A situation awareness-based password security service management method

Abstract

The application discloses a kind of based on situation awareness cryptographic security service management method, belong to cryptographic service security technical field.This method acquires the node running state sequence and security alarm log stream of cryptographic service node cluster, carries out time series decomposition and event aggregation to obtain state trend component, state fluctuation component and alarm intensity sequence;Calculate situation evolution offset and situation disturbance coefficient, to both as constraint constructs security situation evaluation function and solves steady-state solution, according to the change gradient of steady-state solution determines situation transition critical point;After triggering, activate security probe in critical point, collect encryption suite negotiation sequence and key exchange load characteristics to generate security enhancement verification vector, generate dynamic security policy parameter set in combination with situation characteristic parameter, adjust key update period and session reconstruction threshold.The application realizes accurate perception to cryptographic service security situation and adaptive dynamic adjustment of security policy.

Description

Technical Field

[0001] This invention relates to the field of cryptographic service security technology, specifically to a cryptographic security service management method based on situational awareness. Background Technology

[0002] Cryptographic service node clusters typically employ fixed security policies when providing encryption, decryption, signature verification, and other cryptographic operations for business systems. These policies include preset key update cycles and session reconstruction thresholds. However, these static policies cannot respond to dynamic changes in the security posture during operation. When node load fluctuates or frequent anomaly alarms occur, fixed key update intervals may be too long, leading to an expanded key leakage risk window, or too short, resulting in unnecessary waste of computing resources. Fixed session reconstruction thresholds also struggle to isolate risky sessions in a timely manner during sudden surges in attack traffic. Existing security monitoring methods primarily rely on threshold alarms for single resource indicators, such as alarms generated when CPU utilization exceeds limits or memory usage is too high, requiring manual adjustments to security configurations by operations personnel. This approach analyzes node operating status and security events in isolation, lacking a quantitative characterization of their coupling relationship. It fails to perceive the evolution direction and degree of disturbance in the system-level security posture and cannot automatically generate security policy parameters that match the current threat intensity. When attackers penetrate cryptographic services through methods such as cipher suite downgrade attacks and key exchange parameter tampering, static rules alone are insufficient to identify early shifts in the posture, resulting in a delayed response. Summary of the Invention

[0003] The problem this application aims to solve is how to accurately capture the phase shift and disturbance magnitude of the situation evolution when performing correlation analysis on the operating status and alarm logs of the cryptographic service node cluster, and to build an evaluation mechanism based on this to discover the critical point of situation transition; furthermore, when a situation transition occurs, how to extract the verification vector associated with the current security situation from the cryptographic suite negotiation process and key exchange payload of the cryptographic service request message, and generate policy parameters for dynamically adjusting the key update cycle and session reconstruction threshold accordingly, so as to realize the real-time adaptive adjustment of the security policy.

[0004] This invention provides a situational awareness-based cryptographic security service management method. The aim is to jointly analyze the operational status sequence and security alarm log stream of a cryptographic service node cluster. By quantifying the phase deviation and amplitude correlation between the status trend and alarm intensity through situational evolution offset and situational disturbance coefficient, a security situation assessment function is established and situational transition critical points are automatically identified. After the critical point is triggered, a security enhancement verification vector is generated based on the cryptographic suite negotiation sequence and key exchange payload characteristics. Combined with situational feature parameters, adjustment strategies for the key update cycle and session reconstruction threshold are dynamically output, achieving adaptive optimization of the cryptographic service security strategy as the security situation changes.

[0005] To achieve the above objectives, the present invention provides the following technical solution.

[0006] A situational awareness-based method for managing cryptographic security services, comprising the following steps: The system collects node operation status sequences and security alarm log streams from a cryptographic service node cluster within a continuous time window. It performs time-series decomposition on the node operation status sequences to extract state trend and state fluctuation components, and aggregates and statistically analyzes the event types in the security alarm log streams to generate an alarm intensity sequence. Preferably, it pulls CPU utilization, memory usage, and network throughput from each cryptographic service node in the cluster in parallel at preset sampling intervals, and combines them to generate a node operation status sequence. A local weighted regression smoothing algorithm is used to perform seasonal trend decomposition on the node operation status sequences, decomposing them into state trend components, state periodic components, and state residual components. The state trend components and state residual components are selected as the extraction results. Each alarm record in the security alarm log stream is classified and statistically analyzed according to alarm event type. The frequency of occurrence of each alarm event type per unit time within the time window is calculated, and the weighted sum of the unit time frequencies of each alarm event type is used to generate an alarm intensity sequence. This process, through refined decomposition of operational metrics of the cryptographic service node cluster and quantitative aggregation of security alarms, can accurately grasp the operational status of the cluster from both macro-trend and micro-fluctuation levels, providing a reliable data foundation for situation evolution analysis.

[0007] The situation evolution offset is calculated based on the phase difference between the state trend component and the alarm intensity sequence, and the situation disturbance coefficient is calculated based on the amplitude ratio between the state fluctuation component and the alarm intensity sequence. As a technical solution of the present invention, the state trend component and the alarm intensity sequence are respectively transformed in the frequency domain to obtain the state trend spectrum and the alarm intensity spectrum. The first phase angle corresponding to the dominant frequency component in the state trend spectrum is extracted, and the second phase angle corresponding to the dominant frequency component in the alarm intensity spectrum is extracted. The absolute value of the difference between the first phase angle and the second phase angle is calculated as the situation evolution offset. The first amplitude corresponding to the dominant frequency component in the state trend spectrum is extracted, and the second amplitude corresponding to the dominant frequency component in the alarm intensity spectrum is extracted. The second amplitude is divided by the first amplitude to obtain the reference amplitude ratio. The local maximum value sequence and the local minimum value sequence of the state fluctuation component are extracted. The first absolute value sequence of the difference between the local maximum value sequence and the alarm intensity sequence at the corresponding positions is calculated, and the second absolute value sequence of the difference between the local minimum value sequence and the alarm intensity sequence at the corresponding positions is calculated. The mean of the first absolute value sequence of the difference and the second absolute value sequence of the difference is used as the amplitude correction coefficient. The reference amplitude ratio is multiplied by the amplitude correction coefficient to obtain the situation disturbance coefficient. In this way, by combining frequency domain analysis and time domain fluctuation characteristic correction, the deviation in the rate of evolution between the operating status and safety alarms, as well as the degree of disturbance amplification, are accurately quantified, thereby improving the accuracy of the description of situational changes.

[0008] Using situation evolution offset and situation disturbance coefficient as constraints, a cryptographic service security situation assessment function is constructed. The steady-state solution of the cryptographic service security situation assessment function is solved, and the situation transition critical point is determined based on the change gradient of the steady-state solution within the current time window. Preferably, the situation evolution offset is used as the offset penalty term of the situation assessment function, and the situation disturbance coefficient is used as the disturbance penalty term of the situation assessment function, constructing a cryptographic service security situation assessment function containing a security situation baseline term, an offset penalty term, and a disturbance penalty term. The values ​​of the state trend components and the alarm intensity sequence corresponding to each sampling moment within the continuous time window are substituted into the cryptographic service security situation assessment function to calculate the situation assessment value corresponding to each sampling moment, forming a situation assessment time series. The situation assessment time series is accumulated and summed to obtain a situation accumulation sequence, and the situation accumulation sequence is differentially processed to obtain a situation change gradient sequence. Sampling moments whose absolute values ​​exceed a preset gradient threshold are extracted from the situation change gradient sequence as candidate transition moments, and the moment with the largest rate of change of the situation assessment value among the candidate transition moments is selected as the situation transition critical point. The preset gradient threshold is dynamically calculated based on the mean square error of the situation assessment time series. By introducing dual penalties for offset and disturbance to construct the assessment function, and using the gradient of cumulative change to detect critical transition points, it is possible to effectively suppress occasional fluctuations and accurately pinpoint the moment when the security situation undergoes a fundamental change, preventing missed or false alarms.

[0009] Once the state transition critical point is triggered, the security probes in the cryptographic service node cluster are activated to collect the cipher suite negotiation sequence and key exchange payload features from the cryptographic service request message, generating a security enhancement verification vector. In a preferred implementation, when the current sampling time is detected to have reached the state transition critical point, a probe activation command is sent to each cryptographic service node in the cluster, causing each node to initiate a deep message parsing process. This deep parsing process extracts the cipher suite negotiation sequence from the transport layer security protocol handshake phase of the cryptographic service request message. This sequence contains the identifiers and priority order of each candidate encryption algorithm. The deep parsing process also extracts the key exchange payload from the key exchange phase of the message, parsing out elliptic curve parameters, prime moduli, and generators as key exchange payload features. The identifiers of each candidate encryption algorithm in the cipher suite negotiation sequence are mapped to encryption capability encoding vectors according to their priority order, and the elliptic curve parameters, prime moduli, and generators are mapped to key parameter encoding vectors. The encryption capability encoding vector and the key parameter encoding vector are then concatenated to generate the security enhancement verification vector. At critical moments of strategic shifts, deep probes are launched in real time to collect micro-features at the key level of session negotiation. The generated verification vector carries both encryption capability preferences and key parameter features, providing valuable information for precise adjustments to subsequent strategies.

[0010] Based on the security enhancement verification vector and the situation feature parameters at the situation transition critical point, a dynamic security policy parameter set is generated. The key update cycle and session reconstruction threshold in the cryptographic service node cluster are adjusted according to this dynamic security policy parameter set. As a further improvement of this invention, situation assessment values ​​and situation change gradient values ​​at the situation transition critical point are extracted to form situation feature parameters. The security enhancement verification vector and the situation feature parameters are concatenated to generate a comprehensive security feature vector. This comprehensive security feature vector is input to a policy parameter mapping function, which outputs key update cycle adjustment coefficients and session reconstruction threshold adjustment coefficients. The currently effective baseline key update cycle and baseline session reconstruction threshold in the cryptographic service node cluster are queried. The baseline key update cycle is multiplied by the key update cycle adjustment coefficient to obtain the updated key update cycle, and the baseline session reconstruction threshold is multiplied by the session reconstruction threshold adjustment coefficient to obtain the updated session reconstruction threshold. The updated key update cycle and the updated session reconstruction threshold are combined to generate a dynamic security policy parameter set, which is then distributed to each cryptographic service node in the cryptographic service node cluster for adjustment. By integrating macro-level situational transition features with micro-level message verification vectors to generate comprehensive feature-guided strategy mapping, the adjusted key update cycle and session reconstruction threshold can adaptively match the current threat intensity and security status.

[0011] Preferably, the process of inputting the comprehensive security feature vector into the policy parameter mapping function specifically involves: obtaining a pre-stored policy parameter mapping table, which contains multiple security feature vector samples and key update cycle adjustment coefficient labels and session reconstruction threshold adjustment coefficient labels corresponding to each security feature vector sample; calculating the cosine similarity between the comprehensive security feature vector and each security feature vector sample in the policy parameter mapping table, and selecting the security feature vector sample with the highest cosine similarity as the matching sample; extracting the key update cycle adjustment coefficient label corresponding to the matching sample as the key update cycle adjustment coefficient, and extracting the session reconstruction threshold adjustment coefficient label corresponding to the matching sample as the session reconstruction threshold adjustment coefficient. Specifically, the comprehensive security feature vector and the security feature vector samples in the policy parameter mapping table are normalized before the cosine similarity matching. This table-based mapping method based on similarity matching achieves policy parameter generation, resulting in high computational efficiency, stable and interpretable results, and the ability to quickly respond to changes in the situation and adaptively adjust the security policy.

[0012] As a preferred embodiment of the present invention, after distributing the dynamic security policy parameter set to each cryptographic service node in the cryptographic service node cluster for adjustment, the method further includes a step of verifying the consistency of the security status of each cryptographic service node after adjustment: sending a security status query request to each cryptographic service node in the cryptographic service node cluster, receiving the actual effective key update cycle and the actual effective session reconstruction threshold fed back by each cryptographic service node; comparing the actual effective key update cycle fed back by each cryptographic service node with the updated key update cycle in the dynamic security policy parameter set one by one to determine whether each cryptographic service node has completed the key update cycle adjustment; comparing the actual effective session reconstruction threshold fed back by each cryptographic service node with the updated session reconstruction threshold in the dynamic security policy parameter set one by one to determine whether each cryptographic service node has completed the session reconstruction threshold adjustment; if there are cryptographic service nodes that have not completed the adjustment, the dynamic security policy parameter set is reissued to the cryptographic service nodes that have not completed the adjustment and the number of reissues is recorded. When the number of reissues reaches the preset retry limit, a policy issuance failure alarm is generated. By implementing a closed-loop verification and retry mechanism for the actual effective status of each node after the policy is issued, the consistency of security policies and the reliability of adjustment actions of the entire cryptographic service node cluster are ensured, eliminating the security shortcomings caused by the lack of synchronization of policies on some nodes.

[0013] Technical effects: By extracting state trend and state fluctuation components from the node's operational state sequence, and generating an alarm intensity sequence from the security alarm log stream, and calculating the situation evolution offset and situation disturbance coefficient accordingly, the performance change trend of the cryptographic service node and the dynamic intensity of security alarms can be coupled and analyzed in the frequency and time domains. The situation evolution offset quantifies the degree of lead or lag of the operational state trend relative to the alarm intensity change by using the absolute value of the phase difference between the dominant frequency component of the state trend spectrum and the dominant frequency component of the alarm intensity spectrum. This allows situation assessment to no longer rely on the index value at a single point in time, but rather capture the relative evolution rhythm of the two over time. The situation disturbance coefficient is an amplitude correction coefficient generated by combining the baseline amplitude ratio of the dominant frequency amplitude of the state trend spectrum to the dominant frequency amplitude of the alarm intensity spectrum, along with the difference between the local extreme value sequence of the state fluctuation component and the alarm intensity sequence. It simultaneously reflects the overall amplification of the alarm intensity relative to the state trend and the instantaneous deviation of local fluctuations from the alarm. These two coefficients, as constraints, participate in the construction of the security posture assessment function, which can more completely express the degree of system deviation from steady state and the scale of disturbance. Based on the gradient of the steady-state solution of this function, the critical point of posture transition can be determined, allowing for earlier and more accurate detection of the boundary moment when the system transitions from a normal operating state to a high-risk state. After the critical point of posture transition is triggered, the security probe is activated to collect the cipher suite negotiation sequence and key exchange payload features in the cryptographic service request message, generating a security enhancement verification vector. This vector is then concatenated with the posture feature parameters at the critical point to form a comprehensive security feature vector used to map the dynamic security policy parameter set. This enables the dual constraint of security policy adjustment on the current business encryption behavior characteristics and the overall security posture. The cipher suite negotiation sequence reflects the actual negotiation process and priority selection of encryption algorithms between the client and the cryptographic service node during the handshake phase. The key exchange payload features extract key cryptographic parameters such as elliptic curve parameters, prime modulus, and generators. Encoding this information into a security enhancement verification vector can capture potential cipher suite downgrading or weak key parameter injection behaviors that attackers may implement. By combining this vector with the situation assessment value and change gradient at the situation transition point, and inputting it into the policy parameter mapping function, the key update cycle adjustment coefficient and session reconstruction threshold adjustment coefficient are obtained. Based on the adjusted parameters, each cryptographic service node is updated, so that the key update frequency and session reconstruction conditions not only change dynamically with the overall deterioration or improvement of the security situation, but are also directly related to the strength of the encryption suite and key exchange parameters currently being transmitted. This avoids triggering excessive adjustments when the encryption service level has not substantially declined, or insufficient adjustments when the encryption parameters have already shown vulnerability, thereby improving the accuracy and real-time performance of the cryptographic service node cluster in resisting dynamic threats during continuous operation. Attached Figure Description

[0014] Figure 1 This is a flowchart of a situational awareness-based cryptographic security service management method. Figure 2 This is a flowchart showing the running status and security alarm handling process of the cryptographic service node; Figure 3 This is a flowchart of the security posture assessment method for cryptographic services; Figure 4 This is a flowchart of message deep parsing and security enhancement verification vector generation; Figure 5 This is a flowchart of the generation and distribution of dynamic security policy parameters. Detailed Implementation

[0015] See Figure 1 A situational awareness-based cryptographic security service management method is proposed. This method collects node operation state sequences and security alarm log streams from a cryptographic service node cluster within a continuous time window. The node operation state sequences are decomposed temporally to extract state trend components and state fluctuation components. The security alarm log streams are aggregated and statistically analyzed to generate alarm strength sequences. Subsequently, a situational evolution offset is calculated based on the phase difference between the state trend components and the alarm strength sequences, and a situational disturbance coefficient is calculated based on the amplitude ratio between the state fluctuation components and the alarm strength sequences. Using the situational evolution offset and the situational disturbance coefficient as constraints, a cryptographic service security situation assessment function is constructed, and the steady-state solution of this function is solved. The situational transition critical point is determined based on the gradient of the steady-state solution within the current time window. When the situational transition critical point is triggered, security probes in the cryptographic service node cluster are activated to collect the cryptographic suite negotiation sequence and key exchange payload features from the cryptographic service request messages, generating a security enhancement verification vector. Based on the security enhancement verification vector and the situational characteristic parameters at the situational transition critical point, a dynamic security policy parameter set is generated, and the key update cycle and session reconstruction threshold in the cryptographic service node cluster are adjusted accordingly.

[0016] Example 1: In specific implementation, please refer to Figure 2 The system collects the node operation status sequence and security alarm log stream of the cryptographic service node cluster within a continuous time window. The continuous time window is a preset fixed-length period, with its start and end times determined by the system clock synchronization signal. The cryptographic service node cluster contains multiple cryptographic service nodes, each independently running cryptographic computation services. At a preset sampling interval, the system pulls three metrics—CPU utilization, memory usage, and network throughput—in parallel from the performance monitoring interfaces of each cryptographic service node. Each pull operation reads the instantaneous sampled value of the corresponding cryptographic service node at the current moment. If a cryptographic service node is unreachable at the sampling moment, all three metrics for that sampling moment are set to zero, and that moment is marked as a missing point.

[0017] The three types of indicators obtained constitute a three-dimensional vector at each sampling time. Arranging the three-dimensional vectors at all sampling times in temporal order yields the node's operational state sequence. For each dimension of the sequence component in the node's operational state sequence, a locally weighted regression smoothing algorithm is used for seasonal trend decomposition. Seasonal trend decomposition decomposes a sequence into a state trend component, a state cycle component, and a state residual component. The decomposition process is iterative: the state trend component is initialized to equal the original sequence component; in each iteration, the state trend component is first subtracted from the original sequence component to obtain a detrended sequence; the detrended sequence is segmented according to the seasonal cycle, with data points at the same position in each cycle forming a periodic subsequence; locally weighted regression smoothing is performed on each periodic subsequence; the smoothed result is low-pass filtered and then subjected to another locally weighted regression smoothing to obtain the state cycle component; the state cycle component is subtracted from the original sequence component to obtain the de-periodic sequence; locally weighted regression smoothing is performed on the de-periodic sequence to obtain the updated state trend component; the above steps are repeated until the changes in the state trend component and the state cycle component are less than a preset convergence threshold. After iteration, the state trend component and state periodic component are subtracted from the original sequence components to obtain the state residual component. After decomposition, the three sub-components corresponding to CPU utilization are denoted as CPU utilization trend component, CPU utilization periodic component, and CPU utilization residual component, respectively; the three sub-components corresponding to memory occupancy are denoted as memory occupancy trend component, memory occupancy periodic component, and memory occupancy residual component, respectively; and the three sub-components corresponding to network throughput are denoted as network throughput trend component, network throughput periodic component, and network throughput residual component, respectively.

[0018] All state trend components are selected as extraction results. The extraction method is as follows: The CPU utilization trend component, memory usage trend component, and network throughput trend component at the same sampling time are weighted and averaged. The weights are pre-set according to the degree to which each indicator reflects system load; for example, the weight of CPU utilization is 0.4, the weight of memory usage is 0.3, and the weight of network throughput is 0.3. This yields the state trend component value at that sampling time. The state trend component values ​​at all sampling times form a state trend component sequence. All state residual components are selected as extraction results. The extraction method is as follows: The CPU utilization residual component, memory usage residual component, and network throughput residual component at the same sampling time are weighted and averaged. The weights are the same as the weights of the state trend components. This yields the state fluctuation component value at that sampling time. The state fluctuation component values ​​at all sampling times form a state fluctuation component sequence.

[0019] In some implementations, instead of using a weighted average, the trend components and residual components of each dimension can be retained separately to form multidimensional state trend components and state fluctuation components, which can then be used directly in subsequent steps to create a multidimensional sequence.

[0020] While extracting the state trend component and state fluctuation component, the security alarm log stream is processed. The security alarm log stream is generated in real time by the security monitoring module in the cryptographic service node cluster and aggregated to the log collection center. The log collection center categorizes and statistically analyzes each alarm record according to the alarm event type. Alarm event types are predefined and include, but are not limited to: cryptographic algorithm degradation, certificate verification failure, insufficient key strength, abnormal cipher suite requests, and multiple failed handshakes. Each alarm event type has a type identifier.

[0021] The statistical work is conducted within a continuous time window. For each statistical moment, the interval of one time window length preceding that moment is taken as the statistical window. The total number of occurrences of each alarm event type within the statistical window is divided by the length of the statistical window to obtain the frequency of occurrence of that alarm event type per unit time at the statistical moment. Corresponding to the current statistical moment, a vector is obtained consisting of the frequency of occurrence per unit time for each alarm event type.

[0022] A weighted summation method is used when generating the alarm intensity sequence. Alarm Intensity Sequence At any moment The value is represented as:

[0023] in, This represents the total number of alarm event types. Indicates the first Types of alarm events at time Frequency of occurrence per unit of time For the first Weighting coefficients corresponding to different alarm event types. The preset value range is based on the severity of the security threat posed by the alarm event type. ,all The sum of them is For example, setting the weight for certificate verification failure to [a certain value]... Set the weight of insufficient key strength to Set the weight of multiple failed handshakes to The weights of the remaining alarm event types are then allocated proportionally. Through the above weighted summation, the alarm intensity value for each statistical moment is obtained, and these values ​​are arranged chronologically to form an alarm intensity sequence.

[0024] Optionally, if a certain type of alarm event does not occur within the statistical window, the corresponding frequency per unit time is zero, and the contribution of this alarm event type to the alarm intensity sequence is zero. When the cryptographic service node cluster is under low load, the inflow rate of security alarm logs is low, and the alarm intensity sequence remains low; when security events occur in a concentrated manner, the alarm intensity sequence shows a significant peak.

[0025] The collection, decomposition, and statistical processes of node operation status sequences and security alarm log streams are all executed online. At each new sampling time, the tail data of the node operation status sequence and alarm intensity sequence are updated, and subsequent situation evolution offset and situation disturbance coefficient calculations are triggered.

[0026] Example 2: In practical implementation, the state trend component and alarm intensity sequence are respectively transformed in the frequency domain to obtain the state trend spectrum and alarm intensity spectrum. The frequency domain transformation adopts the discrete Fourier transform. Before the transformation, the state trend component and alarm intensity sequence are respectively subjected to mean-reduction processing to eliminate the interference of DC component on spectrum analysis. The mean-reduction processing method is as follows: calculate the arithmetic mean of the values ​​at all sampling times in the state trend component sequence, and subtract the arithmetic mean from the value at each sampling time in the state trend component sequence to obtain the mean-reduced state trend component sequence; calculate the arithmetic mean of the values ​​at all sampling times in the alarm intensity sequence, and subtract the arithmetic mean from the value at each sampling time in the alarm intensity sequence to obtain the mean-reduced alarm intensity sequence.

[0027] A Discrete Fourier Transform (DFT) is performed on the mean-free state trend component sequence to obtain a complex state trend spectrum. Each frequency point in the state trend spectrum corresponds to a complex value, the magnitude of which is the amplitude of the corresponding frequency component, and the argument of which is the phase angle of the corresponding frequency component. In the state trend spectrum, the frequency component with the largest amplitude is taken as the dominant frequency component. The phase angle corresponding to the dominant frequency component is extracted and denoted as the first phase angle, and the amplitude corresponding to the dominant frequency component is extracted and denoted as the first amplitude.

[0028] A Discrete Fourier Transform (DFT) is performed on the mean-free alarm intensity sequence to obtain a complex form alarm intensity spectrum. Each frequency point in the alarm intensity spectrum corresponds to a complex value, the magnitude of which is the amplitude of the corresponding frequency component, and the argument of which is the phase angle of the corresponding frequency component. In the alarm intensity spectrum, the frequency component with the largest amplitude is taken as the dominant frequency component. The phase angle corresponding to the dominant frequency component is extracted and denoted as the second phase angle, and the amplitude corresponding to the dominant frequency component is extracted and denoted as the second amplitude.

[0029] The absolute value of the difference between the first phase angle and the second phase angle is calculated as the situation evolution offset. The situation evolution offset is expressed in radians and its value ranges from [value missing]. The situation evolution offset reflects the degree of temporal misalignment between the state trend component and the alarm intensity sequence in the main fluctuation rhythm. When the situation evolution offset is close to zero, it indicates that the fluctuations of the state trend component and the alarm intensity sequence are basically synchronized; when the situation evolution offset is close to... When the state trend component and the alarm intensity sequence show an inverse relationship, it indicates that the fluctuations are opposite.

[0030] In some implementations, when there are multiple main frequency components with similar amplitudes in the state trend spectrum or alarm intensity spectrum, the three frequency components with the largest amplitudes are selected, the phase angle difference corresponding to each frequency component is calculated, and the average of the three phase angle differences is taken as the situation evolution offset.

[0031] Divide the second amplitude by the first amplitude to obtain the baseline amplitude ratio. The baseline amplitude ratio reflects the proportional relationship between the fluctuation amplitude of the alarm intensity sequence and the fluctuation amplitude of the node's operating status trend.

[0032] In the process of extracting the local maxima and local minima sequences of the state fluctuation components, the state fluctuation component sequence is scanned point by point. For the position numbered in the state fluctuation component sequence... value ,Will and and If a comparison is made, Greater than and Greater than ,but For a local maximum, record the local maximum and its position number in the sequence; if Less than and Less than ,but For a local minimum, record the local minimum and its position number in the sequence. Perform the above comparison operation on all position numbers in the state fluctuation component sequence to obtain the local maximum and local minimum sequences.

[0033] The first absolute value sequence of differences between the local maximum sequence and the alarm intensity sequence is calculated as follows: For each local maximum in the local maximum sequence, according to the position number of the local maximum in the state fluctuation component sequence, the value with the same position number is taken from the alarm intensity sequence, and the absolute value of the difference between the local maximum and the value of the alarm intensity sequence is calculated. The absolute values ​​of the differences corresponding to all position numbers constitute the first absolute value sequence of differences.

[0034] The second absolute value sequence of differences between the local minimum sequence and the alarm intensity sequence is calculated as follows: For each local minimum in the local minimum sequence, according to the position number of the local minimum in the state fluctuation component sequence, the value with the same position number is taken from the alarm intensity sequence, and the absolute value of the difference between the local minimum and the value of the alarm intensity sequence is calculated. The absolute values ​​of the differences corresponding to all position numbers constitute the second absolute value sequence of differences.

[0035] The mean of the first and second absolute difference sequences is used as the amplitude correction coefficient. The calculation method is as follows: sum the absolute values ​​of all differences in the first and second absolute difference sequences, add the two sums together, and divide by the sum of the number of elements in the first and second absolute difference sequences to obtain the amplitude correction coefficient.

[0036] The situation disturbance coefficient is obtained by multiplying the reference amplitude ratio by the amplitude correction factor. The situation disturbance coefficient is calculated using the following formula:

[0037] in, The disturbance coefficient is the situational disturbance coefficient. The second value, The first value, Let be the number of elements in the sequence of local maxima. Let be the number of elements in the local minimum sequence. The first local maximum in the sequence A local maximum, For alarm intensity sequence and Values ​​of the same position number, The first local minimum in the sequence A local minimum, For alarm intensity sequence and The values ​​of the same position number. The situational disturbance coefficient reflects the degree of interference of security alarms on the fluctuations in the operating status of cryptographic service nodes. The larger the situational disturbance coefficient, the stronger the interference.

[0038] Example 3: In specific implementation, please refer to Figure 3A security posture assessment function for cryptographic services is constructed, using the posture evolution offset as the offset penalty term and the posture disturbance coefficient as the disturbance penalty term. The security posture assessment function comprises three terms: a security posture baseline term, an offset penalty term, and a disturbance penalty term. The security posture baseline term characterizes the basic security posture level of the cryptographic service node cluster at the current moment; the offset penalty term quantifies the weakening effect of the security posture on the security posture caused by the temporal misalignment between the state trend component and the alarm intensity sequence; and the disturbance penalty term quantifies the deterioration effect of the security posture on the system state fluctuations caused by security alarms.

[0039] The cryptographic service security posture assessment function at the sampling time The value is denoted as Its form of expression is:

[0040] in Sampling time Security posture benchmark items, Sampling time Offset penalty term, Sampling time Disturbance penalty items. As the weight of the security situation baseline item, For the offset penalty term weight, The weight of the perturbation penalty term. , and The value is determined based on the weight of the security status benchmark item. Reflecting the importance of basic operational status in security situation assessment, it is set as follows: Offset penalty term weight Reflecting the degree of impact of situational evolution offset on the security situation, it is set as follows: Perturbation penalty term weight The influence of the situational disturbance coefficient on the security situation is reflected by setting it to... The values ​​of the three weights are determined based on empirical assessments of the relative importance of system status, alarm synchronization, and alarm interference in the field of cryptographic security operations and maintenance.

[0041] Security situation baseline items The calculation method is as follows: take the sampling time The corresponding state trend component value is denoted as Take sampling time The corresponding alarm intensity sequence value is denoted as ,Will After normalization and Weighted fusion is performed. Normalization is achieved using a maximum-minimum normalization method, mapping the values ​​at all sampling times in the state trend component sequence to... Within the interval, the normalized state trend component values ​​are denoted as... Security Status Baseline Items The value is and The average value of the alarm intensity sequence. When the values ​​of the lower and higher states trend components are both higher, the values ​​of the security status baseline items are higher, indicating that the cryptographic service node cluster is operating well and has low security risks.

[0042] Offset penalty The calculation method is as follows: the sampling time The corresponding situation evolution offset is used as the input to the offset penalty term. The value of the situation evolution offset is directly used as the penalty factor in the offset penalty term. The value is the situation evolution offset. When the situation evolution offset is close to zero, the offset penalty term is small; when the situation evolution offset is close to zero, the offset penalty term is small. At that time, the value of the offset penalty term is relatively large.

[0043] Disturbance penalty item The calculation method is as follows: the sampling time The corresponding situational disturbance coefficients are used as inputs to the disturbance penalty term. The values ​​of the situational disturbance coefficients are directly used as penalty factors in the disturbance penalty term. The value of is the situation disturbance coefficient. The larger the situation disturbance coefficient, the larger the value of the disturbance penalty term.

[0044] Substituting the values ​​of the state trend components and alarm strength sequences corresponding to each sampling moment within a continuous time window into the cryptographic service security situation assessment function, and calculating moment by moment according to the above calculation method, the situation assessment value corresponding to each sampling moment is obtained. The situation assessment values ​​of all sampling moments are arranged in chronological order to form a situation assessment time series.

[0045] The cumulative situation assessment time series is summed to obtain the cumulative situation quantity series. The summation method is as follows: at the initial sampling time, the value of the cumulative situation quantity series equals the situation assessment value at that time; at each subsequent sampling time, the value of the cumulative situation quantity series equals the sum of the cumulative situation quantity value at the previous sampling time and the situation assessment value at the current sampling time. The cumulative situation quantity series reflects the cumulative effect of the security situation.

[0046] The situation change gradient sequence is obtained by performing a difference operation on the situation accumulation sequence. The difference operation uses a first-order forward difference method: the sampling time in the situation change gradient sequence... The value is equal to the sampling time in the situation cumulative sequence. The value minus the sampling time in the situation accumulation sequence The value of . The gradient sequence of situational changes reflects the instantaneous rate of change of the cumulative amount of security situation.

[0047] The sampling moments whose absolute values ​​exceed a preset gradient threshold are extracted from the situation change gradient sequence as candidate transition moments. The preset gradient threshold is dynamically calculated based on the mean square error of the situation assessment time series. The dynamic calculation process is as follows: calculate the mean square error of the situation assessment values ​​at all sampling moments in the situation assessment time series, denoted as . , mean squared With preset coefficient Multiplying yields the preset gradient threshold. Preset coefficients. The value is set to This setting is based on the assumption that, under a normal distribution, data points fall within the mean (positive or negative). The probability of values ​​outside the range of two standard deviations is low and can be considered abnormal fluctuations; therefore, [the following is a possible interpretation:] This serves as a threshold coefficient for determining whether the gradient of a change in the situation deviates significantly.

[0048] After obtaining candidate transition times, for each candidate transition time, the rate of change of the situation assessment value is calculated. The rate of change of the situation assessment value is calculated as follows: the value of the situation change gradient sequence corresponding to the candidate transition time is divided by the value of the situation cumulative quantity sequence at that time, and the absolute value is taken. The rate of change of the situation assessment value of all candidate transition times is compared, and the candidate transition time with the largest rate of change of the situation assessment value is selected as the situation transition critical point. The situation transition critical point represents the moment when the security situation of the cryptographic service node cluster undergoes the most drastic change within a continuous time window.

[0049] In some implementations, if multiple candidate transition times have the same rate of change of situation assessment values ​​and are all at their maximum values, then the earliest candidate transition time is selected as the situation transition critical point.

[0050] Example 4: In specific implementation, please refer to Figure 4 When the current sampling time is detected to have reached the critical point of a situation transition, a probe activation command is sent to each cryptographic service node in the cryptographic service node cluster. The determination result of the situation transition critical point is output by the situation transition critical point determination module. This module compares the timestamp of the current sampling time with the timestamp of the situation transition critical point in real time. Once the two match, the generation of the probe activation command is immediately triggered. The probe activation command is broadcast to all cryptographic service nodes in the cryptographic service node cluster through the management network channel. The command message contains an opcode field and a parameter configuration field. The opcode field identifies the start command of the message deep parsing process, and the parameter configuration field carries the port range and protocol type identifier that the message deep parsing process needs to listen to.

[0051] Upon receiving the probe activation command, the cryptographic service node initiates a deep parsing subprocess within the cryptographic service process. This deep parsing process is mounted in the cryptographic service node's network input / output module and performs bypass capture on cryptographic service request packets received via the network interface card. The capture targets are Transmission Control Protocol (TCP) packets whose destination port falls within the cryptographic service's listening port range, retaining only the TCP handshake phase packets.

[0052] The message deep parsing process performs protocol parsing on the captured Transport Layer Security (TLS) handshake messages, based on the standard syntax definition of TLS. It identifies the ClientHello message and extracts a list of cipher suites from the CipherSuites field in the message body. Each cipher suite occupies two bytes, forming a list of cipher suite identifiers. The order of these identifiers is based on the client's priority, which constitutes the cipher suite negotiation sequence. Each cipher suite identifier in the negotiation sequence represents a candidate encryption algorithm combination, including identifiers for the key exchange algorithm, authentication algorithm, symmetric encryption algorithm, and message authentication code algorithm.

[0053] The message deep parsing process continues parsing subsequent handshake messages. When parsing the ServerKeyExchange message, it extracts the key exchange payload based on the key exchange algorithm type. If the key exchange algorithm is Elliptic Curve Diffie-Hellman, the named elliptic curve identifier is obtained from the curve type field of the ServerKeyExchange message. This named elliptic curve identifier is a standard assigned value; for example, the identifier for the standard secp256r1 curve is 23. Simultaneously, the elliptic curve public key coordinates are obtained from the public key field of the ServerKeyExchange message. These coordinates are not directly used as generators in the key exchange payload features; generators are part of the elliptic curve field parameters. Based on the named elliptic curve identifier, the message deep parsing process looks up the elliptic curve parameter database pre-stored locally on the cryptographic service node. This database stores the prime modulus and generator coordinates for each standard named curve. The lookup yields the prime modulus, x-coordinate, and y-coordinate of the generator corresponding to the named curve, stored as unsigned large integers. The prime modulus, x-coordinate, and y-coordinate of the generator constitute the key exchange payload features.

[0054] The identifiers of each candidate encryption algorithm in the cipher suite negotiation sequence are sorted by priority and mapped to a cryptographic capability encoding vector. Before mapping, a mapping table is pre-constructed to map cipher algorithm identifiers to encoded values. This table covers all possible cipher suite identifiers, and each cipher suite identifier is mapped to a unique positive integer code, ranging from 1 to the total number of cipher suite identifiers. Following the priority order of the cipher suite identifiers in the cipher suite negotiation sequence, from highest to lowest priority, cipher suite identifiers are retrieved sequentially. The mapping table is consulted to convert each cipher suite identifier into its corresponding encoded value. These encoded values ​​are then arranged in order to form a one-dimensional sequence vector, which is the cryptographic capability encoding vector. The dimension of the cryptographic capability encoding vector is equal to the number of cipher suite identifiers in the cipher suite negotiation sequence, denoted as . .

[0055] The elliptic curve parameters, prime modulus, and generators are mapped to a key parameter encoding vector. The elliptic curve parameter, i.e., the named elliptic curve identifier, is mapped to an integer code through a curve identifier mapping table. This table pre-stores the correspondence between all standard named elliptic curve identifiers and their encoded values, which are consecutive integers starting from 1. The prime modulus, a large integer, is converted to a fixed-length big-endian byte sequence. The fixed length is chosen to match the maximum byte length of prime modulus in the elliptic curve parameter library; if the actual prime modulus byte length is insufficient, zeros are padded on the left. The x-coordinate and y-coordinate values ​​of the generators are encoded using big-endian byte sequences of the same length as the prime modulus. The curve identifier code, prime modulus byte sequence, generator x-coordinate byte sequence, and generator y-coordinate byte sequence are concatenated sequentially. Each element in the resulting sequence is a one-byte value, forming the key parameter encoding vector. The dimension of the key parameter encoding vector is denoted as... , It equals the number of bytes occupied by the curve identifier encoding plus the length of the prime modulo byte sequence plus the length of the generator x-coordinate byte sequence plus the length of the generator y-coordinate byte sequence.

[0056] The encryption capability encoding vector and the key parameter encoding vector are concatenated to generate a security enhancement verification vector. Security Enhancement Verification Vector The formal representation is:

[0057] in, Encoding the encryption capability vector Each encoded value The integer encoding obtained by mapping the corresponding cipher suite identifier; Encode the key parameter vector Each byte value This is a byte element in the key parameter encoding vector. Security Enhancement Verification Vector The total length is .

[0058] The generated security enhancement verification vector is passed to the dynamic security policy generation component for feature concatenation with situational feature parameters.

[0059] Example 5: In specific implementation, please refer to Figure 5 The situation assessment value and situation change gradient value at the situation transition critical point are extracted to form situation feature parameters. The situation transition critical point corresponds to a specific sampling time. The situation assessment value at that sampling time is extracted from the situation assessment time series, and the situation change gradient value at that sampling time is extracted from the situation change gradient series. The situation assessment value and the situation change gradient value are combined into a two-dimensional vector, which is the situation feature parameter.

[0060] A comprehensive security feature vector is generated by concatenating the security enhancement verification vector with the situational feature parameters. The security enhancement verification vector is a sequence containing elements of the encryption capability encoding vector and the key parameter encoding vector, while the situational feature parameters are two-dimensional vectors. The feature concatenation method is as follows: all elements of the security enhancement verification vector are arranged in their original order, and then the two elements of the situational feature parameters are appended to the end of the sequence to form a longer sequence, which is the comprehensive security feature vector. The total length of the comprehensive security feature vector is equal to the length of the security enhancement verification vector plus 2.

[0061] Obtain the pre-stored policy parameter mapping table. The policy parameter mapping table is built and persistently stored in the local storage medium of the cryptographic service management node during the system initialization phase. The construction process of the policy parameter mapping table is as follows: Collect historical security enhancement verification vector samples and corresponding historical situation feature parameter samples from the cryptographic service node cluster under different security scenarios to form historical comprehensive security feature vector samples. For each historical comprehensive security feature vector sample, security operations personnel label the key update cycle adjustment coefficient and session reconstruction threshold adjustment coefficient according to the adjustment measures taken at that time. The value range of the key update cycle adjustment coefficient label is set to a real number greater than 0; when the key update cycle needs to be shortened, the label value is less than 1, and when the key update cycle needs to be extended, the label value is greater than 1. The value range of the session reconstruction threshold adjustment coefficient label is also set to a real number greater than 0; when the session reconstruction trigger threshold needs to be lowered, the label value is less than 1, and when the session reconstruction trigger threshold needs to be raised, the label value is greater than 1. All labeled historical comprehensive security feature vector samples and their corresponding labels constitute the policy parameter mapping table. In the policy parameter mapping table, any security feature vector sample corresponds to a key update cycle adjustment coefficient label and a session reconstruction threshold adjustment coefficient label. The dimension of each security feature vector sample is consistent with the dimension of the comprehensive security feature vector.

[0062] The security feature vector samples in the comprehensive security feature vector and policy parameter mapping table are normalized. L2 norm normalization is used. For the comprehensive security feature vector, the sum of squares of all elements in the comprehensive security feature vector is calculated, and the square root of the sum is taken to obtain the L2 norm value. Each element in the comprehensive security feature vector is then divided by the L2 norm value to obtain the normalized comprehensive security feature vector. Similarly, for each security feature vector sample in the policy parameter mapping table, the sum of squares of all elements in the security feature vector sample is calculated, and the square root of the sum is taken to obtain the sample L2 norm value. Each element in the security feature vector sample is then divided by the sample L2 norm value to obtain the normalized security feature vector sample.

[0063] Calculate the cosine similarity between the normalized integrated security feature vector and each normalized security feature vector sample in the policy parameter mapping table. The cosine similarity is calculated using the following formula:

[0064] in, Represents the comprehensive security feature vector The first in the policy parameter mapping table Security feature vector samples The cosine similarity. This represents the total number of dimensions of the comprehensive security feature vector. Represents the comprehensive security feature vector In the Dimensional component values, The first term in the strategy parameter mapping table represents the... The security feature vector sample at the th th Dimensional component values. Represents the comprehensive security feature vector With the Security feature vector samples The inner product, Represents the comprehensive security feature vector L2 norm, Indicates the first Security feature vector samples The L2 norm.

[0065] Cosine similarity The range of values ​​is The closer the value is to 1, the more consistent the directions of the two vectors. Since the normalization process has converted the comprehensive security feature vector and all security feature vector samples into unit vectors, the cosine similarity is equal to the inner product value.

[0066] Traverse all security feature vector samples in the policy parameter mapping table, calculate the cosine similarity between each security feature vector sample and the comprehensive security feature vector, compare all the calculated cosine similarity values, and select the security feature vector sample with the largest cosine similarity value as the matching sample.

[0067] The key update cycle adjustment coefficient label corresponding to the matching sample is extracted as the key update cycle adjustment coefficient, and the session reconstruction threshold adjustment coefficient label corresponding to the matching sample is extracted as the session reconstruction threshold adjustment coefficient. Both the key update cycle adjustment coefficient and the session reconstruction threshold adjustment coefficient are specific real values.

[0068] This query retrieves the currently effective baseline key update cycle and baseline session reconstruction threshold for the cryptographic service node cluster. The baseline key update cycle and baseline session reconstruction threshold are stored in the global configuration center of the cryptographic service node cluster. The global configuration center maintains the currently effective security policy parameters for each cryptographic service node. The baseline key update cycle is in seconds, and its default value is determined by the deployment specifications of the cryptographic service node cluster. The baseline session reconstruction threshold is in units of the cumulative number of reconstruction requests, and its default value is determined by the session management policy. A query request is sent to the global configuration center to retrieve the values ​​of the baseline key update cycle and the baseline session reconstruction threshold.

[0069] The updated key update period is obtained by multiplying the baseline key update period by a key update period adjustment factor. If the adjustment factor is less than 1, the updated key update period will be shorter than the baseline key update period, indicating that more frequent key updates are needed to address the current security situation; if the adjustment factor is greater than 1, the updated key update period will be longer than the baseline key update period. The updated session reconstruction threshold is obtained by multiplying the baseline session reconstruction threshold by a session reconstruction threshold adjustment factor. If the adjustment factor is less than 1, the updated session reconstruction threshold will be lower than the baseline session reconstruction threshold, indicating that earlier session reconstruction is needed to reduce security risks; if the adjustment factor is greater than 1, the updated session reconstruction threshold will be higher than the baseline session reconstruction threshold.

[0070] The updated key update cycle and the updated session reconstruction threshold are combined to generate a dynamic security policy parameter set. The dynamic security policy parameter set is a structured data object containing two elements: the first field is the key update cycle value, and the second field is the session reconstruction threshold.

[0071] The dynamic security policy parameter set is distributed to each cryptographic service node in the cryptographic service node cluster for adjustment. The distribution process is conducted through the management network channel. The management node encapsulates the dynamic security policy parameter set into a configuration update message and sends it sequentially to each cryptographic service node in the cluster via unicast. Upon receiving the configuration update message, the cryptographic service node parses out the updated key update period and the updated session reconstruction threshold, calls its local security policy update interface, replaces the currently effective key update period with the updated one, and replaces the currently effective session reconstruction threshold with the updated one, completing the adjustment operation.

[0072] After the adjustment operation is executed, a consistency check is performed on the security status of each cryptographic service node. A security status query request is sent to each cryptographic service node in the cluster, and the request is sent one by one in a round-robin manner through the management network channel. Upon receiving the security status query request, each cryptographic service node reads the currently effective key update cycle and session reconstruction threshold locally, encapsulates the effective key update cycle and session reconstruction threshold into a security status response message, and returns it through the management network channel.

[0073] The system receives security status response messages from each cryptographic service node and parses the actual effective key update period and the actual effective session reconstruction threshold from these messages. It then compares the actual effective key update period reported by each cryptographic service node with the updated key update period in the dynamic security policy parameter set to determine whether each cryptographic service node has completed the key update period adjustment. The comparison method is as follows: for each cryptographic service node, it checks whether the value of its reported actual effective key update period is equal to the updated key update period value. If they are equal, the cryptographic service node is considered to have completed the key update period adjustment; otherwise, it is considered that the cryptographic service node has not completed the key update period adjustment.

[0074] The actual effective session reconstruction threshold reported by each cryptographic service node is compared one by one with the updated session reconstruction threshold in the dynamic security policy parameter set to determine whether each cryptographic service node has completed the session reconstruction threshold adjustment. The comparison method is as follows: for each cryptographic service node, check whether the value of the actual effective session reconstruction threshold reported by it is equal to the value of the updated session reconstruction threshold. If they are equal, it is considered that the cryptographic service node has completed the session reconstruction threshold adjustment; if they are not equal, it is considered that the cryptographic service node has not completed the session reconstruction threshold adjustment.

[0075] If any cryptographic service nodes have not completed their adjustments, the dynamic security policy parameter set will be reissued to these nodes. The reissue operation uses the same message encapsulation and sending process as the initial allocation operation. Each time a reissue is completed, the reissue count counter for the cryptographic service nodes involved in the reissue is incremented by 1. The reissue count counter is maintained using the node identifier of the cryptographic service node as an index. When the reissue count for a cryptographic service node reaches the preset retry limit, a policy issuance failure alarm is generated. The preset retry limit is set to 3. This setting is based on the assumption that, under the condition that the management network channel is stable and the cryptographic service nodes have no hardware failures, three retries are sufficient to cover scenarios where occasional network packet loss or instantaneous high node load causes configuration update delays. If the retry still fails after three attempts, it is considered an abnormal situation requiring manual intervention. The policy issuance failure alarm includes the node identifier of the cryptographic service node that has not completed its adjustment, the type of the incomplete policy item, and the retry count information. The policy issuance failure alarm is pushed to the security management console and the log system.

Claims

1. A method for managing cryptographic security services based on situational awareness, characterized in that, Includes the following steps: Collect the node running status sequence and security alarm log stream of the cryptographic service node cluster within a continuous time window, perform time-series decomposition on the node running status sequence to extract the state trend component and state fluctuation component, and perform event type aggregation and statistics on the security alarm log stream to generate an alarm intensity sequence. The situation evolution offset is calculated based on the phase difference between the state trend component and the alarm intensity sequence, and the situation disturbance coefficient is calculated based on the amplitude ratio between the state fluctuation component and the alarm intensity sequence. Using the situation evolution offset and situation disturbance coefficient as constraints, a cryptographic service security situation assessment function is constructed, the steady-state solution of the cryptographic service security situation assessment function is solved, and the situation transition critical point is determined based on the change gradient of the steady-state solution within the current time window. Once the state transition critical point is triggered, the security probes in the cryptographic service node cluster are activated to collect the cryptographic suite negotiation sequence and key exchange payload characteristics in the cryptographic service request message and generate a security enhancement verification vector. Based on the security enhancement verification vector and the situation feature parameters at the situation transition critical point, a dynamic security policy parameter set is generated, and the key update cycle and session reconstruction threshold in the cryptographic service node cluster are adjusted according to the dynamic security policy parameter set.

2. The method for managing cryptographic security services based on situational awareness according to claim 1, characterized in that, The system collects the node operation status sequence and security alarm log stream of the cryptographic service node cluster within a continuous time window. It performs time-series decomposition on the node operation status sequence to extract state trend components and state fluctuation components, and aggregates and statistically analyzes the event types of the security alarm log stream to generate an alarm strength sequence. Specifically: According to a preset sampling interval, the CPU utilization, memory usage and network throughput are pulled in parallel from each cryptographic service node in the cryptographic service node cluster, and combined to generate a node running status sequence. A local weighted regression smoothing algorithm is used to perform seasonal trend decomposition on the node running state sequence, which decomposes the node running state sequence into state trend component, state cycle component and state residual component. The state trend component and state residual component are selected as the extraction results. Each alarm record in the security alarm log stream is classified and statistically analyzed according to the alarm event type. The frequency of occurrence of each alarm event type per unit time within the time window is counted. The unit time frequency of each alarm event type is weighted and summed to generate an alarm intensity sequence.

3. The method for managing cryptographic security services based on situational awareness according to claim 2, characterized in that, The situation evolution offset is calculated based on the phase difference between the state trend component and the alarm intensity sequence, and the situation disturbance coefficient is calculated based on the amplitude ratio between the state fluctuation component and the alarm intensity sequence, specifically as follows: The state trend component and alarm intensity sequence are transformed in the frequency domain to obtain the state trend spectrum and alarm intensity spectrum respectively. The first phase angle corresponding to the main frequency component in the state trend spectrum is extracted, and the second phase angle corresponding to the main frequency component in the alarm intensity spectrum is extracted. The absolute value of the difference between the first phase angle and the second phase angle is calculated as the situation evolution offset. Extract the first amplitude corresponding to the main frequency component in the status trend spectrum, extract the second amplitude corresponding to the main frequency component in the alarm intensity spectrum, and divide the second amplitude by the first amplitude to obtain the reference amplitude ratio. Extract the local maximum and local minimum sequences of the state fluctuation components, calculate the first absolute value sequence of the difference between the local maximum sequence and the alarm intensity sequence at corresponding positions, calculate the second absolute value sequence of the difference between the local minimum sequence and the alarm intensity sequence at corresponding positions, and use the mean of the first and second absolute value sequences of the difference as the amplitude correction coefficient. The situation disturbance coefficient is obtained by multiplying the baseline amplitude ratio by the amplitude correction factor.

4. The method for managing cryptographic security services based on situational awareness according to claim 3, characterized in that, Using the situation evolution offset and situation disturbance coefficient as constraints, a cryptographic service security situation assessment function is constructed. The steady-state solution of the cryptographic service security situation assessment function is solved, and the situation transition critical point is determined based on the gradient of the steady-state solution within the current time window. Specifically: Using the situation evolution offset as the offset penalty term of the situation evaluation function and the situation disturbance coefficient as the disturbance penalty term of the situation evaluation function, a cryptographic service security situation evaluation function containing a security situation baseline term, an offset penalty term, and a disturbance penalty term is constructed. Substitute the values ​​of the state trend component and the alarm strength sequence corresponding to each sampling moment within the continuous time window into the cryptographic service security situation assessment function to calculate the situation assessment value corresponding to each sampling moment, thus forming a situation assessment time series. The situation assessment time series is summed to obtain the situation cumulative quantity series, and the situation change gradient series is obtained by differentiating the situation cumulative quantity series. The sampling moments whose absolute values ​​exceed the preset gradient threshold are extracted from the gradient sequence of situation changes as candidate transition moments, and the moment with the largest rate of change of situation assessment value among the candidate transition moments is selected as the critical point of situation transition.

5. The method for managing cryptographic security services based on situational awareness according to claim 4, characterized in that, The preset gradient threshold is dynamically calculated based on the mean square error of the situation assessment time series.

6. The method for managing cryptographic security services based on situational awareness according to claim 4, characterized in that, Once the state transition critical point is triggered, the security probes in the cryptographic service node cluster are activated to collect the cipher suite negotiation sequence and key exchange payload characteristics from the cryptographic service request message, and generate a security enhancement verification vector, specifically: When the current sampling time is detected to have reached the critical point of state transition, a probe activation command is sent to each cryptographic service node in the cryptographic service node cluster, so that each cryptographic service node starts the message deep parsing process. The deep parsing process extracts the cipher suite negotiation sequence from the transport layer security protocol handshake phase of the cryptographic service request message. The cipher suite negotiation sequence contains the identifiers and priority order of each candidate encryption algorithm. The key exchange payload of the key exchange phase in the cryptographic service request message is extracted through the message deep parsing process. Elliptic curve parameters, prime modulus and generators are parsed from the key exchange payload as key exchange payload features. The identifiers of each candidate encryption algorithm in the cipher suite negotiation sequence are sorted by priority and mapped to encryption capability encoding vectors. Elliptic curve parameters, prime moduli, and generators are mapped to key parameter encoding vectors. The encryption capability encoding vectors and key parameter encoding vectors are concatenated to generate a security enhancement verification vector.

7. The method for managing cryptographic security services based on situational awareness according to claim 6, characterized in that, Based on the security enhancement verification vector and the situational feature parameters at the situational transition critical points, a dynamic security policy parameter set is generated. The key update cycle and session reconstruction threshold in the cryptographic service node cluster are adjusted according to this dynamic security policy parameter set, specifically: The situation assessment value and situation change gradient value at the critical point of situation transition are extracted to form situation feature parameters. The security enhancement verification vector is then concatenated with the situation feature parameters to generate a comprehensive security feature vector. The comprehensive security feature vector is input into the policy parameter mapping function, which outputs the key update cycle adjustment coefficient and the session reconstruction threshold adjustment coefficient. Query the currently effective baseline key update cycle and baseline session reconstruction threshold in the cryptographic service node cluster. Multiply the baseline key update cycle by the key update cycle adjustment factor to obtain the updated key update cycle. Multiply the baseline session reconstruction threshold by the session reconstruction threshold adjustment factor to obtain the updated session reconstruction threshold. The updated key update cycle and the updated session reconstruction threshold are combined to generate a dynamic security policy parameter set, which is then distributed to each cryptographic service node in the cryptographic service node cluster for adjustment.

8. The method for managing cryptographic security services based on situational awareness according to claim 7, characterized in that, The comprehensive security feature vector is input into the policy parameter mapping function, which outputs the key update cycle adjustment coefficient and the session reconstruction threshold adjustment coefficient, specifically: Obtain the pre-stored policy parameter mapping table, which contains multiple security feature vector samples and the key update cycle adjustment coefficient label and session reconstruction threshold adjustment coefficient label corresponding to each security feature vector sample; Calculate the cosine similarity between each security feature vector sample in the mapping table between the comprehensive security feature vector and the policy parameter, and select the security feature vector sample with the highest cosine similarity as the matching sample; Extract the key update cycle adjustment coefficient label corresponding to the matching sample as the key update cycle adjustment coefficient, and extract the session reconstruction threshold adjustment coefficient label corresponding to the matching sample as the session reconstruction threshold adjustment coefficient.

9. The method for managing cryptographic security services based on situational awareness according to claim 8, characterized in that, Before cosine similarity matching, the security feature vector samples in the comprehensive security feature vector and policy parameter mapping table are normalized.

10. A method for managing cryptographic security services based on situational awareness according to claim 8, characterized in that, After distributing the dynamic security policy parameter set to each cryptographic service node in the cryptographic service node cluster for adjustment, the process also includes a step of verifying the consistency of the security status of each cryptographic service node after adjustment. Send security status query requests to each cryptographic service node in the cryptographic service node cluster, and receive feedback from each cryptographic service node on the actual effective key update cycle and the actual effective session reconstruction threshold; The actual effective key update cycle reported by each cryptographic service node is compared with the updated key update cycle in the dynamic security policy parameter set to determine whether each cryptographic service node has completed the key update cycle adjustment. The actual effective session reconstruction threshold reported by each cryptographic service node is compared with the updated session reconstruction threshold in the dynamic security policy parameter set to determine whether each cryptographic service node has completed the session reconstruction threshold adjustment. If there are cryptographic service nodes that have not completed the adjustment, the dynamic security policy parameter set will be reissued to the cryptographic service nodes that have not completed the adjustment and the number of reissues will be recorded. When the number of reissues reaches the preset retry limit, a policy issuance failure alarm will be generated.

Images