A data communication system and method for remotely transmitting encrypted data

Abstract

The application relates to the technical field of data communication and information security, and discloses a data communication system and a method for remotely transmitting encrypted data, which comprises a sending-end communication module, a receiving-end communication module, a remote transmission link module, an encryption management and control center module, a link adaptive adjustment module and a data verification and tracing module. The data communication system and the method for remotely transmitting encrypted data adopt a dynamic key rotation mechanism, generate a key in combination with a hardware random number, avoid a fixed key cracking risk, integrate encryption management, data communication, link adjustment, verification and tracing functions into one, deeply cooperate an encryption process with a transmission process, do not need to additionally deploy independent encryption equipment, adopt a fragmentation encryption and decryption mode, avoid power consumption caused by whole package data encryption, adapt to remote terminal equipment with limited power, support batch remote encryption transmission of massive data, and consider the communication requirements of small terminal and large server.

Description

Technical Field

[0001] This invention relates to the field of data communication and information security technology, specifically to a data communication system and a method for remotely transmitting encrypted data. Background Technology

[0002] With the widespread adoption of digital and network technologies, the application scenarios for remote data communication are becoming increasingly broad. From remote interaction between industrial field equipment and cloud platforms, and massive data backhaul from IoT terminals, to cross-regional transmission of confidential enterprise data and remote sharing of government data, all these scenarios place extremely high demands on the security and reliability of data communication. Existing remote data transmission technologies generally suffer from several drawbacks. Traditional encryption methods often employ a single fixed key, significantly increasing data loss and retransmission rates. Existing data communication systems are mostly based on general-purpose architectures, making it difficult to trace anomalies. Some encryption schemes focus only on data content encryption, neglecting supporting mechanisms such as communication link authentication, dynamic key distribution and updates, and transmission log traceability, resulting in a high risk of identity forgery and unauthorized access.

[0003] While some existing encrypted transmission systems and methods have made improvements to address the aforementioned issues, they still fail to achieve integrated collaboration of "dynamic encryption, link self-adaptation, efficient transmission, and secure traceability." They cannot simultaneously resolve the contradictions between security, stability, and efficiency in long-distance transmission. Therefore, there is an urgent need for a dedicated data communication system and a corresponding remote encrypted transmission method to compensate for the shortcomings of existing technologies. Summary of the Invention

[0004] (a) Technical problems to be solved To address the shortcomings of existing remote data communication technologies, such as insufficient encryption security, low transmission efficiency, poor link adaptability, and lack of identity authentication, this paper provides a data communication system and a method for remotely transmitting encrypted data. By constructing a modular and adaptive data communication system architecture, and combining it with encryption transmission methods such as dynamic key encryption, fragmented encrypted transmission, two-way identity authentication, and real-time link optimization, the system achieves high-strength encryption protection, low-latency and efficient transmission, and end-to-end security and controllability during remote data transmission. At the same time, it improves the system's compatibility with different remote communication links and reduces deployment and maintenance costs.

[0005] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: a data communication system, comprising a transmitting end communication module, a receiving end communication module, a remote transmission link module, an encryption control center module, a link adaptive adjustment module, and a data verification and traceability module. Each module works in concert through hardware circuits and software programs, and the specific structure is as follows: Preferably, the transmitting end communication module includes a data acquisition unit, a data preprocessing unit, a transmitting end encryption unit, and a data sending unit. The data acquisition unit is used to acquire the raw data to be remotely transmitted, covering various data types such as structured data, unstructured files, and real-time streaming data. The data preprocessing unit is used to standardize the format of the raw data, remove redundant data, and perform fixed-size data fragmentation to adapt to the data packet specifications for remote transmission. The transmitting end encryption unit communicates with the encryption control center to obtain a dynamic encryption key, encrypt the fragmented data piece by piece, and generate a data verification code. The data sending unit is used to package the encrypted data fragments, verification codes, and key identifiers, and send them to the receiving end through the remote transmission link module, while synchronously transmitting link status information. Preferably, the receiving end communication module includes a data receiving unit, a receiving end decryption unit, a data reassembly unit, and a data verification unit. The data receiving unit receives encrypted data packets transmitted remotely and parses out encrypted data fragments, checksums, and key identifiers. The receiving end decryption unit requests the corresponding key from the encryption control center, completes the decryption of each encrypted data fragment, and removes invalid data. The data reassembly unit reassembles the decrypted valid data fragments in their original order to restore the original complete data. The data verification unit compares the received checksum with the decrypted data to verify whether the data has been tampered with or lost. Preferably, the encryption control center module serves as the core security control unit of the system, comprising a key generation unit, a key distribution unit, a key update unit, and an authentication unit. The key generation unit uses a hardware random number generator to generate dynamic symmetric and asymmetric public-private key pairs. The key generation frequency can be set according to the transmission scenario, supporting both scheduled and triggered updates. The key distribution unit distributes corresponding keys to the sender and receiver through an encrypted channel, using asymmetric encryption to protect the key transmission process. The key update unit is used to periodically discard old keys and generate and distribute new keys, avoiding security risks associated with long-term key use. The authentication unit performs two-way authentication for the sender and receiver, ensuring that only authenticated terminals can access the system for data transmission, preventing unauthorized access. Preferably, the remote transmission link module is compatible with a variety of remote transmission media, including fiber optic leased lines, 4G / 5G mobile communication, satellite communication, wireless private networks, and public network VPN channels. It supports multi-link redundancy backup and automatically switches to the backup link when the main link fails, ensuring uninterrupted remote transmission. Preferably, the link adaptive adjustment module is connected to the sending end communication module and the remote transmission link module respectively. It detects the latency, packet loss rate and bandwidth parameters of the remote transmission link in real time, and dynamically adjusts the data fragment size, transmission rate and encryption strength according to the detection results. It automatically optimizes the transmission parameters in weak network and high latency scenarios to balance security and transmission efficiency. Preferably, the data verification and traceability module connects to the sending end, receiving end, and encryption control center, records the transmission time, key information, link status, and verification results of each set of data, generates a transmission traceability log, supports rapid tracing and investigation of abnormal transmission data, and triggers a retransmission mechanism for data that fails verification.

[0006] Based on the aforementioned data communication system, this invention also discloses a method for remotely transmitting encrypted data, specifically comprising the following steps: Preferably, the system initialization and two-way authentication steps are as follows: The data communication system is started, and the encryption control center module performs two-way authentication on the sending and receiving communication modules. The authentication method uses a combination of digital certificates and dynamic passwords. After successful authentication, an encrypted communication channel is established between the sending end, the receiving end, and the encryption control center. The key generation unit generates an initial dynamic symmetric encryption key and asymmetric key pair, and the key distribution unit securely distributes the corresponding keys to the sending end encryption unit and the receiving end decryption unit, completing the key initialization. Preferably, the raw data preprocessing and fragmentation steps are as follows: the data acquisition unit at the sending end acquires the raw data to be remotely transmitted and transmits it to the data preprocessing unit; the preprocessing unit performs format standardization processing on the raw data, removes duplicate and redundant data, and divides the raw data into several data fragments of fixed size according to the link status fed back by the link adaptive adjustment module, while assigning a unique sequence number to each data fragment to ensure that the subsequent reassembly order is correct; Preferably, the dynamic encryption and verification code generation steps are as follows: The sending end encryption unit calls the currently valid dynamic symmetric key to independently encrypt each data fragment, so as to avoid the leakage of a single data fragment from affecting the overall data security; after encryption, the verification code of the corresponding data fragment is generated based on the hash algorithm, and the encrypted data fragment, sequence number identifier, verification code and current key identifier are packaged into a data packet to be transmitted. Preferably, the remote transmission and link adaptive adjustment steps are as follows: The data sending unit sends the data packet to be transmitted to the receiving end through the remote transmission link module. During the transmission, the link adaptive adjustment module monitors the link latency, packet loss rate, and bandwidth parameters in real time. If the link status deteriorates, it automatically reduces the data fragment size, lowers the transmission rate, and maintains the encryption strength unchanged. If the link status is good, the data fragment size can be appropriately increased to improve transmission efficiency. At the same time, multi-link redundancy backup is enabled, and the backup link is automatically switched when the main link is abnormal to ensure transmission continuity. Preferably, the data receiving and decryption steps are as follows: The receiving end data receiving unit listens to and receives the transmitted data packets in real time, and parses out the encrypted data fragments, sequence number identifiers, check codes and key identifiers; The receiving end decryption unit requests the corresponding decryption key from the encryption control center according to the key identifier, and after key verification, decrypts the encrypted data fragments one by one, and removes invalid fragments and out-of-order fragments generated during the transmission process. Preferably, the data reconstruction and integrity verification steps are as follows: The data reconstruction unit accurately reconstructs the decrypted valid data fragments in their original order according to the unique sequence number of the data fragment, restoring them into complete original data; The data verification unit regenerates a check code for the reconstructed data and compares it with the received original check code. If the comparison matches, the data is determined to be complete and valid; if the comparison does not match, the data is determined to have been tampered with or lost, and a retransmission command is triggered through the data verification and tracing module, causing the sending end to retransmit the corresponding abnormal data fragment. Preferably, the key dynamic update and traceability recording steps are as follows: The key update unit of the encryption control center automatically discards the old key and generates a new dynamic encryption key according to a preset cycle or abnormal triggering instruction. The new key is then redistributed to the sender and receiver through the encryption channel to achieve dynamic key rotation. The data verification and traceability module records the core information of this data transmission throughout the process, including transmission time, participating terminal identity, key information, link status, and verification results. It generates an immutable traceability log and completes the single remote encrypted data transmission process.

[0007] Compared with the prior art, the present invention provides a data communication system and a method for remotely transmitting encrypted data, which has the following beneficial effects: 1. This data communication system and method for remotely transmitting encrypted data employ a dynamic key rotation mechanism, combined with hardware-generated random numbers to avoid the risk of fixed-key cracking; triple protection—independent encryption of data fragments, two-way authentication, and verification code integrity check—effectively prevents security issues such as data leakage, tampering, and man-in-the-middle attacks, adapting to the remote transmission needs of classified and sensitive data; through a link adaptive adjustment module, data fragmentation and transmission parameters are dynamically adjusted according to the remote link status, balancing encryption strength and transmission efficiency, and solving packet loss and latency issues in weak network and high-latency remote links; multi-link redundancy backup design ensures uninterrupted long-distance transmission, is compatible with various transmission media, and adapts to the remote communication needs of different scenarios.

[0008] 2. This data communication system and method for remotely transmitting encrypted data integrate encryption control, data communication, link adjustment, and verification and traceability functions into one. The encryption process and transmission process are deeply coordinated, eliminating the need for additional independent encryption equipment, resulting in low deployment costs and strong compatibility. It also has data traceability capabilities, facilitating anomaly investigation and security auditing, and is suitable for remote data communication scenarios in various fields such as industry, IoT, government affairs, and enterprises. 3. The data communication system and the method for remotely transmitting encrypted data adopt a segmented encryption and decryption approach to avoid the computational power consumption caused by encrypting the entire data packet. It is compatible with remote terminal devices with limited computing power and supports batch remote encrypted transmission of massive amounts of data, taking into account the communication needs of small terminals and large servers. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating the method steps for remotely transmitting encrypted data according to the present invention. Figure 2 This is a block diagram of the overall modules of the data communication system. Figure 3 This is a flowchart of the system's data interaction method. Detailed Implementation

[0010] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0011] See Figure 1-3 A data communication system and a method for remotely transmitting encrypted data, comprising a sending end communication module, a receiving end communication module, a remote transmission link module, an encryption control center module, a link adaptive adjustment module, and a data verification and traceability module; The transmitting end communication module includes a data acquisition unit, a data preprocessing unit, a transmitting end encryption unit, and a data sending unit. The data acquisition unit is used to acquire the original data to be transmitted. The data preprocessing unit is used to standardize and fragment the original data. The transmitting end encryption unit is used to dynamically encrypt the data fragments and generate a checksum. The data sending unit is used to send encrypted data packets through the remote transmission link module. The receiving end communication module includes a data receiving unit, a receiving end decryption unit, a data reassembly unit, and a data verification unit. The data receiving unit is used to receive encrypted data packets, the receiving end decryption unit is used to decrypt encrypted data in fragments, the data reassembly unit is used to restore the original data, and the data verification unit is used to verify data integrity. The encryption control center module includes a key generation unit, a key distribution unit, a key update unit, and an identity authentication unit. The key generation unit uses hardware random numbers to generate dynamic encryption keys. The key distribution unit is used to securely distribute keys to both ends. The key update unit is used to periodically rotate the keys. The identity authentication unit is used to complete two-way identity verification between the sending end and the receiving end. The link adaptive adjustment module is connected to the remote transmission link module and the sending end communication module, and monitors the link status in real time and dynamically adjusts the transmission parameters; the data verification and traceability module is used to record transmission logs, verify data and trigger retransmission mechanisms.

[0012] Furthermore, the remote transmission link module is compatible with one or more of fiber optic leased lines, 4G / 5G mobile communication, satellite communication, wireless private networks, and VPN channels, and has a multi-link redundancy backup automatic switching function.

[0013] Furthermore, the sending end encryption unit and the receiving end decryption unit use a symmetric encryption algorithm for data encryption and decryption. The key is dynamically generated by the encryption control center and updated periodically. The key transmission is protected by an asymmetric encryption algorithm.

[0014] Furthermore, the data preprocessing unit divides the original data into fixed-size data fragments with unique serial numbers, and the data reassembly unit accurately reassembles the data according to the serial number identifiers.

[0015] Furthermore, a method for remotely transmitting encrypted data includes the following steps: S1. System initialization and two-way authentication: The encryption control center performs two-way authentication on the sending and receiving ends. After successful authentication, an encrypted communication channel is established and an initial dynamic encryption key is distributed. S2. Raw data preprocessing and fragmentation: The sending end collects raw data, which is then processed according to standardization and divided into data fragments with unique sequence numbers based on the link status. S3. Dynamic Encryption and Verification Code Generation: The sending end uses the current dynamic key to encrypt data fragments one by one, generates corresponding verification codes, and packages them into data packets to be transmitted. S4. Remote transmission and link adaptive adjustment: Send data packets through remote transmission links, monitor link status in real time, dynamically adjust transmission parameters, and enable multi-link redundancy backup; S5. Data reception and decryption: The receiving end receives data packets, parses the key identifier, and completes data fragment decryption piece by piece. S6. Data Reassembly and Integrity Verification: Reassemble data according to sequence number, verify integrity by comparing check code, and trigger retransmission for abnormal data; S7. Dynamic Key Update and Traceability Record: The encryption key is updated periodically, and the entire transmission traceability log is recorded to complete the transmission process.

[0016] Furthermore, the dynamic encryption key is updated through timed updates and exception-triggered updates, with old keys being automatically discarded and new keys being distributed through an encrypted channel.

[0017] Furthermore, during the link adaptive adjustment process, when the link condition deteriorates, the data fragment size is reduced and the transmission rate is decreased; when the link condition is good, the data fragment size is increased to improve transmission efficiency.

[0018] Furthermore, data integrity verification uses a hash algorithm to generate a checksum. If the checksum is inconsistent, only the abnormal data fragment is retransmitted, without the need to retransmit the entire packet.

[0019] Furthermore, data integrity verification uses a hash algorithm to generate a checksum. If the checksum is inconsistent, only the abnormal data fragment is retransmitted, without the need to retransmit the entire packet.

[0020] Example 1: System Hardware and Software Deployment In this embodiment, the transmitting communication module is deployed on the PLC control terminal in the industrial field, with a built-in ARM architecture processor. The data acquisition unit interfaces with industrial sensors and equipment operating parameter acquisition interfaces. The data preprocessing unit and the transmitting encryption unit are integrated into the terminal embedded system. The receiving communication module is deployed on a cloud server, using an x86 architecture server, and equipped with data receiving, decryption, and reconstruction software programs. The encryption control center module is deployed on a dedicated security server in the enterprise intranet, configured with a hardware random number generator, supporting 24 / 7 uninterrupted operation. The remote transmission link module adopts 5G mobile communication + fiber optic leased line dual-link backup, and the link adaptive adjustment module monitors the status parameters of the two links in real time. The data verification and traceability module adopts blockchain log storage technology to ensure that the transmission log is tamper-proof.

[0021] Example 2: Detailed Process of Remote Encrypted Data Transmission Step 1: Initialization and Identity Authentication: After the system starts, the encryption control center performs two-way digital certificate authentication on the PLC terminal and the cloud server. After successful authentication, an initial AES-256 dynamic symmetric key is generated and distributed to both ends through the RSA2048 asymmetric encryption channel. The key update cycle is set to 1 hour. Step 2: Data Preprocessing: The PLC terminal collects real-time data such as voltage, current, and temperature of the equipment. The preprocessing unit unifies the data format to CSV format, removes redundant data collected repeatedly, and divides the data into 1KB fragments according to the link status (initial 5G link bandwidth 10Mbps, latency 50ms), assigning each fragment a unique serial number. Step 3: Dynamic Encryption: The sending end encryption unit uses the current AES-256 key to independently encrypt each data fragment, generates a checksum based on the SHA-256 algorithm, and packages it into a data packet; Step 4: Remote transmission: Data packets are transmitted through the 5G link. The link adaptive module monitors in real time. When the packet loss rate of the 5G link is detected to rise to 3%, the data fragment size is automatically adjusted to 512KB, the transmission rate is reduced, and the backup fiber optic leased line is switched. Step 5: Decryption and Reassembly: The cloud server receives the data packet, parses the key identifier to obtain the corresponding decryption key, decrypts the data piece by piece, and reassembles the data according to the sequence number; Step Six: Verification and Retransmission: If the verification code matches, the data is uploaded to the cloud database; if a fragment packet is lost, a retransmission command is immediately triggered, and the PLC terminal retransmits the corresponding sequence number fragment. Step 7: Key Update and Traceability: After the 1-hour cycle, the encryption control center automatically generates a new AES key, discards the old key, and redistributes it; all transmitted information is written to the blockchain log, completing this transmission.

[0022] Example 3: System Performance Test Results Tests have shown that the data communication system and encrypted transmission method in this embodiment achieve AES-256 encryption strength in a 1000-kilometer long-distance transmission scenario, with a data packet loss rate of less than 0.1%, a transmission delay 40% lower than traditional fixed encryption methods, a 100% identity authentication pass rate, and no data leakage or tampering, fully meeting the security and efficiency requirements of industrial remote data transmission.

[0023] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A data communication system, characterized in that, It includes a sending end communication module, a receiving end communication module, a remote transmission link module, an encryption control center module, a link adaptive adjustment module, and a data verification and traceability module; The transmitting end communication module includes a data acquisition unit, a data preprocessing unit, a transmitting end encryption unit, and a data sending unit. The data acquisition unit is used to acquire the original data to be transmitted. The data preprocessing unit is used to standardize and fragment the original data. The transmitting end encryption unit is used to dynamically encrypt the data fragments and generate a checksum. The data sending unit is used to send encrypted data packets through the remote transmission link module. The receiving end communication module includes a data receiving unit, a receiving end decryption unit, a data reassembly unit, and a data verification unit. The data receiving unit is used to receive encrypted data packets, the receiving end decryption unit is used to decrypt encrypted data in fragments, the data reassembly unit is used to restore the original data, and the data verification unit is used to verify data integrity. The encryption control center module includes a key generation unit, a key distribution unit, a key update unit, and an identity authentication unit. The key generation unit uses hardware random numbers to generate dynamic encryption keys. The key distribution unit is used to securely distribute keys to both ends. The key update unit is used to periodically rotate the keys. The identity authentication unit is used to complete two-way identity verification between the sending end and the receiving end. The link adaptive adjustment module is connected to the remote transmission link module and the sending end communication module, and monitors the link status in real time and dynamically adjusts the transmission parameters; the data verification and traceability module is used to record transmission logs, verify data and trigger retransmission mechanisms.

2. The data communication system according to claim 1, characterized in that: The remote transmission link module is compatible with one or more of the following: fiber optic leased lines, 4G / 5G mobile communication, satellite communication, wireless private networks, and VPN channels, and has a multi-link redundancy backup automatic switching function.

3. The data communication system according to claim 1, characterized in that: The sending end encryption unit and the receiving end decryption unit use a symmetric encryption algorithm for data encryption and decryption. The key is dynamically generated by the encryption control center and updated periodically. The key transmission is protected by an asymmetric encryption algorithm.

4. A data communication system according to claim 1, characterized in that: The data preprocessing unit divides the raw data into fixed-size data fragments with unique serial numbers, and the data reassembly unit accurately reassembles the data according to the serial number identifiers.

5. A method for remotely transmitting encrypted data, based on the data communication system according to any one of claims 1-4, characterized in that: Includes the following steps: S1. System initialization and two-way authentication: The encryption control center performs two-way authentication on the sending and receiving ends. After successful authentication, an encrypted communication channel is established and an initial dynamic encryption key is distributed. S2. Raw data preprocessing and fragmentation: The sending end collects raw data, which is then processed according to standardization and divided into data fragments with unique sequence numbers based on the link status. S3. Dynamic Encryption and Verification Code Generation: The sending end uses the current dynamic key to encrypt data fragments one by one, generates corresponding verification codes, and packages them into data packets to be transmitted. S4. Remote transmission and link adaptive adjustment: Send data packets through remote transmission links, monitor link status in real time, dynamically adjust transmission parameters, and enable multi-link redundancy backup; S5. Data reception and decryption: The receiving end receives data packets, parses the key identifier, and completes data fragment decryption piece by piece. S6. Data Reassembly and Integrity Verification: Reassemble data according to sequence number, verify integrity by comparing check code, and trigger retransmission for abnormal data; S7. Dynamic Key Update and Traceability Record: The encryption key is updated periodically, and the entire transmission traceability log is recorded to complete the transmission process.

6. The method for remotely transmitting encrypted data according to claim 5, characterized in that: The dynamic encryption key is updated through timed updates and exception-triggered updates. Old keys are automatically discarded, and new keys are distributed through an encrypted channel.

7. The method for remotely transmitting encrypted data according to claim 5, characterized in that: During the link adaptive adjustment process, when the link condition deteriorates, the data fragment size is reduced and the transmission rate is decreased; when the link condition is good, the data fragment size is increased to improve transmission efficiency.

8. The method for remotely transmitting encrypted data according to claim 5, characterized in that: Data integrity verification uses a hash algorithm to generate a checksum. If the checksum is inconsistent, only the abnormal data fragment is retransmitted, and the entire packet does not need to be retransmitted.

Images