A network information security protection method based on encryption algorithm

Abstract

The application discloses a network information security protection method based on an encryption algorithm, and relates to the technical field of network information security, and comprises the following steps: S1, establishing a current password state; S2, forming an encrypted message sequence by using an SM4-GCM authentication encryption algorithm; S3, forming an authentication transmission state sequence by authentication decryption; S4, determining a continuous authentication boundary and limiting cross-boundary propagation by using an improved ConvTimeNet model; S5, keeping a boundary front indication and restoring boundary post propagation when the state changes, and forming a closed authentication interval by authentication confirmation of both parties; S6, forming a closed authentication digest by using an SM3 password hash algorithm; S7, deriving a next password state in combination with the current password state and the closed authentication digest; and S8, authentication encryption based on the next password state and binding the closed authentication digest. The application improves the password state connection consistency and the network information transmission security.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, and in particular to a network information security protection method based on encryption algorithms. Background Technology

[0002] Existing network information security protection methods typically employ encryption algorithms to encrypt transmitted messages and combine them with authentication mechanisms to verify message integrity and authenticity, thereby reducing the risk of information leakage, tampering, and forgery during network transmission. Some methods also update the communication password state based on the message authentication result to maintain security during continuous transmission.

[0003] However, when network packets are lost, out of order, delayed, or abnormally inserted, existing methods typically process the authentication results of individual packets separately. This makes it difficult to accurately define the continuous and reliable authentication range based on the sending order and actual receiving location, easily leading to the problem of packets that have not formed continuous authentication participating in password state updates. Furthermore, when expanding the sensing range, existing time-series processing models are prone to using block sampling and convolutional propagation to cross the authentication state interruption points, causing confirmed and unconfirmed states to influence each other.

[0004] Furthermore, existing password state updates typically lack the ability to continuously utilize closed consecutive authentication results, making it difficult to reliably transfer the authentication process confirmed in the previous stage to the next stage of authentication encryption process, thereby affecting the consistency and security of password state continuation in continuous network transmission scenarios.

[0005] Therefore, how to provide a network information security protection method based on encryption algorithms is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a network information security protection method based on encryption algorithms. This invention employs a method combining the SM4-GCM authentication encryption algorithm, an improved ConvTimeNet model, and the SM3 cryptographic hash algorithm. It determines continuous authentication boundaries based on the authentication result and the receiving location, and inversely restricts the cross-boundary propagation of deformable blocks and hierarchical fully convolutional methods. When the authentication state changes, it maintains the pre-boundary representation and restores the post-boundary propagation, forming a closed continuous authentication interval. Based on the closed interval, it generates an authentication digest and derives the next cryptographic state, while simultaneously binding the authentication digest to additional authentication data, achieving continuous cryptographic state continuity. This method has the advantages of strong state isolation, high cryptographic update consistency, and high network transmission security.

[0007] A network information security protection method based on an encryption algorithm according to an embodiment of the present invention includes the following steps: S1. Establish the current password state based on the secure transmission relationship of network information; S2. Based on the current password state, the SM4-GCM authentication and encryption algorithm is used to perform authentication and encryption on network information to form an encrypted message sequence; S3. Perform authentication and decryption on the encrypted message sequence, and associate the authentication result with the receiving position according to the sending order to form an authentication transmission status sequence; S4. An improved ConvTimeNet model is used to process the authentication transmission state sequence. The authentication success result and corresponding receiving position are checked at each sending position along the sending order to determine the continuous authentication boundary. The continuous authentication boundary is used to restrict the range of deformable blocks and restrict the propagation of the hierarchical full convolution across the boundary, forming a boundary constraint hierarchical representation. S5. When the authentication transmission state changes, the boundary pre-level representation is maintained and the boundary post-propagation is restored based on the boundary constraint hierarchy representation. Combined with the authentication confirmation of both communicating parties, a closed continuous authentication interval is formed. S6. Extract the SM4-GCM authentication results within the closed continuous authentication interval, process them according to the sending order using the SM3 cryptographic hash algorithm, and form a closed authentication digest. S7. Using the current cryptographic state and the closed authentication digest as key derivation input, perform key derivation using the SM3 cryptographic hash algorithm to form the next cryptographic state; S8. Based on the next cryptographic state, the SM4-GCM authentication encryption algorithm is used to perform authentication encryption on the network information, and the closed authentication digest is bound to the additional authentication data to form an updated encrypted message sequence.

[0008] Optionally, S1 specifically includes: S11. Determine the initial key shared by both communicating parties based on the secure transmission relationship of network information, and form the initial key corresponding to the current communication; S12. Perform key derivation on the initial key to generate the current encryption key corresponding to the SM4-GCM authentication encryption algorithm, and establish the current password state based on the current encryption key.

[0009] Optionally, S2 specifically includes: S21. Obtain the key required for SM4-GCM authentication encryption from the current password state, generate unique initial vectors according to the order of network information transmission, and form message encryption parameters; S22. Perform SM4-GCM authentication encryption on each network message using message encryption parameters, and encapsulate the generated ciphertext, authentication tag and corresponding initialization vector into encrypted messages to form an encrypted message sequence.

[0010] Optionally, S3 specifically includes: S31. Extract the initial vector, ciphertext and authentication tag from the encrypted message. Based on the current cryptographic state, perform SM4-GCM authentication and decryption on a message-by-message basis and verify the authentication tag to form the authentication result corresponding to the encrypted message. S32. Check the actual receiving position of each encrypted message according to the sending order, arrange the authentication results and corresponding receiving positions in sequence, and retain the corresponding sending position when no corresponding encrypted message is received, forming an authentication transmission state sequence.

[0011] Optionally, the improved ConvTimeNet model includes a deformable block embedding layer, a first-level fully convolutional layer, a second-level fully convolutional layer, a third-level fully convolutional layer, and a linear readout layer connected in sequence. The deformable block embedding layer divides the authentication transmission state sequence according to the transmission order, uses a lightweight predictor to generate block center offset and scale change, adjusts the block boundaries and then performs linear interpolation sampling and embedding projection to form block embedding; The first-level fully convolutional layer performs depthwise convolution and pointwise convolution on the block embedding, maintaining the correspondence between the convolution position and the corresponding position in the transmission order. It checks the authentication result and receiving position of each transmission position along the transmission order, and determines the end of the continuous transmission position that has been authenticated and has obtained the receiving position as the continuous authentication boundary. The continuous authentication boundary acts inversely on the deformable block embedding layer. For blocks that cross the continuous authentication boundary, the sampling range on the side where the block center is located is preserved. The sampling range that crosses the continuous authentication boundary is shrunk to the continuous authentication boundary and linear interpolation sampling and embedding projection are re-executed. The first-level fully convolutional layer reprocesses the updated block embedding. The second and third fully convolutional layers successively expand the receptive range of the depth convolution. Before each level of convolution, the output is segmented according to the continuous authentication boundary. The depth convolution only slides along the continuous positions within the same segment. Point convolution and learnable residuals update the hierarchical representation at the corresponding positions. The linear readout layer performs a linear mapping on the hierarchical representation of the output of the third-level fully convolutional layer to form a boundary-constrained hierarchical representation.

[0012] Optionally, the reverse action of the continuous authentication boundary on the deformable block embedding layer specifically includes: Based on the correspondence between the convolution positions in the first-level fully convolutional layer and the corresponding positions in the transmission sequence, the continuous authentication boundary is mapped to the sampling position of the deformable block embedding layer. The initial block center and initial block length are determined according to the initial block of the authentication transmission state sequence. The adjusted block center, block length and left and right boundaries are determined according to the center offset and scale change generated by the lightweight predictor. For blocks whose left and right boundaries cross the continuous authentication boundary, if the block center is located in front of or coincides with the continuous authentication boundary, the left boundary is retained and the right boundary is shrunk to the continuous authentication boundary. If the block center is located behind the continuous authentication boundary, the right boundary is retained and the left boundary is shrunk to the continuous authentication boundary. The block center and block length are re-determined based on the adjusted left and right boundaries. The center offset is updated with the displacement between the redefined block center and the initial block center, the scale change is updated with half the difference between the redefined block length and the initial block length, and the updated result replaces the center offset and scale change generated by the lightweight predictor for blocks that cross the boundary. Blocks that do not cross the continuous certified boundary retain the output of the lightweight predictor. The deformable block embedding layer redetermines the block boundaries based on the updated center offset and scale change, performs linear interpolation sampling and embedding projection, and the updated block embedding is reprocessed by the first-level fully convolutional layer to form the first-level representation corresponding to the continuous authentication boundary.

[0013] Optionally, S5 specifically includes: S51. When the authentication transmission state changes, the hierarchical representation that has been formed before the continuous authentication boundary before the change is maintained, and the improved ConvTimeNet model processing is re-executed on the authentication transmission state after the continuous authentication boundary before the change to redetermine the continuous authentication boundary. S52. Starting from the next transmission position adjacent to the previous continuous authentication boundary, sequentially check the SM4-GCM authentication results up to the transmission positions corresponding to the newly determined continuous authentication boundaries. S53. When the authentication continuity is interrupted, the sending position before the interruption is determined as the end point of continuous authentication; when there is no interruption, the sending position corresponding to the newly determined continuous authentication boundary is determined as the end point of continuous authentication. S54. When the continuous authentication endpoint exceeds the continuous authentication boundary before the change, the receiving end writes the continuous authentication endpoint into the authentication confirmation information and performs password authentication based on the current password state. The sending end verifies the authentication confirmation information based on the current password state and returns the authentication confirmation of the same continuous authentication endpoint, thus fixing the closed endpoint. S55. When the authentication confirmation of both communicating parties is consistent, the range of messages that have been continuously authenticated from the next sending position adjacent to the continuous authentication boundary before the change to the closing end point is determined as the closed continuous authentication interval.

[0014] Optionally, S6 specifically includes: S61. Read the SM4-GCM authentication results of each encrypted message within the closed continuous authentication interval according to the sending order; S62. Encode each authentication result in sequence according to the sending order, concatenate the encoded results sequentially and perform SM3 hash operation to form a closed authentication digest.

[0015] Optionally, S7 specifically includes: S71. Obtain the current encryption key used for SM4-GCM authentication encryption from the current password state, and concatenate the current encryption key before the closed authentication digest to form a key derivation input. S72. Perform SM3 hash operation on the key derivation input, and extract data from the hash result that is the same length as the SM4 key to form the next encryption key; S73. Replace the current encryption key in the current password state with the next encryption key to form the next password state.

[0016] Optionally, S8 specifically includes: S81. Obtain the next encryption key from the next cipher state, and use the closed authentication digest as additional authentication data for SM4-GCM authentication encryption; S82. Generate unique initial vectors for the network information to be sent according to the sending order. Input the network information to be sent, the next encryption key, the corresponding initial vector, and the additional authentication data into SM4-GCM authentication encryption to generate ciphertext and authentication tag. S83. Assemble the ciphertext, authentication tag, and initialization vector corresponding to each network information into an encrypted message according to the sending order, forming an updated encrypted message sequence.

[0017] The beneficial effects of this invention are: This invention uses the SM4-GCM authentication encryption algorithm to perform authentication encryption and decryption of network information, and constructs an authentication transmission state sequence by combining the sending order, authentication result and receiving location. This enables the network to distinguish between continuous and reliable authentication ranges and unclosed authentication ranges even when network packets are lost, out of order, delayed or have authentication anomalies. This avoids the message state of incomplete authentication directly affecting password state updates, and improves the continuity of authentication and the reliability of state determination during network transmission.

[0018] This invention uses an improved ConvTimeNet model to determine continuous authentication boundaries and applies these boundaries inversely to the deformable block embedding process. It also restricts the propagation of fully convolutional layers across boundaries. When the authentication transmission state changes, it maintains the hierarchical representation formed before the boundary and only restores the propagation process after the boundary. This reduces the interference of unconfirmed states on confirmed states and avoids the repeated processing of all historical states due to local authentication changes, thereby improving the stability and efficiency of continuous authentication state processing.

[0019] Furthermore, this invention establishes a closed continuous authentication interval through authentication and confirmation by both communicating parties, and generates a closed authentication digest using the SM3 cryptographic hash algorithm. The closed authentication digest is used to participate in the key derivation of the next cryptographic state and is bound to the additional authentication data encrypted in the next stage of authentication. This enables the confirmed continuous authentication results to participate in the subsequent cryptographic state continuation, realizing a continuous association between the authentication process and the cryptographic state update, thereby improving the consistency of cryptographic state continuation and the security of network information transmission. Attached Figure Description

[0020] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is an overall flowchart of a network information security protection method based on encryption algorithms proposed in this invention; Figure 2 This is a schematic diagram of the structure of an improved ConvTimeNet model for a network information security protection method based on encryption algorithms proposed in this invention; Figure 3 This is a schematic diagram illustrating the local recovery and closure confirmation of continuous authentication status in a network information security protection method based on encryption algorithms proposed in this invention. Detailed Implementation

[0021] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0022] refer to Figures 1 to 3 A network information security protection method based on encryption algorithms includes the following steps: S1. Establish the current password state based on the secure transmission relationship of network information; S2. Based on the current password state, the SM4-GCM authentication and encryption algorithm is used to perform authentication and encryption on network information to form an encrypted message sequence; S3. Perform authentication and decryption on the encrypted message sequence, and associate the authentication result with the receiving position according to the sending order to form an authentication transmission status sequence; S4. An improved ConvTimeNet model is used to process the authentication transmission state sequence. The authentication success result and corresponding receiving position are checked at each sending position along the sending order to determine the continuous authentication boundary. The continuous authentication boundary is used to restrict the range of deformable blocks and restrict the propagation of the hierarchical full convolution across the boundary, forming a boundary constraint hierarchical representation. S5. When the authentication transmission state changes, the boundary pre-level representation is maintained and the boundary post-propagation is restored based on the boundary constraint hierarchy representation. Combined with the authentication confirmation of both communicating parties, a closed continuous authentication interval is formed. S6. Extract the SM4-GCM authentication results within the closed continuous authentication interval, process them according to the sending order using the SM3 cryptographic hash algorithm, and form a closed authentication digest. S7. Using the current cryptographic state and the closed authentication digest as key derivation input, perform key derivation using the SM3 cryptographic hash algorithm to form the next cryptographic state; S8. Based on the next cryptographic state, the SM4-GCM authentication encryption algorithm is used to perform authentication encryption on the network information, and the closed authentication digest is bound to the additional authentication data to form an updated encrypted message sequence.

[0023] In this embodiment, S1 specifically includes: The secure transmission relationship of network information represents the one-to-one correspondence established between the sending end and the receiving end for the current communication. When the communication is established, the correspondence is determined by the connection information where both parties have completed identity verification. The sending end and the receiving end access the local protected key storage area with the same correspondence and read the same initial key, so that the current communication obtains consistent key derivation input at both ends. If either end fails to read the initial key corresponding to the current communication, the current password state is not established and the authentication and encryption process of the current communication is stopped. After successful reading, the initial key is associated with the current communication correspondence and is called by the current encryption key generation process.

[0024] The initial key derivation uses the same calculation process at both ends of the current communication. First, the initial key is encoded into the key derivation input in a fixed byte order. Then, the SM3 cryptographic hash algorithm is used to calculate the hash value of the key derivation input. The SM3 output length is 256 bits. 128 bits are continuously truncated from the left end of the hash value as the current encryption key of the SM4-GCM authentication encryption algorithm. The 128 bits are consistent with the key length of the SM4 block cipher algorithm. Both parties use the same encoding order and truncation position for the same initial key, thus obtaining a consistent current encryption key. After the key derivation is completed, the current encryption key is immediately sent to the current cryptographic state establishment process.

[0025] The current cryptographic state is used to store the current encryption key being used in the current communication and the correspondence between the current encryption key and the current communication. When established, the 128-bit current encryption key derived from the key is written into the cryptographic state record of the corresponding communication, and the record is set as the valid cryptographic state read when the current communication performs authentication encryption and authentication decryption. When the current communication enters the message authentication encryption process, the current encryption key is obtained from the cryptographic state record, so that the current cryptographic state directly inherits the initial key derivation result and serves as the cryptographic input for the next processing step.

[0026] In this embodiment, S2 specifically includes: The current encryption key is read from the established current password state. The sending order is determined by the order in which the sender writes the network information to be sent into the sending queue. Each piece of network information to be sent is assigned a continuously increasing sending order. The current password state keeps the current encryption key unchanged during the same round of authentication and encryption. The sender reads the network information to be sent in sequence and generates an initial vector for the corresponding message. The current encryption key and the initial vector of the current message together constitute the message encryption parameters.

[0027] The initial vector is encoded in 96 bits. The sending end maintains a monotonically increasing transmission count for the current encryption key and encodes the transmission count into the initial vector in a fixed byte order. The transmission count is incremented once for each network message to be sent. The transmission count is kept continuous and not reset during the validity period of the current encryption key, so that the initial vectors corresponding to the same current encryption key are not repeated. When the transmission count reaches the upper limit that the current encoding length can represent, the sending of new network messages using the current encryption key is stopped, and the current cryptographic state is maintained until the closed continuous authentication interval is confirmed and the next cryptographic state is established.

[0028] During authentication encryption, network information is sequentially retrieved from the transmission queue. This network information is then used as plaintext input. The current encryption key and the corresponding initialization vector are input into the SM4-GCM authentication encryption algorithm. After completing the encryption and authentication calculations, the algorithm outputs the ciphertext and authentication tag of the current message. The ciphertext, authentication tag, and corresponding initialization vector are then encapsulated into the same encrypted message, maintaining the correspondence between the encrypted message and the original transmission order to form an encrypted message sequence. The receiving end can directly obtain the initialization vector, ciphertext, and authentication tag from the encrypted message and proceed to the authentication and decryption process.

[0029] In this embodiment, S3 specifically includes: The authentication and decryption process takes the encrypted messages obtained by the receiving end as the object. The receiving end parses the initialization vector, ciphertext and authentication tag from each encrypted message, and reads the current encryption key corresponding to the current communication from the current password state. The current encryption key, initialization vector and ciphertext are input into the SM4-GCM authentication and decryption process. At the same time, the authentication tag is used to complete the integrity verification. When the authentication tag verification is consistent, the authentication is recorded as successful and the network information obtained by decryption is retained. When the authentication tag verification is inconsistent, the authentication is recorded as failed and the corresponding decrypted content is discarded. The authentication result is kept in one-to-one correspondence with the current encrypted message and enters the receiving location association processing.

[0030] The sending order is recovered from the sequence information transmitted with the message in the communication protocol, which can indicate the original sending order. The receiving position is continuously recorded by the receiving end starting from 1 according to the actual arrival order of the encrypted messages. When the encrypted message corresponding to the same sending position arrives normally, it is written to the actual receiving position. When it arrives out of order, it is still written to the actual arrival order. Therefore, the position in the sending order and the actual receiving position can directly reflect whether the order of the messages has changed. When a certain sending position does not obtain the corresponding encrypted message within the current receiving range, the empty position of the sending position is reserved and the receiving position is recorded as 0. After the late message arrives and completes authentication and decryption, the actual receiving position and authentication result are written back to the corresponding empty position, thereby causing a change in the authentication transmission status.

[0031] The authentication transmission state sequence is arranged along the sending order. Each sequence position corresponds to a fixed sending position, and the authentication result and actual receiving position of the corresponding sending position are saved. Authentication success is encoded as 1, and authentication failure is encoded as 0. Positions that have not yet received a message record the authentication value as -1 and the receiving position as 0. After a late message completes authentication and decryption, the actual authentication result and actual receiving position are written back to the original sending position. When judging the continuous authentication range along the sending order, the authentication result is 1 and the receiving position is greater than 0 as the criterion for judging that the current sending position has completed authentication and reception. The first occurrence of an authentication result that is not 1 or a receiving position that is 0 forms a continuous authentication interruption. The actual receiving position of out-of-order messages continues to be saved as the input quantity for the model to reflect the change in the receiving order. The completed authentication transmission state sequence is directly entered into the improved ConvTimeNet model.

[0032] In this embodiment, the improved ConvTimeNet model includes a deformable block embedding layer, a first-level fully convolutional layer, a second-level fully convolutional layer, a third-level fully convolutional layer, and a linear readout layer connected in sequence: The original ConvTimeNet model consists of deformable block embedding, hierarchical full convolution processing, and linear readout. Deformable block embedding first uses local input features to predict block center offset and scale changes, and then changes the block position and length based on the prediction results and completes sampling. Hierarchical full convolution processing uses depth convolution, point convolution, and learnable residuals with different receptive ranges to extract multi-scale temporal dependencies layer by layer. Linear readout completes end mapping. In the network authentication transmission state processing, the block range in the original forward path is mainly determined by local temporal features. The convolution receptive range mainly expands with the convolution kernel and network depth. When authentication fails, messages are missing, or the receiving order changes and fall inside the block or convolution window, the states on both sides of the continuous authentication boundary will enter the same sampling or convolution calculation. The states that have not yet formed continuous authentication participate in the hierarchical representation update of the confirmed area. Therefore, this implementation introduces the continuous authentication boundary into the data propagation path between deformable blocks and hierarchical convolution, so that the block sampling range and the convolution propagation range both conform to the actual boundary of authentication continuity.

[0033] The improved ConvTimeNet model consists of a deformable block embedding layer, a first-level fully convolutional layer, a second-level fully convolutional layer, a third-level fully convolutional layer, and a linear readout layer connected in sequence. The authentication transmission state sequence uses the sending order as the time axis, with each position corresponding to a sending position. The authentication value 1 is written to the position where authentication is successful, the authentication value 0 is written to the position where authentication fails, and the authentication value -1 is written to the position where no reception is received. When the receiving position is 0, the normalized receiving position remains 0. When the receiving position is greater than 0, the result of dividing the actual receiving position by the actual receiving position plus 1 is used as the normalized receiving position, so that the normalization result of the same message is determined only by its own actual receiving position and remains between 0 and 1. Each sending position consists of a dual-channel timing input consisting of the authentication value and the normalized receiving position. The sending position index is also reserved for continuous authentication boundary determination and boundary coordinate mapping. The continuous authentication boundary reads the original authentication result and the original receiving position.

[0034] The deformable block embedding layer sequentially performs initial block segmentation, local feature extraction, lightweight prediction, block boundary calculation, linear interpolation sampling, and embedding projection. The initial block is obtained by sliding along the transmission order. The block length is determined by the configuration used during model training and remains consistent during model operation. The sliding step size is fixed at one transmission position, so that the centers of adjacent blocks correspond to adjacent transmission positions. Each initial block simultaneously stores the position of the center on the transmission order coordinate axis and the corresponding block index. Local feature extraction uses convolutional projection to process the current initial block. The lightweight predictor reads the local features obtained by convolutional projection and outputs the center offset and scale change respectively. The center offset is added to the initial block center to obtain the adjusted block center. Twice the scale change is added to the initial block length to obtain the adjusted block length. Then, the adjusted block center is extended to the left and right by half the adjusted block length to obtain the left and right boundaries. After the left and right boundaries are determined, equidistant sampling positions are generated within the corresponding range. Non-integer sampling positions are linearly interpolated using two adjacent transmission positions. The sampling results are converted into a unified hidden channel representation by embedding projection and arranged according to the block index to form a block embedding.

[0035] The first-level fully convolutional layer consists of consecutively arranged fully convolutional blocks. Each fully convolutional block includes a large kernel depthwise convolution branch, a small kernel depthwise convolution branch, GELU nonlinear processing, learnable residuals, 1×1 point convolutions, and batch normalization. The large kernel depthwise convolution branch and the small kernel depthwise convolution branch process the same hidden channel in block order. During training, the convolution results obtained by the two branches at the same position are added element-wise and then GELU nonlinear compression is performed. The compressed result is multiplied by the learnable residual weights corresponding to the current fully convolutional block and added element-wise with the input of the current fully convolutional block at the same position. The residual weights are updated as the model is trained. The residual backfit result enters the 1×1 point convolution, and the hidden channels are linearly combined at each sequence position and batch normalization is performed. During the model execution phase, the small kernel convolution parameters are padded to the same range as the large kernel convolution parameters and merged with the large kernel convolution parameters position by position. The merged convolution parameters are used to complete the depthwise convolution calculation.

[0036] When the first-level fully convolutional layer processes block embedding, it retains the correspondence between the block index and the sending order coordinates. After the convolution process is completed, it reads the authentication result and the original receiving position position by position along the sending order. When the authentication value of the current position is 1 and the receiving position is greater than 0, it continues to check the next sending position. When the authentication value is 0, the authentication value is -1 or the receiving position is 0 for the first time, it stops extending and uses the previous sending position as the continuous authentication boundary. The specific value of the actual receiving position is retained in the authentication transmission state to reflect the degree of message out-of-order and the changes in the authentication transmission state. The continuous authentication boundary is determined by whether the sending position has obtained a valid authentication result and the actual receiving position. Therefore, after a late message is written back to the original sending position, it can re-participate in the determination of the continuous authentication range.

[0037] The continuous authentication boundary feedback occurs between the first-level fully convolutional layer and the deformable block embedding layer. The feedback input includes the continuous authentication boundary position and the block center, block length, and sampling boundary already generated by the deformable block embedding layer. First, the continuous authentication boundary is mapped from the first-level convolutional position back to the sampling position in the authentication transmission state sequence. Then, the relative position of the left and right boundaries of each block with the continuous authentication boundary is checked. Blocks that are completely on the same side of the continuous authentication boundary use the current sampling result. Blocks that cross the continuous authentication boundary enter the boundary correction process. After the boundary correction, the blocks re-perform linear interpolation sampling and embedding projection and replace the original block embedding. The first-level fully convolutional layer then re-performs the current level calculation only with the updated whole block embedding, so that the regenerated first-level representation is consistent with the already determined continuous authentication boundary. The specific rewriting process of the center offset, scale change, and left and right boundaries inside the cross-boundary block is further elaborated in the corresponding continuous authentication boundary reverse action implementation content.

[0038] Both the second and third fully convolutional layers consist of large-kernel deep convolution branches, small-kernel deep convolution branches, GELU, learnable residuals, 1×1 point convolutions, and batch normalization. The internal multiplication-accumulation, non-linear processing, and residual reconnection order are consistent with the first-level fully convolutional layer. The difference lies in the fact that the receptive range of the deep convolution gradually expands along the layers, allowing the second layer to aggregate the hierarchical representations of adjacent regions from the first layer, and the third layer to further aggregate hierarchical representations with a longer transmission range. Before performing deep convolution at each layer, the output of the previous stage is divided into a pre-boundary and post-boundary portion using continuous authentication boundaries, with the convolution center position... When the convolution window is located before the boundary, it only reads the true representation before the boundary. When the convolution center is located after the boundary, it only reads the true representation after the boundary. The missing sample terms at the boundary are written as 0 according to the zero-padding method used by the current depth convolution and participate in the corresponding convolution weight multiplication and addition. This keeps the length of the output sequence unchanged and prevents the true state on the other side from entering the current convolution result. Point convolution only performs the linear combination of hidden channels at the same sequence position. The learnable residuals are also only reconnected to the previous state at the same position. Therefore, the two types of operations use the boundary segmentation already determined by the depth convolution and do not generate new cross-boundary writes.

[0039] The linear readout layer consists of linear mapping weights and biases, and processes the output of the third-level fully convolutional layer position by position. Each element of the input vector corresponds to a hidden channel feature. The columns of the linear mapping weights correspond one-to-one with the hidden channels. The weights are multiplied by the corresponding hidden features and accumulated along the hidden channels, and the biases are superimposed to obtain the readout vector at the current sending position. The readout vectors at each sending position are still arranged in the original sending order and together constitute the boundary constraint hierarchical representation. The boundary constraint hierarchical representation retains the correspondence between the sequence positions before and after the continuous authentication boundary. When the authentication transmission state changes, the representation formed before the boundary can be directly retained, and the input after the boundary re-enters the model for calculation, thus providing a hierarchical state that can be directly inherited for local recovery processing.

[0040] The model parameters are trained using historical authentication transmission state sequences. The training samples include authentication transmission state sequences generated by continuous normal reception, authentication failure, missing messages, and changes in reception order. The training input uses authentication values ​​and normalized reception positions encoded in a dual-channel manner, consistent with the model's runtime phase. During the training phase, authentication success, authentication failure, and no reception are treated as three authentication states. The linear readout layer outputs the authentication state classification result and the normalized reception position result for each transmission position. The classification error for the authentication state is calculated using multi-class cross-entropy, and the position error for the normalized reception position is calculated using mean squared error. The two errors are averaged within the current training batch, summed, and backpropagation is performed to update the lightweight predictor, embedding projection, depthwise convolutions at each level, pointwise convolutions, learnable residuals, and linear readout parameters. The determination of continuous authentication boundaries, boundary coordinate mapping, cross-boundary block recognition, and deep convolution segmentation are directly calculated from the authentication results, reception positions, and transmission order. The corresponding position control processes do not participate in the model parameter training.

[0041] Compared to the existing ConvTimeNet, this invention changes the basis for the establishment of temporal dependencies within the model and the data flow between layers. The original model uses the adaptive blocks generated by DePatch as a fixed front-end result and expands the receptive range unidirectionally along the hierarchical convolution. This invention elevates the continuous authentication boundary to a structural control variable that runs through front-end sampling and deep propagation, enabling the front-end block range to be corrected in reverse by the authentication boundary obtained from the first level. At the same time, the effective receptive ranges of the second and third levels terminate at the same authentication boundary. This transforms the multi-scale dependency based on temporal proximity in the original model into a multi-scale dependency based on the effective range of continuous authentication. This change allows the confirmed authentication state and the state awaiting continuous confirmation to have independent sampling ranges and convolutional propagation ranges within the model. When the authentication state undergoes local changes, it can maintain the hierarchical representation that is stable before the boundary and only recover the propagation chain after the boundary, thereby simultaneously improving the stability of the authentication boundary representation, the efficiency of local state recovery, and the degree of isolation between trusted history and unclosed states during the cryptographic state continuation process.

[0042] In this embodiment, the reverse effect of the continuous authentication boundary on the deformable block embedding layer specifically includes: When the continuous authentication boundary acts inversely on the deformable block embedding layer, the authentication transmission state sequence establishes continuous position coordinates along the transmission order. The first-level fully convolutional layer maintains the correspondence between the convolution output index and the block index during the forward computation. Each block index also retains the position of the initial block center on the transmission order coordinate axis. Therefore, after the continuous authentication boundary is determined, it can be mapped back to the sampling coordinates of the deformable block embedding layer along the block index relationship. Each initial block saves the initial left boundary, initial right boundary, initial block center, and initial block length. After the lightweight predictor outputs the center offset and scale change, the center offset is added to the initial block center to obtain the adjusted block center. Twice the scale change is added to the initial block length to obtain the adjusted block length. The current left and right boundaries are determined by the adjusted block center and block length.

[0043] Blocks that cross continuous authentication boundaries are determined by the positional relationship between the current left boundary, the current right boundary, and the continuous authentication boundary. When the current left boundary is before the continuous authentication boundary and the current right boundary is after the continuous authentication boundary, it is determined to be a cross-boundary block. When the current left and right boundaries are on the same side of the continuous authentication boundary, the center offset and scale changes already generated by the lightweight predictor are maintained. When the center of a cross-boundary block is before or coincides with the continuous authentication boundary, the current left boundary is maintained and the current right boundary is shrunk to the continuous authentication boundary. When the center of a cross-boundary block is after the continuous authentication boundary, the current right boundary is maintained and the current left boundary is shrunk to the continuous authentication boundary.

[0044] After the left and right boundaries are corrected, the midpoint between the corrected left and right boundaries is taken as the new block center, the distance between the corrected right and left boundaries is taken as the new block length, the displacement of the new block center relative to the initial block center is taken as the updated center offset, and half the difference between the new block length and the initial block length is taken as the updated scale change. The updated center offset and scale change directly replace the original output generated by the lightweight predictor for the current cross-boundary block. Blocks that do not cross the continuous authentication boundary continue to maintain the original output of the lightweight predictor. Thus, the original DePatch center update and scale update path is still used to complete the boundary correction.

[0045] The updated center offset and scale change re-enter the geometric calculation of the deformable block embedding layer. Sampling positions are generated equidistantly between the corrected left and right boundaries according to the original sampling number of the current block. Integer sampling positions directly read the input vector of the corresponding sending position. When the sampling position falls between two adjacent integer sending positions, the distance from the sampling position to the right integer position is used as the interpolation weight of the left input vector, and the distance from the sampling position to the left integer position is used as the interpolation weight of the right input vector. The sum of the two weights is 1, which is multiplied by the input vectors on both sides and then added to obtain the current sampling value. Each sampling value enters the embedding projection in the original sampling order. The original embedding of the cross-boundary block is replaced by the newly obtained block embedding, and the non-cross-boundary block embedding retains the original value. Then, they are combined into a complete block embedding sequence according to the original block index.

[0046] The complete block embedding sequence re-enters the first-level fully convolutional layer and performs a forward computation using the already trained convolutions, point convolutions, batch normalization, GELU, and learnable residual parameters. The newly obtained first-level representation replaces the first-level representation before boundary feedback. The updated first-level representation is then fed into the second and third fully convolutional layers to perform boundary segment propagation. The continuous authentication boundary determined in the current round remains fixed during this round of resampling and first-level recalculation. The recalculation result of this round directly enters the deep propagation. When the authentication result or the receiving position changes again, a new continuous authentication boundary is determined and the next local recovery is initiated.

[0047] Compared to the existing ConvTimeNet, the essential change in this implementation lies in the reallocation of the decision-making power for the DePatch deformation parameters and the alteration of the data flow direction within the model. In the original ConvTimeNet, the center offset and scale change output of the lightweight predictor directly serve as the final geometric parameters for the current block, and subsequent convolutions only consume the block representations already determined at the front end. This implementation changes the output of the lightweight predictor to candidate deformation parameters that can be further corrected by the authentication boundary, and establishes a reverse control path that returns the first-level authentication boundary to the DePatch parameter path, transforming the model from unidirectional local feature-driven block segmentation to local feature-generated candidate ranges. The two-layer determination method for defining the effective range of cryptographic authentication boundaries: This change directly writes the continuous authentication state into the sampling geometry at the front end of the model, preventing unclosed authentication regions from entering the block representation of closed regions through the adaptive expansion of DePatch. At the same time, it maintains the learning ability of the original convolution parameters and embedding parameters. Therefore, without destroying ConvTimeNet's multi-scale temporal modeling capabilities, it improves the effective temporal perception range of the model from being solely determined by data similarity to being simultaneously controlled by the effective range of cryptographic authentication. This provides a unified internal model foundation for the inheritance of stable representations before the boundary, the local recovery of states after the boundary, and the continuous continuation of communication cryptographic states.

[0048] In this embodiment, S5 specifically includes: The determination of changes in the authentication transmission state is based on the comparison between the authentication result and the receiving position of the same sending position in the current authentication transmission state sequence and the previous authentication transmission state sequence. When no received message arrives and an authentication result is obtained, the authentication result changes, or the actual receiving position changes, the corresponding sending position is determined as the state change position. The continuous authentication boundary before the change is the continuous authentication boundary saved after the previous round of processing by the improved ConvTimeNet model. When the state change position is after the continuous authentication boundary before the change, local recovery processing is entered. When the state change position falls in the area before the already closed boundary, the current communication is marked as authentication abnormal and the current round of closed interval expansion is stopped to avoid the fixed continuous authentication history being directly rewritten by the new receiving state.

[0049] The local recovery process directly preserves the block embeddings and hierarchical representations that have already been calculated for the continuous authentication boundary before the change. It then extracts the authentication transmission state sequence starting from the next transmission position adjacent to the continuous authentication boundary before the change, extending the extraction range to the last transmission position where the authentication result or reception position has been recorded. The state within the extraction range is then recalculated using the deformable block, boundary feedback, and hierarchical full convolution processing methods determined earlier. The hierarchical representations previously saved for the boundary do not re-enter the convolution calculation. The recalculated hierarchical representations are still written back to the corresponding sequence positions according to the original transmission positions. The first-level full convolutional layer re-checks the continuity along the updated authentication result and reception position to obtain a new continuous authentication boundary, thereby limiting the impact of this state change to the range after the continuous authentication boundary before the change.

[0050] The determination of the continuous authentication endpoint begins from the next transmission position adjacent to the previous continuous authentication boundary, and reads the SM4-GCM authentication results one by one along the transmission sequence until the transmission position corresponding to the redefined continuous authentication boundary is reached. When each transmission position has obtained an authentication result, the next position is checked. If an authentication failure occurs or the corresponding message has not yet obtained an authentication result, the current round of continuous verification is terminated immediately, and the transmission position before the interruption position is determined as the continuous authentication endpoint. When all authentications are successful from the starting position to the redefined continuous authentication boundary, the transmission position corresponding to the redefined continuous authentication boundary is directly determined as the continuous authentication endpoint. If the continuous authentication endpoint does not exceed the previous continuous authentication boundary, the previous continuous authentication boundary is maintained and the current round of interval closure processing ends.

[0051] The authentication and confirmation process between the communicating parties uses the continuous authentication endpoint as the information content that needs to be jointly confirmed. The receiving end reads the current encryption key from the current cipher state, generates an initial vector that does not repeat the initial vector of existing messages under the current encryption key, and performs authentication encryption on the authentication confirmation information containing the continuous authentication endpoint using the SM4-GCM authentication encryption algorithm. The sending end completes authentication decryption and obtains the continuous authentication endpoint using the same current encryption key in the current cipher state. After successful authentication, a return confirmation message containing the same continuous authentication endpoint is generated using the same cipher state. The receiving end completes authentication verification again and compares the returned continuous authentication endpoint. When both authentications are successful and the continuous authentication endpoints confirmed by both parties are consistent, the position is fixed as the closed endpoint, and the range of messages that have passed authentication continuously from the next sending position adjacent to the previous continuous authentication boundary to the closed endpoint is determined as the closed continuous authentication interval. If any authentication fails or the endpoints confirmed by both parties are inconsistent, the previous continuous authentication boundary is maintained and no new closed continuous authentication interval is generated. The successfully formed closed continuous authentication interval directly enters the closed authentication digest calculation.

[0052] In this embodiment, S6 specifically includes: The closed continuous authentication interval is determined after the authentication confirmation by both communicating parties is consistent. The starting point of the interval is the next transmission position adjacent to the previous continuous authentication boundary, and the ending point of the interval is the closing endpoint. The receiving end reads the SM4-GCM authentication results already saved in the closed continuous authentication interval from the starting point of the interval along the transmission sequence. After the sending end completes the authentication confirmation by both parties at the closing endpoint, it records each transmission position in the interval as authenticated as passed according to the same closed continuous authentication interval and transmission sequence. This enables both communicating parties to obtain the authentication result sequence corresponding to the same closed continuous authentication interval. Authentication passed is recorded as 1, and authentication failed is recorded as 0, and the authentication results are kept in a one-to-one correspondence with the original transmission positions. If a transmission position in the interval that has not yet obtained an authentication result is found during the reading process, the current digest calculation is stopped and the current password state is maintained. The digest calculation is performed on the updated closed continuous authentication interval only after the corresponding position obtains the authentication result and completes the closing confirmation again.

[0053] The authentication result encoding uses a fixed-length binary encoding consistent with both communicating parties. Successful authentication is encoded as a single byte 01, and authentication failure is encoded as a single byte 00. Starting from the beginning of the closed continuous authentication interval, the encoded values ​​of each authentication result are obtained sequentially according to the sending order, and then concatenated continuously in the order of the previous sending position encoding first and the next sending position encoding last, to obtain the authentication result byte sequence with a length corresponding to the number of messages in the closed continuous authentication interval. The concatenation order always takes the sending order and not the actual arrival order. Therefore, the same closed continuous authentication interval corresponds to the same authentication result arrangement order at both the sending and receiving ends.

[0054] The authentication result byte sequence serves as the message input for the SM3 cryptographic hash algorithm. The sending and receiving ends each perform an SM3 hash operation on the same closed continuous authentication interval confirmed by both parties, according to the same sending order and the same encoding method, and obtain a 256-bit hash value. The obtained hash value is saved as the closed authentication digest corresponding to the current closed continuous authentication interval. After the closed authentication digest is generated, it is directly used as the input for key derivation in the current cryptographic state, and continues to be used as the additional authentication data for SM4-GCM authentication encryption in the next cryptographic state.

[0055] In this embodiment, S7 specifically includes: The key derivation input consists of the current encryption key and the closed authentication digest. The current encryption key is read directly from the current cryptographic state. The closed authentication digest is the 256-bit hash value obtained by processing the current closed continuous authentication interval using the SM3 cryptographic hash algorithm. Both communicating parties maintain the original byte order of the current encryption key and concatenate the two byte sequences directly in the order of the current encryption key first and the closed authentication digest last. The key derivation process begins when the closed continuous authentication interval has been authenticated and confirmed by both parties and a closed authentication digest has been generated. If the closed authentication digest has not yet been generated, the current cryptographic state is maintained.

[0056] The key derivation input is used as the message input for the SM3 cryptographic hash algorithm to perform a hash operation. Both communicating parties continuously extract 128 bits from the left end of the 256-bit hash result as the next encryption key. The extraction direction and extraction length are consistent between the two communicating parties. After the next encryption key is generated, it replaces the current encryption key in the current cryptographic state and establishes the next cryptographic state.

[0057] The next cryptographic state is updated based on the communication record corresponding to the current cryptographic state. The two communicating parties maintain the original communication correspondence unchanged, and replace the current encryption key in the record with the next encryption key. The state record after the replacement is saved as the next cryptographic state. The closed authentication digest that has been completed in the current round continues to correspond with this state update and enters the additional authentication data processing of the next round of authentication encryption. After the next cryptographic state is established, both the sending end and the receiving end read the next encryption key from the same state record, so that the cryptographic state update result can directly inherit the closed authentication digest and enter the next round of SM4-GCM authentication encryption and decryption process.

[0058] In this embodiment, S8 specifically includes: After the next cipher state is established, the sending end reads the next encryption key from the cipher state record corresponding to the current communication, and reads the closed authentication digest corresponding to the previous closed continuous authentication interval. The closed authentication digest maintains the original byte order of the SM3 cryptographic hash algorithm output and is directly used as the additional authentication data for encryption in this round of SM4-GCM authentication. It participates in the authentication calculation of each network information to be sent during the validity period of the next cipher state. When the closed authentication digest has not yet been generated, the current cipher state is maintained, and the transmission of network information under the next cipher state is not started.

[0059] The network information to be sent is processed message by message in the order of its transmission queue. Each message continues to use the initial vector generation method determined earlier, and ensures that the initial vectors of each message are not repeated during the validity period of the same next encryption key. During authentication encryption, the current network information to be sent is used as plaintext input, the next encryption key is used as encryption key, and the initial vector corresponding to the current message is used as the SM4-GCM initial vector. At the same time, the closed authentication digest is used as additional authentication data input to the SM4-GCM authentication encryption algorithm. The algorithm generates ciphertext for the network information to be sent, and combines the ciphertext and additional authentication data to complete the authentication calculation and obtain the authentication tag. The ciphertext, authentication tag and initial vector corresponding to the same network information to be sent are then encapsulated into an encrypted message. The encrypted messages are arranged in the original transmission order to obtain the updated encrypted message sequence.

[0060] After receiving the updated encrypted message, the receiving end reads the next encryption key, which is consistent with the sending end, from the next cryptographic state. It parses the initialization vector, ciphertext, and authentication tag from the encrypted message and reads the same closed authentication digest stored in the previous closed continuous authentication interval as additional authentication data. Then, it performs SM4-GCM authentication decryption and authentication tag verification. If any of the ciphertext, initialization vector, next encryption key, or closed authentication digest is inconsistent with the content used by the sending end during authentication encryption, the authentication tag verification will fail. Messages that pass authentication continue to enter the association processing of authentication result and receiving position. In this way, the authentication digest formed in the previous closed continuous authentication interval participates in the key derivation of the next cryptographic state and the next round of message authentication, and the confirmed continuous authentication history is directly connected to the new authentication encryption process.

[0061] Example 1: To verify the feasibility of this invention in practice, it was applied to an industrial data acquisition and remote control network. Edge acquisition devices in the network continuously send device status, control feedback, and operation records to the service server. Individual message lengths range from 256 to 1024 bytes. Under normal circumstances, messages arrive consecutively in the order they were sent. However, due to link jitter, queue congestion, and abnormal messages, a small number of messages may be lost, out of order, delayed, or fail to authenticate. Traditional message-by-message authentication methods can determine whether an individual message has passed authentication, but when the message reception order changes, it is difficult to determine whether already authenticated messages constitute a continuous trusted range. If the password state is directly advanced based on a single authentication result, it can easily lead to a desynchronization of the password states between the communicating parties.

[0062] When applying this invention, the sending end uses the SM4-GCM authentication encryption algorithm to complete authentication encryption message by message based on the current cryptographic state, and encapsulates the ciphertext, authentication tag, and corresponding initialization vector into an encrypted message. After the receiving end completes authentication decryption, it arranges the authentication result and the actual receiving position according to the sending order to form an authentication transmission state sequence. The authentication transmission state sequence is input into the improved ConvTimeNet model. The deformable block embedding layer first generates the block center offset and scale change. The first-level fully convolutional layer checks the authentication result and receiving position of each sending position along the sending order to determine the continuous authentication boundary. The continuous authentication boundary shrinks the sampling range of the cross-boundary block in the reverse direction and restricts the cross-boundary propagation of the second-level and third-level fully convolutional layers. When the authentication state changes, the layer representation formed before the boundary is retained, and only the authentication transmission state after the boundary is reprocessed. After authentication and confirmation by both communicating parties, a closed continuous authentication interval is formed. Then, the SM3 cryptographic hash algorithm is used to generate a closed authentication digest, and the next cryptographic state is derived from it. At the same time, the closed authentication digest is used as additional authentication data for the next round of SM4-GCM authentication encryption.

[0063] During the verification process, 30 independent communication sessions were selected, and a total of 240,000 encrypted messages were collected as test samples. While maintaining consistency in business message content and encryption parameters, message loss, out-of-order delivery, delay, and authentication failure disturbances were introduced. The original sending record from the sending end and the authentication record from the receiving end were used together as the verification basis for continuous authentication intervals. The same test samples were processed using the traditional SM4-GCM message-by-message authentication method with password state updates based on message count, the ConvTimeNet method without reverse restrictions on continuous authentication boundaries, and the method of this invention. The results of continuous authentication boundary determination, password state synchronization, early updates under abnormal conditions, and recovery processing after authentication state changes were statistically analyzed. The statistical results are shown in Table 1 below.

[0064] Table 1 Comparison of continuous authentication and password state continuation effects under network transmission disturbance conditions.

[0065] As can be seen from the data in Table 1 above, the method of the present invention outperforms the traditional SM4-GCM message-by-message authentication method and the SM4-GCM combined with the unmodified ConvTimeNet method in terms of continuous authentication boundary determination, password state synchronization, password state update control, and recovery processing after authentication state changes. The traditional SM4-GCM message-by-message authentication method mainly processes based on the authentication result of a single message, with a continuous authentication boundary determination accuracy of 91.7% and a password state synchronization success rate of 96.4%. However, in cases of message loss, out-of-order delivery, delay, or authentication anomalies, there is still a 3.6% premature password state update rate. After introducing the unmodified ConvTimeNet, the continuous authentication boundary determination accuracy increases to 95.5%, and the password state synchronization success rate increases to 98.2%, indicating that temporal feature processing can improve continuous state recognition. However, since block sampling and hierarchical convolution may still propagate across authentication interruption points, the average reprocessing rate of messages after authentication state changes still reaches 72.3%, and the average recovery latency is 5.7ms. The method of this invention achieves a continuous authentication boundary determination accuracy of 99.1%, a password state synchronization success rate of 99.6%, a password state early update rate reduced to 0.4%, an average recovery latency reduced to 3.5ms, and an average reprocessing rate of 24.8% after authentication state changes. Specifically, the continuous authentication boundary determination accuracy reflects the proportion of determined continuous authentication boundaries that match the verification boundaries; the password state synchronization success rate reflects the proportion of communicating parties maintaining the same password state after state continuation; the password state early update rate reflects the proportion of password state updates occurring before continuous authentication is closed; and the recovery latency and reprocessing rate of 24.8% measure the recovery efficiency after authentication state changes. The results demonstrate that this invention can balance boundary determination accuracy, state synchronization stability, and local recovery efficiency.

[0066] This embodiment uses the SM4-GCM authentication encryption algorithm to complete the authentication encryption and decryption of network information. The authentication results and actual receiving locations are organized into an authentication transmission state sequence according to the sending order. Based on this, an improved ConvTimeNet model is used to determine continuous authentication boundaries. These continuous authentication boundaries not only limit the propagation range of the hierarchical full convolution but also influence the deformable block embedding process, redefining the sampling range for blocks that cross the boundary. This ensures that states without continuous authentication do not propagate to already confirmed areas through block sampling and deep convolution. When the authentication transmission state changes, the hierarchical representation formed before the continuous authentication boundary is retained. Only the authentication transmission state after the boundary is reprocessed, and the closed continuous authentication interval is determined by combining the SM4-GCM authentication results and the authentication confirmations from both communicating parties, thereby reducing the redundant calculation of irrelevant historical messages. After the closed continuous authentication interval is determined, the SM3 cryptographic hash algorithm is used to generate a closed authentication digest for the authentication results within the interval. The closed authentication digest is then combined with the current cryptographic state to derive the next cryptographic state. The closed authentication digest is used as additional authentication data for the next stage of SM4-GCM authentication encryption. This allows the transmission state that has completed closed authentication to continue to participate in the next stage of cryptographic state continuation, avoiding premature key updates caused by unclosed authentication states. This improves the isolation capability of authentication states during network transmission, the consistency of cryptographic states between the communicating parties, and the recovery stability under abnormal disturbance conditions.

[0067] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network information security protection method based on encryption algorithms, characterized in that, Includes the following steps: S1. Establish the current password state based on the secure transmission relationship of network information; S2. Based on the current password state, the SM4-GCM authentication and encryption algorithm is used to perform authentication and encryption on network information to form an encrypted message sequence; S3. Perform authentication and decryption on the encrypted message sequence, and associate the authentication result with the receiving position according to the sending order to form an authentication transmission status sequence; S4. An improved ConvTimeNet model is used to process the authentication transmission state sequence. The authentication success result and corresponding receiving position are checked at each sending position along the sending order to determine the continuous authentication boundary. The continuous authentication boundary is used to restrict the range of deformable blocks and restrict the propagation of the hierarchical full convolution across the boundary, forming a boundary constraint hierarchical representation. S5. When the authentication transmission state changes, the boundary pre-level representation is maintained and the boundary post-propagation is restored based on the boundary constraint hierarchy representation. Combined with the authentication confirmation of both communicating parties, a closed continuous authentication interval is formed. S6. Extract the SM4-GCM authentication results within the closed continuous authentication interval, process them according to the sending order using the SM3 cryptographic hash algorithm, and form a closed authentication digest. S7. Using the current cryptographic state and the closed authentication digest as key derivation input, perform key derivation using the SM3 cryptographic hash algorithm to form the next cryptographic state; S8. Based on the next cryptographic state, the SM4-GCM authentication encryption algorithm is used to perform authentication encryption on the network information, and the closed authentication digest is bound to the additional authentication data to form an updated encrypted message sequence.

2. The network information security protection method based on encryption algorithm according to claim 1, characterized in that, S1 specifically includes: S11. Determine the initial key shared by both communicating parties based on the secure transmission relationship of network information, and form the initial key corresponding to the current communication; S12. Perform key derivation on the initial key to generate the current encryption key corresponding to the SM4-GCM authentication encryption algorithm, and establish the current password state based on the current encryption key.

3. The network information security protection method based on encryption algorithm according to claim 1, characterized in that, S2 specifically includes: S21. Obtain the key required for SM4-GCM authentication encryption from the current password state, generate unique initial vectors according to the order of network information transmission, and form message encryption parameters; S22. Perform SM4-GCM authentication encryption on each network message using message encryption parameters, and encapsulate the generated ciphertext, authentication tag and corresponding initialization vector into encrypted messages to form an encrypted message sequence.

4. The network information security protection method based on encryption algorithm according to claim 1, characterized in that, S3 specifically includes: S31. Extract the initial vector, ciphertext and authentication tag from the encrypted message. Based on the current cryptographic state, perform SM4-GCM authentication and decryption on a message-by-message basis and verify the authentication tag to form the authentication result corresponding to the encrypted message. S32. Check the actual receiving position of each encrypted message according to the sending order, arrange the authentication results and corresponding receiving positions in sequence, and retain the corresponding sending position when no corresponding encrypted message is received, forming an authentication transmission state sequence.

5. A network information security protection method based on an encryption algorithm according to claim 1, characterized in that, The improved ConvTimeNet model includes a deformable block embedding layer, a first-level fully convolutional layer, a second-level fully convolutional layer, a third-level fully convolutional layer, and a linear readout layer connected in sequence. The deformable block embedding layer divides the authentication transmission state sequence according to the transmission order, uses a lightweight predictor to generate block center offset and scale change, adjusts the block boundaries and then performs linear interpolation sampling and embedding projection to form block embedding; The first-level fully convolutional layer performs depthwise convolution and pointwise convolution on the block embedding, maintaining the correspondence between the convolution position and the corresponding position in the transmission order. It checks the authentication result and receiving position of each transmission position along the transmission order, and determines the end of the continuous transmission position that has been authenticated and has obtained the receiving position as the continuous authentication boundary. The continuous authentication boundary acts inversely on the deformable block embedding layer. For blocks that cross the continuous authentication boundary, the sampling range on the side where the block center is located is preserved. The sampling range that crosses the continuous authentication boundary is shrunk to the continuous authentication boundary and linear interpolation sampling and embedding projection are re-executed. The first-level fully convolutional layer reprocesses the updated block embedding. The second and third fully convolutional layers successively expand the receptive range of the depth convolution. Before each level of convolution, the output is segmented according to the continuous authentication boundary. The depth convolution only slides along the continuous positions within the same segment. Point convolution and learnable residuals update the hierarchical representation at the corresponding positions. The linear readout layer performs a linear mapping on the hierarchical representation of the output of the third-level fully convolutional layer to form a boundary-constrained hierarchical representation.

6. A network information security protection method based on an encryption algorithm according to claim 5, characterized in that, The reverse effect of the continuous authentication boundary on the deformable block embedding layer specifically includes: Based on the correspondence between the convolution positions in the first-level fully convolutional layer and the corresponding positions in the transmission sequence, the continuous authentication boundary is mapped to the sampling position of the deformable block embedding layer. The initial block center and initial block length are determined according to the initial block of the authentication transmission state sequence. The adjusted block center, block length and left and right boundaries are determined according to the center offset and scale change generated by the lightweight predictor. For blocks whose left and right boundaries cross the continuous authentication boundary, if the block center is located in front of or coincides with the continuous authentication boundary, the left boundary is retained and the right boundary is shrunk to the continuous authentication boundary. If the block center is located behind the continuous authentication boundary, the right boundary is retained and the left boundary is shrunk to the continuous authentication boundary. The block center and block length are re-determined based on the adjusted left and right boundaries. The center offset is updated with the displacement between the redefined block center and the initial block center, the scale change is updated with half the difference between the redefined block length and the initial block length, and the updated result replaces the center offset and scale change generated by the lightweight predictor for blocks that cross the boundary. Blocks that do not cross the continuous certified boundary retain the output of the lightweight predictor. The deformable block embedding layer redetermines the block boundaries based on the updated center offset and scale change, performs linear interpolation sampling and embedding projection, and the updated block embedding is reprocessed by the first-level fully convolutional layer to form the first-level representation corresponding to the continuous authentication boundary.

7. A network information security protection method based on an encryption algorithm according to claim 1, characterized in that, S5 specifically includes: S51. When the authentication transmission state changes, the hierarchical representation that has been formed before the continuous authentication boundary before the change is maintained, and the improved ConvTimeNet model processing is re-executed on the authentication transmission state after the continuous authentication boundary before the change to redetermine the continuous authentication boundary. S52. Starting from the next transmission position adjacent to the previous continuous authentication boundary, sequentially check the SM4-GCM authentication results up to the transmission positions corresponding to the newly determined continuous authentication boundaries. S53. When the authentication continuity is interrupted, the sending position before the interruption is determined as the end point of continuous authentication; when there is no interruption, the sending position corresponding to the newly determined continuous authentication boundary is determined as the end point of continuous authentication. S54. When the continuous authentication endpoint exceeds the continuous authentication boundary before the change, the receiving end writes the continuous authentication endpoint into the authentication confirmation information and performs password authentication based on the current password state. The sending end verifies the authentication confirmation information based on the current password state and returns the authentication confirmation of the same continuous authentication endpoint, thus fixing the closed endpoint. S55. When the authentication confirmation of both communicating parties is consistent, the range of messages that have been continuously authenticated from the next sending position adjacent to the continuous authentication boundary before the change to the closing end point is determined as the closed continuous authentication interval.

8. A network information security protection method based on an encryption algorithm according to claim 1, characterized in that, S6 specifically includes: S61. Read the SM4-GCM authentication results of each encrypted message within the closed continuous authentication interval according to the sending order; S62. Encode each authentication result in sequence according to the sending order, concatenate the encoded results sequentially and perform SM3 hash operation to form a closed authentication digest.

9. A network information security protection method based on an encryption algorithm according to claim 1, characterized in that, Specifically, S7 includes: S71. Obtain the current encryption key used for SM4-GCM authentication encryption from the current password state, and concatenate the current encryption key before the closed authentication digest to form a key derivation input. S72. Perform SM3 hash operation on the key derivation input, and extract data from the hash result that is the same length as the SM4 key to form the next encryption key; S73. Replace the current encryption key in the current password state with the next encryption key to form the next password state.

10. A network information security protection method based on an encryption algorithm according to claim 1, characterized in that, S8 specifically includes: S81. Obtain the next encryption key from the next cipher state, and use the closed authentication digest as additional authentication data for SM4-GCM authentication encryption; S82. Generate unique initial vectors for the network information to be sent according to the sending order. Input the network information to be sent, the next encryption key, the corresponding initial vector, and the additional authentication data into SM4-GCM authentication encryption to generate ciphertext and authentication tag. S83. Assemble the ciphertext, authentication tag, and initialization vector corresponding to each network information into an encrypted message according to the sending order, forming an updated encrypted message sequence.

Images