Data packet selective encryption transmission method, system, device, medium and program product

Abstract

The embodiment of the application provides a kind of data packet selective encryption transmission method, system, equipment, medium and program product, it is related to data transmission technical field.The method comprises the following steps: receiving the data packet to be transmitted sent by first terminal equipment;Identify the encryption identification extension header carried in the IPv6 extension header of the data packet to be transmitted;Determine that the data packet to be transmitted needs encrypted transmission, encrypt the data packet to be transmitted, and the data packet to be transmitted after encryption is forwarded to second gateway equipment;Determine that the encryption identification extension header represents that the data packet to be transmitted does not need encrypted transmission, and directly forward the data packet to be transmitted to second gateway equipment.The embodiment of the application selectively encrypts the transmission data packet, directly uses the custom extension header to realize the accurate identification of sensitive data packet, without modifying the communication protocol and simplifying the gateway processing procedure, thereby reducing the gateway computing load, ensuring data security while improving transmission efficiency.

Description

Technical Field

[0001] This application relates to the field of data transmission technology, and more specifically, to a method, system, device, medium, and program product for selectively encrypting data packets during transmission. Background Technology

[0002] With the widespread deployment of IPv6 networks, network communication among various terminal devices is becoming increasingly frequent, and data transmission security and efficiency are gradually becoming core requirements for network applications. During network data transmission, many existing encryption schemes employ a "negotiated full encryption" mode, such as HTTPS (Hypertext Transfer Protocol Secure), SSH (Secure Shell), and IPSec (Internet Protocol Security). After key negotiation, both communicating parties or the access gateway encrypt all transmitted data packets.

[0003] However, while full encryption can guarantee data transmission security to a certain extent, in practical applications, a large number of transmitted data packets do not contain sensitive information (such as plain text, irrelevant instructions, etc.), and these ordinary data packets do not require encryption or decryption. Existing full encryption methods perform encryption and decryption operations on all data packets uniformly, causing gateway devices to consume a large amount of computing resources and experience a surge in computational load. Especially in high-concurrency network scenarios, gateway performance degrades significantly, and even data transmission delays and stuttering occur, making it difficult to balance data security and transmission efficiency. Some methods that use selective encryption require complex detection processes and changes to the communication protocol on the gateway side, which also leads to gateway devices consuming a large amount of computing resources and has poor system compatibility.

[0004] In summary, existing data transmission solutions have the drawback of failing to balance data security and transmission efficiency. Summary of the Invention

[0005] The purpose of this application is to provide a method, system, device, medium, and program product for selectively encrypting data packets for transmission, so as to improve transmission efficiency while ensuring data security.

[0006] In a first aspect, embodiments of this application provide a method for selectively encrypting data packets for transmission, applied to a first gateway device, the method comprising: Receive the data packet to be transmitted sent by the first terminal device; Identify the encryption identifier extension header carried in the IPv6 extension header of the data packet to be transmitted; wherein, the encryption identifier extension header is added by the first terminal device based on the detection result of sensitive information of the data to be transmitted; If it is determined that the encryption identifier extension header indicates that the data packet to be transmitted needs to be encrypted, the data packet to be transmitted is encrypted, and the encrypted data packet to be transmitted is forwarded to the second gateway device. If it is determined that the encryption identifier extension header indicates that the data packet to be transmitted does not require encrypted transmission, the data packet to be transmitted is directly forwarded to the second gateway device.

[0007] In this embodiment, data packets are selectively encrypted during transmission, and sensitive data packets are accurately identified directly using a custom extension header. This eliminates the need to modify the communication protocol and simplifies the gateway processing flow, thereby reducing the gateway's computational load and improving transmission efficiency while ensuring data security.

[0008] In some embodiments, the encrypted identifier extension header includes an identifier bit and a sensitive information type field; the identifier bit is used to indicate whether the data packet to be transmitted needs to be transmitted encrypted; the sensitive information type field is used to characterize the type of sensitive information detected in the data to be transmitted. The encryption process for the data packet to be transmitted includes: The corresponding encryption strategy is determined based on the sensitive information type field and / or the current communication scenario type; wherein, the encryption strategy includes an encryption algorithm and / or a key negotiation period; The data packets to be transmitted are encrypted according to the determined encryption strategy.

[0009] In this application embodiment, by determining the corresponding encryption strategy based on the sensitive information type field and / or communication scenario, it is possible to perform differentiated encryption as needed, thereby improving encryption flexibility and scenario adaptability.

[0010] In some embodiments, before receiving the data packet to be transmitted sent by the first terminal device, the method further includes: Receive the initial communication data packet sent by the first terminal device; Based on the source IPv6 address and destination IPv6 address of the initial communication data packet, it is determined that the first terminal device and the second terminal device are communicating for the first time; wherein, the second terminal device is the terminal device that receives the data corresponding to the data packet to be transmitted via the second gateway device; If it is determined that the first terminal device and the second terminal device are communicating for the first time, a key pre-negotiation is performed with the second gateway device to obtain a session key, and the session key is associated with and stored with the source IPv6 address and the destination IPv6 address.

[0011] In this embodiment, by pre-negotiating and storing the session key with the second gateway device during the first communication, an independent key can be established in advance for each session, ensuring the security of subsequent encryption and decryption and improving the efficiency of encrypted transmission.

[0012] In some embodiments, encrypting the data packet to be transmitted and forwarding the encrypted data packet to the second gateway device includes: Match the corresponding session key based on the source IPv6 address and destination IPv6 address of the data packet to be transmitted; The session key is used to encrypt the application layer data of the data packet to be transmitted; Generate a verification value for the encrypted data and write the verification value into the verification value field of the encryption identifier extension header; The encrypted identifier extension header carrying the verification value is re-encapsulated with the encrypted application layer data and then forwarded.

[0013] In this embodiment of the application, by encrypting application layer data by matching the session key and encapsulating and forwarding the data after writing the verification value into the extension header, the confidentiality and integrity of the data can be guaranteed, thereby further improving the security of encrypted transmission.

[0014] In some embodiments, the method further includes: When the session key reaches its preset validity period, and / or when a preset trigger event is detected, a key update negotiation is conducted with the second gateway device to update the session key; The preset triggering event includes at least one of the following: Determine that the cumulative number of verification failures during decryption by the second gateway device reaches a preset threshold; The data packet to be transmitted was detected to have been tampered with and / or showed signs of being hijacked. The first terminal device or the second terminal device initiates a reconnection request.

[0015] In this embodiment, by updating the negotiation session key when the usage period expires or a triggering event is detected, the session key can be replaced in a timely manner, thereby further improving the security of encrypted transmission.

[0016] In some embodiments, the method further includes: The session key is deleted when a key destruction notification is received from the first terminal device or the second terminal device, or when the data packet to be transmitted is not received for a preset period of time.

[0017] In this embodiment, by deleting the session key when communication is terminated or no data packet is received within a timeout, expired keys can be cleared in a timely manner and cached resources can be released, thereby further improving the security and efficiency of encrypted transmission.

[0018] Secondly, embodiments of this application provide a method for selectively encrypting and transmitting data packets, applied to a first terminal device, the method comprising: A sensitive information detection model is used to detect sensitive information in the application layer data of the data to be transmitted. Based on the results of the sensitive information detection, an encryption identifier extension header is added to the IPv6 extension header of the data packet to be transmitted, and the data packet to be transmitted carrying the encryption identifier extension header is sent to the first gateway device, so that the first gateway device can encrypt and transmit the data packet to be transmitted according to the encryption identifier extension header or directly forward it to the second gateway device.

[0019] In this embodiment, by using a sensitive information detection model to identify application layer data and adding an encryption identifier extension header on the terminal side, data packets can be selectively encrypted for transmission without modifying the communication protocol or simplifying the gateway processing flow, thereby improving data security while increasing transmission efficiency.

[0020] In some embodiments, the method further includes: Obtain feedback information from the second terminal device; wherein the second terminal device is a terminal device that receives the data corresponding to the data packet to be transmitted via the second gateway device, and the feedback information is used to characterize the second terminal device's detection status of sensitive information in the data it receives; The sensitive information detection model is adjusted based on the feedback information.

[0021] In this embodiment of the application, by obtaining the sensitive information detection status fed back by the second terminal device and adjusting the terminal-side detection model, a closed loop of sensitive information detection and feedback optimization can be formed, thereby continuously improving the accuracy and scenario adaptability of sensitive information detection.

[0022] In some embodiments, adjusting the sensitive information detection model based on the feedback information includes: Based on the feedback information, the number of false detections and / or missed detections of sensitive information is statistically analyzed; If the number of false detections and / or missed detections exceeds a preset threshold, the sensitive information detection model is adjusted based on the feedback information.

[0023] In this embodiment, by adjusting the sensitive information detection model only when the number of false detections and / or missed detections exceeds a preset threshold, the frequent adjustment of the model due to occasional fluctuations in the detection results can be avoided, thereby improving the detection accuracy while maintaining stable recognition.

[0024] In some embodiments, the method further includes: Obtain reference information for adjusting the detection strategy; wherein, the reference information for adjusting the detection strategy includes at least one of the following: the security level of the current network environment, the security level of the terminal device, and network transmission efficiency parameters; The sensitive information detection model is adjusted based on the reference information adjusted by the detection strategy.

[0025] In this embodiment, by dynamically adjusting the sensitive information detection model based on the network environment security level, terminal device security level, and network transmission efficiency, the sensitivity information detection intensity can be dynamically adapted to the security situation and transmission efficiency, thereby further improving the scenario adaptability and flexibility of data transmission.

[0026] Thirdly, embodiments of this application provide a selective encrypted transmission device for data packets, applied to a first gateway device, comprising: The data receiving module is used to receive data packets to be transmitted sent by the first terminal device; The extension header identification module is used to identify the encryption identifier extension header carried in the IPv6 extension header of the data packet to be transmitted; wherein, the encryption identifier extension header is added by the first terminal device according to the detection result of sensitive information of the data to be transmitted; The data forwarding module is used to encrypt the data packet to be transmitted when it is determined that the encryption identifier extension header indicates that the data packet to be transmitted needs to be transmitted in an encrypted manner, and to forward the encrypted data packet to be transmitted to the second gateway device. The data forwarding module is also used to directly forward the data packet to be transmitted to the second gateway device when it is determined that the encryption identifier extension header indicates that the data packet to be transmitted does not need to be encrypted.

[0027] Fourthly, embodiments of this application provide a selective encrypted transmission device for data packets, applied to a first terminal device, comprising: The sensitive information identification module is used to detect sensitive information in the application layer data to be transmitted using a sensitive information detection model. The identifier adding module is used to add an encrypted identifier extension header to the IPv6 extension header of the data packet to be transmitted based on the result of the sensitive information detection, and send the data packet to be transmitted carrying the encrypted identifier extension header to the first gateway device, so that the first gateway device can encrypt the data packet to be transmitted or directly forward it to the second gateway device based on the encrypted identifier extension header.

[0028] Fifthly, embodiments of this application provide a selective encrypted data packet transmission system, including a first terminal device, a second terminal device, a first gateway device, and a second gateway device; The first terminal device is used to perform sensitive information detection on the application layer data to be transmitted; based on the result of the sensitive information detection, selectively add an encryption identifier extension header to the IPv6 extension header of the data packet to be transmitted, and send the data packet to be transmitted to the first gateway device; The first gateway device is configured to: identify the encryption identifier extension header carried in the IPv6 extension header of the data packet to be transmitted; determine whether the data packet to be transmitted needs to be encrypted based on the characteristics of the encryption identifier extension header; and forward the encrypted data packet or the unencrypted data packet to be transmitted to the second gateway device. The second gateway device is used to identify the encryption identifier extension header in the received data packet to be transmitted, determine whether the data packet to be transmitted needs to be decrypted based on the encryption identifier extension header, and forward the decrypted data packet to be transmitted or the unencrypted data packet to be transmitted to the second terminal device.

[0029] In a sixth aspect, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the methods described in any of the embodiments.

[0030] In a seventh aspect, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, can implement the methods described in any of the embodiments.

[0031] Eighthly, embodiments of this application provide a computer program product, the computer program product including a computer program, wherein the computer program, when executed by a processor, can implement the methods described in any of the embodiments. Attached Figure Description

[0032] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This application provides a schematic diagram of the structure of a selective encrypted data packet transmission system according to an embodiment of the present application. Figure 2 A flowchart illustrating a selective encrypted transmission method for data packets provided in an embodiment of this application; Figure 3 A flowchart illustrating another data packet selective encryption transmission method provided in this application embodiment; Figure 4 This is a schematic diagram of the structure of an encryption identifier extension header provided in an embodiment of this application; Figure 5 This application provides a schematic diagram of the structure of a key negotiation extension header. Figure 6 This is a schematic diagram of the structure of a selective encrypted transmission device for data packets provided in an embodiment of this application; Figure 7 This is a schematic diagram of another selective data packet encryption transmission device provided in an embodiment of this application; Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0034] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0035] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0036] It should be noted that the existing technology, which uses full data encryption, has the following drawbacks in practical applications: 1. Significant performance degradation: Regardless of whether the data packet contains sensitive information, it must go through the encryption and decryption process, which consumes a lot of computing resources of the gateway device. In high-concurrency IPv6 network scenarios (such as enterprise intranets, cloud service clusters, IoT terminal communication, etc.), the gateway performance degrades significantly, and even data transmission delays and stuttering occur, making it difficult to balance data security and transmission efficiency.

[0037] 2. Waste of resources: A large number of ordinary data packets that do not contain sensitive information (such as plain text, irrelevant instructions, etc.) are forcibly encrypted and decrypted without the need for encryption, resulting in a waste of gateway computing resources and network bandwidth resources, which does not meet the requirements of lightweight and efficient network communication.

[0038] 3. Insufficient adaptability: It fails to fully utilize the features of the IPv6 extension header, either requiring modification of the IPv6 core protocol, thus affecting compatibility with existing terminals and gateway devices, or failing to accurately identify sensitive data packets, making it difficult to provide a reliable basis for selective encryption.

[0039] 4. Poor key negotiation flexibility: Existing key negotiation processes are complex and often use fixed negotiation cycles and encryption algorithms. They cannot be flexibly adjusted according to communication scenarios and sensitive data types. Furthermore, the dynamic update and destruction mechanisms for keys are not perfect, posing security risks such as key leakage and session hijacking.

[0040] To address at least one of the problems existing in the prior art, embodiments of this application provide a method for selectively encrypting data packets, which can encrypt only specified data packets containing sensitive information, thus balancing data security and gateway performance.

[0041] like Figure 1 As shown, this application provides a selective encrypted data packet transmission system, including a first terminal device, a second terminal device, a first gateway device, and a second gateway device; The first terminal device is used to perform sensitive information detection on the application layer data to be transmitted; based on the result of the sensitive information detection, selectively add an encryption identifier extension header to the IPv6 extension header of the data packet to be transmitted, and send the data packet to be transmitted to the first gateway device; The first gateway device is used to identify the encryption identifier extension header carried in the IPv6 extension header of the data packet to be transmitted, determine whether the data packet to be transmitted needs to be encrypted based on the characteristics of the encryption identifier extension header, and forward the encrypted or unencrypted data packet to be transmitted to the second gateway device. The second gateway device is used to identify the encryption identifier extension header in the received data packet to be transmitted, determine whether the data packet to be transmitted needs to be decrypted based on the encryption identifier extension header, and forward the decrypted data packet or the unencrypted data packet to be transmitted to the second terminal device.

[0042] Specifically, the overall system architecture includes terminal devices, gateway devices, and various functional modules. The terminal devices include a first terminal device and a second terminal device, both supporting the IPv6 protocol and capable of sending IPv6 data packets with or without sensitive information to each other. The first terminal device is the side sending the data packets to be transmitted, and it has a built-in sensitive information identification module and an identifier addition module. It is used to detect whether application layer data contains sensitive information and decide whether to add an encrypted identifier extension header based on the detection result. The second terminal device is the side receiving data, supporting the IPv6 protocol and registered and managed by the gateway. It is used to receive data sent by the first terminal device.

[0043] The gateway devices include a first gateway device and a second gateway device. The first gateway device is the gateway to which the first terminal device connects, and it has a built-in extension header identification module, encryption / decryption module, data forwarding module, and key negotiation module, mainly used for encrypting and forwarding sensitive data packets. The second gateway device is the gateway to which the second terminal device connects, and it also has a built-in extension header identification module, encryption / decryption module, data forwarding module, and key negotiation module, mainly used for decrypting and forwarding encrypted data packets.

[0044] The sensitive information identification module is deployed only in the terminal device and is used to detect whether application layer data contains preset sensitive information. The type of sensitive information can be configured by the administrator. After the detection is completed, the sensitive information identification module triggers the addition of an encryption identifier extension header, providing a basis for the gateway device's encryption and decryption judgment. The gateway device does not participate in sensitive information detection; it only determines whether to perform encryption and decryption operations by recognizing the encryption identifier in the IPv6 extension header, in order to maximize the gateway's processing performance.

[0045] The key negotiation module is deployed in the first and second gateway devices to perform key pre-negotiation, dynamic updating, secure verification, and destruction between the two parties, generating a unified encryption / decryption session key to provide key support for the encryption / decryption module. The encryption / decryption module, deployed in the gateway devices, uses the session key generated by the key negotiation module to encrypt or decrypt application-layer data in data packets containing encryption identifiers. It can employ the ECC elliptic curve cryptography algorithm, balancing security and efficiency. The data forwarding module, also deployed in the gateway devices, is used to forward data packets: it encrypts or decrypts data packets containing encryption identifiers before forwarding; it directly forwards ordinary data packets without encryption identifiers, without performing encryption / decryption operations.

[0046] The overall system flow is as follows: When the first terminal device sends a data packet, it first performs sensitive information detection on the application layer data to be transmitted. If the application layer data contains sensitive information, the first terminal device adds an encryption identifier extension header to the IPv6 extension header of the data packet to be transmitted; if the application layer data does not contain sensitive information, it either does not add an encryption identifier extension header or adds an encryption identifier extension header and sets the identifier position therein to a value that indicates that encrypted transmission is not required.

[0047] Subsequently, the first terminal device sends the data packet to be transmitted to the first gateway device. The first gateway device identifies the encryption identifier extension header carried in the IPv6 extension header of the data packet to be transmitted, and determines whether the data packet needs to be encrypted during transmission based on the characteristics of the encryption identifier extension header. If it is determined that encrypted transmission is required, the first gateway device encrypts the data packet and forwards the encrypted data packet to the second gateway device; if it is determined that encrypted transmission is not required, the first gateway device directly forwards the data packet to the second gateway device.

[0048] After receiving the data packet to be transmitted forwarded by the first gateway device, the second gateway device identifies the encryption identifier extension header and determines whether the data packet needs to be decrypted based on the encryption identifier extension header. If decryption is required, the second gateway device performs the decryption process and forwards the decrypted data packet to the second terminal device; if decryption is not required, the second gateway device directly forwards the data packet to the second terminal device.

[0049] The following are specific examples to illustrate this: Assume the company's intranet uses IPv6. Employee terminal A is the first terminal device, and employee terminal B is the second terminal device. Terminal A is connected to gateway A (the first gateway device), and terminal B is connected to gateway B (the second gateway device). The administrator has preset the sensitive information types as "ID number, employee salary data, and customer privacy information".

[0050] When terminal A sends a data packet containing employee salary data to terminal B, terminal A's sensitive information identification module uses a sensitive information detection model to detect that the application layer data contains salary-related sensitive information. Therefore, it adds an encryption identifier extension header to the IPv6 extension header of the data packet, sets the identifier to the value indicating that encrypted transmission is required, fills in the sensitive information type field, and then sends it to gateway A. Gateway A recognizes the encryption identifier extension header, determines that the data packet needs to be transmitted encrypted, performs ECC encryption on the application layer data based on the session key, and forwards the encrypted data packet to gateway B. Gateway B recognizes the encryption identifier extension header, performs decryption, and forwards the decrypted data packet to terminal B, completing the secure transmission of sensitive data.

[0051] When terminal A sends a regular office document containing no sensitive information to terminal B, terminal A does not add an encryption identifier extension header. Gateway A, upon receiving the data, does not recognize the encryption identifier extension header and directly forwards the ordinary data packet to gateway B. Gateway B also forwards it directly to terminal B. No encryption or decryption is performed throughout the process, resulting in efficient transmission. Therefore, this system selectively encrypts only specified data packets containing sensitive information, while ordinary data packets are forwarded directly, balancing data security and gateway performance.

[0052] like Figure 2 As shown, this application embodiment provides a method for selectively encrypting data packets for transmission, applied to a first gateway device, and may include the following steps: S201, Receive the data packet to be transmitted sent by the first terminal device.

[0053] Specifically, before sending data, the first terminal device performs sensitive information detection on the application layer data to be transmitted. This detection is performed by a sensitive information identification module deployed in the first terminal device, and can employ detection methods based on a sensitive information detection model, such as rule matching, regular expression matching, or semantic recognition. When the application layer data contains sensitive information, the first terminal device adds an encryption identifier extension header to the IPv6 extension header of the data packet to be transmitted, and uses the identifier bits and other information in the encryption identifier extension header to indicate that the data packet needs to be transmitted encrypted.

[0054] When the application layer data does not contain sensitive information, the first terminal device does not add an encryption identifier extension header, or if it does, it sets the identifier to a value indicating that encrypted transmission is not required. Subsequently, the first terminal device sends the data packet to be transmitted, with or without the encryption identifier extension header, to the first gateway device it is connected to. The data packet received by the first gateway device is itself a data packet containing an IPv6 basic header and (optionally) an encryption identifier extension header; the first gateway device does not need to parse the content of the application layer data.

[0055] S202. Identify the encryption identifier extension header carried in the IPv6 extension header of the data packet to be transmitted; wherein the encryption identifier extension header is added by the first terminal device based on the detection result of sensitive information in the data to be transmitted.

[0056] Specifically, after receiving the data packet to be transmitted, the first gateway device uses the extension header identification module to search for and identify the encryption identifier extension header after the IPv6 basic header according to the IPv6 extension header parsing rules.

[0057] Because the encryption identifier extension header has a preset extension header type value, the first gateway device can quickly determine whether the data packet to be transmitted contains an encryption identifier extension header and the values ​​of related fields in that extension header based on the extension header type value. If the data packet to be transmitted does not contain an encryption identifier extension header, or if the identifier bit in its encryption identifier extension header is set to a value indicating that encrypted transmission is not required, the first gateway device can determine that the data packet is a normal data packet and does not require encryption processing. If the data packet to be transmitted contains an encryption identifier extension header, the first gateway device continues to read the identifier bit, sensitive information type field, and other fields in that extension header as the basis for subsequent judgments.

[0058] It should be understood that the identification process only targets the IPv6 extension header. The first gateway device does not perform sensitive information detection on the application layer data of the data packets to be transmitted, thereby simplifying the gateway processing flow and improving processing performance.

[0059] S203. If it is determined that the encryption identifier extension header indicates that the data packet to be transmitted needs to be transmitted in an encrypted manner, the data packet to be transmitted is encrypted and the encrypted data packet to be transmitted is forwarded to the second gateway device.

[0060] Specifically, the first gateway device determines that the data packet to be transmitted is a sensitive data packet containing sensitive information and needs to be transmitted in encrypted form based on the identification information in the encryption identifier extension header identified in step S202, such as the identifier bit value being a first identifier that indicates that the transmission needs to be encrypted (e.g., the identifier bit is 1).

[0061] To address this, the encryption / decryption module of the first gateway device encrypts the application layer data of the data packet to be transmitted. Encryption can be achieved using a session key in conjunction with an encryption algorithm (such as ECC elliptic curve cryptography). After encryption, the first gateway device forwards the encrypted data packet to the second gateway device through its interface to the second gateway device, where the second gateway device continues the decryption process. During this process, the first gateway device only determines whether encryption is required based on the encryption identifier extension header, without performing sensitive information detection on the application layer data of the data packet, thus achieving "zero-checking."

[0062] S204. If it is determined that the encryption identifier extension header indicates that the data packet to be transmitted does not need to be encrypted, the data packet to be transmitted is directly forwarded to the second gateway device.

[0063] Specifically, if the identification information in the identified encryption identifier extension header indicates that the data packet to be transmitted does not need to be encrypted (e.g., the identifier bit is 0), or the data packet to be transmitted does not contain an encryption identifier extension header, then the first gateway device determines that the data packet is a normal data packet and does not need to be encrypted.

[0064] In response, the first gateway device directly forwards the data packet to be transmitted to the second gateway device via its data forwarding module, and the second gateway device then forwards it to the second terminal device. During this process, the data packet skips the encryption / decryption and key verification processes entirely, thereby maximizing transmission efficiency.

[0065] This application embodiment selectively encrypts transmitted data packets and directly uses a custom extension header to accurately identify sensitive data packets. This eliminates the need to modify the communication protocol and simplifies the gateway processing flow, thereby reducing the gateway's computational load and improving transmission efficiency while ensuring data security.

[0066] In some embodiments, the encrypted identifier extension header includes an identifier bit and a sensitive information type field; the identifier bit is used to indicate whether the data packet to be transmitted needs to be transmitted encrypted; the sensitive information type field is used to characterize the type of sensitive information detected in the data to be transmitted. Encrypting the data packets to be transmitted includes: The corresponding encryption strategy is determined based on the sensitive information type field and / or the current communication scenario type; wherein, the encryption strategy includes the encryption algorithm and / or the key negotiation period; The data packets to be transmitted are encrypted according to the determined encryption strategy.

[0067] like Figure 4 As shown, it should be noted that the Encryption Identifier Extension Header is an IPv6 extension header added after the IPv6 basic header. It is distinguished from other IPv6 extension headers by a preset extension header type field, such as 0x0B. The flag bit is used to indicate whether the data packet to be transmitted needs to be encrypted, occupying 1 bit. For example, a flag bit of 1 indicates that the data packet to be transmitted needs to be encrypted, and a flag bit of 0 indicates that the data packet to be transmitted does not need to be encrypted. The flag bit is the core basis for the first gateway device to determine whether to perform encryption / decryption operations.

[0068] The Sensitive Information Type field, occupying 1 byte, is used to characterize the type of sensitive information detected in the data to be transmitted. For example, 0x01 represents an ID card number, 0x02 represents a bank card number, and 0x03 represents private text. The Sensitive Information Type field facilitates the identification of sensitive data types by terminals and gateways, and also provides a basis for gateways to determine differentiated encryption strategies.

[0069] In addition, the encryption identifier extension header may also include a checksum field, which occupies 4 bytes and stores the encrypted / decrypted verification information. This verification information can be generated using the SHA-256 algorithm to ensure data integrity and prevent data tampering. The encryption identifier extension header may also include reserved fields (e.g., 2 bytes) for subsequent functional expansion. It should be understood that the order and width of the above fields can be implemented in various ways, and the specific field order and width can be adjusted according to actual needs.

[0070] It should be noted that when encrypting data packets to be transmitted, the first gateway device can determine the corresponding encryption strategy based on the sensitive information type field and / or the current communication scenario type, and encrypt the data packets to be transmitted according to the determined encryption strategy.

[0071] The current communication scenario type refers to the type of communication scenario to which the data packet to be transmitted belongs, such as enterprise intranet communication scenario, IoT terminal communication scenario, cloud service data transmission scenario, mobile terminal communication scenario, etc. The current communication scenario type can be determined by the first gateway device based on the source IPv6 address, the network segment to which the destination IPv6 address belongs, the type of access device, and the preset communication scenario configuration.

[0072] The encryption strategy includes the encryption algorithm and / or the key negotiation period. The encryption algorithm is used to perform encryption operations on application layer data, and may include, for example, ECC elliptic curve cryptography, AES symmetric encryption, SM4, DES, etc. The key negotiation period is used to indicate the update cycle of the session key, and may be set to, for example, 30 minutes, 1 hour, or other durations configured according to the scenario requirements.

[0073] Specifically, the first gateway device can pre-configure the correspondence between the values ​​of the sensitive information type field and the encryption policy, as well as the correspondence between the communication scenario type and the encryption policy. After determining that the data packet to be transmitted needs to be encrypted, the first gateway device reads the sensitive information type field in the encryption identifier extension header, and, in conjunction with the determined current communication scenario type, finds the matching encryption policy from the above correspondence, and performs encryption processing according to the encryption policy.

[0074] For example, for data packets to be transmitted where the sensitive information type field represents an ID card number, an encryption strategy can be configured that uses a high-security encryption algorithm (e.g., ECC elliptic curve cryptography) and has a short key negotiation period (e.g., 30 minutes). For data packets to be transmitted where the sensitive information type field represents ordinary private text, an encryption strategy can be configured that uses a conventional encryption algorithm and has a relatively long key negotiation period (e.g., 1 hour).

[0075] For example, in enterprise intranet communication scenarios, a default encryption strategy can be configured; in IoT terminal communication scenarios, since IoT terminals are typically limited in computing resources and power consumption, a lightweight encryption algorithm and a relatively long key negotiation period can be configured. Through the above differentiated configuration, while ensuring the security of sensitive information, it is possible to avoid using a uniform high-overhead encryption strategy for all data packets, thereby improving encryption flexibility and scenario adaptability, and balancing security and efficiency.

[0076] In some embodiments, before receiving the data packet to be transmitted sent by the first terminal device, the method further includes: Receive the initial communication data packet sent by the first terminal device; Based on the source IPv6 address and destination IPv6 address of the initial communication data packet, it is determined that the first terminal device and the second terminal device are communicating for the first time; wherein, the second terminal device is the terminal device that receives the data corresponding to the data packet to be transmitted via the second gateway device; If it is determined that the first terminal device and the second terminal device are communicating for the first time, a key pre-negotiation is performed with the second gateway device to obtain a session key, and the session key is associated with and stored with the source IPv6 address and the destination IPv6 address.

[0077] It should be noted that the initial communication data packet refers to the data packet sent by the first terminal device at the start of communication between the two parties to trigger the establishment of communication, such as the first IPv6 data packet sent by the first terminal device to the second terminal device. It can be understood that the initial communication data packet can be considered a special form of the data packet to be transmitted, representing the earliest stage in time. The first communication refers to the situation where a communication relationship has not yet been established between the first terminal device and the second terminal device, which can be determined through historical communication records.

[0078] Specifically, the first gateway device determines whether the first terminal device and the second terminal device are communicating for the first time based on the source IPv6 address and destination IPv6 address of the initial communication data packet. The second terminal device is the terminal device that receives the data corresponding to the data packet to be transmitted via the second gateway device. Specifically, the first gateway device can maintain historical communication records between each terminal device, which may include information such as the source and destination IPv6 addresses of the communicating parties, and the communication time.

[0079] The first gateway device parses the initial communication data packet to obtain the source IPv6 address and destination IPv6 address, and checks if there are any historical communication records with the same source and destination IPv6 addresses. If not, it determines that the first and second terminal devices are communicating for the first time; if they already exist, it determines that it is not the first communication and forwards the data packet normally. Optionally, the first gateway device can also use the extended mechanism of the IPv6 Neighbor Discovery Protocol (NDP) to sense the access and communication status of the terminal, thereby assisting in determining whether it is a first-time communication scenario.

[0080] If it is determined that the first terminal device and the second terminal device are communicating for the first time, the first gateway device and the second gateway device perform key pre-negotiation to obtain a session key, and associate and store the session key with the source IPv6 address and destination IPv6 address of the initial communication data packet.

[0081] Key pre-negotiation is the process by which gateway devices establish a secure communication foundation. As one optional implementation, the first gateway device generates a temporary key pair (public key PA, private key SA) and a random number R1 (for preventing replay attacks). It then encapsulates the public key PA, the random number R1, and the first gateway device's own device identifier into a key negotiation extension header and sends it to the second gateway device.

[0082] After receiving the key negotiation extension header, the second gateway device verifies the legitimacy of the first gateway device's device identifier using a pre-defined gateway whitelist. Upon successful verification, the second gateway device generates its own temporary key pair (public key PB, private key SB) and a random number R2. It then calculates the session key K using the secp256r1 elliptic curve cryptography algorithm. For example, the session key K can be obtained through a key exchange operation based on the public key PA, private key SB, and random numbers R1 and R2. The second gateway device encapsulates the verification information (e.g., verification information generated by encrypting R1 and R2 using the public key PB) into the key negotiation extension header and sends it to the first gateway device.

[0083] The first gateway device decrypts the verification information using its private key SA to check the consistency of R1 and R2. After successful verification, the first gateway device calculates a consistent session key K using the same algorithm. Both parties store the negotiated session key K, along with the other party's public key, random number, and other information, in their local key caches, and associate them with the source and destination IPv6 addresses of this communication, setting a cache validity period (e.g., 30 minutes, configurable). The first gateway device then forwards the initial communication data packets from the first terminal device, completing the communication initialization.

[0084] By associating and storing session keys with source and destination IPv6 addresses, key management can be achieved on a session-by-session basis. This ensures that different terminals use independent session keys for communication, avoids cross-session key confusion, and thus guarantees the security of subsequent encryption and decryption.

[0085] In some embodiments, in order to support the transmission of key negotiation data, a key negotiation extension header can be set in the IPv6 extension header. This extension header is distinguished from other IPv6 extension headers by a preset extension header type field, for example, the extension header type value can be preset to 0x0A.

[0086] like Figure 5 As shown, the key negotiation extension header is used for key negotiation data transmission between the first gateway device and the second gateway device. Its core fields may include: a negotiation type field, occupying 1 byte, used to identify the stage of key negotiation, such as 0x01 indicating pre-negotiation, 0x02 indicating key update, 0x03 indicating key destruction, and 0x04 indicating exception notification; a gateway identifier field, occupying 8 bytes, used to store the device identifier of the sending gateway (such as MAC address or IPv6 address), used to verify the gateway's legitimacy; a key-related data field, with variable length, used to store data that needs to be transmitted during the key negotiation process, such as public key, random number, and key verification information; a timestamp field, occupying 4 bytes, used to prevent replay attacks and ensure the timeliness of the negotiated data; and a verification field, occupying 4 bytes, used to verify the integrity of the key negotiation data and prevent data tampering.

[0087] It should be understood that the key negotiation extension header follows the general format of IPv6 extension headers and is added after the basic IPv6 header. It does not affect the normal transmission of IPv6 packets. Gateway devices can quickly identify it through the extension header type field, improving processing efficiency. The key negotiation extension header and the encryption identification extension header are distinguished by the extension header type field. They can coexist in the same IPv6 packet extension header chain or be applied to different packets, depending on the requirements.

[0088] In some embodiments, encrypting the data packet to be transmitted and forwarding the encrypted data packet to the second gateway device includes: Match the corresponding session key based on the source IPv6 address and destination IPv6 address of the data packet to be transmitted; The session key is used to encrypt the application layer data of the data packets to be transmitted. Generate a verification value for the encrypted data and write the verification value into the verification value field of the encryption identifier extension header; The encrypted identifier extension header carrying the verification value is re-encapsulated with the encrypted application layer data before being forwarded.

[0089] It should be noted that session key matching refers to the process of searching the local key cache of the gateway device for the corresponding session key, using the source and destination IPv6 addresses of the data packets to be transmitted as indexes. The checksum is a hash value generated from the encrypted data (which may combine the session key, timestamp, etc.) using a hash algorithm, used to verify data integrity and key consistency; for example, it can be generated using the SHA-256 algorithm.

[0090] Specifically, during the key pre-negotiation process, the session key, along with the source IPv6 address and destination IPv6 address, is stored in the gateway device's local key cache. After determining that the data packet to be transmitted needs to be encrypted, the first gateway device parses the data packet to obtain its source IPv6 address and destination IPv6 address. Using these addresses as indexes, it searches its local key cache for a matching session key. If a matching session key is found, it is used for encryption; if no matching session key is found (e.g., the key cache has expired or pre-negotiation has not been completed), a session key can be established according to the key pre-negotiation process before encryption.

[0091] The first gateway device uses the matched session key to encrypt the application layer data of the data packets to be transmitted. The encryption process can employ various encryption algorithms, such as ECC elliptic curve cryptography and AES. The encryption algorithm can be determined based on the encryption strategy specified by the sensitive information type field and / or the current communication scenario, or it can use a pre-configured default encryption algorithm. The encrypted data is then obtained.

[0092] The first gateway device generates a checksum for the encrypted data and writes it into the checksum field of the encryption identifier extension header. The checksum is used to ensure data integrity and for key verification. For example, the SHA-256 hash algorithm can be used to calculate the checksum H of the encrypted data, session key, and current timestamp, and this checksum H is written into the checksum field of the encryption identifier extension header (occupying 4 bytes). This checksum is transmitted to the second gateway device along with the encrypted data packet.

[0093] Before decryption, the second gateway device can recalculate the verification value based on the same session key and hash algorithm, and compare it with the received verification value to verify the consistency between the data and the key, preventing data from being tampered with or the key from being replaced.

[0094] The first gateway device re-encapsulates the encrypted identifier extension header carrying the checksum and the encrypted application layer data before forwarding it. Specifically, the first gateway device re-encapsulates the encrypted identifier extension header containing the checksum field value and the encrypted ciphertext data, along with necessary header information such as the IPv6 basic header, to obtain the encrypted data packet to be transmitted, and forwards it to the second gateway device through the interface facing the second gateway device. This re-encapsulation process does not affect the structure and normal routing of the IPv6 data packet. The second gateway device can correctly identify the encrypted identifier extension header based on the extension header type value and perform subsequent decryption processing.

[0095] It should be noted that, to enhance transmission security, both gateway parties can also perform key verification operations each time encrypted data packets are transmitted, in order to prevent key tampering and session hijacking.

[0096] Specifically, when encrypting data packets, the first gateway device uses the session key K to encrypt the application layer data. Simultaneously, it calculates a checksum H of the encrypted data, session key K, and current timestamp using the SHA-256 hash algorithm, and encapsulates this checksum in the checksum field of the encryption identifier extension header. The first gateway device then forwards the encrypted data packet (including the encryption identifier extension header) to the second gateway device.

[0097] After receiving the data, the second gateway device extracts the session key K (obtained by matching the terminal's IPv6 address), calculates the checksum using the same hash algorithm, and compares it for consistency. If they match, it indicates that the key has not been tampered with and the data packet has not been forged, and the decryption operation is performed. If they do not match, it is determined to be an abnormal data packet, discarded, and a key abnormality notification is sent to the first gateway device, triggering a renegotiation process.

[0098] In some embodiments, the method further includes: When the session key reaches its preset validity period, and / or when a preset trigger event is detected, a key update negotiation is conducted with the second gateway device to update the session key; The preset trigger events include at least one of the following: Determine if the cumulative number of failed verification attempts during decryption by the second gateway device reaches a preset threshold. The data packet to be transmitted was detected to have been tampered with and / or showed signs of being hijacked. The first terminal device or the second terminal device initiates a reconnection request.

[0099] It should be noted that the preset validity period refers to the maximum duration for which the session key is allowed to be used, such as 30 minutes, which can be configured by the administrator. The preset trigger event refers to an abnormal situation that requires immediate key updates, such as reaching a threshold for the number of verification failures, detecting signs of tampering or hijacking, or the terminal initiating a reconnection. Key update negotiation refers to the process by which the first gateway device and the second gateway device renegotiate and generate a new session key according to a procedure similar to key pre-negotiation.

[0100] Specifically, when the session key reaches its preset validity period, the first gateway device and the second gateway device negotiate a key update to update the session key. Specifically, both gateways set a key update timer. When the session key's cache time reaches its preset validity period (e.g., 30 minutes, configurable), the first gateway device automatically initiates the update process, generates a new temporary key pair and a random number, and sends an update request to the second gateway device through a key negotiation extension header.

[0101] Both parties negotiate and generate a new session key in a manner similar to key pre-negotiation, replacing the original session key and updating the local key cache and its validity period. During the update process, encrypted data packets being transmitted continue to be encrypted using the old key, and automatically switch to the new key after the new key negotiation is completed, thereby avoiding communication interruption.

[0102] When a preset trigger event is detected, the first gateway device and the second gateway device also perform key update negotiation to update the session key. The preset trigger event includes at least one of the following: First, the cumulative number of verification failures during decryption by the second gateway device reaches a preset threshold. For example, if the second gateway device fails to verify the checksum three times during decryption (configurable), it indicates a potential risk of key tampering, data forgery, or session hijacking, and a key update is immediately triggered. Second, the data packet to be transmitted is detected to have been tampered with and / or shows signs of hijacking. For example, the second gateway device determines that the data packet checksum is inconsistent, or the first gateway device detects abnormal communication behavior. Third, either the first terminal device or the second terminal device initiates a reconnection request. The detection of the above trigger events can be determined by the first gateway device based on its own data packet processing results and notification information from the second gateway device and the second terminal device.

[0103] Based on this, by combining scheduled updates with triggered updates, the exposure time of session keys can be significantly shortened, the risk of key leakage and replay attacks can be reduced, and the security in long-term communication scenarios can be improved.

[0104] In some embodiments, the method further includes: The session key is deleted when a key destruction notification is received from the first or second terminal device, or when no data packet to be transmitted is received for a preset period of time.

[0105] It should be noted that the key destruction notification is a notification message used to instruct the deletion of the session key, typically sent by the terminal device to the gateway device. The preset duration refers to the time threshold for determining communication timeout, such as 5 minutes, which can be configured by the administrator. If no data packet to be transmitted is received within this duration, the communication is determined to have terminated or entered an idle state.

[0106] Specifically, upon receiving a key destruction notification from either the first or second terminal device, the first gateway device deletes the session key. More specifically, when a terminal device actively disconnects communication—for example, by closing the communication window or sending an IPv6 termination packet—the first gateway device receives the key destruction notification, deletes the session key corresponding to that session from its local key cache, and sends a key destruction notification to the second gateway device via a key negotiation extension header. Upon receiving the destruction notification, the second gateway device deletes the corresponding session's key cache, completing the key destruction process.

[0107] In one implementation, if no data packet to be transmitted is received within a preset time period, the first gateway device also deletes the session key. Specifically, if the communication between the first gateway device and the second gateway device times out, for example, if no data is transmitted within a preset time period (e.g., 5 minutes, configurable), both gateways automatically delete the key cache for the corresponding session, releasing computing resources and avoiding the risk of leakage caused by long-term key residency.

[0108] Based on this, by combining the above-mentioned active destruction with timeout destruction, expired keys can be cleared in a timely manner, gateway cache resources can be released, key residues can be prevented from being used to cause data leakage, and the management security of keys throughout their entire lifecycle can be improved.

[0109] Please see Figure 3 This application provides a method for selectively encrypting data packets for transmission, applied to a first terminal device. The method includes: S301. Use a sensitive information detection model to detect sensitive information in the application layer data to be transmitted; S302. Based on the results of sensitive information detection, add an encryption identifier extension header to the IPv6 extension header of the data packet to be transmitted, and send the data packet to be transmitted carrying the encryption identifier extension header to the first gateway device, so that the first gateway device can encrypt and transmit the data packet to be transmitted or directly forward it to the second gateway device according to the encryption identifier extension header.

[0110] It should be noted that the selective encryption transmission method for data packets in this embodiment is a syntax applied to the first terminal device, which corresponds to the aforementioned embodiment applied to the first gateway device. That is, the definitions and relationships of the data packet to be transmitted, the encryption identifier extension header, the first gateway device, the second gateway device, and the second terminal device are consistent with those in the aforementioned embodiment.

[0111] In this embodiment, the sensitive information detection model refers to the model deployed in the first terminal device for identifying and detecting sensitive information in application layer data. This model can be implemented based on rule matching (e.g., regular expression matching), or combined with a semantic recognition model, or implemented using other machine learning or rule engine methods.

[0112] Specifically, a sensitive information detection model is used to detect sensitive information in the application layer data to be transmitted. Before or during data transmission, the sensitive information identification module of the first terminal device invokes the sensitive information detection model to perform detection on the application layer data. Application layer data refers to the content to be sent generated by the terminal application layer, which can be text, file content, business data, etc. For example, the sensitive information detection model can match the application layer data according to preset sensitive information identification rules (e.g., regular expression rules, which can be pre-configured by the administrator or automatically learned by the system) to determine whether it contains preset sensitive information, such as ID card numbers, bank card numbers, or private text. The administrator can configure the sensitive information types and corresponding identification rules, such as configuring the regular expression for "ID card number" and the regular expression for "bank card number." During the detection process, the accuracy of the identification can be improved by combining the context information of the current application layer data (e.g., data length, field names, source application, etc.).

[0113] If sensitive information is detected in the application layer data, an encryption identifier extension header is added to the IPv6 extension header of the data packet to be transmitted, and the data packet to be transmitted carrying the encryption identifier extension header is sent to the first gateway device, so that the first gateway device can encrypt the data packet to be transmitted or directly forward it to the second gateway device according to the encryption identifier extension header.

[0114] Specifically, when the sensitive information detection model indicates that the application layer data contains sensitive information, the first terminal device adds an encryption identifier extension header to the IPv6 extension header of the data packet to be transmitted, sets the identifier to a value indicating that encrypted transmission is required (e.g., 1), and fills in the sensitive information type field (e.g., 0x01 representing an ID card number), thus obtaining the data packet to be transmitted carrying the encryption identifier extension header. Subsequently, the first terminal device sends this data packet to the first gateway device it is connected to. If the detection result indicates that the application layer data does not contain sensitive information, the first terminal device either does not add an encryption identifier extension header, or adds an encryption identifier extension header and sets the identifier to a value indicating that encrypted transmission is not required (e.g., 0), allowing the first gateway device to directly forward the data packet.

[0115] For example, suppose the first terminal device is a browser client. A user fills out and submits a form containing a mobile phone number and payment account information. The sensitive information identification module of the first terminal device uses a sensitive information detection model to detect the form content and identifies two sensitive information types: bank card number and private text. Therefore, it adds an encryption identifier extension header to the IPv6 extension header of the request data packet, sets the identifier to 1, and fills in the sensitive information type field (e.g., 0x02 representing a bank card number). The data packet is then sent to the first gateway device. After identification, the first gateway device performs encrypted transmission on the data packet, thus achieving a secure transmission method where sensitive data is tagged at the source and the gateway executes the corresponding actions.

[0116] It should be noted that in this embodiment of the application, the sensitive information identification mechanism takes the terminal device as the sole detection subject and the terminal inspection result as the standard. The gateway device does not perform sensitive information re-inspection, but only determines whether to perform encryption and decryption by the encryption identifier of the IPv6 extension header, thereby maximizing the improvement of gateway processing performance.

[0117] In some embodiments, the method further includes: Obtain feedback information from the second terminal device; wherein, the second terminal device is the terminal device that receives the data corresponding to the data packet to be transmitted via the second gateway device, and the feedback information is used to characterize the second terminal device's detection status of sensitive information in the data it receives; The sensitive information detection model is adjusted based on feedback information.

[0118] It should be noted that feedback information refers to information generated by the second terminal device that characterizes the second terminal device's detection status of sensitive information in the data it receives.

[0119] Specifically, after receiving data from the first terminal device, the second terminal device can perform sensitive information detection on the received data (e.g., by a built-in detection module or manual inspection) and generate feedback information. The feedback information can characterize the second terminal device's detection status of sensitive information in the received data, such as missed detections or false detections. The feedback information can be forwarded from the second gateway device to the first gateway device, and then from the first gateway device to the first terminal device. Alternatively, the second terminal device can send the feedback information directly or indirectly to the first terminal device through other communication channels (e.g., management channels or out-of-band channels).

[0120] The first terminal device can incorporate the missed or false detection samples reflected in the feedback information into the optimization process of the detection model. For example, it can adjust the threshold of the matching rule, update the regular expression rule, update the model parameters (such as retraining based on the updated training samples), and add or reduce the types of sensitive information. This will enable the sensitive information detection model to more accurately identify sensitive information in actual communication, thereby forming a closed-loop mechanism of detection, feedback, and optimization, continuously reducing the missed detection rate and false detection rate of sensitive information, and improving the accuracy of identification.

[0121] In some embodiments, the sensitive information detection model is adjusted based on feedback information, including: The number of false positives and / or false negatives of sensitive information is counted based on feedback information. If the number of false positives and / or false negatives exceeds a preset threshold, the sensitive information detection model will be adjusted based on feedback information.

[0122] It should be noted that a false positive occurs when the second terminal device determines that the received data does not actually contain sensitive information, but the data is identified as containing sensitive information on the first terminal device side. A false negative occurs when the second terminal device determines that the received data actually contains sensitive information, but the data is not identified as containing sensitive information on the first terminal device side.

[0123] In this embodiment, the first terminal device counts the number of false detections and / or missed detections of sensitive information based on feedback information. If the number of false detections and / or missed detections exceeds a preset threshold, the sensitive information detection model is adjusted based on the feedback information. Specifically, to avoid frequent model adjustments due to occasional fluctuations in single detection results, the first terminal device first accumulates and counts the false detection and missed detection events in the feedback information, for example, counting the number of missed detections and false detections within a preset statistical period (such as 1 hour or 1 day).

[0124] The sensitive information detection model is only adjusted once based on the feedback information when the number of false positives and / or false negatives exceeds a preset threshold (e.g., a cumulative total of 5 false negatives, configurable). When the number of false positives and / or false negatives does not exceed the preset threshold, no model adjustment is triggered, thus filtering out occasional fluctuations in detection results and gradually improving detection accuracy while maintaining stable recognition behavior. Both the statistical period and the threshold can be configured by the administrator to adapt to the different business scenarios' requirements for model stability and response speed.

[0125] For example, suppose a second terminal device receives 100 data packets over a period of time. Detection reveals that 3 of these data packets actually contain sensitive information, but the first terminal device failed to add the correct encryption identifier, resulting in a missed detection. The second terminal device sends this missed detection information as feedback to the first terminal device. The first terminal device counts 3 missed detections. If the preset threshold is 5, no model adjustment is triggered. If subsequent missed detections accumulate to 5 or more, the first terminal device updates the rules or parameters of the sensitive information detection model based on these missed detection samples to reduce subsequent missed detections.

[0126] In some embodiments, the method further includes: Obtain reference information for adjusting the detection strategy; wherein, the reference information for adjusting the detection strategy includes at least one of the following: the security level of the current network environment, the security level of the terminal device, and network transmission efficiency parameters; The sensitive information detection model is adjusted based on the reference information adjusted by the detection strategy.

[0127] It should be noted that the reference information for adjusting the detection strategy refers to information used to assist in determining the direction and step size of adjustments to the sensitive information detection model, including at least one of the following: the security level of the current network environment, the security level of the terminal device, and network transmission efficiency parameters. The security level of the current network environment characterizes the current security situation of the network environment, and can be classified as high, medium, or low. The security level of the terminal device characterizes the degree of trust or security protection level of the terminal device itself, and can be classified as trusted terminal, general terminal, or risky terminal. Network transmission efficiency parameters characterize the current network transmission performance and load status, and may include network bandwidth utilization, latency, and packet loss rate.

[0128] Specifically, the current network environment security level can be obtained by the first terminal device from the network management platform, security situation awareness system, or gateway device, or it can be determined by the first terminal device based on the current network threat detection results. The security level of the terminal device can be determined by the first / second terminal device based on its own security status, or it can be issued by the unified terminal management platform. Network transmission efficiency parameters can be obtained by the first terminal device through network measurements or from the gateway device.

[0129] The first terminal device adjusts reference information based on the acquired detection strategy to determine the target recognition strength or target recognition threshold parameter, and adjusts the sensitive information detection model accordingly, such as adjusting the matching threshold, the type and range of the rule set, and the model sensitivity. Specifically, when the network environment security level is high (high risk) or the terminal device security level is low, the recognition strength corresponding to the recognition threshold parameter can be increased (e.g., lowering the matching threshold or enabling a more comprehensive rule set) to more strictly identify data packets that may contain sensitive information and prevent sensitive data from being missed. When the network environment security level is low (low risk) or the network transmission efficiency parameter shows a high network load, the recognition strength can be appropriately reduced (e.g., increasing the matching threshold or simplifying the rule set) while meeting the preset basic security requirements to reduce encryption transmission overhead and ensure transmission efficiency.

[0130] By dynamically adjusting the sensitive information detection model based on security level and transmission efficiency, the detection intensity can be adapted to the current security situation and transmission conditions, strengthening identification in high-risk scenarios and reducing overhead in high-efficiency scenarios, thus achieving a dynamic balance between security and efficiency.

[0131] Optionally, model adjustments based on feedback information and model adjustments based on detection strategy adjustment reference information can be used in combination. For example, after adjusting the recognition strength according to the security level, the model parameters can still be continuously optimized by using feedback information. The two do not conflict with each other and work together to improve the accuracy and adaptability of the sensitive information detection model.

[0132] For example, suppose the first terminal device is deployed in an office network, and the administrator divides the network environment into three risk levels. When the first terminal device obtains from the network management platform that the current network environment security level is high-risk, it automatically lowers the matching threshold of the sensitive information detection model and enables a more comprehensive set of sensitive information type rules to improve detection sensitivity and more strictly identify sensitive data. When the network environment returns to a normal level, the first terminal device raises the matching threshold and simplifies the rule set to reduce detection sensitivity and prioritize the efficiency of business transmission.

[0133] Compared with the prior art, the embodiments of this application have the following beneficial effects: 1. Improve gateway performance and reduce resource consumption: Only data packets containing sensitive information are encrypted and decrypted, while ordinary data packets are forwarded directly. No need for the gateway to re-inspect sensitive information, simplifying the gateway processing flow, significantly reducing the gateway's computational load, and solving the performance pain points of existing full encryption.

[0134] 2. Ensure data transmission security: Employ the ECC elliptic curve encryption algorithm, combined with dynamic key updates, security verification and destruction mechanisms, to effectively resist security risks such as brute-force attacks, man-in-the-middle attacks, and data tampering; the encryption identifier extension header accurately identifies sensitive data packets, ensuring that sensitive data is not leaked or stolen.

[0135] 3. Strong compatibility and low deployment cost: Based on IPv6 custom extension headers, it does not modify the core IPv6 protocol and can be seamlessly adapted to existing IPv6 terminals and gateway devices. No hardware modification of the terminal is required. Only sensitive information identification rules and gateway parsing logic need to be configured. The deployment is simple and low cost.

[0136] 4. Lightweight and easily expandable: The overall solution is lightweight, the key negotiation process is simple, the sensitive information identification rules and key parameters can be flexibly configured, it supports custom sensitive information types, adapts to the application needs of different industries and scenarios, and is easy to promote and apply.

[0137] 5. Good communication continuity: During the dynamic key update process, the data packets being transmitted can continue to use the old key, and the new key will automatically switch after negotiation, avoiding communication interruption; the processing flow of ordinary data packets and sensitive data packets is independent and does not affect each other.

[0138] Please refer to Figure 6 , Figure 6 A block diagram illustrating the composition of a selectively encrypted data packet transmission apparatus provided in some embodiments of this application is shown. It should be understood that this selectively encrypted data packet transmission apparatus is similar to the one described above. Figure 2 Corresponding to the method embodiments, it is able to perform each step involved in the above method embodiments. The specific functions of the selective encryption transmission device for data packets can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here.

[0139] Figure 6 The selective encryption transmission device for data packets includes at least one software function module that can be stored in a memory or embedded in the selective encryption transmission device in the form of software or firmware. The selective encryption transmission device for data packets is applied to a first gateway device and includes: The data receiving module 610 is used to receive the data packet to be transmitted sent by the first terminal device; The extension header identification module 620 is used to identify the encryption identifier extension header carried in the IPv6 extension header of the data packet to be transmitted; wherein, the encryption identifier extension header is added by the first terminal device according to the detection result of sensitive information of the data to be transmitted; The data forwarding module 630 is used to encrypt the data packet to be transmitted when it is determined that the encryption identifier extension header indicates that the data packet to be transmitted needs to be transmitted in an encrypted manner, and forward the encrypted data packet to be transmitted to the second gateway device. The data forwarding module 630 is also used to directly forward the data packet to be transmitted to the second gateway device when it is determined that the encryption identifier extension header indicates that the data packet to be transmitted does not need to be encrypted.

[0140] Please refer to Figure 7 , Figure 7 A block diagram illustrating the composition of a selectively encrypted data packet transmission apparatus provided in some embodiments of this application is shown. It should be understood that this selectively encrypted data packet transmission apparatus is similar to the one described above. Figure 3 Corresponding to the method embodiments, it is able to perform each step involved in the above method embodiments. The specific functions of the selective encryption transmission device for data packets can be found in the description above. To avoid repetition, detailed descriptions are appropriately omitted here.

[0141] Figure 7 The selective encryption transmission device for data packets includes at least one software function module that can be stored in a memory or embedded in the selective encryption transmission device in the form of software or firmware. The selective encryption transmission device for data packets is applied to a first terminal device and includes: Sensitive information identification module 710 is used to detect sensitive information in application layer data to be transmitted using a sensitive information detection model. The identifier adding module 720 is used to add an encrypted identifier extension header to the IPv6 extension header of the data packet to be transmitted based on the result of sensitive information detection, and send the data packet to be transmitted carrying the encrypted identifier extension header to the first gateway device, so that the first gateway device can encrypt the data packet to be transmitted or directly forward it to the second gateway device according to the encrypted identifier extension header.

[0142] It is understood that the above-described device embodiments correspond to the method embodiments of this application. The data packet selective encryption transmission device provided by the embodiments of this application can implement the data packet selective encryption transmission method provided by any one of the method embodiments of this application.

[0143] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working process of the device described above can be referred to the corresponding process in the aforementioned method, and will not be elaborated further here.

[0144] like Figure 8 As shown, some embodiments of this application provide an electronic device 800, which includes: a memory 810, a processor 820, and a computer program stored in the memory 810 and executable on the processor 820. When the processor 820 reads the program from the memory 810 via a bus 830 and executes the program, it can implement any of the methods included in the above-described selective encrypted transmission method for data packets.

[0145] Processor 820 can process digital signals and can include various computing architectures. Examples include complex instruction set computer architectures, reduced instruction set computer architectures, or architectures that implement multiple instruction set combinations. In some examples, processor 820 can be a microprocessor.

[0146] The memory 810 can be used to store instructions executed by the processor 820 or data related to the execution of instructions. These instructions and / or data may include code used to implement some or all of the functions of one or more modules described in the embodiments of this application. The processor 820 of the embodiments of this application can be used to execute the instructions in the memory 810 to implement the methods shown above. The memory 810 includes dynamic random access memory, static random access memory, flash memory, optical memory, or other memories well known to those skilled in the art.

[0147] Some embodiments of this application also provide a computer-readable storage medium storing a computer program that, when executed by a processor, describes the method described in the method embodiments.

[0148] Some embodiments of this application also provide a computer program product that, when run on a computer, causes the computer to perform the methods described in the method embodiments.

[0149] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0150] It should be understood, in the several embodiments provided in this application, that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0151] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0152] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0153] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0154] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0155] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A method for selectively encrypting and transmitting data packets, characterized in that, Applied to a first gateway device, the method includes: Receive the data packet to be transmitted sent by the first terminal device; Identify the encryption identifier extension header carried in the IPv6 extension header of the data packet to be transmitted; wherein, the encryption identifier extension header is added by the first terminal device based on the detection result of sensitive information of the data to be transmitted; If it is determined that the encryption identifier extension header indicates that the data packet to be transmitted needs to be encrypted, the data packet to be transmitted is encrypted, and the encrypted data packet to be transmitted is forwarded to the second gateway device. If it is determined that the encryption identifier extension header indicates that the data packet to be transmitted does not require encrypted transmission, the data packet to be transmitted is directly forwarded to the second gateway device.

2. The method according to claim 1, characterized in that, The encryption identifier extension header includes an identifier bit and a sensitive information type field; the identifier bit is used to indicate whether the data packet to be transmitted needs to be encrypted for transmission. The sensitive information type field is used to characterize the type of sensitive information detected in the data to be transmitted; The encryption process for the data packet to be transmitted includes: The corresponding encryption strategy is determined based on the sensitive information type field and / or the current communication scenario type; wherein, the encryption strategy includes an encryption algorithm and / or a key negotiation period; The data packets to be transmitted are encrypted according to the determined encryption strategy.

3. The method according to claim 1, characterized in that, Before receiving the data packet to be transmitted sent by the first terminal device, the method further includes: Receive the initial communication data packet sent by the first terminal device; Based on the source IPv6 address and destination IPv6 address of the initial communication data packet, it is determined that the first terminal device and the second terminal device are communicating for the first time; wherein, the second terminal device is the terminal device that receives the data corresponding to the data packet to be transmitted via the second gateway device; If it is determined that the first terminal device and the second terminal device are communicating for the first time, a key pre-negotiation is performed with the second gateway device to obtain a session key, and the session key is associated with and stored with the source IPv6 address and the destination IPv6 address.

4. The method according to claim 1, characterized in that, The step of encrypting the data packet to be transmitted and forwarding the encrypted data packet to the second gateway device includes: Match the corresponding session key based on the source IPv6 address and destination IPv6 address of the data packet to be transmitted; The session key is used to encrypt the application layer data of the data packet to be transmitted; Generate a verification value for the encrypted data and write the verification value into the verification value field of the encryption identifier extension header; The encrypted identifier extension header carrying the verification value is re-encapsulated with the encrypted application layer data and then forwarded.

5. The method according to claim 3, characterized in that, The method further includes: When the session key reaches its preset validity period, and / or when a preset trigger event is detected, a key update negotiation is conducted with the second gateway device to update the session key; The preset triggering event includes at least one of the following: Determine that the cumulative number of verification failures during decryption by the second gateway device reaches a preset threshold; The data packet to be transmitted was detected to have been tampered with and / or showed signs of being hijacked. The first terminal device or the second terminal device initiates a reconnection request.

6. The method according to claim 3, characterized in that, The method further includes: The session key is deleted when a key destruction notification is received from the first terminal device or the second terminal device, or when the data packet to be transmitted is not received for a preset period of time.

7. A method for selectively encrypting and transmitting data packets, characterized in that, Applied to a first terminal device, the method includes: A sensitive information detection model is used to detect sensitive information in the application layer data of the data to be transmitted. Based on the results of the sensitive information detection, an encryption identifier extension header is added to the IPv6 extension header of the data packet to be transmitted, and the data packet to be transmitted carrying the encryption identifier extension header is sent to the first gateway device, so that the first gateway device can encrypt and transmit the data packet to be transmitted according to the encryption identifier extension header or directly forward it to the second gateway device.

8. The method according to claim 7, characterized in that, The method further includes: Obtain feedback information from the second terminal device; wherein the second terminal device is a terminal device that receives the data corresponding to the data packet to be transmitted via the second gateway device, and the feedback information is used to characterize the second terminal device's detection status of sensitive information in the data it receives; The sensitive information detection model is adjusted based on the feedback information.

9. The method according to claim 8, characterized in that, The adjustment of the sensitive information detection model based on the feedback information includes: Based on the feedback information, the number of false detections and / or missed detections of sensitive information is statistically analyzed; If the number of false detections and / or missed detections exceeds a preset threshold, the sensitive information detection model is adjusted based on the feedback information.

10. The method according to claim 7, characterized in that, The method further includes: Obtain reference information for adjusting the detection strategy; wherein, the reference information for adjusting the detection strategy includes at least one of the following: the security level of the current network environment, the security level of the terminal device, and network transmission efficiency parameters; The sensitive information detection model is adjusted based on the reference information adjusted by the detection strategy.

11. A selective encrypted transmission system for data packets, characterized in that, Includes a first terminal device, a second terminal device, a first gateway device, and a second gateway device; The first terminal device is used to perform sensitive information detection on the application layer data to be transmitted; based on the result of the sensitive information detection, selectively add an encryption identifier extension header to the IPv6 extension header of the data packet to be transmitted, and send the data packet to be transmitted to the first gateway device; The first gateway device is configured to: identify the encryption identifier extension header carried in the IPv6 extension header of the data packet to be transmitted; determine whether the data packet to be transmitted needs to be encrypted based on the characteristics of the encryption identifier extension header; and forward the encrypted data packet or the unencrypted data packet to be transmitted to the second gateway device. The second gateway device is used to identify the encryption identifier extension header in the received data packet to be transmitted, and determine whether the data packet to be transmitted needs to be decrypted based on the encryption identifier extension header; The decrypted or unencrypted data packet to be transmitted is forwarded to the second terminal device.

12. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, can implement the method of any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs the method as described in any one of claims 1-10.

14. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-10.

Images