack of scenario adaptability of encryption schemes and the risk of communication interruption during key library updates. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention proposes a dynamic encryption method and apparatus for communication channels, which solves the aforementioned technical problems.

[0005] Firstly, a dynamic encryption method for communication channels is provided, including: Collect information related to the communication scenario and security status to obtain the evaluation results; Based on the evaluation results, a corresponding encryption scheme is selected, and an encrypted link is established. The updated keystore is transmitted using the encrypted link, thus achieving a seamless update of the keystore. Based on the encrypted link and the updated key library, the encryption scheme and session information are bound together and the session parameters are optimized to obtain encrypted transmission of communication data.

[0006] Furthermore, the collected communication scenario-related information and security status-related information are used to obtain evaluation results, including: Obtain sensitivity-related information of the data to be transmitted to obtain the data sensitivity level; Detect security association information of the current network environment to obtain the network security level; Query the historical security records of the two communicating parties to obtain the historical risk level; The assessment results are obtained by integrating the data sensitivity level, network security level, and historical risk level.

[0007] Furthermore, the step of obtaining sensitivity-related information of the data to be transmitted to obtain the data sensitivity level includes: The data to be transmitted is subjected to type identification to obtain the type identification result; Based on the type identification results, the data to be transmitted is labeled with a sensitivity level label to obtain the sensitivity level label; The sensitivity level label is sent to the communication peer along with the data transmission request. After the communication peer verifies the validity of the label, the data sensitivity level is obtained.

[0008] Furthermore, the detection of security association information in the current network environment to obtain the network security level includes: Collect network environment information; The collected network environment information is quantitatively calculated based on preset weighted scoring rules to obtain a network security score. The network security level is obtained by mapping the network security score.

[0009] Furthermore, the step of selecting a corresponding encryption scheme based on the evaluation results and establishing an encrypted link includes: A library of encryption schemes with varying encryption strengths is pre-established. Based on the evaluation results, rules are set to obtain adaptation rules; Based on the adaptation rules, the corresponding encryption scheme is selected from the encryption scheme library to establish an encrypted link.

[0010] Furthermore, the step of transmitting the updated keystore using the encrypted link to achieve seamless keystore updates includes: Both communicating parties deploy a current key store and a backup key store respectively. The current key store stores the key used in the current session, and the backup key store is used to receive the updated key store. The peer detects the current keystore version of the initiator. If there is a version difference, the latest version of the keystore is encrypted and sent to the initiator in segments through the encrypted link. The initiator receives the latest version of the keystore and stores it in the backup keystore. After confirmation by hash verification and digital signature verification, the keystore is smoothly switched during the idle interval of the current communication or after the current session ends. After the switch is completed, the old version of the keystore is retained for a preset time according to preset rules, and the old version of the keystore is eliminated according to the storage situation, thus completing the seamless update of the keystore.

[0011] Furthermore, the step of binding the encryption scheme and session information and optimizing session parameters based on the encrypted link and the updated keystore to obtain encrypted transmission of communication data includes: Establish a binding relationship between the encryption scheme and the session information. During each data transmission, verify the consistency between the encryption scheme used and the binding information. If they are inconsistent, refuse to receive the data and trigger a security alarm. The session timeout time is adjusted according to data sensitivity, network security level and historical risk level. After the timeout, the same encryption scheme with the same strength is reassigned and the binding information is updated without interrupting the encrypted link. When the encrypted link is unexpectedly disconnected, the initiator sends a reconnection request with the original session information and the updated security status information. After the communication peer verifies the connection, the encrypted link is quickly rebuilt based on the updated key library to recover the data segments that were not transmitted before the interruption.

[0012] Furthermore, the adjustment of session timeout based on data sensitivity, network security level, and historical risk level includes: Preset timeout baseline values ​​for different data sensitivities; The timeout benchmark is adjusted based on the adjustment coefficient corresponding to the network security level and the risk coefficient corresponding to the historical risk level. The final timeout is calculated when the session is established. If the network security level or historical risk level changes during the session, the timeout is recalculated and updated synchronously in real time.

[0013] Secondly, a dynamic encryption device for communication channels is provided, based on any of the dynamic encryption methods for communication channels described above, including: The data acquisition module is configured to collect information related to the communication scenario and security status to obtain evaluation results. A module is configured to select a corresponding encryption scheme based on the evaluation results and establish an encrypted link. The update module is configured to use the encrypted link to transmit the updated keystore, thereby completing a seamless update of the keystore; The binding module is configured to bind the encryption scheme and session information and optimize session parameters based on the encrypted link and the updated key library to obtain encrypted transmission of communication data.

[0014] Thirdly, a communication channel dynamic encryption device is provided, including a processor and a memory storing program instructions, the processor being configured to execute the communication channel dynamic encryption method as described in any of the preceding items when running the program instructions.

[0015] The invention employing the above technical solution has the following advantages: This invention effectively solves the core defects of existing dynamic encryption technologies for communication channels, such as the lack of scenario adaptability of encryption schemes and the easy communication interruption caused by key library updates, by constructing a full-process technical system of scene perception and security assessment → dynamic adaptation of encryption schemes → seamless key library updates → intelligent session binding. It achieves dual protection of encryption security and communication continuity. On the one hand, by evaluating data sensitivity, network security level, and historical interaction security records in three dimensions and dynamically adapting encryption schemes, high-sensitivity data and dangerous network environments are given targeted high-strength encryption, while low-sensitivity data and secure network environments are adapted to appropriate encryption strength. This avoids the low transmission efficiency caused by excessive encryption and reduces the security risks caused by insufficient encryption strength, thereby improving the security and adaptability of communication data transmission. On the other hand, the dual-buffered keystore architecture achieves seamless keystore updates without interrupting current communication by running the current keystore and backup keystore in parallel and switching smoothly during idle periods. Combined with intelligent session binding, dynamic timeout adjustment, and abnormal reconnection mechanisms, it ensures business continuity in scenarios such as large file transfers and real-time communication, reduces user experience loss caused by communication interruptions, and prevents illegal reuse of encryption schemes, further enhancing session security and meeting the core communication requirements of high security and uninterrupted communication in complex scenarios as much as possible. Attached Figure Description

[0016] To more clearly illustrate the specific embodiments of the present invention, the accompanying drawings used in the specific embodiments will be briefly described below. In all the drawings, the elements or parts are not necessarily drawn to scale.

[0017] Fig. 1 This is a flowchart of the dynamic encryption method for communication channels of the present invention; Fig. 2 This is a flowchart of the communication channel dynamic encryption device of the present invention. Detailed Implementation

[0018] The embodiments of the technical solution of the present invention will now be described in detail with reference to the accompanying drawings. These embodiments are merely illustrative of the technical solution of the present invention and are therefore intended to limit the scope of protection of the present invention.

[0019] like Figs. 1-2 As shown, the communication channel dynamic encryption method of the present invention includes: Step S01: Collect information related to the communication scenario and security status to obtain the evaluation results; Step S02: Select the corresponding encryption scheme based on the evaluation results and establish an encryption link; Step S03: Transmit the updated keystore using an encrypted link to complete the seamless update of the keystore; Step S04: Based on the encrypted link and the updated key library, bind the encryption scheme and session information and optimize the session parameters to obtain encrypted transmission of communication data.

[0020] In this embodiment, communication scenario-related information and security status-related information are collected to obtain evaluation results, including: Obtain sensitivity-related information of the data to be transmitted to obtain the data sensitivity level; Detect security association information of the current network environment to obtain the network security level; Query the historical security records of the two communicating parties to obtain the historical risk level; The assessment results are obtained by integrating data sensitivity level, network security level, and historical risk level.

[0021] In this embodiment, sensitivity-related information of the data to be transmitted is obtained to determine the data sensitivity level, including: Type identification is performed on the data to be transmitted to obtain the type identification result; Based on the type identification results, the data to be transmitted is labeled with a sensitivity level label to obtain the sensitivity level label; The sensitivity level label is sent along with the data transmission request to the communication peer. After the communication peer verifies the validity of the label, the data sensitivity level is obtained.

[0022] Specifically, the server (server-side) and client collaborate to complete a comprehensive collection and assessment of scenario and security dimensions, which is divided into three sub-steps: Scene sensitivity classification: The client and server pre-agree on a unified data sensitivity grading standard (high, medium, and low levels) and establish a data type sensitivity mapping library. The specific implementation method is as follows: Before initiating a data transmission request, the client identifies the type of the data to be transmitted. The identification methods include: matching based on file extensions (e.g., .pfx privacy certificate files and .enc encrypted documents are considered highly sensitive), extracting keywords based on data content (e.g., data containing keywords such as "payment password" and "business secret" are considered highly sensitive), and associating data based on the type of transmission business (e.g., financial payment business is considered highly sensitive by default, and public notification business is considered low sensitive by default). The client assigns a sensitivity level label to the data based on the identification results. The label format is "Sensitivity Business Type" (e.g., "High Financial Payment", "Medium Business Approval", "Low System Notification"). The client sends the sensitivity level label along with the data transmission request to the server. The server verifies the label. If the label is missing or does not match the data type, the client is triggered to re-label it to ensure the accuracy of the classification.

[0023] Specific example: When a client initiates a bank transfer data transmission, it identifies fields such as "transfer amount" and "bank card number" through keyword extraction and marks them with a sensitivity level of "high financial payment". After receiving the data, the server verifies the consistency between the data type and the label. Once confirmed to be correct, it proceeds to the next evaluation stage.

[0024] In this embodiment, the security association information of the current network environment is detected to obtain the network security level, including: Collect network environment information; The collected network environment information is quantitatively calculated based on preset weighted scoring rules to obtain a network security score. The network security level is obtained by mapping the network security score.

[0025] Specifically, network security status detection: The server determines the current network security level through multi-dimensional data collection and quantitative assessment. The specific implementation method is as follows: Data collection: The server receives network environment information reported by the client, including network type (public Wi-Fi / corporate intranet / mobile data), IP address location, port connection status, and the number of abnormal connection attempts in the past 5 minutes (such as incorrect password login, number of illegal port scans). Security Level Assessment: The server has a built-in security assessment engine that uses a weighted scoring method to calculate the network security score. The scoring formula is as follows: S = w1×T + w2×I + w3×A Wherein, S is the network security score (0-100 points); T is the basic score for network type (90 points for enterprise intranet, 70 points for mobile data, and 40 points for public Wi-Fi); I is the IP address security score (80 points for commonly used location, 40 points for unfamiliar location, and 20 points for high-risk area); A is the abnormal connection correction score (100 points for no abnormal attempts, 60 points for 13 abnormal attempts, and 20 points for more than 3 abnormal attempts); w1 (0.4), w2 (0.3), and w3 (0.3) are weight coefficients, determined through training with historical attack data; Level mapping: The server maps network security level based on the scoring results: 80 points and above is "secure", 40-80 points is "average" and below 40 points is "dangerous".

[0026] Specific example: If a client connects via public Wi-Fi (T=40), and the IP address is a commonly used home address (I=80), and there are no abnormal connection attempts in the last 5 minutes (A-100), then the security score S=0.4×40+0.3×80+0.3×100=64 points, which is mapped to the "average" level.

[0027] Historical interaction security record verification: The server queries the client's historical communication records to supplement and verify security risks. The specific implementation method is as follows: The server queries historical communication records through client identity identifiers (such as device serial number, registered mobile phone number hash value). The record dimensions include: encryption scheme cracking records in the past 30 days, abnormal login times (such as login from different locations, login from inconsistent devices), and key leakage warning records. Risk assessment rules: If there is one or more cracking records or key leakage warnings, it is judged as "high risk"; if there are 12 abnormal logins, it is judged as "medium risk"; if there are no such records, it is judged as "low risk". Assessment results integration: The server integrates historical risk levels, sensitivity levels, and network security levels to form a "three-dimensional assessment matrix," which serves as the final basis for encryption scheme adaptation.

[0028] In this embodiment, the corresponding encryption scheme is selected based on the evaluation results, and an encrypted link is established, including: A library of encryption schemes with varying encryption strengths is pre-established. Based on the evaluation results, rules are set to obtain adaptive rules; Based on the adaptation rules, the corresponding encryption scheme is selected from the encryption scheme library to establish an encrypted link.

[0029] Specifically, the encryption scheme library is constructed as follows: The server and client pre-synchronize to establish a unified encryption scheme library. The library structure adopts a two-dimensional architecture of "three levels of strength and three types of uses". The specific implementation method is as follows: Strength classification: Encryption methods are divided into three sets: high strength, medium strength, and low strength. Each set corresponds to a specific combination of encryption algorithms. High-strength encryption scheme: The first encryption scheme (connection establishment) adopts the TLS 1.3 protocol, the second encryption scheme (authentication) adopts the RSA 4096 algorithm, and the third encryption scheme (data transmission) adopts the AES 256 GCM algorithm; Medium-strength encryption set: The first encryption scheme adopts the TLS 1.2 protocol, the second encryption scheme adopts the RSA2048 algorithm, and the third encryption scheme adopts the AES128GCM algorithm; Low-strength encryption set: The first encryption scheme uses the TLS 1.1 protocol, the second encryption scheme uses the RSA1024 algorithm, and the third encryption scheme uses the DESEDE3 algorithm; Scheme storage: The client stores the complete encryption scheme library locally, while the server stores the scheme library and corresponding algorithm parameters (such as key length and number of iterations) to ensure consistency between the two ends.

[0030] Adaptation rule settings: The server-side sets rigid adaptation rules based on a "three-dimensional evaluation matrix," adopting a decision-making logic of "sensitivity first, network security second," as follows: Table 1 The adaptation rules support dynamic updates. The server can adjust the rule parameters according to the latest security threat situation (such as the cracking of a certain algorithm), and the updated rules are synchronized to the client through an encrypted channel.

[0031] Dynamic allocation of plans: The client and server complete the deployment of the encryption scheme through an interaction process of "request verification and allocation". The specific implementation method is as follows: According to the above adaptation rules, the client extracts the first encryption scheme (used for connection establishment) from the local encryption scheme library with the corresponding strength set, and initiates an encrypted connection request, which carries the first encryption scheme identifier and the client's identity information. After receiving the request, the server verifies the client's identity (through dual verification of device fingerprint and verification code) and checks the consistency between the first encryption scheme identifier and the server's adaptation result. After successful verification, the server randomly selects a second encryption scheme (for authentication) and a third encryption scheme (for data transmission) from the same encryption set, and sends the scheme identifier and related parameters (such as RSA public key and AES initialization vector) to the client through the channel established by the first encryption scheme; After receiving the data, the client loads the corresponding scheme, completes local initialization, sends back confirmation information, and the encrypted link is officially established.

[0032] Specific example: The client is transmitting sensitive business approval data (medium sensitivity), the network security level is "general", the historical risk level is "low risk", and it is compatible with a high-strength encryption set; the client initiates a TLS 1.3 connection request, and after the server verifies the request, it allocates the RSA4096 authentication scheme and the AES256GCM transmission scheme. After the client loads the data, it sends a confirmation, and the scheme allocation is completed.

[0033] In this embodiment, an encrypted link is used to transmit the updated keystore, achieving seamless keystore updates, including: Both communicating parties deploy a current key store and a backup key store respectively. The current key store stores the key used in the current session, and the backup key store is used to receive the updated key store. The peer detects the current keystore version of the initiator. If there is a version difference, the latest version of the keystore is encrypted and sent to the initiator in segments through the encrypted link. The initiator receives the latest version of the keystore and stores it in the backup keystore. After confirmation by hash verification and digital signature verification, the keystore is smoothly switched during the idle interval of the current communication or after the current session ends. After the switch is completed, the old version of the keystore is retained for a preset time according to preset rules, and the old version of the keystore is eliminated according to the storage situation, thus completing the seamless update of the keystore.

[0034] Specifically, the dual-buffered keystore architecture is deployed as follows: The client and server adopt a dual-buffered storage architecture of current database + backup database, and the specific implementation method is as follows: The client maintains two independent keystores locally: the Active Key Store, which stores the keystore version currently in use and contains all the keys required for the current session (such as symmetric keys and asymmetric key pairs); and the Standby Key Store, which receives and stores updated keystore versions and is initially empty. The server stores all versions of the keystore, supports backward compatibility, and each keystore version is associated with a unique version number (in the format "YYYYMMDD.V", such as 20240520.1), and records version update logs (update time, update content, and applicable client range). Both key stores are stored in encrypted form, and the stored keys are protected by the device hardware security module (HSM) to prevent local leakage.

[0035] Keystore update triggering and synchronization: The server actively detects and triggers updates, and the synchronization process does not affect current communication. The specific implementation method is as follows: Update trigger: The server periodically (every 24 hours by default) checks the client's keystore version. The detection method is that the client carries the current keystore version number in each session heartbeat packet; the server compares the client version with the latest version. If the version difference is ≥1, an update command is triggered. Encrypted transmission: The server packages the latest version of the keystore into an encrypted package (encrypted using the third encryption scheme in the high-strength encryption set), and sends it to the client in segments through the currently used encrypted link to avoid establishing a separate update channel; Local verification: After receiving the encrypted packet, the client stores it in the backup key store directory and ensures its integrity and legitimacy through dual verification: ① Hash verification (calculate the SHA256 value of the encrypted packet and compare it with the verification value sent by the server); ② Digital signature verification (verify the server's RSA signature on the key store to confirm that it has not been tampered with). Verification failure handling: If verification fails, the client requests the server to retransmit the corresponding segment. The number of retransmissions shall not exceed 3. If it still fails, the log shall be recorded and an update shall be triggered in the next session.

[0036] Smooth keystore switchover and legacy keystore retirement: The client can switch key stores without interrupting current communication. The specific implementation method is as follows: Switching timing determination: After the client verifies the backup key library, it monitors the current communication session status in real time and identifies the "idle gap" (defined as a period of 500ms without data transmission or a frame interval ≥100ms). Smooth handover: If an idle gap is detected, the client automatically switches the backup keystore to the new current keystore, updates the version number, and marks the original current keystore as pending obsolescence; if there is no idle gap in the current communication (such as continuous large file transfer), the handover is completed after the current session ends normally and before the next connection is established; Old keystore elimination: After the switch is completed, the client retains the original keystore for 24 hours (for rollback) if there is sufficient local storage space. If the retention time is exceeded or storage space is insufficient, the old keystore will be automatically deleted. After all clients have completed the update, the server retains the latest 3 versions of the keystore and cleans up the remaining versions periodically.

[0037] Specific example: The client is currently using keystore version 20240520.1, and the server pushes the latest version 20240521.1; the client receives encrypted packets through the current AES256GCM channel, and stores them in the backup library after successful verification; the switch is completed at the frame interval (120ms) of large file transmission, the original version is marked as pending elimination, and is automatically deleted after 24 hours.

[0038] In this embodiment, based on the encrypted link and the updated keystore, the encryption scheme and session information are bound together and the session parameters are optimized to obtain encrypted transmission of communication data, including: Establish a binding relationship between the encryption scheme and the session information. During each data transmission, verify the consistency between the encryption scheme used and the binding information. If they are inconsistent, refuse to receive the data and trigger a security alarm. The session timeout is adjusted based on data sensitivity, network security level, and historical risk level. After the timeout, the same encryption scheme with the same strength is reallocated and the binding information is updated without interrupting the encrypted link. When the encrypted link is unexpectedly disconnected, the initiator sends a reconnection request with the original session information and the updated security status information. After the communication peer verifies the connection, the encrypted link is quickly rebuilt based on the updated keystore, and the data segments that were not transmitted before the interruption are recovered.

[0039] In this embodiment, adjusting the session timeout based on data sensitivity, network security level, and historical risk level includes: Preset timeout baseline values ​​for different data sensitivities; The timeout benchmark is adjusted based on the adjustment coefficient corresponding to the network security level and the risk coefficient corresponding to the historical risk level. The final timeout is calculated when the session is established. If the network security level or historical risk level changes during the session, the timeout is recalculated and updated synchronously in real time.

[0040] Specifically, the session binding mechanism is implemented as follows: The server strongly binds the encryption scheme to the session information to prevent unauthorized reuse of the encryption scheme. The specific implementation method is as follows: Binding information generation: After establishing an encrypted link, the server generates a session binding dataset, which includes the third encryption scheme identifier, session timeout, client identity identifier (device serial number + IP address hash value), and network security level. The dataset is stored in JSON format. Binding storage: The server associates the binding dataset with the session ID and stores it in the session cache (the validity period and timeout are the same). The client stores a simplified binding information locally (containing only the third encryption scheme identifier and session ID). Transmission verification: During each data transmission, the client carries the session ID in the header of the data packet. After receiving the data, the server queries the session cache to verify whether the encryption scheme used in the data packet is consistent with the binding information. If they are inconsistent, the server refuses to receive the data and triggers a security alarm.

[0041] Intelligent timeout period dynamically adjusted: The timeout period is dynamically adjusted based on data sensitivity to avoid security risks or resource waste caused by a fixed timeout. The specific implementation method is as follows: Basic timeout settings: Preset timeout baseline values, with 8 minutes for highly sensitive data, 18 minutes for medium sensitive data, and 30 minutes for low sensitive data; Dynamic adjustment formula: T timeout = T0×(1 + k×R) Among them, T timeoutT0 is the final timeout period; T0 is the corresponding sensitivity baseline value; k is the adjustment coefficient (k=0.2 when the network security level is "dangerous", k=0 when it is "normal", and k=0.1 when it is "secure"); R is the historical risk coefficient (R=0.3 for high risk, R=0.1 for medium risk, and R=0 for low risk). Timeout Update: The timeout period is calculated when the session is established. If the network security level or historical risk level changes during the session, the server will recalculate it in real time and synchronize it to the client. Timeout handling: After a timeout, the server will reallocate a third encryption scheme of the same strength set during the idle interval of the current session, update the binding information, and the client will automatically load the new scheme to continue communication without disconnecting the connection.

[0042] Specific example: Highly sensitive data (T0=8 minutes), network security level "dangerous" (k=0.2), historical risk level "medium risk" (R=0.1), then the final timeout time T timeout =8×(1+0.2×0.1)=8.16 minutes (approximately 8 minutes and 10 seconds); after the timeout, the server reallocates the AES256GCM scheme during the idle interval, and the client continues transmission after updating.

[0043] Abnormal reconnection and fast recovery mechanism: To address scenarios where communication links are unexpectedly disconnected, a fast reconnection and encryption scheme reuse mechanism is implemented. The specific implementation method is as follows: Reconnection request generation: After communication is interrupted, the client retains the original session ID, the strength of the bound encryption scheme, and the latest security status information (re-detected network security level and data sensitivity) to generate a reconnection request packet; Authentication: When the client sends a reconnection request, the server receives it and verifies the validity of the session ID (whether it is within the timeout period), the consistency of the client's identity identifier, and the latest security status information. Scheme allocation: After successful verification, the server prioritizes allocating an encryption scheme within the same strength set as the original session, reusing some key parameters (such as the RSA public key) to quickly rebuild the encrypted link; if verification fails, the regular connection process is triggered (re-executed from step 1). Data recovery: After the link is rebuilt, the client uses a sequence number verification mechanism to recover the data segments that were not transmitted before the interruption, ensuring data integrity.

[0044] Specific example: When a client transmits highly sensitive data, the connection is lost due to network fluctuations. After 1 minute, a reconnection is initiated, carrying the original session ID, a high-strength encryption set identifier, and the updated network security level "general". After the server verifies the connection, it quickly assigns an RSA4096 authentication scheme and an AES256GCM transmission scheme, and the client resumes the file transmission before the interruption without data loss.

[0045] In other embodiments, a communication channel dynamic encryption apparatus is provided, based on any of the communication channel dynamic encryption methods described above, including: The data acquisition module is configured to collect information related to the communication scenario and security status to obtain evaluation results. Establish a module and configure it to select the corresponding encryption scheme based on the evaluation results and establish an encrypted link; The update module is configured to transmit the updated keystore via an encrypted link, thus achieving a seamless update of the keystore. The binding module is configured to bind encryption schemes and session information and optimize session parameters based on encrypted links and updated keystores to achieve encrypted transmission of communication data.

[0046] In other embodiments, a communication channel dynamic encryption apparatus is provided, including a processor and a memory storing program instructions, the processor being configured to execute a communication channel dynamic encryption method as described above when the program instructions are executed.

[0047] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A dynamic encryption method for communication channels, characterized in that, include: Collect information related to the communication scenario and security status to obtain the evaluation results; Based on the evaluation results, a corresponding encryption scheme is selected, and an encrypted link is established. The updated keystore is transmitted using the encrypted link, thus achieving a seamless update of the keystore. Based on the encrypted link and the updated key library, the encryption scheme and session information are bound together and the session parameters are optimized to obtain encrypted transmission of communication data.

2. The dynamic encryption method for communication channels according to claim 1, characterized in that, The collected communication scenario-related information and security status-related information are used to obtain evaluation results, including: Obtain sensitivity-related information of the data to be transmitted to obtain the data sensitivity level; Detect security association information of the current network environment to obtain the network security level; Query the historical security records of the two communicating parties to obtain the historical risk level; The assessment results are obtained by integrating the data sensitivity level, network security level, and historical risk level.

3. The dynamic encryption method for communication channels according to claim 2, characterized in that, The process of obtaining sensitivity-related information of the data to be transmitted to obtain the data sensitivity level includes: The data to be transmitted is subjected to type identification to obtain the type identification result; Based on the type identification results, the data to be transmitted is labeled with a sensitivity level label to obtain the sensitivity level label; The sensitivity level label is sent to the communication peer along with the data transmission request. After the communication peer verifies the validity of the label, the data sensitivity level is obtained.

4. The dynamic encryption method for communication channels according to claim 2, characterized in that, The process of detecting security association information of the current network environment to obtain the network security level includes: Collect network environment information; The collected network environment information is quantitatively calculated based on preset weighted scoring rules to obtain a network security score. The network security level is obtained by mapping the network security score.

5. The dynamic encryption method for communication channels according to claim 1, characterized in that, The step of selecting a corresponding encryption scheme based on the evaluation results and establishing an encryption link includes: A library of encryption schemes with varying encryption strengths is pre-established. Based on the evaluation results, rules are set to obtain adaptation rules; Based on the adaptation rules, the corresponding encryption scheme is selected from the encryption scheme library to establish an encrypted link.

6. The dynamic encryption method for communication channels according to claim 1, characterized in that, The step of transmitting the updated keystore using the encrypted link to achieve seamless keystore updates includes: Both communicating parties deploy a current key store and a backup key store respectively. The current key store stores the key used in the current session, and the backup key store is used to receive the updated key store. The peer detects the current keystore version of the initiator. If there is a version difference, the latest version of the keystore is encrypted and sent to the initiator in segments through the encrypted link. The initiator receives the latest version of the keystore and stores it in the backup keystore. After confirmation by hash verification and digital signature verification, the keystore is smoothly switched during the idle interval of the current communication or after the current session ends. After the switch is completed, the old version of the keystore is retained for a preset time according to preset rules, and the old version of the keystore is eliminated according to the storage situation, thus completing the seamless update of the keystore.

7. The dynamic encryption method for communication channels according to claim 1, characterized in that, The process of binding the encryption scheme and session information and optimizing session parameters based on the encrypted link and the updated key library to obtain encrypted transmission of communication data includes: Establish a binding relationship between the encryption scheme and the session information. During each data transmission, verify the consistency between the encryption scheme used and the binding information. If they are inconsistent, refuse to receive the data and trigger a security alarm. The session timeout time is adjusted according to data sensitivity, network security level and historical risk level. After the timeout, the same encryption scheme with the same strength is reassigned and the binding information is updated without interrupting the encrypted link. When the encrypted link is unexpectedly disconnected, the initiator sends a reconnection request with the original session information and the updated security status information. After the communication peer verifies the connection, the encrypted link is quickly rebuilt based on the updated key library to recover the data segments that were not transmitted before the interruption.

8. The dynamic encryption method for communication channels according to claim 7, characterized in that, The adjustment of session timeout based on data sensitivity, network security level, and historical risk level includes: Preset timeout baseline values ​​for different data sensitivities; The timeout benchmark is adjusted based on the adjustment coefficient corresponding to the network security level and the risk coefficient corresponding to the historical risk level. The final timeout is calculated when the session is established. If the network security level or historical risk level changes during the session, the timeout is recalculated and updated synchronously in real time.

9. A communication channel dynamic encryption device, characterized in that, The communication channel dynamic encryption method based on any one of claims 1 to 8 includes: The data acquisition module is configured to collect information related to the communication scenario and security status to obtain evaluation results. A module is configured to select a corresponding encryption scheme based on the evaluation results and establish an encrypted link. The update module is configured to use the encrypted link to transmit the updated keystore, thereby completing a seamless update of the keystore; The binding module is configured to bind the encryption scheme and session information and optimize session parameters based on the encrypted link and the updated key library to obtain encrypted transmission of communication data.

10. A communication channel dynamic encryption device, comprising a processor and a memory storing program instructions, characterized in that, The processor is configured to execute the communication channel dynamic encryption method as described in any one of claims 1 to 8 when running the program instructions.

Images