Policy-based multi-protocol dynamic encapsulation method and system

Abstract

The embodiment of the application discloses a policy-based multi-protocol dynamic encapsulation method and system, the method is used for a policy-based multi-protocol dynamic encapsulation system, a plurality of preset policies are configured in the system, the method comprises the following steps: when it is needed to perform encapsulation processing on original data, an encapsulation instruction is read from an instruction queue, the encapsulation instruction is calculated based on the plurality of preset policies and network real-time feedback signals, and the encapsulation instruction carries a target network protocol combination and an optimal encapsulation path used for encapsulation processing; the encapsulation instruction is analyzed to obtain the target network protocol combination and the optimal encapsulation path, the original data is cut based on the plurality of preset policies to obtain a plurality of data blocks of non-fixed sizes; parameter perturbation processing is performed on each data block to eliminate fixed fingerprint characteristics; and multi-layer nested encapsulation is respectively performed on each data block after the parameter perturbation processing based on the target network protocol combination and the optimal encapsulation path in the encapsulation instruction, so that encapsulation data packets are obtained.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a policy-based multi-protocol dynamic encapsulation method and system. Background Technology

[0002] With the rapid development of network communication technology, data encapsulation technology, as one of the fundamental technologies of network communication, has been widely used in various network systems and communication equipment. The basic principle of network data encapsulation technology is to add protocol header information layer by layer to the original data according to the format requirements of a specific protocol, forming a data packet that can be transmitted in the network. Deep Packet Inspection (DPI), as a deep analysis method for encapsulated data, can perform protocol feature matching, statistical feature analysis, and behavioral pattern recognition on network data packets, thereby identifying and classifying network traffic.

[0003] The following is a brief introduction to existing packaging technologies: For example, a policy-based dynamic VPN configuration selection technology selects the optimal configuration from multiple VPN configurations for data transmission based on network conditions and security requirements. While this approach achieves a degree of flexibility through policy configuration, its protocol switching granularity is relatively coarse, making the encapsulation technology easily recognizable by DPI devices.

[0004] Therefore, there is an urgent need to provide a data encapsulation solution that can solve the above technical problems. Summary of the Invention

[0005] This invention provides a policy-based multi-protocol dynamic encapsulation method and system, which can perform parameter perturbation and multi-layer encapsulation masquerading at the data block level, effectively increasing anti-identification capabilities and significantly improving data security.

[0006] On one hand, embodiments of the present invention provide a policy-based multi-protocol dynamic encapsulation method, the method being used in a policy-based multi-protocol dynamic encapsulation system, the system being configured with multiple preset policies, the method comprising: When it is necessary to encapsulate the raw data, an encapsulation instruction is read from the instruction queue. The encapsulation instruction is calculated based on the multiple preset strategies and real-time network feedback signals. The encapsulation instruction carries the target network protocol combination and the optimal encapsulation path for the encapsulation process. The encapsulation instructions are parsed to obtain the target network protocol combination and the optimal encapsulation path; Based on the aforementioned multiple preset strategies, the original data is segmented to obtain multiple data blocks of non-fixed size; Perform parameter perturbation processing on each of the data blocks to eliminate fixed fingerprint features; Based on the target network protocol combination and optimal encapsulation path in the encapsulation instruction, multi-level nested encapsulation is performed on each data block after parameter perturbation processing to obtain encapsulated data packets.

[0007] Furthermore, based on the multiple preset strategies, the original data is segmented to obtain multiple data blocks of non-fixed size, including: The target range of the data block is read from the encapsulation instructions. The target range is dynamically configured according to the multiple preset strategies. The target range is used to limit the size of the data block after it is cut. A random number generator is used to generate data blocks of random size within the target range, wherein the data blocks of random size are uniformly distributed; Gaussian noise is superimposed on the uniformly distributed data blocks of random size to obtain the plurality of non-fixed-size data blocks, wherein the size of the non-fixed-size data blocks is within the target range.

[0008] The method further includes: Add metadata to each non-fixed-size data block, including: data block sequence number, data block length, total number of data blocks, stream identifier, and checksum.

[0009] Furthermore, the multiple preset policies include: security policy, performance policy, and compliance policy; The security policy defines security levels and corresponding perturbation intensities for parameter perturbation processing. The security levels include a first security level, a second security level, and a third security level, from highest to lowest. The parameter perturbation processing for the first security level includes: random packet length padding, random session ID generation, random window size adjustment, padding appending, and header key-value pair rearrangement. The parameter perturbation processing for the second security level includes: random packet length padding, random session ID generation, and header key-value pair rearrangement. The parameter perturbation processing for the third security level includes: random packet length padding. The performance strategy is used to define transmission performance and resource consumption constraints. The performance strategy includes a maximum allowable delay parameter, a maximum allowable packet loss rate parameter, a minimum throughput parameter, and a maximum CPU utilization parameter. The compliance strategy is used to define compliance requirements and restrictions on the use of protocols. The compliance strategy includes a whitelist of allowed protocols, a blacklist of prohibited protocols, compliance requirements for data export, and restrictions on protocols in specific regions. Among the multiple preset strategies, the order of priority from high to low is compliance strategy, security strategy, and performance strategy. When there is a conflict among the multiple preset strategies, the preset strategy with higher priority is executed, and the preset strategy with lower priority is ignored.

[0010] Furthermore, the multiple preset policies are stored in the form of policy files in a local file system or database. Each policy file contains a policy identifier, policy name, policy type, policy parameters, effective time, priority field, and policy version number. The method also includes: When the system starts up or the policy is updated, the policy file is read and the policy file is validated in terms of format and logic. The validation in terms of format and logic includes: field type check, required field check, enumeration value check, policy conflict detection, parameter range validity check, and dependency check. If the validation fails, an error log is recorded and the default policy is adopted. If the validation passes, multiple preset policies in the policy file are adopted. In response to the detection of a policy file change event, a policy update process is automatically triggered through a file change notification mechanism. The policy update process includes: reading the new policy file, performing verification, writing the new policy file to a shared memory area, and notifying the policy update. The policy update process is executed based on a hot update mechanism and is completed within a preset time without affecting the ongoing encapsulation session.

[0011] Furthermore, the parameter perturbation process includes: random padding of packet length, random generation of Session ID, random adjustment of Window Size, padding appending, and rearrangement of HTTP Header key-value pairs; The random padding of the packet length includes: calculating the padding length based on the distribution model specified by the security policy using the perturbation strength parameter in the parameter perturbation process, wherein the padding length follows a normal distribution or a uniform distribution; in the normal distribution mode, the mean and standard deviation are calculated from the baseline padding length and the perturbation strength parameter; in the uniform distribution mode, the distribution range is determined by the baseline padding length and the perturbation strength parameter; the padding content uses a pseudo-random byte sequence, and the key of the pseudo-random number generator is generated by the session key derivation function; The Session ID is generated randomly, including: when using the TLS protocol, the packet randomly generates the Session ID field in the TLS Client Hello message, the Session ID length is randomly selected within a preset range, the content is a cryptographically secure pseudo-random number, and the operating system's random number generator is used as the entropy source; Window Size is randomly adjusted, including: when using the TCP protocol, the Window Size field in the TCP header is randomly adjusted by multiplying the original Window Size by a random factor, and the adjusted Window Size is limited to a preset range; Padding includes: appending a random length of padding data to the end of the encapsulated data packet. The padding length is determined by the perturbation strength parameter and the current data block size. The padding content is a random byte sequence, and the pseudo-random number generator used is the same as the random padding for the packet length. HTTP header key-value pairs can be rearranged, including when using HTTP / 1.1 or HTTP / 2 protocols. To eliminate traffic fingerprinting features based on header order, the order of key-value pairs in HTTP request header fields is shuffled. This involves parsing the HTTP header, extracting all key-value pairs into a list, randomly rearranging the list using a random shuffling algorithm, and then reserializing the rearranged key-value pairs into HTTP headers.

[0012] Furthermore, the method also includes: adaptively adjusting the disturbance intensity parameter in the parameter disturbance processing process based on an adaptive adjustment mechanism, wherein the adaptive adjustment mechanism dynamically adjusts the disturbance intensity based on the network state assessment results and the DPI detection risk level; The adaptive adjustment mechanism includes: When the network state assessment reaches the preset level and no DPI probe behavior is detected, the current disturbance intensity remains unchanged; When DPI detection behavior is detected, the level of the disturbance intensity is increased according to a preset step size. The levels of the disturbance intensity, from low to high, include: first disturbance level, second disturbance level, and third disturbance level. The preset step size is less than or equal to the difference between two adjacent disturbance intensity levels. When the network status assessment is lower than the preset level, the level of the disturbance intensity is reduced by a preset step size to reduce the additional overhead caused by the disturbance. When the network state is stable and there is no detection behavior within a preset number of consecutive evaluation periods, the level of the disturbance intensity is reduced to the baseline level according to a preset step size. The relationship between the disturbance intensity and the protocol type is as follows: Different types of protocols have different tolerances for disturbances. The upper limit of the disturbance parameter is adjusted based on the currently used protocol type. For different types of protocols, the maximum delay of timing disturbances is set to different preset values. Among them, the tolerance of each protocol to packet length disturbances and timing disturbances from high to low is as follows: TCP protocol, QUIC protocol, and WebSocket protocol.

[0013] Furthermore, the method also includes: The timing of data packet transmission is perturbed to eliminate traffic fingerprint characteristics based on packet interval time series; The timing disturbance employs a delay injection algorithm: a random delay is injected based on the normal transmission time of the data packet, and the delay time follows an exponential or uniform distribution. In the exponential distribution mode, the rate parameter is calculated from the confusion intensity parameter and the reference delay parameter. In the uniform distribution mode, the range of the delay time is determined by the reference delay parameter and the confusion intensity parameter. Timing perturbation implementation method: The scheduler is maintained in advance. The scheduler uses a time wheel data structure to manage the data packets to be sent. When each data packet is added to the sending queue, the scheduler calculates its target sending time according to the timing perturbation strategy, which is the current time plus a random delay time. The scheduler sends the data packet when the target sending time is reached. The impact of timing disturbances on transmission efficiency: Timing disturbances introduce additional transmission delays. The higher the real-time requirements of the application scenario, the lower the corresponding timing disturbance intensity.

[0014] On the other hand, embodiments of the present invention provide a policy-based multi-protocol dynamic encapsulation system, wherein the system is configured with multiple preset policies, and the system includes: The reading module is used to read encapsulation instructions from the instruction queue when it is necessary to encapsulate the raw data. The encapsulation instructions are calculated based on the multiple preset strategies and real-time network feedback signals. The encapsulation instructions carry the target network protocol combination and the optimal encapsulation path for encapsulation processing. The parsing module is used to parse the encapsulation instructions to obtain the target network protocol combination and the optimal encapsulation path; The cutting module is used to cut the original data based on the multiple preset strategies to obtain multiple data blocks of non-fixed size; A perturbation module is used to perform parameter perturbation processing on each of the data blocks to eliminate fixed fingerprint features; The encapsulation module is used to perform multi-level nested encapsulation on each data block after parameter perturbation processing, based on the target network protocol combination and optimal encapsulation path in the encapsulation instruction, to obtain encapsulated data packets.

[0015] Thirdly, embodiments of the present invention provide an electronic device, including: a memory and a processor, wherein the memory and the processor are connected; Memory, used to store computer programs; A processor is used to invoke a computer program stored in memory to perform any of the above methods.

[0016] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when run by a computer, performs any of the methods described above.

[0017] This invention provides a policy-based multi-protocol dynamic encapsulation method and system. The method is used in a policy-based multi-protocol dynamic encapsulation system, which is configured with multiple preset policies. The method includes: when raw data needs to be encapsulated, reading an encapsulation instruction from an instruction queue; the encapsulation instruction is calculated based on the multiple preset policies and real-time network feedback signals, and carries a target network protocol combination and an optimal encapsulation path for encapsulation processing; parsing the encapsulation instruction to obtain the target network protocol combination and the optimal encapsulation path; segmenting the raw data based on the multiple preset policies to obtain multiple non-fixed-size data blocks; performing parameter perturbation processing on each data block to eliminate fixed fingerprint features; and performing multi-level nested encapsulation on each parameter-perturbed data block based on the target network protocol combination and the optimal encapsulation path in the encapsulation instruction to obtain encapsulated data packets. This method and system can perform parameter perturbation and multi-level encapsulation camouflage at the data block level, effectively increasing anti-identification capabilities and significantly improving data security. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 A flowchart of a policy-based multi-protocol dynamic encapsulation method provided in an embodiment of the present invention; Figure 2 This is a block diagram of a policy-based multi-protocol dynamic encapsulation system provided in an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0021] The terms "first," "second," etc., used in this invention are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein, and that the objects distinguished by "first," "second," etc., are generally of the same class.

[0022] The following specific embodiments will be used to explain and illustrate the solution of this patent application.

[0023] One embodiment of this patent application provides a policy-based multi-protocol dynamic encapsulation method, such as... Figure 1 As shown, the method is used in a policy-based multi-protocol dynamic encapsulation system, where multiple preset policies are configured. The method includes steps 101-105: Step 101: When it is necessary to encapsulate the raw data, read the encapsulation instruction from the instruction queue. The encapsulation instruction is calculated based on the multiple preset strategies and real-time network feedback signals. The encapsulation instruction carries the target network protocol combination and the optimal encapsulation path for the encapsulation process. Step 102: Parse the encapsulation instructions to obtain the target network protocol combination and the optimal encapsulation path; Step 103: Based on the multiple preset strategies, the original data is segmented to obtain multiple data blocks of non-fixed size; Step 104: Perform parameter perturbation processing on each of the data blocks to eliminate fixed fingerprint features; Step 105: Based on the target network protocol combination and optimal encapsulation path in the encapsulation instruction, perform multi-level nested encapsulation on each data block after parameter perturbation processing to obtain encapsulated data packets.

[0024] In one embodiment, the step of segmenting the original data based on the multiple preset strategies to obtain multiple data blocks of non-fixed size includes: The target range of the data block is read from the encapsulation instructions. The target range is dynamically configured according to the multiple preset strategies. The target range is used to limit the size of the data block after it is cut. A random number generator is used to generate data blocks of random size within the target range, wherein the data blocks of random size are uniformly distributed; Gaussian noise is superimposed on the uniformly distributed data blocks of random size to obtain the plurality of non-fixed-size data blocks, wherein the size of the non-fixed-size data blocks is within the target range.

[0025] In another embodiment, the method further includes: Add metadata to each non-fixed-size data block, including: data block sequence number, data block length, total number of data blocks, stream identifier, and checksum.

[0026] The preset policies include: security policies, performance policies, and compliance policies; The security policy defines security levels and corresponding perturbation intensities for parameter perturbation processing. The security levels include a first security level, a second security level, and a third security level, from highest to lowest. The parameter perturbation processing for the first security level includes: random packet length padding, random session ID generation, random window size adjustment, padding appending, and header key-value pair rearrangement. The parameter perturbation processing for the second security level includes: random packet length padding, random session ID generation, and header key-value pair rearrangement. The parameter perturbation processing for the third security level includes: random packet length padding. The performance strategy is used to define transmission performance and resource consumption constraints. The performance strategy includes a maximum allowable delay parameter, a maximum allowable packet loss rate parameter, a minimum throughput parameter, and a maximum CPU utilization parameter. The compliance strategy is used to define compliance requirements and restrictions on the use of protocols. The compliance strategy includes a whitelist of allowed protocols, a blacklist of prohibited protocols, compliance requirements for data export, and restrictions on protocols in specific regions.

[0027] Among the multiple preset policies, they are ordered from highest to lowest priority as compliance policy, security policy, and performance policy. When there is a conflict among the multiple preset policies, the preset policy with higher priority is executed, and the preset policy with lower priority is ignored.

[0028] Furthermore, the multiple preset policies are stored in the form of policy files in a local file system or database. Each policy file contains a policy identifier, policy name, policy type, policy parameters, effective time, priority field, and policy version number. The method also includes: When the system starts up or the policy is updated, the policy file is read and the policy file is validated in terms of format and logic. The validation in terms of format and logic includes: field type check, required field check, enumeration value check, policy conflict detection, parameter range validity check, and dependency check. If the validation fails, an error log is recorded and the default policy is adopted. If the validation passes, multiple preset policies in the policy file are adopted. In response to the detection of a policy file change event, a policy update process is automatically triggered through a file change notification mechanism. The policy update process includes: reading the new policy file, performing verification, writing the new policy file to a shared memory area, and notifying the policy update. The policy update process is executed based on a hot update mechanism and is completed within a preset time without affecting the ongoing encapsulation session.

[0029] Existing technologies often employ a one-size-fits-all protocol configuration approach, lacking policy-driven dynamic adaptation capabilities. Rigid policies cannot adapt to diverse business needs, making it difficult to flexibly switch between various business scenarios and simultaneously meet the conflicting requirements of low overhead and high resilience within a single system. For example, IoT device communication scenarios require lightweight transmission solutions to reduce computational and bandwidth overhead, while financial data transmission scenarios require high-strength encryption and spoofing protection. The policy in the embodiments of this application can be flexibly adjusted based on a hot update mechanism, easily switching between various business scenarios to adapt to different business needs. By decoupling business logic from transmission logic, a single system can simultaneously meet multiple business requirements such as lightweight transmission for IoT devices, high-security transmission of financial data, and privacy protection through anti-traffic analysis.

[0030] Furthermore, the parameter perturbation process includes: random padding of packet length, random generation of Session ID, random adjustment of Window Size, padding appending, and rearrangement of HTTP Header key-value pairs; The random padding of the packet length includes: calculating the padding length based on the distribution model specified by the security policy using the perturbation strength parameter in the parameter perturbation process, wherein the padding length follows a normal distribution or a uniform distribution; in the normal distribution mode, the mean and standard deviation are calculated from the baseline padding length and the perturbation strength parameter; in the uniform distribution mode, the distribution range is determined by the baseline padding length and the perturbation strength parameter; the padding content uses a pseudo-random byte sequence, and the key of the pseudo-random number generator is generated by the session key derivation function; The Session ID is generated randomly, including: when using the TLS protocol, the packet randomly generates the Session ID field in the TLS Client Hello message, the Session ID length is randomly selected within a preset range, the content is a cryptographically secure pseudo-random number, and the operating system's random number generator is used as the entropy source; Window Size is randomly adjusted, including: when using the TCP protocol, the Window Size field in the TCP header is randomly adjusted by multiplying the original Window Size by a random factor, and the adjusted Window Size is limited to a preset range; Padding includes: appending a random length of padding data to the end of the encapsulated data packet. The padding length is determined by the perturbation strength parameter and the current data block size. The padding content is a random byte sequence, and the pseudo-random number generator used is the same as the random padding for the packet length. HTTP header key-value pairs can be rearranged, including when using HTTP / 1.1 or HTTP / 2 protocols. To eliminate traffic fingerprinting features based on header order, the order of key-value pairs in HTTP request header fields is shuffled. This involves parsing the HTTP header, extracting all key-value pairs into a list, randomly rearranging the list using a random shuffling algorithm, and then reserializing the rearranged key-value pairs into HTTP headers.

[0031] In one embodiment, the method further includes: adaptively adjusting the disturbance intensity parameter during the parameter disturbance processing based on an adaptive adjustment mechanism, wherein the adaptive adjustment mechanism dynamically adjusts the disturbance intensity based on the network state assessment result and the DPI detection risk level.

[0032] The adaptive adjustment mechanism includes: When the network state assessment reaches the preset level and no DPI probe behavior is detected, the current disturbance intensity remains unchanged; When DPI detection behavior is detected, the level of the disturbance intensity is increased according to a preset step size. The levels of the disturbance intensity, from low to high, include: first disturbance level, second disturbance level, and third disturbance level. The preset step size is less than or equal to the difference between two adjacent disturbance intensity levels. When the network status assessment is lower than the preset level, the level of the disturbance intensity is reduced by a preset step size to reduce the additional overhead caused by the disturbance. When the network state is stable and there is no detection behavior within a preset number of consecutive evaluation periods, the level of the disturbance intensity is reduced to the baseline level according to a preset step size.

[0033] The closed-loop adaptive adjustment (or feedback) mechanism works as follows: continuously monitor transmission quality and blocking feedback; when an RST signal is received or a handshake timeout is detected, trigger policy degradation or protocol switching; input the transmission quality assessment results and blocking feedback signals to the dynamic decision module, which then updates the encapsulation instructions and re-executes the protocol selection and encapsulation process.

[0034] In this embodiment, a link-state-aware dynamic decision-making mechanism automatically switches to a protocol with stronger packet loss resistance in weak network environments. A closed-loop adaptive feedback loop continuously monitors the network status, and when network quality degradation is detected, it automatically switches to a protocol with built-in forward error correction and fast connection recovery features to cope with high packet loss environments. The entire closed-loop response time completes the protocol switching within a preset time range. Through optimization measures such as pre-calculating decision results, parallel connection establishment, and fast recovery, the total latency of the feedback loop is further reduced, and transmission performance is significantly optimized.

[0035] The relationship between the disturbance intensity and the protocol type is as follows: Different types of protocols have different tolerances for disturbances. The upper limit of the disturbance parameter is adjusted based on the currently used protocol type. For different types of protocols, the maximum delay of timing disturbances is set to different preset values. Among them, the tolerance of each protocol to packet length disturbances and timing disturbances from high to low is as follows: TCP protocol, QUIC protocol, and WebSocket protocol.

[0036] Furthermore, the method also includes: The timing of data packet transmission is perturbed to eliminate traffic fingerprint characteristics based on packet interval time series; The timing disturbance employs a delay injection algorithm: a random delay is injected based on the normal transmission time of the data packet, and the delay time follows an exponential or uniform distribution. In the exponential distribution mode, the rate parameter is calculated from the confusion intensity parameter and the reference delay parameter. In the uniform distribution mode, the range of the delay time is determined by the reference delay parameter and the confusion intensity parameter. Timing perturbation implementation method: The scheduler is maintained in advance. The scheduler uses a time wheel data structure to manage the data packets to be sent. When each data packet is added to the sending queue, the scheduler calculates its target sending time according to the timing perturbation strategy, which is the current time plus a random delay time. The scheduler sends the data packet when the target sending time is reached. The impact of timing disturbances on transmission efficiency: Timing disturbances introduce additional transmission delays. The higher the real-time requirements of the application scenario, the lower the corresponding timing disturbance intensity.

[0037] On the other hand, embodiments of the present invention provide a policy-based multi-protocol dynamic encapsulation system, such as... Figure 2 As shown, the system is configured with multiple preset strategies, and the system includes: The reading module 201 is used to read encapsulation instructions from the instruction queue when it is necessary to encapsulate the raw data. The encapsulation instructions are calculated based on the multiple preset strategies and real-time network feedback signals. The encapsulation instructions carry the target network protocol combination and the optimal encapsulation path for encapsulation processing. The parsing module 202 is used to parse the encapsulation instructions to obtain the target network protocol combination and the optimal encapsulation path; The cutting module 203 is used to cut the original data based on the multiple preset strategies to obtain multiple data blocks of non-fixed size; The perturbation module 204 is used to perform parameter perturbation processing on each of the data blocks to eliminate fixed fingerprint features; The encapsulation module 205 is used to perform multi-level nested encapsulation on each data block after parameter perturbation processing based on the target network protocol combination and optimal encapsulation path in the encapsulation instruction, so as to obtain encapsulated data packets.

[0038] The policy-based multi-protocol dynamic encapsulation system provided in this application has an overall architecture comprising four core modules: a policy management module, a protocol library module, a dynamic decision-making module, and an encapsulation execution module. The policy management module, protocol library module, and dynamic decision-making module belong to the control plane and are responsible for policy definition, protocol management, and decision calculation; the encapsulation execution module belongs to the data plane and is responsible for the actual data encapsulation processing and transmission operations.

[0039] The policy management module and the dynamic decision-making module are connected via an internal high-speed bus or inter-process communication mechanism, used to distribute parsed policy data to the dynamic decision-making module. The protocol library module and the dynamic decision-making module are connected via a registry query interface, through which the dynamic decision-making module queries available protocol plugins and their capability descriptions. The dynamic decision-making module and the encapsulation execution module are connected via an encapsulation instruction queue. The dynamic decision-making module writes the calculated encapsulation instructions into the instruction queue, and the encapsulation execution module reads instructions from the queue and executes the corresponding encapsulation operations.

[0040] In terms of hardware implementation, the four core modules mentioned above can be deployed on the same physical server or distributed across multiple servers. In a centralized deployment, the system runs on a general-purpose server with a multi-core processor. In a distributed deployment, the policy management module and dynamic decision-making module are deployed on the control node server, the encapsulation and execution module is deployed on the data node server, and the protocol library module can be distributed and cached locally on each data node. Nodes communicate with each other via a high-speed internal network.

[0041] In terms of software implementation, the system can run on either a Linux or Windows Server operating system. Communication between modules can be achieved using shared memory, message queues, or remote procedure calls. Preferably, in high-performance scenarios, the control plane and data plane communicate using shared memory and lock-free queues to reduce context switching and memory copy overhead.

[0042] The following is a detailed introduction to the strategy management module: The policy management module is used to define and manage preset policies, which include at least one of security policies, performance policies, and compliance policies. The policy management module provides a visual configuration interface or application programming interface (API) for administrators to define high-level intent policies.

[0043] The policy management module includes a policy definition unit, a policy storage unit, a policy parsing unit, and a policy update unit. The policy definition unit provides a graphical user interface or a RESTful API interface, allowing administrators to define and modify policies. Policies are defined and stored using a structured data format, and policy files are validated according to a predefined schema.

[0044] Security policies define security levels and obfuscation strength (or perturbation strength). Security levels are divided into several tiers, each corresponding to different protocol combinations and parameter perturbation strengths. The obfuscation strength parameter (or perturbation strength parameter) takes values ​​within a preset range; a higher value indicates stronger perturbation. At low security levels (e.g., level 3), only basic packet length randomization is enabled; at medium security levels (e.g., level 2), packet length randomization, random session ID generation, and header key-value pair rearrangement are enabled; at high security levels (e.g., level 1), all perturbation methods are enabled, including packet length randomization, random session ID generation, random window size adjustment, padding appending, and header key-value pair rearrangement.

[0045] Performance policies define constraints on transmission performance and resource consumption. These policies include parameters for maximum allowable latency, maximum allowable packet loss rate, minimum throughput, and maximum CPU utilization. When actual transmission performance falls below the thresholds defined by the performance policy, the dynamic decision-making module triggers protocol switching to optimize transmission performance.

[0046] The compliance policy defines compliance requirements and restrictions on protocol usage. It includes a whitelist of allowed protocols, a blacklist of prohibited protocols, cross-border data export compliance requirements, and regional restrictions on protocols. The compliance policy has the highest priority among all policies; when it conflicts with security or performance policies, the compliance policy takes precedence.

[0047] The policy storage unit stores policy data in a local file system or database. Policy files are stored in a structured format, with each file containing fields such as policy identifier, policy name, policy type, policy parameters, effective time, and priority. The policy storage unit supports policy version management, generating a new version number after each policy modification, facilitating policy rollback and audit tracing.

[0048] When the system starts up or the policy is updated, the policy parsing unit reads the policy file in the policy storage unit and performs format and logical validation. Validation includes field type checks, required field checks, enumeration value checks, policy conflict detection, parameter range validity checks, and dependency checks. If validation fails, the policy parsing unit will log an error and apply the default policy.

[0049] The policy update unit supports a hot update mechanism for policies. When an administrator modifies a policy via API or GUI, the policy update unit detects a policy file change event and automatically triggers a policy reload process through the file system's file change notification mechanism. The policy update process includes: reading the new policy file, performing verification, writing the new policy data to the shared memory area, and notifying the dynamic decision-making module that the policy has been updated. The entire hot update process is completed within a preset time and does not affect ongoing encapsulation sessions.

[0050] The following is a detailed introduction to the protocol library module: The protocol library module integrates multiple transport layer protocols and application layer protocol stacks in a plug-in manner, supporting hot-swappable expansion. The protocol library module includes a protocol registration unit, a protocol discovery unit, and a protocol management unit.

[0051] The protocol library module integrates the following protocols: transport layer protocols, including TCP, UDP, KCP, and QUIC; application layer protocols, including HTTP / 1.1, HTTP / 2, WebSocket, and gRPC; and cryptographic layer protocols, including TLS and the Noise Protocol framework. Each protocol is implemented as an independent plugin, and the plugins follow a unified interface specification.

[0052] The protocol plugin interface is defined as follows: Each protocol plugin must implement a unified protocol plugin interface, which includes methods for initializing protocol stack resources, returning protocol capability description information, creating protocol session instances, sending data, receiving data, closing sessions, and releasing protocol stack resources.

[0053] The protocol registration unit scans the preset plugin directory during system startup and loads all protocol plugins that conform to the interface specifications. Each protocol plugin exists as a dynamic link library. The protocol registration unit loads the plugin through a dynamic loading mechanism, initializes it by calling the plugin's initialization method, then obtains the protocol capability description and registers the description information in the local registry. The registry uses a key-value pair structure for storage, where the key is the protocol identifier and the value is structured data describing the protocol capabilities.

[0054] The protocol discovery unit provides a protocol query interface, through which the dynamic decision-making module queries a list of protocols that meet specific conditions. Query conditions may include: protocol type, supported functionalities, performance requirements, etc. The protocol discovery unit filters the registry based on the query conditions and returns a list of matching protocols along with their capability descriptions.

[0055] The protocol management unit is responsible for the lifecycle management of protocol plugins, including loading, uninstallation, updating, and version management. The protocol management unit supports a runtime hot-plug mechanism: when a new protocol needs to be added, the administrator places the new protocol plugin file in the plugin directory. The protocol management unit detects the new file through a file monitoring mechanism, automatically loads the plugin, and registers it in the registry. When a protocol needs to be uninstalled, the protocol management unit first checks if there are any active sessions for that protocol. If so, it waits until all sessions are closed before uninstalling the plugin; otherwise, it directly uninstalls the plugin and removes it from the registry. Hot-plugging operations do not interrupt encapsulated sessions that are using other protocols.

[0056] Regarding protocol version management and compatibility, each protocol plugin returns a protocol version number. The protocol management unit maintains a protocol version compatibility matrix. When multiple versions of the same protocol exist simultaneously, the optimal version is selected based on the compatibility matrix. Preferably, the latest stable version is selected by default.

[0057] The dynamic decision-making module is described in detail below: The dynamic decision-making module is the core of the system, connected to both the policy management module and the protocol library module. It receives preset policies and real-time network feedback signals, calculates the optimal encapsulation path, and generates encapsulation instructions. The dynamic decision-making module includes a data acquisition unit, a decision engine, a status evaluation unit, and a feedback processing unit.

[0058] The data acquisition unit is responsible for collecting real-time network feedback signals, which include at least one of round-trip time (RTT), packet loss rate, and blocking feedback signals. RTT measurement employs a combination of active probing and passive statistical methods: active probing sends probe data packets at preset time intervals, records the sending and response times, and calculates the RTT value; passive statistical methods calculate RTT by analyzing the acknowledgment responses of sent data packets. RTT calculation uses a sliding window averaging algorithm to eliminate the impact of instantaneous fluctuations.

[0059] Packet loss rate is calculated based on the ratio of the number of data packets sent to the number of data packets received as acknowledgments. The data acquisition unit maintains a sliding time window, within which it counts the total number of data packets sent and the number of data packets that did not receive acknowledgments, and calculates the packet loss rate accordingly.

[0060] The blocking feedback signal detection includes RST signal detection and handshake timeout detection. RST signal detection is achieved by monitoring the transport layer connection status: when a data packet with the transport layer connection termination flag bit or a connection close frame is received, it is determined that an RST signal has been received. Handshake timeout detection is achieved by monitoring the duration of the protocol handshake phase: when the handshake is not completed within a preset timeout period, it is determined that the handshake has timed out. In addition, the data acquisition unit also supports active network probing behavior detection: by analyzing the characteristic patterns of inbound traffic, it determines whether active probing has occurred.

[0061] The decision engine receives preset policies from the policy management module and real-time network feedback signals from the data acquisition unit, and calculates the optimal encapsulation path based on the current session context. The decision engine employs a multi-dimensional weighted scoring model for protocol combination selection, comprehensively considering scores across security, performance, compliance, and adaptive dimensions. The weight coefficients for each dimension are defined by the security and performance policies.

[0062] The security dimension score is calculated based on the encryption strength, resistance to analysis, and obfuscation level of the protocol combination. Encryption strength is scored based on the key length and algorithm type of the encryption algorithm used by the protocol; resistance to analysis is scored based on the protocol's ability to resist traffic analysis; and obfuscation level is scored based on the perturbation strength of the parameter perturbation engine.

[0063] Performance scores are calculated based on the latency and throughput characteristics of the protocol combination and the current network status. Latency characteristics are based on the theoretical minimum latency score of the protocol; throughput characteristics are based on the theoretical maximum throughput score of the protocol; the current network status is calculated based on real-time collected RTT and packet loss rate data. When the packet loss rate exceeds a preset threshold, the score for connection-oriented protocols is appropriately reduced, while the score for connectionless protocols or protocols with built-in retransmission mechanisms is increased.

[0064] The compliance score is calculated based on the whitelist and blacklist of protocols defined in the compliance strategy. If any protocol in the protocol portfolio is on the blacklist, the compliance score is zero; if all protocols in the protocol portfolio are on the whitelist, the compliance score is full marks.

[0065] Adaptive dimensional scoring is calculated based on the historical performance of protocol combinations and their compatibility with the current network environment. The decision engine maintains a historical performance database, recording the actual transmission quality scores of each protocol combination under different network conditions. When the current network environment is similar to a certain network condition in the historical data, the historical performance data is used as a reference value for the adaptive dimensional scoring.

[0066] After calculating scores for all candidate protocol combinations, the decision engine selects the protocol combination with the highest score as the optimal encapsulation path. The decision result is output in the form of encapsulation instructions, which include: outer transport protocol identifier, inner tunnel protocol identifier, encryption layer protocol identifier, parameter perturbation configuration, data packet configuration, etc.

[0067] The decision engine also includes a decision result caching mechanism and a fast handover mechanism. The decision result caching adopts a least recently used strategy, caching several recently used decision results. When the network state changes but the change does not exceed the handover threshold, the cached decision results are used first to avoid duplicate calculations. The fast handover mechanism pre-defines fast channels for several commonly used protocol handover paths; parameters can be directly filled in when a handover is needed to shorten handover latency.

[0068] The status assessment unit periodically conducts a comprehensive evaluation of the network status, classifying it into multiple levels: excellent, good, average, poor, and severe. Each network status level is determined based on RTT (Round-Trip Time) and packet loss rate conditions, with specific criteria set according to preset thresholds. The status assessment results are used to assist the decision engine in calculating its score.

[0069] The feedback processing unit is responsible for processing transmission quality assessment results and blocking feedback signals, and inputting them into the decision engine. When the feedback processing unit receives an RST signal or detects a handshake timeout, it immediately triggers a policy degradation or protocol switching process. Policy degradation refers to reducing the obfuscation strength to improve connection stability while maintaining the same security level; protocol switching refers to switching to a completely different protocol combination to circumvent network blocking.

[0070] The following is a detailed introduction to the encapsulated execution module: The encapsulation execution module is connected to the dynamic decision-making module and is used to perform multi-level nested encapsulation and parameter randomization processing on the raw data according to the encapsulation instructions, to obtain encapsulated data packets and send them. The encapsulation execution module includes a parameter perturbation engine and a protocol adapter.

[0071] The parameter perturbation engine is used to randomize the parameters of the encapsulated data packets to eliminate fixed fingerprint characteristics. The parameter perturbation engine includes a packet length perturbation sub-engine, a header field perturbation sub-engine, a timing perturbation sub-engine, and a padding perturbation sub-engine.

[0072] The protocol adapter is used to perform multi-layered nested encapsulation and dynamically change the hierarchical structure. The protocol adapter includes an encapsulation orchestration unit, a protocol header construction unit, and a decapsulation unit. The encapsulation orchestration unit, according to the protocol stack hierarchy specified in the encapsulation instruction, sequentially calls the encapsulation methods of each protocol plugin, encapsulating layer by layer from the inside out. The protocol header construction unit is responsible for constructing the protocol header for each layer, including setting fields such as the protocol version number, flags, length field, and sequence number. The decapsulation unit performs the reverse operation at the receiving end, decapsulating layer by layer from the outside in to restore the original data.

[0073] Thirdly, embodiments of the present invention provide an electronic device, including: a memory and a processor, wherein the memory and the processor are connected; Memory, used to store computer programs; A processor is used to invoke a computer program stored in memory to perform any of the above methods.

[0074] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when run by a computer, performs any of the methods described above.

[0075] This invention provides a policy-based multi-protocol dynamic encapsulation method and system. The method is used in a policy-based multi-protocol dynamic encapsulation system, which is configured with multiple preset policies. The method includes: when raw data needs to be encapsulated, reading an encapsulation instruction from an instruction queue; the encapsulation instruction is calculated based on the multiple preset policies and real-time network feedback signals, and carries a target network protocol combination and an optimal encapsulation path for encapsulation processing; parsing the encapsulation instruction to obtain the target network protocol combination and the optimal encapsulation path; segmenting the raw data based on the multiple preset policies to obtain multiple non-fixed-size data blocks; performing parameter perturbation processing on each data block to eliminate fixed fingerprint features; and performing multi-level nested encapsulation on each parameter-perturbed data block based on the target network protocol combination and the optimal encapsulation path in the encapsulation instruction to obtain encapsulated data packets. This method and system can perform parameter perturbation and multi-level encapsulation camouflage at the data block level, effectively increasing anti-identification capabilities and significantly improving data security.

[0076] It should be noted that the content of the method embodiments and system embodiments provided in this patent application corresponds one-to-one with each other. The content involved in any embodiment can be referenced or combined with other embodiments to form part of that embodiment. For ease of description, this patent application focuses on explaining the method embodiments. The description of relevant technical features and solutions of the system, electronic device, and computer-readable storage medium embodiments can be referred to the relevant content in the method embodiments.

[0077] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, systems, electronic devices, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0078] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0079] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0080] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A policy-based multi-protocol dynamic encapsulation method, characterized in that, The method is used in a policy-based multi-protocol dynamic encapsulation system, wherein the system is configured with multiple preset policies, and the method includes: When it is necessary to encapsulate the raw data, an encapsulation instruction is read from the instruction queue. The encapsulation instruction is calculated based on the multiple preset strategies and real-time network feedback signals. The encapsulation instruction carries the target network protocol combination and the optimal encapsulation path for the encapsulation process. The encapsulation instructions are parsed to obtain the target network protocol combination and the optimal encapsulation path. Based on the aforementioned multiple preset strategies, the original data is segmented to obtain multiple data blocks of non-fixed size; Perform parameter perturbation processing on each of the data blocks to eliminate fixed fingerprint features; Based on the target network protocol combination and optimal encapsulation path in the encapsulation instruction, multi-level nested encapsulation is performed on each data block after parameter perturbation processing to obtain encapsulated data packets.

2. The method according to claim 1, characterized in that, The process of segmenting the original data based on the multiple preset strategies to obtain multiple data blocks of non-fixed size includes: The target range of the data block is read from the encapsulation instructions. The target range is dynamically configured according to the multiple preset strategies. The target range is used to limit the size of the data block after it is cut. A random number generator is used to generate data blocks of random size within the target range, wherein the data blocks of random size are uniformly distributed; Gaussian noise is superimposed on the uniformly distributed data blocks of random size to obtain the plurality of non-fixed-size data blocks, wherein the size of the non-fixed-size data blocks is within the target range; The method further includes: Add metadata to each non-fixed-size data block, including: data block sequence number, data block length, total number of data blocks, stream identifier, and checksum.

3. The method according to claim 1, characterized in that, The multiple preset policies include: security policies, performance policies, and compliance policies; The security policy defines security levels and corresponding perturbation intensities for parameter perturbation processing. The security levels include a first security level, a second security level, and a third security level, from highest to lowest. The parameter perturbation processing for the first security level includes: random packet length padding, random session ID generation, random window size adjustment, padding appending, and header key-value pair rearrangement. The parameter perturbation processing for the second security level includes: random packet length padding, random session ID generation, and header key-value pair rearrangement. The parameter perturbation processing for the third security level includes: random packet length padding. The performance strategy is used to define transmission performance and resource consumption constraints. The performance strategy includes a maximum allowable delay parameter, a maximum allowable packet loss rate parameter, a minimum throughput parameter, and a maximum CPU utilization parameter. The compliance strategy is used to define compliance requirements and restrictions on the use of protocols. The compliance strategy includes a whitelist of allowed protocols, a blacklist of prohibited protocols, compliance requirements for data export, and restrictions on protocols in specific regions. Among the multiple preset strategies, the order of priority from high to low is compliance strategy, security strategy, and performance strategy. When there is a conflict among the multiple preset strategies, the preset strategy with higher priority is executed, and the preset strategy with lower priority is ignored.

4. The method according to claim 1, characterized in that, The multiple preset policies are stored in the form of policy files in a local file system or database. Each policy file contains a policy identifier, policy name, policy type, policy parameters, effective time, priority field, and policy version number. The method further includes: When the system starts up or the policy is updated, the policy file is read and the policy file is validated in terms of format and logic. The validation in terms of format and logic includes: field type check, required field check, enumeration value check, policy conflict detection, parameter range validity check, and dependency check. If the validation fails, an error log is recorded and the default policy is adopted. If the validation passes, multiple preset policies in the policy file are adopted. In response to the detection of a policy file change event, a policy update process is automatically triggered through a file change notification mechanism. The policy update process includes: reading the new policy file, performing verification, writing the new policy file to a shared memory area, and notifying the policy update. The policy update process is executed based on a hot update mechanism and is completed within a preset time without affecting the ongoing encapsulation session.

5. The method according to claim 1, characterized in that, The parameter perturbation process includes: random padding of packet length, random generation of Session ID, random adjustment of Window Size, padding addition, and rearrangement of HTTP Header key-value pairs. The random padding of the packet length includes: calculating the padding length based on the distribution model specified by the security policy using the perturbation strength parameter in the parameter perturbation process, wherein the padding length follows a normal distribution or a uniform distribution; in the normal distribution mode, the mean and standard deviation are calculated from the baseline padding length and the perturbation strength parameter; in the uniform distribution mode, the distribution range is determined by the baseline padding length and the perturbation strength parameter; the padding content uses a pseudo-random byte sequence, and the key of the pseudo-random number generator is generated by the session key derivation function; The Session ID is generated randomly, including: when using the TLS protocol, the packet randomly generates the Session ID field in the TLS Client Hello message, the Session ID length is randomly selected within a preset range, the content is a cryptographically secure pseudo-random number, and the operating system's random number generator is used as the entropy source; Window Size is randomly adjusted, including: when using the TCP protocol, the Window Size field in the TCP header is randomly adjusted by multiplying the original Window Size by a random factor, and the adjusted Window Size is limited to a preset range; Padding includes: appending a random length of padding data to the end of the encapsulated data packet. The padding length is determined by the perturbation strength parameter and the current data block size. The padding content is a random byte sequence, and the pseudo-random number generator used is the same as the random padding for the packet length. HTTP header key-value pairs can be rearranged, including when using HTTP / 1.1 or HTTP / 2 protocols. To eliminate traffic fingerprinting features based on header order, the order of key-value pairs in HTTP request header fields is shuffled. This involves parsing the HTTP header, extracting all key-value pairs into a list, randomly rearranging the list using a random shuffling algorithm, and then reserializing the rearranged key-value pairs into HTTP headers.

6. The method according to claim 1, characterized in that, The method further includes: adaptively adjusting the disturbance intensity parameter in the parameter disturbance processing process based on an adaptive adjustment mechanism, wherein the adaptive adjustment mechanism dynamically adjusts the disturbance intensity based on the network state assessment results and the DPI detection risk level; The adaptive adjustment mechanism includes: When the network state assessment reaches the preset level and no DPI probe behavior is detected, the current disturbance intensity remains unchanged; When DPI detection behavior is detected, the level of the disturbance intensity is increased according to a preset step size. The levels of the disturbance intensity, from low to high, include: first disturbance level, second disturbance level, and third disturbance level. The preset step size is less than or equal to the difference between two adjacent disturbance intensity levels. When the network status assessment is lower than the preset level, the level of the disturbance intensity is reduced by a preset step size to reduce the additional overhead caused by the disturbance. When the network state is stable and there is no detection behavior within a preset number of consecutive evaluation periods, the level of the disturbance intensity is reduced to the baseline level according to a preset step size. The relationship between the disturbance intensity and the protocol type is as follows: Different types of protocols have different tolerances for disturbances. The upper limit of the disturbance parameter is adjusted based on the currently used protocol type. For different types of protocols, the maximum delay of timing disturbances is set to different preset values. Among them, the tolerance of each protocol to packet length disturbances and timing disturbances from high to low is as follows: TCP protocol, QUIC protocol, and WebSocket protocol.

7. The method according to claim 1, characterized in that, The method further includes: The timing of data packet transmission is perturbed to eliminate traffic fingerprint characteristics based on packet interval time series; The timing disturbance employs a delay injection algorithm: a random delay is injected based on the normal transmission time of the data packet, and the delay time follows an exponential or uniform distribution. In the exponential distribution mode, the rate parameter is calculated from the confusion intensity parameter and the reference delay parameter. In the uniform distribution mode, the range of the delay time is determined by the reference delay parameter and the confusion intensity parameter. Timing perturbation implementation method: The scheduler is maintained in advance. The scheduler uses a time wheel data structure to manage the data packets to be sent. When each data packet is added to the sending queue, the scheduler calculates its target sending time according to the timing perturbation strategy, which is the current time plus a random delay time. The scheduler sends the data packet when the target sending time is reached. The impact of timing disturbances on transmission efficiency: Timing disturbances introduce additional transmission delays. The higher the real-time requirements of the application scenario, the lower the corresponding timing disturbance intensity.

8. A policy-based multi-protocol dynamic encapsulation system, characterized in that, The system is configured with multiple preset strategies, and the system includes: The reading module is used to read encapsulation instructions from the instruction queue when it is necessary to encapsulate the raw data. The encapsulation instructions are calculated based on the multiple preset strategies and real-time network feedback signals. The encapsulation instructions carry the target network protocol combination and the optimal encapsulation path for encapsulation processing. The parsing module is used to parse the encapsulation instructions to obtain the target network protocol combination and the optimal encapsulation path; The cutting module is used to cut the original data based on the multiple preset strategies to obtain multiple data blocks of non-fixed size; A perturbation module is used to perform parameter perturbation processing on each of the data blocks to eliminate fixed fingerprint features; The encapsulation module is used to perform multi-level nested encapsulation on each data block after parameter perturbation processing, based on the target network protocol combination and optimal encapsulation path in the encapsulation instruction, to obtain encapsulated data packets.

9. An electronic device, characterized in that, include: Memory and processor, and the connection between memory and processor; Memory, used to store computer programs; A processor for invoking a computer program stored in memory to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a computer, performs the method as described in any one of claims 1-7.

Images