Cross-border link encryption adaptation system and method based on post-quantum key agreement

Abstract

The application discloses a cross-border link encryption adaptation system and method based on post-quantum key agreement, and belongs to the field of data security transmission. The system comprises an initiation module, a response module and an encryption module. The initiation module is used for obtaining operation monitoring data, calculating a link quality score, matching parameters for the current cross-border link through quality grading, constructing a public-private key pair of the initiation end, initiating a negotiation request to the response end, and constructing an initiation end session key after receiving the negotiation response returned by the response end. The response module is used for parameter compliance verification and link environment consistency verification of the negotiation request. Only when the double verifications are passed, a public-private key pair and a session key of the response end are constructed, and a negotiation response is returned to the initiation end. The encryption module uses the session key to perform symmetric encryption and decryption processing on cross-border business data, constructs a traceability verification label for the cross-border link, and performs fragmentation specification and encapsulation according to transmission strategy parameters, so that the security protection capability and transmission operation efficiency are synergistically improved.

Description

Technical Field

[0001] This invention relates to a cross-border link encryption adaptation system and method based on post-quantum key negotiation, belonging to the field of data security transmission technology. Background Technology

[0002] As the infrastructure for globalized digital economy and cross-border business collaboration, the security and reliability of cross-border data transmission links are not only a key guarantee for compliant management of cross-border data flows, but also a core foundation for achieving full lifecycle security protection of cross-border data.

[0003] However, existing technologies do not consider the security of encryption systems under the threat of quantum computing and their compatibility with the complex network environment of cross-border heterogeneous links. Specifically, existing cross-border data protection mostly uses traditional number theory encryption algorithms, which cannot resist the decryption risks brought by quantum computing. Moreover, the key negotiation mechanism has high latency, making it difficult to adapt to the actual scenario of large fluctuations and unstable transmission latency in cross-border link networks. This not only restricts the efficiency of cross-border data transmission, but also results in insufficient defense capabilities against quantum attacks, and poses security risks of data leakage and tampering. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the present invention aims to provide a cross-border link encryption adaptation system and method based on post-quantum key negotiation. It constructs a key negotiation system through post-quantum cryptography, dynamically matches encryption levels and transmission strategies with cross-border link quality grading, and resists hijacking attacks through link binding verification. It adapts to the transmission characteristics of heterogeneous links while ensuring quantum-resistant security.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A cross-border link encryption adaptation system based on post-quantum key negotiation includes: an initiation module, a response module, and an encryption module;

[0007] The initiating module actively detects and obtains the current cross-border link operation monitoring data to calculate the link quality score. Based on the quality rating, it matches the quantum encryption parameters and transmission strategy parameters of the current cross-border link, constructs the initiating end public-private key pair, actively initiates a negotiation request to the responding end, and after receiving the negotiation response returned by the responding end, constructs the initiating end session key through key desealing operation, interactive verification, and validity period setting.

[0008] The response module is used to perform parameter compliance verification and link environment consistency verification on the negotiation request. Only when both verifications pass, the response module constructs the public-private key pair and session key, and returns the negotiation response to the initiating end.

[0009] The encryption module uses the session key generated by key negotiation to perform symmetric encryption and decryption processing on cross-border business data, and builds traceability verification tags for cross-border links to bind encrypted data to transmission links. At the same time, it dynamically performs fragmentation and encapsulation according to the transmission strategy parameters.

[0010] Specifically, the initiation module includes a status acquisition unit, a configuration unit, and a negotiation initiation unit;

[0011] The status acquisition unit is used to acquire operation monitoring data, construct a link status vector by normalizing the operation monitoring data, and obtain a link quality score by weighted summation of the link status vector.

[0012] The configuration unit is used to compare the scoring threshold range with the link quality score to obtain a quality level label, and use the quality level label as an index to call the hierarchical mapping table to match the adaptation parameter set for the current cross-border link, and call the initiator's private key and the responder's public key to generate the initiator's session key through key desealing operation, interactive verification, and validity period setting.

[0013] The negotiation initiation unit is used to instantiate the post-quantum key encapsulation mechanism according to the adaptation parameter set, and construct a public-private key pair for the initiator by combining random number sampling and polynomial operation. At the same time, it calls the link state vector and the transmission strategy parameters in the adaptation parameter set, and generates a negotiation request message through hash operation, message construction, and fragmentation encapsulation to send to the response end. Simultaneously, it obtains the negotiation response message returned by the response end and parses the public key of the response end.

[0014] Specifically, the encryption module includes an encryption sending unit and a decryption receiving unit;

[0015] The encrypted sending unit obtains the initiating session key, uses an encryption algorithm to encrypt the cross-border business data to be transmitted, obtains the encrypted data payload, calls the link state vector, performs a hash operation by combining the initiating session key identifier and the transmission message sequence number, generates a traceability verification tag, binds it to the encrypted data payload, generates a business data payload, and segments and encapsulates the business data payload according to the transmission strategy parameters to generate an encrypted transmission data packet for sending to the responding end.

[0016] The decryption receiving unit receives and parses the encrypted transmission data packet, performs decryption processing on the parsed encrypted data payload based on the response end's session key, obtains the original service data, recalculates the traceability verification tag based on the response end's link state vector, compares and verifies it with the parsed traceability verification tag, generates decrypted service data after verification, and discards the corresponding transmission message and triggers an alarm if verification fails.

[0017] Specifically, the steps for constructing the scoring threshold range include:

[0018] Historical operational monitoring data is acquired, a link quality score is calculated for each historical sample, and an ordered sample set is constructed by arranging the samples in ascending order; the quality level labels include excellent, good, medium, and poor.

[0019] The ordered sample set is divided into ordered clusters using Fisher's optimal segmentation method. The optimal segmentation combination is obtained by iteratively solving the problem with the goal of minimizing the sum of squared deviations within groups and maximizing the sum of squared deviations between groups.

[0020] Based on the historical operation monitoring data, the score fluctuation range of each sampling period is statistically analyzed, all score fluctuation ranges are sorted in ascending order, and the 95th percentile is selected as the buffer baseline width.

[0021] On both sides of each segmentation threshold, two judgment boundaries are set according to the buffer reference width to form a narrow buffer zone, and hysteresis judgment rules are set at the same time.

[0022] By integrating the segmentation threshold with the corresponding narrow buffer, a scoring threshold range with hysteresis boundaries is formed, which corresponds to four levels of link quality labels: excellent, good, medium, and poor.

[0023] The specific steps for generating the initiating session key include:

[0024] Based on the initiator's private key and the responder's public key, a standard key decryption operation is performed to generate an initial session key;

[0025] The link state vector is hashed to generate a link digest. The initial session key, the link digest, and the session sequence number negotiated in this session are concatenated in sequence and hashed to generate a short checksum for this end.

[0026] The local short check code is sent to the responding end through the negotiation channel, and the short check code of the peer end is received from the responding end. The local short check code and the peer short check code are compared bit by bit.

[0027] If the short checksum of the local end is exactly the same as the short checksum of the remote end, the key is determined to be the same, and the initial session key is used as the official session key.

[0028] Set a minimum validity period and a maximum validity period, and then perform a linear mapping based on the link quality score to obtain the validity period;

[0029] Add an expiration date identifier and a key identifier to the formal session key and encapsulate it as the initiator session key.

[0030] The specific steps for generating a negotiation request message include:

[0031] A random session sequence number is generated, and the link state vector, the session sequence number, and the quality level in the adaptation parameter set are concatenated to generate a fingerprint input string;

[0032] Perform a hash operation on the fingerprint input string to generate a link fingerprint;

[0033] Based on the quality level field, session sequence number field, initiator public key field, and link fingerprint field, a negotiation request body is constructed, and a length flag containing the field length is set before each field;

[0034] Calculate the total byte length of the negotiation request body and compare it with the fragmentation threshold corresponding to the current quality level; if the total byte length does not exceed the fragmentation threshold, use the negotiation request body as a single fragment;

[0035] If the total byte length exceeds the fragmentation threshold, it will be continuously split from the beginning according to the byte order to generate multiple consecutive fragments;

[0036] The fragment header is set to the corresponding fragment, which is then encapsulated as a negotiation request fragment.

[0037] All negotiation requests are fragmented and arranged sequentially according to their fragment numbers to generate negotiation request messages.

[0038] The specific steps for parameter compliance verification and link environment consistency verification include:

[0039] Based on the session sequence number of the fragment, the fragments are aggregated, and the effective range of the fragments is set according to the total number of fragments. Fragments whose current sequence number exceeds the effective range are judged as abnormal fragments and discarded directly.

[0040] After all fragments of the same session have been received, remove the header fields of all fragments, and concatenate them in ascending order of fragment sequence number to restore the negotiation request body;

[0041] Based on the parsed quality level and matching threshold, combined with the total number of fragments, the main byte range is constructed. ;

[0042] Obtain the recombined byte length of the subject requesting the recombination negotiation. Simultaneously, based on the length flag in the negotiation request body, the theoretical byte length is obtained. .

[0043] Specifically, the steps for parameter compliance verification and link environment consistency verification also include:

[0044] like and If the fragment reassembly is successful, the fragment reassembly is deemed effective; otherwise, the main body reassembly is deemed to have failed, the session cache is cleared, and a full packet retransmission request is triggered.

[0045] Remove the last fragment, take the average length of the remaining fragment bytes to generate the actual fragment granularity, and calculate the negotiation deviation by combining it with the fragment threshold;

[0046] Set a deviation allowable threshold. If the negotiated deviation is not greater than the deviation allowable threshold, the encryption level verification is considered successful; otherwise, the session cache is cleared and the current request processing is terminated.

[0047] Retrieve the historical replay records of the stored session sequence number and compare them with the parsed session sequence number;

[0048] If there is overlap, it is determined to be a replay request, and the current request is discarded;

[0049] If they do not overlap, the public key of the initiating party is checked for public key format and domain compliance. Only if the public key format and domain compliance check passes, the parameters are deemed compliant.

[0050] Specifically, the steps for parameter compliance verification and link environment consistency verification also include:

[0051] Based on the response end, the monitoring and operation data of the response end is obtained, the response link vector is constructed, and the parsed session sequence number and quality level are concatenated in sequence. Through hash operation, the response link fingerprint is generated.

[0052] The response link fingerprint is compared bit by bit with the link fingerprint parsed at the response end. The basic link consistency check is deemed to have passed only when the response link vectors are completely identical.

[0053] The response quality level is determined by comparing the scoring threshold range with the link quality score at the response end, and then compared with the parsed quality level.

[0054] The quality level linkage verification is considered passed only if the response quality level matches the parsing quality level.

[0055] If both checks pass, the link environment consistency check is considered successful.

[0056] If any check fails, the negotiation request will be discarded and no response message will be generated.

[0057] Cross-border link encryption adaptation methods based on post-quantum key negotiation include:

[0058] Obtain operational monitoring data, and obtain a link quality score through normalization and weighted summation;

[0059] By comparing the scoring threshold range with the link quality score, quality level labels are configured and matched with the appropriate parameter set.

[0060] After instantiating the quantum key encapsulation mechanism with the aforementioned adaptation parameter set and generating a public-private key pair locally, a negotiation request message is generated and sent to the responding end through hash operation, message construction, and fragment encapsulation.

[0061] Perform parameter compliance verification and link environment consistency verification on the negotiation request message, and construct a public-private key pair for the responding end and return the negotiation response message;

[0062] Both communicating parties use their local private key and the peer's public key respectively, and generate a session key with an expiration date through post-quantum key desealing operation, negotiation channel interaction verification, and expiration date setting;

[0063] Symmetric encryption is performed on the cross-border business data to be transmitted based on the session key, and a traceability verification tag is constructed. Encrypted transmission data packets are generated according to the adaptation parameter set.

[0064] The beneficial effects of this invention are:

[0065] A full-process key negotiation system is constructed based on standardized post-quantum cryptography algorithms, building a robust security defense against quantum attacks from the cryptographic level. Simultaneously, a mapping mechanism between link quality grading and encryption levels ensures a positive correlation between security strength and the actual carrying capacity of the link. This avoids the problems of high negotiation failure rates and excessive transmission latency caused by fixed high security parameters in weak link scenarios, balancing the security baseline and operational feasibility under different quality levels. For real-world scenarios with large fluctuations and unstable latency in cross-border links, dynamic quality assessment is performed based on actively probed link operation data, simultaneously adapting encryption parameter levels and transmission fragmentation and encapsulation strategies. In high-quality link scenarios, high security levels and whole-packet transmission modes are used to ensure security strength and transmission efficiency, while in low-quality link scenarios, lightweight encryption is used... The system enhances negotiation success rate and transmission stability by employing multiple encryption levels and fine-grained fragmentation modes. Simultaneously, it dynamically adjusts key validity by incorporating link jitter characteristics, balancing key security risks with renegotiation overhead and adapting to the time-varying characteristics of cross-border links. Addressing the vulnerability of open cross-border links to man-in-the-middle attacks and replay attacks, the system binds link state characteristics to the negotiation verification and business transmission stages throughout the entire process. Link fingerprints and traceability verification tags are used to verify the authenticity of the negotiation process and business data. This layer of security verification, built upon cryptographic security, fills the gap in defense against link-layer attacks in cross-border transmission scenarios. While ensuring quantum-resistant data transmission security, the system effectively improves transmission stability and negotiation efficiency in complex network environments, constructing a secure, reliable, and highly adaptable cross-border data encryption transmission system. Attached Figure Description

[0066] Figure 1 A diagram of the cross-border link encryption adaptation system based on post-quantum key negotiation;

[0067] Figure 2 This is a flowchart illustrating the construction of the scoring threshold range in this invention;

[0068] Figure 3 This is a flowchart of parameter compliance verification and link environment consistency verification in this invention;

[0069] Figure 4 This is a flowchart of a cross-border link encryption adaptation method based on post-quantum key negotiation. Detailed Implementation

[0070] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0071] Example 1

[0072] refer to Figures 1 to 3 As shown, this embodiment introduces a cross-border link encryption adaptation system based on post-quantum key negotiation, including: an initiation module, a response module, and an encryption module;

[0073] The initiating module actively probes and acquires the current cross-border link operation monitoring data. Combining normalization processing and weighted calculation, it calculates the link quality score and performs quality classification. Based on the quality level, it adaptively matches the quantum encryption parameters and transmission strategy parameters to construct an adaptation parameter set. Relying on the quantum key encapsulation mechanism after instantiating the adaptation parameter set, it generates a local public-private key pair and actively initiates a key negotiation request carrying the link fingerprint to the responding end. After receiving the negotiation response, it independently performs key decapsulation operation based on the local private key and the responding end's public key. After interactive verification confirms the consistency, it generates a formal session key and dynamically adjusts the key validity period according to the link quality to achieve dynamic adaptation of encryption security strength and link transmission capability.

[0074] The initiation module includes a status acquisition unit, a configuration unit, and a negotiation initiation unit;

[0075] The status acquisition unit sends probe messages to the responding end through network probing protocols such as ICMP and TWAMP. Based on the probe responses, it obtains the current cross-border link operation monitoring data, performs min-max normalization on the operation monitoring data, and thus aligns all indicators in a positive direction. It constructs a link state vector, calculates the objective weights of each dimension of the link state vector based on the entropy weight method, and performs a weighted summation of the indicator elements in the link state vector to obtain the link quality score of the current cross-border link. The operation monitoring data includes end-to-end latency, packet loss rate, link jitter, available bandwidth, and bit error rate.

[0076] The configuration unit is used to call a pre-stored scoring threshold range and compare it with the current cross-border link's link quality score to classify the current cross-border link's quality, obtain a quality level label, and use the quality level label as an index to call a pre-stored classification mapping table to match the corresponding set of adaptation parameters for the current cross-border link, including post-quantum encryption parameters and transmission strategy parameters. It also calls the initiator's private key and the responder's public key to perform post-quantum key desealing operations, generate an initial session key, generate a short checksum based on the initial session key, and verify it through the negotiation channel. After confirming that the keys are completely consistent, a formal session key is generated. The validity period of the session key is dynamically set according to the link quality score, and finally, an initiator session key with a validity period identifier is generated and sent to the encryption module.

[0077] The negotiation initiation unit receives the adaptation parameter set, instantiates the post-quantum key encapsulation mechanism based on the post-quantum key negotiation parameters in the adaptation parameter set, constructs an algorithm running instance bound to the current security parameters, performs random number sampling and polynomial operations based on the algorithm running instance, constructs a public-private key pair for the initiator, and simultaneously calls the link state vector and the transmission strategy parameters in the adaptation parameter set. Through hash operation, message construction, and fragmentation encapsulation, it generates a negotiation request message, sends it along the current cross-border link to the responder to initiate the post-quantum key negotiation request, and simultaneously obtains the negotiation response message returned by the responder, parses it to obtain the responder's public key, and outputs it to the configuration unit.

[0078] The response module receives negotiation request messages initiated by the initiator via a cross-border link. It parses the message to perform parameter compliance and link environment consistency checks to confirm the request's legitimacy and that the link environment has not been tampered with. If either check fails, the negotiation is terminated and a failure flag is returned. If both checks pass, the module instantiates a quantum key encapsulation mechanism based on the adapted parameter set and generates a public-private key pair for the responder. Simultaneously, it constructs a negotiation response message carrying the responder's public key and confirmation flag, returning it to the initiator along the same cross-border link. The module also calls the responder's private key and the initiator's public key, performing post-quantum key decapsulation operations, negotiation channel interaction verification, and validity period setting to generate a response session with an expiration flag. The key is sent to the encryption module for data decryption and verification. Since ML-KEM key negotiation is a symmetric key negotiation mechanism, after the negotiation is completed, the initiating end and the responding end will independently calculate a shared session key with completely identical values. The initiating end encapsulates the shared key material using the responding end's public key, and the responding end decapsulates and restores the same shared key material using its local private key. Based on the completely identical shared key material, the same key derivation function, and the same input parameters, both ends independently derive the final session key. The initiating end's session key and the responding end's session key stored locally are simply local copies of the same symmetric key at both ends, with completely equivalent values ​​and no difference.

[0079] The encryption module is used to perform symmetric encryption and decryption on cross-border business data using the session key generated by key negotiation. On the data sending side, it completes the encryption operation of business data, generation of link traceability tags, fragmentation and encapsulation of transmission messages, and targeted transmission. On the data receiving side, it completes the reception and parsing of encrypted transmission messages, verification of the legitimacy of traceability tags, data decryption operation, and plaintext output. By binding the link state vector with the session key identifier and the sequence number of the transmission message of business data and performing hash operation, it generates the traceability verification tag of the current cross-border link and attaches it to the header of the transmission message, realizing a strong association between encrypted data and transmission link, supporting full-link data source verification and tamper protection. At the same time, it dynamically adjusts the fragmentation specification and encapsulation strategy of transmission messages according to the transmission strategy parameters in the adaptation parameter set. For low-quality links, it enables compression encoding and fragmentation optimization, and for high-quality links, it adopts standard encapsulation to reduce computational overhead, adapting to cross-border links of different quality levels, and optimizing the overall transmission efficiency while ensuring post-quantum level security strength.

[0080] The encryption module includes an encryption sending unit and a decryption receiving unit;

[0081] The encryption sending unit is used to obtain the initiating end session key, encrypt the cross-border business data to be transmitted using the AES-256-GCM symmetric encryption algorithm to obtain the encrypted data payload, call the link state vector, combine the initiating end session key identifier and the transmission message sequence number to perform SHA-256 hash operation, generate a traceability verification tag bound to the current cross-border link, append it to the end of the encrypted data payload to generate the business data payload, fragment the business data payload according to the transmission strategy parameters, encapsulate it to generate an encrypted transmission data packet adapted to the current cross-border link, and send it to the other end, i.e. the responding end, along the corresponding cross-border link;

[0082] The decryption receiving unit receives encrypted transmission data packets sent by the initiating end, parses them to obtain the encrypted data payload, traceability verification tag, and key identifier, performs decryption processing on the encrypted data payload based on the local response end session key to obtain the original business data, recalculates the traceability verification tag according to the transmission message sequence number and the local link state vector, compares and verifies it with the tag carried in the transmission message to confirm the authenticity of the data source and transmission link, outputs the decrypted business data after successful verification, and discards the corresponding transmission message and triggers an alarm if the verification fails.

[0083] Furthermore, the steps for constructing the scoring threshold range include:

[0084] Obtain historical operational monitoring data and the number of categories of quality level labels for cross-border links, and calculate a link quality score for each historical sample; among which, the quality level labels include excellent, good, medium and poor;

[0085] All historical samples are sorted in ascending order according to their corresponding link quality scores to form an ordered sample set;

[0086] Fisher's optimal segmentation method is used to perform ordered clustering of ordered sample sets, with the optimization objectives being to minimize the sum of squared deviations within groups and maximize the sum of squared deviations between groups. To divide the ordered sample set into 4 intervals, 3 segmentation threshold points are used as the segmentation combination, and the optimal segmentation combination is obtained by iterative solution. Specifically, for any segmentation combination, the ordered sample set is divided into 4 intervals with 3 segmentation threshold points, and the sum of squared deviations within each interval is calculated. By summing the sums of squared deviations of the 4 intervals, the sum of squared deviations within groups is obtained. Using the arithmetic mean of the link quality score, the mean score of each interval is calculated and compared with the mean score of the ordered sample set. The squared deviation of the corresponding interval is obtained by multiplying the square of the difference between the mean interval score and the mean sample score by the number of samples in the corresponding interval. The sum of the squared deviations of the 4 intervals is then calculated to obtain the sum of squared deviations between groups.

[0087] Because the metrics are positively aligned, all dimensions in the link state vector are considered to be of higher quality, resulting in a higher link quality score and better overall link quality. The optimal segmentation combination found contains three optimal segmentation threshold points, namely the first segmentation threshold... Second segmentation threshold Third segmentation threshold ,and , Used to classify quality grades as excellent and good. Used to classify quality grades as good or medium. This is used to classify the quality levels as medium and poor. When the link quality score crosses the segmentation threshold, the corresponding quality level will switch, triggering a complete post-quantum key renegotiation process.

[0088] Based on historical operation monitoring data, the corresponding link quality score is calculated for each sampling period. The link quality score of the previous sampling period and the current sampling period are taken, and the difference between the link quality scores is used as the score fluctuation range of the current sampling period. Thus, the score fluctuation range of each sampling period is statistically analyzed, and all score fluctuation ranges are sorted in ascending order. The 95th percentile is selected as the buffer baseline width.

[0089] If a single threshold is used, small fluctuations in the score around the threshold can lead to frequent switching of the adaptation level, triggering a large number of meaningless renegotiations, increasing link overhead and the risk of negotiation failure. Therefore, two judgment boundaries are set on both sides of each segmentation threshold based on the buffer baseline width to form a narrow buffer zone. At the same time, hysteresis judgment rules are set, including: when the link quality score continues to rise and crosses the upper judgment boundary, it is judged as an improvement in quality level and a switch is performed; when the link quality score continues to fall and crosses the lower judgment boundary, it is judged as a decline in quality level and a switch is performed; when the link quality score is within the narrow buffer zone, the current quality level remains unchanged.

[0090] By integrating the segmentation threshold with the corresponding narrow buffer, four scoring threshold intervals with hysteresis boundaries are formed, corresponding to four levels of link quality labels: excellent, good, medium, and poor.

[0091] Furthermore, the steps for constructing the hierarchical mapping table include:

[0092] The three sets of post-quantum encryption parameters for ML-KEM specified in the FIPS 203 standard published by NIST are called: ML-KEM-512, ML-KEM-768 and ML-KEM-1024. Each set of post-quantum encryption parameters corresponds to a security level, public key length, ciphertext length, polynomial order, modulus and noise distribution. At the same time, the corresponding quality level is configured for the corresponding post-quantum encryption parameter set based on the security level.

[0093] Following the core principle of positive adaptation between link carrying capacity and security strength, a mapping relationship is established. The high-quality level is matched with the highest security level ML-KEM-1024, which achieves the highest level of post-quantum security protection based on high carrying capacity. The good quality level is matched with the balanced level ML-KEM-768, which takes into account security strength and transmission overhead. The medium and poor quality levels are matched with the lightweight level ML-KEM-512, which prioritizes negotiation success rate and transmission stability, and reduces the impact of message size and computational overhead on weak links, thereby establishing a one-to-one correspondence between quality level labels and post-quantum encryption parameters.

[0094] Based on the scoring threshold range, the historical operation monitoring data is classified into quality levels. For each quality level of historical samples, the range of values ​​for end-to-end latency, packet loss rate, link jitter, available bandwidth, and bit error rate are statistically analyzed to form the link characteristic range of each quality level.

[0095] Based on the upper limit of packet loss rate for each quality level, and combined with the total length of negotiation messages for the corresponding ML-KEM level, fragmentation thresholds are set for each quality level according to the rule that the higher the packet loss rate, the smaller the fragmentation threshold. For example, the best quality level has the lowest packet loss rate, and the fragmentation threshold is set to the standard Ethernet MTU value to reduce the number of fragments and reduce encapsulation overhead. The good quality level has a relatively low packet loss rate, and the fragmentation threshold is set to two-thirds of the fragmentation threshold for the best quality level to moderately balance the impact of packet loss and encapsulation overhead. The medium quality level has a moderate packet loss rate, and the fragmentation threshold is set to half of the fragmentation threshold for the best quality level to further reduce the impact of a single packet loss. The poor quality level has the highest packet loss rate, and the fragmentation threshold is set to one-quarter of the fragmentation threshold for the best quality level to minimize the impact of a single fragment loss on the overall negotiation.

[0096] Since the link bandwidth is limited for medium and poor quality levels, ML-KEM standard compression coding is enabled to reduce the packet transmission volume. Meanwhile, the link bandwidth is sufficient for excellent and good quality levels, so compression coding is disabled to reduce the computational overhead on the encryption and decryption side. Thus, a corresponding compression coding on / off state is set for each quality level.

[0097] Based on the packet loss rate range of each quality level, different granularity fragmentation confirmation mechanisms are configured according to the packet loss rate from low to high. For example, the packet loss rate of the excellent and good quality levels is in the low range, so the whole packet confirmation mechanism is adopted to reduce the number of interaction rounds and reduce latency loss. The packet loss rate of the medium quality level is in the medium range, so the fragment group confirmation mechanism is adopted, and a fixed number of fragments are confirmed as a group to balance the confirmation overhead and retransmission efficiency. The packet loss rate of the poor quality level is in the high range, so the fragment-by-fragment confirmation mechanism is adopted to avoid the loss of a single fragment leading to the retransmission of the whole packet and improve the negotiation success rate in high packet loss scenarios.

[0098] Based on the fragmentation threshold, compression encoding switch, and fragmentation confirmation mechanism for each quality level, transmission strategy parameters are constructed for the corresponding quality level. Combining the correspondence between quality level labels and post-quantum encryption parameters, the corresponding post-quantum encryption parameters and transmission strategy parameters are strongly bound and stored using the link quality label as the index key, forming a one-to-one hierarchical mapping table. During online operation, only the link quality label needs to be input to simultaneously obtain two types of complete adaptation parameters.

[0099] Furthermore, generating the initiating session key with an expiration date includes:

[0100] Based on the adapted parameter set, a lattice-based cryptographic operation environment is constructed, and polynomial multiplication, modular reduction, and noise sampling are initialized to form a polynomial ring operation domain. At the same time, three types of ML-KEM standard primitives are bound, including key generation primitives, encapsulation primitives, and decapsulation primitives. Meanwhile, the corresponding key derivation functions are configured, the output format and length are unified, and an algorithm running instance is generated.

[0101] The algorithm runs an instance, using the initiator's private key as the private key input and the responder's public key as the other party's public key input. It performs a standard key decryption operation, eliminating noise terms through lattice basis polynomial operations during the operation to recover the shared key material. After the operation is completed, it outputs an initial shared key material of fixed length as the initial session key.

[0102] Hash the link state vector to generate a link digest. Concatenate the initial session key, link digest, and session sequence number negotiated in sequence as the verification input string. Perform SHA-256 hash operation on the verification input string and truncate it to a fixed length to generate a short local verification code.

[0103] The local short check code is sent to the responding end through the negotiation channel, and the short check code of the peer end is received from the responding end. The local short check code and the peer short check code are compared bit by bit.

[0104] If the short checksum of the local end is exactly the same as the short checksum of the remote end, the key is determined to be the same, and the initial session key is used as the official session key.

[0105] Using the shortest boundary of the key lifecycle as the minimum validity period and the longest boundary of the key lifecycle as the maximum validity period, the percentage of the link quality score and the difference between the maximum and minimum validity periods are calculated through linear mapping. The validity period is obtained by adding the minimum validity period to the product of the percentage and the difference.

[0106] Attach an expiration date identifier and a key identifier to the formal session key, encapsulate it into a structured initiator session key, store it in the local key management cache and set an automatic expiration cleanup mechanism, and simultaneously output it to the encryption module for encrypted access by business data.

[0107] Furthermore, the steps for generating a negotiation request message include:

[0108] The session sequence number is randomly generated by the negotiation initiating unit at the start of this negotiation, using a combination of the initiating node identifier, the negotiation start timestamp, and a cryptographically secure random number.

[0109] The link state vector, session number, and quality level in the adaptation parameter set are concatenated to generate a fingerprint input string. The fingerprint input string is then hashed to generate a link fingerprint, which is used to identify the link environment characteristics corresponding to this negotiation.

[0110] Based on the quality level field, session sequence number field, initiator public key field, and link fingerprint field, the negotiation request body is constructed in sequence. Each field is pre-set with a length flag including the field length, which makes it easy for the responding end to parse by field and avoids parsing errors due to the variable field length.

[0111] Calculate the total byte length of the negotiation request body and compare it with the fragmentation threshold corresponding to the current quality level. If the total byte length does not exceed the fragmentation threshold, no fragmentation is performed, and the entire body is treated as a single fragment. If the total byte length exceeds the fragmentation threshold, the body is continuously fragmented from the header in byte order to generate multiple consecutive fragments.

[0112] Based on the order of the splits, configure a fragment sequence number for each fragment, and add it to the corresponding fragment with the session sequence number, total number of fragments, current fragment sequence number, and quality level as the fragment header, and encapsulate it as an independent negotiation request fragment;

[0113] All negotiation requests are fragmented and arranged sequentially according to their fragment numbers, generating negotiation request messages, and then sent to the cross-border link in order.

[0114] Furthermore, the steps for parameter compliance verification and link environment consistency verification include:

[0115] Extract the session sequence number from the header of each shard, and group shards with the same session sequence number into the same session cache queue to achieve shard isolation for multiple concurrent negotiation sessions;

[0116] Take the total number of fragments from the first fragment header in the same session, and use 1 to the total number of fragments as the valid range for fragments. For the current fragment number in each fragment, compare the current fragment number with the valid range for fragments. Fragments that exceed the valid range for fragments are judged as abnormal fragments and are discarded directly.

[0117] After all fragments of the same session have been received, remove the header fields of all fragments and concatenate them in ascending order of fragment sequence number to restore the complete negotiation request body.

[0118] Based on the parsed quality level, the corresponding fragmentation threshold is matched from the hierarchical mapping table, and combined with the total number of parsed fragments, the main byte range is constructed. The lower limit of the range is the difference between the total number of fragments and 1, multiplied by the fragmentation threshold. The product of the total number of fragments and the fragmentation threshold is used as the upper limit of the range. ;

[0119] Obtain the recombined byte length of the subject requesting the recombination negotiation. Simultaneously, based on the length flag in the negotiation request body, the theoretical byte length is obtained. ,like and If so, the fragmentation and reorganization are deemed valid; if or or If the main body reassembly fails, the session cache is cleared and a full packet retransmission request is triggered.

[0120] Since the fragmentation encapsulation rules allow the payload length of the last fragment to be less than the standard fragmentation threshold, the last fragment is discarded, and the fragmentation byte length of the remaining fragments is extracted. The average of the multiple fragmentation byte lengths is calculated as the actual fragmentation granularity of this request. The negotiation deviation is obtained by dividing the absolute value of the difference between the actual fragmentation granularity and the fragmentation threshold by the fragmentation threshold.

[0121] To accommodate byte alignment differences across devices, a minimum byte alignment range required by the protocol encapsulation is used to set a deviation allowable threshold. If the negotiated deviation is not greater than the deviation allowable threshold, it indicates that the fragment granularity is consistent with the standard configuration of the encryption profile and no profile tampering has occurred, thus the encryption level verification for this negotiation is deemed successful. If the negotiated deviation is greater than the deviation allowable threshold, it indicates that the fragment granularity does not match the encryption profile, and there is a risk of profile tampering or message forgery, thus the encryption level verification is deemed unsuccessful, the session cache is cleared, and the processing of this request is terminated.

[0122] Based on the construction order of the negotiation request subject, the quality level, session number, initiator public key, and link fingerprint are extracted sequentially from the restored negotiation request subject. At the same time, the historical replay record is retrieved, which stores the session number of the completed negotiation. The parsed session number is compared with the historical replay record. If there is an overlap, it is determined to be a replay request, the parameter verification fails, and the request is discarded.

[0123] If they do not overlap, the initiator's public key is then verified. The byte length of the initiator's public key is checked to see if it matches the standard public key length for the corresponding quality level. At the same time, the public key byte stream is deserialized into a polynomial coefficient vector, and the numerical range of the coefficients is checked one by one to see if it conforms to the modulus constraint corresponding to the current quality level. Only when the lengths are consistent and all coefficients fall within the valid modulus range is the public key format and domain compliance verification deemed to have passed, and the parameters are ultimately deemed compliant.

[0124] Based on the response end, acquire the monitoring and operation data of the response end, and construct the response link vector;

[0125] The response link vector, the parsed session number, and the quality level are concatenated sequentially to generate the response fingerprint input string. The response fingerprint input string is then hashed to generate the response link fingerprint.

[0126] The response link fingerprint is compared bit by bit with the link fingerprint parsed at the response end. If the response link vector is completely consistent, the basic link consistency check is deemed to have passed; if there is any bit difference, the check is deemed to have failed.

[0127] The response quality level is determined by comparing the score threshold range with the link quality score at the response end. The response quality level is then compared with the parsing quality level. If the response quality level and the parsing quality level are consistent, the quality level linkage verification is considered to have passed. If they are inconsistent, the verification is considered to have failed.

[0128] If both checks pass, the link environment consistency check is considered successful. If either check fails, the link environment check is considered unsuccessful, the negotiation request is discarded, and no response message is generated.

[0129] Furthermore, the steps for generating traceability verification labels for the current cross-border supply chain include:

[0130] For cross-border business data to be transmitted, a transmission sequence number is randomly generated, and an AES-256-GCM authentication encryption algorithm instance is initialized. The session key generated through negotiation is used as the encryption master key, and the value derived from the transmission sequence number is used as the initialization vector. The transmission sequence number is converted into the standard length required by the AES-256-GCM authentication encryption algorithm to ensure that the initialization vector of each message in the same session is not repeated, thereby avoiding the risk of ciphertext replay under the same key and completing the encryption context configuration.

[0131] Using the original cross-border business data to be transmitted as the encryption object, synchronous authentication encryption operation is performed based on the configured encryption context. During the operation, ciphertext data and GCM authentication tags are generated synchronously, and the ciphertext data and GCM authentication tags are concatenated to generate encrypted data payload.

[0132] The link state vector, session key identifier, and transmission sequence number are concatenated sequentially to form the traceability input string. The traceability input string is then subjected to SHA-256 hash operation to generate a traceability verification tag. This traceability verification tag is then appended to the end of the encrypted data payload to generate the business data payload.

[0133] Example 2

[0134] Please see Figure 4 Another embodiment of the present invention provides a cross-border link encryption adaptation method based on post-quantum key negotiation, comprising:

[0135] Step S1: Obtain real-time operational monitoring data of cross-border links through network probing protocols, construct a link state vector through min-max normalization, and obtain a link quality score by weighted summation of the indicator elements in the link state vector.

[0136] Step S2: By comparing the scoring threshold range with the link quality score, configure quality level labels for cross-border links, and use the quality level labels as indexes to match the corresponding set of adaptation parameters for cross-border links from the hierarchical mapping table;

[0137] Step S3: After instantiating the quantum key encapsulation mechanism with the adapted parameter set, generate a local public and private key pair. Through hash operation, message construction, and fragmentation encapsulation, generate a negotiation request message and send it to the response end. The response end parses the negotiation request message, verifies the compliance of the parameters and the consistency of the link environment, constructs a public and private key pair for the response end, and returns a negotiation response message.

[0138] Step S4: Both communicating parties call their local private key and the peer's public key respectively, and generate a session key with an expiration date through post-quantum key desealing operation, negotiation channel interaction verification, and expiration date setting;

[0139] Step S5: Perform symmetric encryption on the cross-border business data to be transmitted based on the session key, generate a traceability verification tag for link binding by combining the link state vector and the session key identifier, adjust the packet fragment size according to the adaptation parameter set and encapsulate it to obtain an encrypted transmission data packet adapted to the current cross-border link, and complete the post-quantum encryption adaptation of the cross-border link.

[0140] Working principle and effects:

[0141] By proactively probing and acquiring cross-border link operation monitoring data, calculating link quality scores and completing quality classification, and synchronously matching post-quantum encryption parameter levels and transmission fragmentation strategies based on the classification results, a positive adaptation relationship is formed between security strength and link carrying capacity. The initiating and responding ends complete public-private key interaction and key encapsulation negotiation based on the matched ML-KE levels. During the negotiation process, link status characteristics are bound to complete parameter compliance and link environment dual verification, which can effectively resist downgrade attacks and link hijacking risks. At the same time, the key validity period is dynamically adjusted in combination with link jitter characteristics to balance key security risks and transmission overhead caused by frequent renegotiation. The shared session key generated by negotiation is used for authentication and encryption processing of business data, and a traceability verification tag bound to the link is generated simultaneously. With the help of dynamic fragmentation strategies, it adapts to the transmission characteristics of links of different quality levels, reduces the transmission failure rate in high packet loss scenarios, and achieves collaborative adaptation between post-quantum security protection and cross-border heterogeneous link environments. While resisting the risk of quantum computing decryption, it improves the transmission stability and operating efficiency in complex network environments.

[0142] The above description is merely a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A cross-border link encryption adaptation system based on post-quantum key negotiation, characterized in that, include: Initiation module, response module, and encryption module; The initiating module actively detects and obtains the current cross-border link operation monitoring data to calculate the link quality score. Based on the quality rating, it matches the quantum encryption parameters and transmission strategy parameters of the current cross-border link, constructs the initiating end public-private key pair, actively initiates a negotiation request to the responding end, and after receiving the negotiation response returned by the responding end, constructs the initiating end session key through key desealing operation, interactive verification, and validity period setting. The response module is used to perform parameter compliance verification and link environment consistency verification on the negotiation request. Only when both verifications pass, the response module constructs the public-private key pair and session key, and returns the negotiation response to the initiating end. The encryption module uses the session key generated by key negotiation to perform symmetric encryption and decryption processing on cross-border business data, and builds traceability verification tags for cross-border links to bind encrypted data to transmission links. At the same time, it dynamically performs fragmentation and encapsulation according to the transmission strategy parameters.

2. The cross-border link encryption adaptation system based on post-quantum key negotiation according to claim 1, characterized in that: The initiation module includes a status acquisition unit, a configuration unit, and a negotiation initiation unit; The status acquisition unit is used to normalize the operation monitoring data, construct a link status vector, and obtain a link quality score by weighted summation of the link status vector. The configuration unit is used to determine the quality level label based on the link quality score, and in conjunction with the hierarchical mapping table, match the appropriate parameter set for the current cross-border link, and call the initiator's private key and the responder's public key to generate the initiator's session key through key desealing operation, interactive verification, and validity period setting. The negotiation initiation unit is used to construct a public-private key pair for the initiating end based on the adaptation parameter set, and simultaneously call the link state vector and the transmission strategy parameters in the adaptation parameter set to generate a negotiation request message through hash operation, message construction, and fragmentation encapsulation, which is then sent to the responding end. At the same time, it obtains the negotiation response message returned by the responding end and parses the public key of the responding end.

3. The cross-border link encryption adaptation system based on post-quantum key negotiation according to claim 2, characterized in that: The encryption module includes an encryption sending unit and a decryption receiving unit; The encrypted sending unit obtains the initiating session key, uses an encryption algorithm to encrypt the cross-border business data to be transmitted, obtains the encrypted data payload, calls the link state vector, performs a hash operation by combining the initiating session key identifier and the transmission message sequence number, generates a traceability verification tag, binds it to the encrypted data payload, generates a business data payload, and segments and encapsulates the business data payload according to the transmission strategy parameters to generate an encrypted transmission data packet for sending to the responding end. The decryption receiving unit receives and parses the encrypted transmission data packet, performs decryption processing on the parsed encrypted data payload based on the response end's session key, obtains the original service data, recalculates the traceability verification tag based on the response end's link state vector, compares and verifies it with the parsed traceability verification tag, generates decrypted service data after verification, and discards the corresponding transmission message and triggers an alarm if verification fails.

4. The cross-border link encryption adaptation system based on post-quantum key negotiation according to claim 2, characterized in that, The steps for constructing the scoring threshold range include: Historical operational monitoring data is acquired, a link quality score is calculated for each historical sample, and an ordered sample set is constructed by arranging the samples in ascending order; the quality level labels include excellent, good, medium, and poor. The ordered sample set is divided into ordered clusters using Fisher's optimal segmentation method. The optimal segmentation combination is obtained by iteratively solving the problem with the goal of minimizing the sum of squared deviations within groups and maximizing the sum of squared deviations between groups. Based on the historical operation monitoring data, the score fluctuation range of each sampling period is statistically analyzed, all score fluctuation ranges are sorted in ascending order, and the 95th percentile is selected as the buffer baseline width. On both sides of each segmentation threshold, two judgment boundaries are set according to the buffer reference width to form a narrow buffer zone, and hysteresis judgment rules are set at the same time. By integrating the segmentation threshold with the corresponding narrow buffer, a scoring threshold range with hysteresis boundaries is formed, which corresponds to four levels of link quality labels: excellent, good, medium, and poor.

5. The cross-border link encryption adaptation system based on post-quantum key negotiation according to claim 2, characterized in that, The steps for generating the initiator session key include: Based on the initiator's private key and the responder's public key, a standard key decryption operation is performed to generate an initial session key; The link state vector is hashed to generate a link digest. The initial session key, the link digest, and the session sequence number negotiated in this session are concatenated in sequence and hashed to generate a local short checksum. The local short check code is sent to the responding end through the negotiation channel, and the short check code of the peer end is received from the responding end. The local short check code and the peer short check code are compared bit by bit. If the short checksum of the local end is exactly the same as the short checksum of the remote end, the key is determined to be the same, and the initial session key is used as the official session key. Set a minimum validity period and a maximum validity period, and then perform a linear mapping based on the link quality score to obtain the validity period; Add an expiration date identifier and a key identifier to the formal session key and encapsulate it as the initiator session key.

6. The cross-border link encryption adaptation system based on post-quantum key negotiation according to claim 5, characterized in that, The steps to generate a negotiation request message include: The link state vector, the randomly generated session number, and the quality level in the adaptation parameter set are concatenated to generate a fingerprint input string. The link fingerprint is then generated through a hash operation. Based on the quality level field, session sequence number field, initiator public key field, and link fingerprint field, a negotiation request body is constructed, and a length flag is set before each field; Calculate the total byte length of the negotiation request body and compare it with the fragmentation threshold corresponding to the current quality level; if the total byte length does not exceed the fragmentation threshold, use the negotiation request body as a single fragment; If the total byte length exceeds the fragmentation threshold, it will be continuously split from the beginning according to the byte order to generate multiple consecutive fragments; The fragment header is set to the corresponding fragment, which is then encapsulated as a negotiation request fragment. All negotiation requests are fragmented and arranged sequentially according to their fragment numbers to generate negotiation request messages.

7. The cross-border link encryption adaptation system based on post-quantum key negotiation according to claim 6, characterized in that, The steps for performing parameter compliance verification and link environment consistency verification include: Based on the session sequence number of the fragment, the fragments are aggregated, and the effective range of the fragments is set according to the total number of fragments. Fragments whose current sequence number exceeds the effective range are judged as abnormal fragments and discarded directly. After all fragments of the same session have been received, remove the header fields of all fragments, and concatenate them in ascending order of fragment sequence number to restore the negotiation request body; Based on the parsed quality level and matching threshold, combined with the total number of fragments, the main byte range is constructed. ; Obtain the recombined byte length of the subject requesting the recombination negotiation. Simultaneously, based on the length flag in the negotiation request body, the theoretical byte length is obtained. .

8. The cross-border link encryption adaptation system based on post-quantum key negotiation according to claim 1, characterized in that, The steps for parameter compliance verification and link environment consistency verification also include: like and If the fragment reassembly is deemed valid, the main body reassembly is deemed to have failed, the session cache is cleared, and a full packet retransmission request is triggered. Remove the last fragment, take the average length of the remaining fragment bytes to generate the actual fragment granularity, and calculate the negotiation deviation by combining it with the fragment threshold; Set a deviation allowable threshold. If the negotiated deviation is not greater than the deviation allowable threshold, the encryption level verification is considered successful; otherwise, the current request processing is terminated. Retrieve the historical replay records of the stored session sequence number and compare them with the parsed session sequence number; If there is overlap, it is determined to be a replay request; If they do not overlap, the public key of the initiating party is checked for public key format and domain compliance. Only if the public key format and domain compliance check passes, the parameters are deemed compliant.

9. The cross-border link encryption adaptation system based on post-quantum key negotiation according to claim 3, characterized in that, The steps for parameter compliance verification and link environment consistency verification also include: Based on the response end, the monitoring and operation data of the response end is obtained, the response link vector is constructed, and the parsed session sequence number and quality level are concatenated in sequence. Through hash operation, the response link fingerprint is generated. The response link fingerprint is compared bit by bit with the link fingerprint parsed at the response end. The basic link consistency check is deemed to have passed only when the response link vectors are completely identical. The response quality level is determined by comparing the scoring threshold range with the link quality score at the response end, and then compared with the parsed quality level. The quality level linkage verification is considered passed only if the response quality level matches the parsing quality level. If both checks pass, the link environment consistency check is considered successful. If any check fails, the negotiation request will be discarded and no response message will be generated.

10. A cross-border link encryption adaptation method based on post-quantum key negotiation, implemented based on the cross-border link encryption adaptation system based on post-quantum key negotiation as described in any one of claims 1-9, characterized in that, include: Obtain operational monitoring data, and obtain a link quality score through normalization and weighted summation; By comparing the scoring threshold range with the link quality score, quality level labels are configured and matched with the appropriate parameter set. After instantiating the quantum key encapsulation mechanism with the aforementioned adaptation parameter set and generating a public-private key pair locally, a negotiation request message is generated and sent to the responding end through hash operation, message construction, and fragment encapsulation. Perform parameter compliance verification and link environment consistency verification on the negotiation request message, and construct a public-private key pair for the responding end and return the negotiation response message; Both communicating parties use their local private key and the peer's public key respectively, and generate a session key with an expiration date through post-quantum key desealing operation, negotiation channel interaction verification, and expiration date setting; Symmetric encryption is performed on the cross-border business data to be transmitted based on the session key, and a traceability verification tag is constructed. Encrypted transmission data packets are generated according to the adaptation parameter set.

Images