A hierarchical key private security protocol processing method, system and device

Abstract

This invention relates to the field of network security technology and discloses a layered key private security protocol processing method, system, and apparatus. In a trusted hardware environment where a reconfigurable chip is built with a trusted root key, this invention obtains the root key and session master key; generates a key set based on the root key and session master key; acquires uplink packets, performs step-by-step parsing and verification of the uplink packets, and after successful verification, decrypts the uplink packets layer by layer using the key set to obtain the original service payload. If any level of verification fails, the uplink packet is discarded, and the step-by-step parsing and verification of the upper-layer packets is blocked; finally, it acquires the downlink plaintext service payload and encrypts and encapsulates the downlink plaintext service payload layer by layer using the key set to obtain an Ethernet frame. This invention achieves a synergistic improvement in high-strength security protection performance and high-speed network throughput performance.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method, system, and apparatus for processing layered key private security protocols. Background Technology

[0002] Traditional network protocol stacks typically rely on general-purpose CPU software for serial processing of message verification and encryption logic at each layer. This leads to significant computing power bottlenecks when dealing with massive, high-concurrency traffic, making it difficult to simultaneously meet the dual business requirements of high-strength end-to-end security protection and low-latency, high-throughput message forwarding.

[0003] However, existing solutions have certain technical flaws. On the one hand, the encryption mechanisms are relatively simple, mostly using a single key to encrypt the entire message. This not only results in fragmented security policies and key systems at different protocol levels and poor security isolation of the protection logic, but also in high encryption computational overhead. Once this single key is leaked, it can easily trigger a global risk, creating vulnerabilities for cross-layer composite attacks. On the other hand, the message verification logic is discrete, lacking a bidirectional pipelined, step-by-step, strongly dependent interception mechanism. When processing uplink messages, messages that fail verification or are abnormal cannot be directly rejected; they still need to be sent uplink and subjected to deep inspection using the CPU. This not only fails to block attack traffic targeting upper-layer parsing but also introduces additional processing latency and significant CPU computational consumption, making it difficult to achieve a synergistic improvement in network security protection effectiveness and throughput performance. Summary of the Invention

[0004] This invention provides a layered key private security protocol processing method, system, and apparatus to solve the problems of relatively simple encryption mechanism design and lack of bidirectional pipelined step-by-step strong dependency interception mechanism.

[0005] In a first aspect, the present invention provides a method for processing a hierarchical key private security protocol, comprising: Obtain the root key and session master key; Generate a key set based on the root key and the session master key; The uplink message is acquired, and the uplink message is parsed and verified level by level. After the verification is passed, the uplink message is decrypted layer by layer using the key set to obtain the original service payload. If any level of verification fails, the uplink message is removed and the layer-by-layer parsing and verification of the upper layer message is blocked. The downlink plaintext service payload is obtained, and the downlink plaintext service payload is encrypted and encapsulated step by step using a key set to obtain an Ethernet frame.

[0006] Beneficial effects: By obtaining the root key and session master key to generate a key set, uplink packets are parsed, verified, and decrypted layer by layer, while downlink plaintext service payloads are encrypted and encapsulated layer by layer, thus constructing a bidirectional, layer-by-layer, strongly constrained security processing mechanism. In particular, if verification fails at any level, the uplink packet is discarded, and the layer-by-layer parsing and verification of upper-layer packets is blocked. This directly intercepts malicious attack traffic at the lower level, preventing illegal packets from consuming subsequent system computing power. It effectively resolves the contradiction between high-strength security protection and high-speed packet forwarding, significantly improving network throughput and security protection effectiveness.

[0007] In one alternative implementation, the session master key is obtained by means of: Asymmetric algorithms are used to perform two-way authentication of the terminal to obtain session key materials; After successful two-way authentication on the terminal, the session key material is decrypted and restored using the local private key to obtain the session master key.

[0008] Beneficial effects: By utilizing asymmetric algorithms for two-way terminal authentication, and then decrypting and restoring the session key material encrypted with the gateway's public key using the local private key after successful authentication, absolute security is ensured during the session master key generation process. This mechanism eliminates the risk of session key material being eavesdropped on or cracked during network transmission, providing a highly reliable security foundation for subsequent hierarchical symmetric key derivation.

[0009] In one optional implementation, a key set is generated based on the root key and the session master key, including: Using a key derivation algorithm, the root key and session master key are calculated to obtain a key set containing network layer keys, transport layer keys, and application layer keys.

[0010] Beneficial effects: By utilizing a key derivation algorithm, a key set containing network layer, transport layer, and application layer keys is calculated from the root key and session master key, achieving differentiated isolation encryption at the protocol layer level. This layered independent key generation mechanism completely breaks through the limitations of traditional single-key whole-packet encryption, making the protection logic of each layer independent and avoiding the risk of overall security failure caused by a single point of key leakage.

[0011] In one alternative implementation, the protocol stack of the uplink message includes, from bottom to top, the link layer, network layer, transport layer, and application layer; The uplink message is parsed and verified level by level. After successful verification, the uplink message is decrypted layer by layer using a key set to obtain the original service payload, including: The integrity of the uplink message is verified by the link layer to obtain a complete Ethernet frame. The complete Ethernet frame includes the Ethernet frame header, custom extended fields, encrypted transport layer private header, encrypted application layer private header, and encrypted service payload. The network layer verifies the legitimacy of the terminal identity in the complete Ethernet frame. After the verification is successful, the network layer key is used to decrypt the private header of the encrypted transport layer to obtain the transport layer plaintext. The transport layer performs link legitimacy verification on the transport layer plaintext. After the verification is successful, the transport layer key is used to decrypt the encrypted application layer private header to obtain the application layer plaintext. The application layer performs header integrity verification on the plaintext. After the verification passes, the encrypted business payload is decrypted using the application layer key to obtain the original business payload.

[0012] Beneficial effects: A bottom-up, strictly dependent, hierarchical parsing and decryption process is constructed. The private header of the adjacent upper layer is decrypted using the lower-layer protocol key, forming a layered, onion-peeling protection structure where each key unlocks a lock. Only after the integrity and legitimacy verification of the current layer is passed can the plaintext features of the next layer be obtained, completely severing the paths of cross-layer composite attacks and layered bypass attacks from a physical and logical perspective.

[0013] In one optional implementation, the network layer verifies the legitimacy of the terminal identity within the complete Ethernet frame. Upon successful verification, the network layer key is used to decrypt the encrypted transport layer private header to obtain the transport layer plaintext, including: The custom extended field is parsed to obtain the terminal ID; Using the terminal ID as an index, determine the terminal baseline fingerprint, and calculate the Hamming distance between the real-time fingerprint of the complete Ethernet frame and the terminal baseline fingerprint. When the Hamming distance is less than or equal to the preset trust threshold, the terminal's identity is verified as legitimate, and the network layer key is used to decrypt the encrypted transport layer private header to obtain the transport layer plaintext.

[0014] Beneficial effects: By parsing the custom extended field in a complete Ethernet frame to obtain the terminal ID, and using this as an index to calculate the Hamming distance between the real-time fingerprint and the pre-stored terminal baseline fingerprint, a highly efficient terminal identity verification mechanism is achieved. By comparing the Hamming distance with a preset trusted threshold, message-level terminal identity authentication can be completed within a very short clock cycle, accurately and quickly rejecting spoofed terminal messages at the network layer.

[0015] In one optional implementation, link validity verification is performed on the transport layer plaintext at the transport layer, including: Extract the link binding ID, transmission path identifier, and session state fields from the transport layer plaintext; Retrieve the session mapping table to obtain triplet data; The link binding ID, transmission path identifier, session state field, and triple data are compared byte-by-byte. If they match completely, the link validity check passes.

[0016] Beneficial effects: By extracting the link binding ID, transmission path identifier, and session state field from the transport layer plaintext and performing a full-byte equality comparison with the triple data obtained from retrieving the session mapping table, extremely high-strength link legitimacy verification is achieved. This mechanism ensures the three-dimensional consistency of the packet's transmission link, terminal identity binding relationship, and current service state, preventing malicious transport layer attacks such as session hijacking, route topology mapping, and packet tampering.

[0017] In an optional implementation, after blocking the layer-by-layer parsing and verification of upper-layer messages, the method further includes: Record the abnormal characteristics of the failed verification, including the abnormal terminal ID, the protocol level at which the abnormality occurred, and the type of abnormality; Generate lightweight event logs based on anomaly characteristics.

[0018] Beneficial effects: By blocking the layer-by-layer parsing and verification of upper-layer packets, lightweight security auditing and fault tracing are achieved by recording abnormal terminal IDs, abnormal protocol layers, and abnormal types, and generating lightweight event logs. This approach can discard massive amounts of abnormal attack data packets while accurately preserving core attack clues, without consuming system backbone bandwidth and core computing power, and ensuring closed-loop management of security defense.

[0019] In one optional implementation, the downlink plaintext service payload is encrypted and encapsulated step-by-step using a key set to obtain an Ethernet frame, including: The downlink plaintext service payload is encrypted using the application layer key and a verification tag is attached to obtain the service ciphertext; Obtain the current session's service transmission status, generate application layer session fields and service verification codes based on the service transmission status, construct application layer private headers based on the application layer session fields and service verification codes, and encrypt the application layer private headers and service ciphertext using the transport layer key to obtain application layer ciphertext. Obtain the dynamic transmission field, construct the transport layer private header based on the dynamic transmission field, and encrypt the transport layer private header and application layer ciphertext using the network layer key to obtain the transport layer ciphertext. The process involves obtaining terminal identity information, generating basic network layer fields and custom extended fields based on the terminal identity information, filling the transport layer ciphertext with the basic network layer fields and custom extended fields to obtain a standard IP header, and performing link layer normalization on the standard IP header to obtain an Ethernet frame. The link layer normalization process includes: uniform message length, frame alignment, encapsulation of Ethernet frame header, and generation of frame check sequence.

[0020] Beneficial effects: A top-down, hierarchical encryption encapsulation and normalization mechanism was designed for the downlink direction. By sequentially constructing encrypted application layer private headers and encrypted transport layer private headers, and finally filling the transport layer ciphertext with network layer basic fields and custom extended fields to obtain the standard IP header, and performing strict link layer normalization processing, not only is the end-to-end confidentiality of core business data and session states at each layer guaranteed, but the final output Ethernet frame is also fully compatible with existing standard network routing and switching equipment, achieving seamless network access.

[0021] Secondly, the present invention provides a hierarchical key private security protocol processing system, comprising: The terminal is used to send uplink messages to the reconfigurable chip and to receive Ethernet frames from the reconfigurable chip. The reconfigurable chip is used to obtain the root key and session master key; generate a key set based on the root key and session master key; receive uplink messages sent by the terminal, perform step-by-step parsing and verification of the uplink messages, and after the verification is successful, use the key set to decrypt the uplink messages layer by layer to obtain the original service payload and output it to the service end. If any level of verification fails, the uplink message is discarded and the step-by-step parsing and verification of the upper layer messages is blocked. On the service side, it is used to receive the original service payload and send the downlink plaintext service payload to the reconfigurable chip; The reconfigurable chip is also used to receive downlink plaintext service payloads, perform step-by-step encryption and encapsulation using a key set, obtain Ethernet frames, and output them to the terminal.

[0022] Thirdly, the present invention provides a layered key private security protocol processing apparatus, comprising: The acquisition module is used to obtain the root key and session master key; The generation module is used to generate a key set based on the root key and the session master key; The decryption module is used to obtain the uplink message, parse and verify the uplink message level by level. After the verification is successful, the uplink message is decrypted layer by layer using the key set to obtain the original service payload. If any level of verification fails, the uplink message is removed and the layer-by-layer parsing and verification of the upper layer message is blocked. The encryption module is used to acquire the downlink plaintext service payload and encapsulate it step by step using a key set to obtain an Ethernet frame.

[0023] Fourthly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform a hierarchical key private security protocol processing method according to the first aspect or any corresponding embodiment described above.

[0024] Fifthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute a layered key private security protocol processing method according to the first aspect or any corresponding embodiment described above.

[0025] In a sixth aspect, the present invention provides a computer program product, including computer instructions for causing a computer to execute a layered key private security protocol processing method as described in the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0026] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0027] Figure 1 This is a first flowchart illustrating a layered key private security protocol processing method according to an embodiment of the present invention; Figure 2 This is a second flowchart illustrating a layered key private security protocol processing method according to an embodiment of the present invention; Figure 3 This is a schematic diagram of a hierarchical encryption method according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the third process of a layered key private security protocol processing method according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the fourth process of a layered key private security protocol processing method according to an embodiment of the present invention; Figure 6 This is a schematic diagram of the module design provided in an embodiment of the present invention; Figure 7 This is a structural block diagram of a layered key private security protocol processing device according to an embodiment of the present invention; Figure 8 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0029] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0030] This addresses the technical shortcomings of related technologies, such as poor security isolation due to the use of single-key encryption, the risk of single-point leakage leading to global risks, and the discrete message verification logic that cannot directly remove abnormal messages at the underlying level, resulting in significant CPU consumption and processing latency.

[0031] This invention addresses the disconnect between security policies and key systems at different protocol levels. It obtains the root key and session master key, and generates a key set based on these keys to construct an independent, isolated, layered protection system. Secondly, to establish a bidirectional, pipelined, step-by-step, strongly dependent interception mechanism and avoid unnecessary computational waste, when processing uplink traffic, it acquires uplink packets and performs step-by-step parsing and verification. Upon successful verification, the key set is used to decrypt the uplink packets layer by layer to obtain the original service payload. Specifically, if any level of verification fails, the uplink packet is discarded, and the step-by-step parsing and verification of upper-layer packets is blocked, thus directly achieving physical interception of attack traffic at the lower level. Finally, when processing downlink traffic, it acquires the downlink plaintext service payload and uses the key set to perform step-by-step encryption and encapsulation of the downlink plaintext service payload to obtain Ethernet frames. This perfectly resolves the technical contradictions of traditional solutions, achieving a synergistic and balanced improvement in network security protection effectiveness and high-throughput packet forwarding performance.

[0032] According to an embodiment of the present invention, a method for processing a hierarchical key private security protocol is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0033] This embodiment provides a hierarchical key private security protocol processing method, which can be used in the aforementioned electronic devices. Figure 1This is a schematic diagram of the first process of a layered key private security protocol processing method according to an embodiment of the present invention, as shown below. Figure 1 As shown, the process includes the following steps: Step S101: Obtain the root key and session master key.

[0034] Specifically, the root key refers to the trusted basic key permanently stored in the built-in security IP core of the reconfigurable chip, which circulates entirely within the chip and is not exposed externally. The session master key refers to the unique trusted key source generated through identity authentication and trusted negotiation mechanisms when a terminal accesses the network.

[0035] In the early stages of business operation or session establishment, the root key and session master key are securely obtained. This process establishes the endpoints of the trust chain throughout the entire protocol processing, providing the most basic and core cryptographic support for the subsequent construction of a cross-layer hierarchical key security mechanism.

[0036] Step S102: Generate a key set based on the root key and the session master key.

[0037] Specifically, a key set refers to a group of independent, non-reusable, and hierarchically isolated dedicated working keys derived from underlying basic key materials. It is specifically used to achieve differentiated isolation and protection at different levels of network protocols. It consists of SM4 (short for commercial cryptography) working keys, which refers to the commercial block cipher algorithm issued by the State Cryptography Administration.

[0038] Using the root key and session master key as inputs, a key set is generated through derivation computation. By generating a key set, the shortcomings of traditional security schemes that use a single key for coarse-grained overall encryption of the entire message are overcome. This enables layered and partitioned fine-grained encryption, thereby avoiding the risk of overall security failure due to the leakage of a single key.

[0039] Step S103: Obtain the uplink message, perform step-by-step parsing and verification of the uplink message, and after the verification is successful, use the key set to decrypt the uplink message layer by layer to obtain the original service payload. If any level of verification fails, the uplink message is removed and the step-by-step parsing and verification of the upper layer message is blocked.

[0040] Specifically, an uplink message refers to the raw network data packet sent by the terminal, containing nested protocol headers. The raw service payload refers to the core plaintext data that has had all network transport protocol headers removed and has been completely decrypted, making it ready for direct business processing by the service end.

[0041] Strictly adhering to a bottom-up decapsulation and security processing logic, the system acquires uplink packets and performs step-by-step parsing and verification. Upon successful verification, the system uses a key set to decrypt the uplink packets layer by layer, obtaining the original business payload. Crucially, a mandatory hardware closed-loop interception mechanism is constructed: if any level of verification fails, the uplink packet is immediately rejected at the underlying hardware level, and the step-by-step parsing and verification of upper-layer packets is blocked. This achieves zero-latency, on-site discarding of malicious packets, thereby preventing unauthorized attack traffic from penetrating to the upper layers and consuming valuable CPU (Central Processing Unit) computing power.

[0042] Step S104: Obtain the downlink plaintext service payload, and use the key set to encrypt and encapsulate the downlink plaintext service payload step by step to obtain an Ethernet frame.

[0043] Specifically, downlink plaintext service payload refers to the core service data generated by the service end and prepared to be sent to the terminal in an unencrypted state. Ethernet frame refers to the low-level output data packet that has undergone encapsulation and normalization at all protocol layers, has a complete structure, and can be directly compatible with and transmitted by existing standard network switches, routers, and other forwarding devices.

[0044] For downlink data, a strict top-down security encapsulation logic is followed. The downlink plaintext service payload is obtained, and a key set is used to encrypt and encapsulate the downlink plaintext service payload step by step. Through this process, the end-to-end confidentiality and tamper-proof capability of core data and session characteristics are ensured, and the Ethernet frames are finally output in a standardized manner, perfectly achieving high-strength private security protection and compatibility with existing network infrastructure.

[0045] This embodiment provides a layered key private security protocol processing method. By obtaining the root key and session master key to generate a key set, it performs step-by-step parsing and verification of uplink packets and decryption layer by layer, and performs step-by-step encryption and encapsulation of downlink plaintext service payloads, thus constructing a bidirectional, step-by-step, strongly constrained security processing mechanism. In particular, if verification fails at any level, the uplink packet is rejected, and the step-by-step parsing and verification of the upper-layer packets is blocked. This can directly intercept malicious attack traffic at the lower level, prevent illegal packets from consuming subsequent system computing power, effectively resolve the contradiction between high-strength security protection and high-speed packet forwarding, and significantly improve network throughput performance and security protection effectiveness.

[0046] This embodiment provides a hierarchical key private security protocol processing method, which can be used in the aforementioned electronic devices. Figure 2 This is a schematic diagram of the second process of a layered key private security protocol processing method according to an embodiment of the present invention, as shown below. Figure 2 As shown, the process includes the following steps: Step S201: Obtain the root key and session master key.

[0047] Specifically, step S201 above includes: Step S2011: Perform two-way authentication of the terminal using an asymmetric algorithm to obtain session key materials.

[0048] Specifically, asymmetric algorithms refer to public-private key encryption mechanisms, such as the SM2 elliptic curve public-key cryptography algorithm, used during low-frequency control signaling interactions like initial network access or periodic key rotation. SM2 refers to the commercially available elliptic curve public-key cryptography algorithm released by the State Cryptography Administration. Session key material refers to a dynamic security element generated by the terminal based on the gateway's public key for subsequent negotiation.

[0049] It unifies the management of terminal online / offline status and processes control signaling such as certificate authentication. It uses asymmetric algorithms to perform two-way identity authentication for terminals, prompting terminals to send authentication messages and obtain session key materials during the authentication process.

[0050] Step S2012: After the terminal's two-way authentication is successful, the session key material is decrypted and restored using the local private key to obtain the session master key.

[0051] Specifically, a local private key refers to a dedicated private key generated by a national cryptographic asymmetric algorithm, stored only in secure memory throughout the entire process, and never distributed to hardware.

[0052] After successful two-way authentication at the terminal, a trusted key exchange is achieved through a public-private key separation security mechanism. The session key material encrypted with the gateway's public key is received, and then the session key material is decrypted and restored in secure memory using the local private key to obtain the session master key.

[0053] Step S202: Generate a key set based on the root key and the session master key. See details below. Figure 1 Step S102 of the illustrated embodiment will not be described again here.

[0054] Step S203: Obtain the uplink message, perform step-by-step parsing and verification of the uplink message. After successful verification, use the key set to decrypt the uplink message layer by layer to obtain the original service payload. If any level of verification fails, the uplink message is discarded, and the step-by-step parsing and verification of the upper-layer message is blocked. For details, please refer to [link to details]. Figure 1 Step S103 of the illustrated embodiment will not be described again here.

[0055] Step S204: Obtain the downlink plaintext service payload, and use the key set to perform step-by-step encryption and encapsulation of the downlink plaintext service payload to obtain the Ethernet frame. For details, please refer to [link to relevant documentation]. Figure 1 Step S104 of the illustrated embodiment will not be described again here.

[0056] This embodiment provides a hierarchical key private security protocol processing method. By utilizing an asymmetric algorithm for two-way terminal authentication, and after successful authentication, using the local private key to decrypt and restore the session key material encrypted with the gateway's public key, the absolute security of the session master key generation process is ensured. This mechanism eliminates the risk of session key material being eavesdropped on or cracked during network transmission, providing a highly reliable security foundation for subsequent hierarchical symmetric key derivation.

[0057] This embodiment provides a hierarchical key private security protocol processing method, which can be used in the aforementioned electronic devices. Figure 3 This is a schematic diagram of a hierarchical encryption method according to an embodiment of the present invention. Specifically, the hierarchical encryption method refers to breaking the traditional single-key whole-packet encryption mode and deriving independent working keys for different protocol levels based on the root key to achieve differentiated security encryption at the protocol level.

[0058] Step S301: Obtain the root key and session master key. For details, please refer to [link to relevant documentation]. Figure 2 Step S201 of the illustrated embodiment will not be described again here.

[0059] Step S302: Generate a key set based on the root key and the session master key.

[0060] Specifically, step S302 above includes: like Figure 3 As shown, after obtaining the root key and session master key, a key derivation algorithm is used to perform parallel hardware computation on the root key and session master key, independently deriving a key set containing network layer keys, transport layer keys, and application layer keys. In this layered and hierarchical encryption protection architecture, a differentiated security mechanism is strictly followed to protect upper-layer protocol fields with lower-layer keys: the bottom-level network layer key is specifically used to encrypt the transport layer private header; the middle-level transport layer key is specifically used to encrypt the application layer private header; and the top-level application layer key is specifically used to encrypt the core business payload. This layered isolation encryption structure, with its one-key-one-lock mechanism, completely solves the technical defect of a single point of key leakage leading to overall security failure.

[0061] Step S3021: Using a key derivation algorithm, calculate the root key and session master key to obtain a key set containing network layer key, transport layer key and application layer key.

[0062] Specifically, key derivation algorithms refer to cryptographic algorithms such as the SMKDF2 standard algorithm used to decompose a high-order key into multiple low-order working keys. SMKDF2 refers to a key derivation function algorithm based on the national cryptographic standard. Network layer keys are working keys used to encrypt transport layer private protocol headers to hide sensitive information such as link session, transmission path identifier, and session state fields. Transport layer keys are working keys used to encrypt application layer private protocol headers to protect session-sensitive data such as application session identifier, message sequence number, service type, and checksum fields. Application layer keys are working keys used to encrypt the original power service payload to ensure the confidentiality and integrity of core business data.

[0063] After the terminal identity is successfully authenticated and a session master key is generated, a key derivation algorithm is used to perform hardware parallel computation with the root key read from the built-in state machine and the session master key as input parameters to independently derive a key set containing network layer keys, transport layer keys, and application layer keys. Subsequently, the hierarchical session keys of online active terminals are distributed to BRAM (Block Random Access Memory) or DDR (Double Data Rate) for hierarchical temporary caching as needed through the PCIe (Peripheral Component Interconnect Express) channel. The key cache is actively cleared when the session ages, the terminal goes offline, or the key is rotated to ensure that no plaintext remains for a long time.

[0064] Step S303: Obtain the uplink message, perform step-by-step parsing and verification of the uplink message. After successful verification, use the key set to decrypt the uplink message layer by layer to obtain the original service payload. If any level of verification fails, the uplink message is discarded, and the step-by-step parsing and verification of the upper-layer message is blocked. For details, please refer to [link to details]. Figure 2 Step S203 of the illustrated embodiment will not be described again here.

[0065] Step S304: Obtain the downlink plaintext service payload, and use the key set to perform step-by-step encryption and encapsulation of the downlink plaintext service payload to obtain an Ethernet frame. For details, please refer to [link to relevant documentation]. Figure 2 Step S204 of the illustrated embodiment will not be described again here.

[0066] This embodiment provides a layered key private security protocol processing method. Utilizing a key derivation algorithm, it calculates a key set containing network layer, transport layer, and application layer keys from the root key and session master key, achieving differentiated isolation encryption at each protocol level. This layered independent key generation mechanism completely breaks through the limitations of traditional single-key whole-packet encryption, making each layer of protection logic independent and avoiding the risk of overall security failure caused by a single point of key leakage.

[0067] This embodiment provides a hierarchical key private security protocol processing method, which can be used in the aforementioned electronic devices. Figure 4 This is a schematic diagram of the third process of a layered key private security protocol processing method according to an embodiment of the present invention, as shown below. Figure 4 As shown, the process includes the following steps: Step S401: Obtain the root key and session master key.

[0068] Step S402: Generate a key set based on the root key and the session master key.

[0069] Step S403: Obtain the uplink message, perform step-by-step parsing and verification of the uplink message, and after the verification is successful, use the key set to decrypt the uplink message layer by layer to obtain the original service payload. If any level of verification fails, the uplink message is removed and the step-by-step parsing and verification of the upper layer message is blocked.

[0070] Specifically, step S403 includes: Step S4031: The integrity of the uplink message is verified by the link layer to obtain a complete Ethernet frame. The complete Ethernet frame includes an Ethernet frame header, a custom extended field, an encrypted transport layer private header, an encrypted application layer private header, and an encrypted service payload.

[0071] Specifically, the link layer refers to the first processing layer in the protocol stack from bottom to top. A complete Ethernet frame refers to a formatted and error-free Ethernet data packet. The Ethernet frame header refers to the basic network link layer structure containing a data preamble, an 8-byte SFD (Start Frame Delimiter), a 6-byte destination MAC (Media Access Control) address, a 6-byte source MAC address, and a 2-byte type or length field. Custom extension fields refer to the reserved extension segments of IPOptions (Internet Protocol Options) selected from the standard IPv4 (Internet Protocol version 4) or IPv6 (Internet Protocol version 6) headers for carrying identity identification. Encrypted transport layer private headers, encrypted application layer private headers, and encrypted service payloads refer to private data segments in the uplink original message that are encrypted layer by layer according to the protocol stack nesting relationship.

[0072] Upon receiving continuously uploaded uplink packets, following a bottom-up decapsulation logic, the integrity of the uplink packets is first verified at the link layer. Specifically, frame length validity checks are performed, which involves counting frame lengths using an SFD (Start-of-Frame Count) counter. For basic frame thresholds of 64 to 1518 bytes and frames tagged with VLAN (Virtual Local Area Network) tags, the range is adaptively adjusted to 64 to 1522 bytes. Frames shorter than 64 bytes are identified as fragmented and malformed frames and discarded, while those longer than the upper limit are identified as excessively long attack frames and discarded. Simultaneously, FCS (Frame Check Sequence) and CRC (Cyclic Redundancy Check) 32 link transmission error detection are performed. An 8-bit single-cycle parallel CRC32 pipeline is used to compare the range from the destination MAC address to the tail of the payload, including a 4-byte FCS. If they do not match, the frame is identified as a line bit error and discarded. In addition, a hardware sliding counting window is opened to perform broadcast storm attack filtering. If the broadcast frame count exceeds the threshold within the window, the frame is identified as a broadcast attack frame and discarded. After the link layer verification passes, a complete Ethernet frame is obtained. The complete Ethernet frame includes an Ethernet frame header, custom extended fields, encrypted transport layer private header, encrypted application layer private header, and encrypted service payload, and is then transmitted without loss.

[0073] Step S4032: Verify the legitimacy of the terminal identity on the complete Ethernet frame through the network layer. After the verification is successful, use the network layer key to decrypt the encrypted transport layer private header to obtain the transport layer plaintext.

[0074] Specifically, the network layer refers to the protocol layer responsible for identity verification and standard IP header parsing. Transport layer plaintext refers to the private data that carries link binding information after the network layer working key streaming encryption protection has been removed.

[0075] After link layer verification, the standard IP header is accurately parsed, and the terminal identity is verified through the network layer on the complete Ethernet frame. After the verification is successful, the network layer key is retrieved, and the encrypted transport layer private header is stream-decrypted using the network layer key. Simultaneously, SM3 hash integrity verification is performed to determine whether malicious tampering has occurred. SM3 is a commercial cryptographic hash algorithm issued by the State Cryptography Administration. Finally, the transport layer plaintext is obtained, and the message is transferred to the transport layer module.

[0076] Specifically, step S4032 above includes: Step a1: Parse the custom extended field to obtain the terminal ID.

[0077] Specifically, the terminal ID refers to the unique identifier of a terminal carried within a custom extended field.

[0078] The custom extended fields are parsed to extract the internal information and obtain the terminal ID.

[0079] Step a2: Use the terminal ID as an index to determine the terminal baseline fingerprint, and calculate the Hamming distance between the real-time fingerprint of the complete Ethernet frame and the terminal baseline fingerprint.

[0080] Specifically, the terminal baseline fingerprint refers to the standard, valid feature fingerprint generated by SM3 hashing of the terminal hardware serial number and historical communication behavior, which is pre-stored in the DDR in batches. The real-time fingerprint refers to the feature fingerprint generated in real time based on the currently incoming complete Ethernet frames. The Hamming distance is a numerical value that measures the degree of deviation between the real-time fingerprint and the baseline fingerprint.

[0081] Using the terminal identifier carried in the message as the primary key and the terminal ID as the index, the pre-stored information is read through the AXI (Advanced deXtensible Interface) high-speed bus to determine the terminal baseline fingerprint. At the same time, the Hamming distance between the real-time fingerprint of the complete Ethernet frame and the terminal baseline fingerprint is calculated through a parallel XOR array.

[0082] Step a3: When the Hamming distance is less than or equal to the preset trust threshold, the terminal identity legality verification is confirmed to be passed, and the private header of the encrypted transport layer is decrypted using the network layer key to obtain the transport layer plaintext.

[0083] Specifically, the preset trust threshold refers to a pre-configured value used to measure the maximum tolerance limit for fingerprint deviation.

[0084] The calculated deviation value is compared with the threshold value. When the Hamming distance is less than or equal to the preset trust threshold, the terminal identity is verified as legitimate, preventing impersonation and tampering attacks. The working key in the cache is retrieved, and the network layer key is used to decrypt the private header of the encrypted transport layer to obtain the transport layer plaintext.

[0085] Step S4033: The transport layer performs link legitimacy verification on the transport layer plaintext. After the verification is successful, the transport layer key is used to decrypt the encrypted application layer private header to obtain the application layer plaintext.

[0086] Specifically, the transport layer refers to the protocol layer responsible for verifying the legitimacy and trusted state of link binding relationships. Application layer plaintext refers to the data obtained after decryption, carrying session sequence numbers and service characteristics.

[0087] After obtaining the transport layer plaintext, the transport layer performs link legitimacy verification on the transport layer plaintext, filters cross-terminal hijacking messages and out-of-order expired messages, and retrieves the transport layer key from the hierarchical cache after the verification is passed. The transport layer key is then used to decrypt the encrypted application layer private header as a whole, and SM3 integrity checks are performed to obtain the application layer plaintext.

[0088] Specifically, step S4033 includes: Step b1: Extract the link binding ID, transmission path identifier, and session state field from the transport layer plaintext.

[0089] Specifically, the link binding ID is a unique session number assigned after two-way authentication to isolate multiple terminal sessions and prevent session hijacking. The transmission path identifier is a path label that records the forwarding of virtual LAN and switch port numbers. The session state field is a communication status description using segmented marking, specifically including session valid bits, key pending rotation bits, backup link bits, and reserved bits.

[0090] From the decrypted and restored transport layer plaintext, extract the link binding ID, transmission path identifier, and session state fields for subsequent validity verification and comparison.

[0091] Step b2: Retrieve the session mapping table to obtain triplet data.

[0092] Specifically, the session mapping table refers to the hardware mapping forwarding table maintained in the on-chip BRAM for storing session binding relationships and path states. The triplet data refers to the combination of link binding identifier, valid path identifier, and session online tag data pre-stored in the mapping table that is legally associated with the terminal.

[0093] At the hardware level, the terminal identifier of the current message is used as the primary key to retrieve the session mapping table and hardware path forwarding table, read the pre-stored valid binding information, and obtain the triple data.

[0094] Step b3 involves performing a full-byte equivalence comparison of the link binding ID, transmission path identifier, session state field, and triplet data. If they match completely, the link validity verification passes.

[0095] Specifically, the extracted link binding ID, transmission path identifier, and session state fields are compared byte-by-byte with the triplet data obtained from the lookup table. Boundary checks and rule verifications are also performed, requiring that the decrypted path identifier fall within the range of currently valid online path numbers. Path identifiers with all zeros, exceeding the maximum path number, or marked as link failures are all considered invalid. Additionally, the session validity bit must be 1, the reserved bits must be all 0, and the key rotation bit and the backup link bit cannot be set to 1 simultaneously to prevent conflicts. If the above checks match perfectly and there are no anomalies, the link legitimacy verification passes.

[0096] Step S4034: Perform header integrity verification on the plaintext of the application layer through the application layer. After the verification is successful, use the application layer key to decrypt the encrypted service payload to obtain the original service payload.

[0097] Specifically, the application layer refers to the highest protocol layer that performs business-level security checks and payload decryption. Header integrity checks refer to the comparison operations performed on keywords such as business type and checksum in the application layer packet header to prevent segment loss, out-of-order delivery, and tampering.

[0098] Extract application layer header keywords for packet header and packet verification. Perform header integrity verification on plaintext at the application layer. Investigate anomalies such as message tampering, segment loss, and out-of-order delivery. After successful verification, retrieve the independent final dedicated working key. Use the application layer key to perform dedicated decryption operations on the encrypted business payload to obtain power private business data, obtain the original business payload, and transmit it to the business end.

[0099] Step S4035: Record the abnormal characteristics of the failed verification. The abnormal characteristics include the abnormal terminal ID, the protocol level at which the abnormality occurred, and the type of abnormality.

[0100] Specifically, anomaly characteristics refer to audit elements captured in real time when attack behaviors such as abnormal length, CRC errors, Hamming distance exceeding the threshold, or hash check mismatch are detected during the step-by-step decapsulation process of the bidirectional hardware pipeline. Anomaly terminal ID refers to the illegal or spoofed identity that triggers security interception. Anomaly occurrence protocol level refers to the specific location where the anomaly was detected. Anomaly type refers to the specific type of attack identified, such as broadcast storm attacks, malicious tampering, or identity forgery.

[0101] All abnormal packets are identified and discarded instantly within the hardware pipeline, eliminating the need for CPU processing and thus avoiding the consumption of backbone bandwidth and computing resources. Blocking information is captured in real time, recording the abnormal characteristics that trigger verification failures. These characteristics include the abnormal terminal ID, the protocol level at which the abnormality occurred, and the type of abnormality, along with a timestamp.

[0102] Step S4036: Generate a lightweight event log based on the anomaly characteristics.

[0103] Specifically, lightweight event logs refer to concise event message packets generated by stripping redundant message data from captured audit elements, which consume very little bandwidth.

[0104] The extracted audit element data is integrated and lightweight event logs are generated based on anomaly characteristics. These logs are then uploaded asynchronously for background log aggregation, security auditing, and attack tracing analysis, achieving a two-layer security loop of real-time hardware defense and post-event software auditing.

[0105] Step S404: Obtain the downlink plaintext service payload, and use the key set to encrypt and encapsulate the downlink plaintext service payload step by step to obtain an Ethernet frame.

[0106] This embodiment provides a layered key private security protocol processing method that constructs a bottom-up, strictly dependent, step-by-step parsing and decryption process. The lower-layer protocol key decrypts the adjacent upper-layer private header, forming a one-key-one-lock, onion-peeling nested protection structure. Only after the integrity and legitimacy verification of the current layer is passed can the plaintext features of the next layer be obtained, completely cutting off the paths of cross-layer composite attacks and layered bypass attacks from a physical and logical perspective. After blocking the step-by-step parsing and verification of upper-layer packets, lightweight security auditing and fault tracing are achieved by recording abnormal terminal IDs, abnormal protocol levels, and abnormal types, and generating lightweight event logs. This processing method can discard massive amounts of abnormal attack data packets while accurately retaining core attack clues, without consuming system backbone bandwidth and core computing power, and ensuring closed-loop management of security defense.

[0107] This embodiment provides a hierarchical key private security protocol processing method, which can be used in the aforementioned electronic devices. Figure 5 This is a schematic diagram of the fourth process of a layered key private security protocol processing method according to an embodiment of the present invention, as shown below. Figure 5 As shown, the process includes the following steps: Step S501: Obtain the root key and session master key. For details, please refer to [link to relevant documentation]. Figure 4 Step S401 of the illustrated embodiment will not be described again here.

[0108] Step S502: Generate a key set based on the root key and the session master key. See details below. Figure 4 Step S402 of the illustrated embodiment will not be described again here.

[0109] Step S503: Obtain the uplink message, perform step-by-step parsing and verification of the uplink message. After successful verification, use the key set to decrypt the uplink message layer by layer to obtain the original service payload. If any level of verification fails, the uplink message is discarded, and the step-by-step parsing and verification of the upper-layer message is blocked. For details, please refer to [link to details]. Figure 4 Step S403 of the illustrated embodiment will not be described again here.

[0110] Step S504: Obtain the downlink plaintext service payload, and use the key set to encrypt and encapsulate the downlink plaintext service payload step by step to obtain an Ethernet frame.

[0111] Specifically, step S504 above includes: Step S5041: Encrypt the downlink plaintext service payload using the application layer key and attach a verification tag to obtain the service ciphertext.

[0112] Specifically, the verification tag refers to the SM3 hash integrity digest tag obtained by hardware parallel computing of the plaintext payload. The business ciphertext refers to the core inner layer ciphertext data that has undergone high-strength hardware encryption and possesses confidentiality and tamper-proof properties.

[0113] For downlink trusted messages, following a top-down protocol reconstruction logic, the application-layer exclusive working key issued by the corresponding terminal is first invoked. The application-layer key is used to encrypt the downlink plaintext service payload, and a hash integrity digest is generated simultaneously and a verification tag is attached to the end of the payload to ensure the end-to-end confidentiality of core business data, thus obtaining the business ciphertext.

[0114] Step S5042: Obtain the service transmission status of the current session, generate an application layer session field and a service verification code based on the service transmission status, construct an application layer private header based on the application layer session field and the service verification code, and encrypt the application layer private header and the service ciphertext using the transport layer key to obtain the application layer ciphertext.

[0115] Specifically, the service transmission status refers to dynamic parameters such as timeouts or retransmissions during the current communication interaction. The application layer session field refers to the current session sequence number and session retransmission flag, read and updated based on the current status. The service checksum refers to a hash digest field calculated in parallel by hardware using the complete service plaintext payload, the updated session sequence number, and the fragment identifier as input. The application layer private header refers to the complete private protocol structure assembled after filling in the application layer session number, message type, and service checksum. The application layer ciphertext refers to the intermediate ciphertext block protected by the transport layer working key.

[0116] The system obtains the current session's service transmission status based on the service operation status, reads the current session sequence number based on the service transmission status, and synchronously updates the flag in case of session timeout or retransmission scenarios, generating application layer session fields and service verification codes. It then fills in the application layer session number and message type, constructing an application layer private header based on the application layer session fields and service verification codes. Subsequently, it calls the second-level dedicated working key, using the transport layer key to encrypt the application layer private header and the entire ciphertext, and attaches a verification tag to mitigate the risk of application layer private field leakage and tampering, obtaining the application layer ciphertext.

[0117] Step S5043: Obtain the dynamic transmission field, construct the transport layer private header based on the dynamic transmission field, and encrypt the transport layer private header and application layer ciphertext using the network layer key to obtain the transport layer ciphertext.

[0118] Specifically, dynamic transmission fields refer to sensitive fields that include link binding identifiers, real-time forwarding transmission path identifiers, and session state fields, and are dynamically updated on a per-packet basis. Transport layer private headers refer to private transport protocol packet headers assembled by filling in the above three types of dynamic fields and calculating the transport layer header checksum. Transport layer ciphertext refers to the outermost private protocol wrapper formed after being stream-encrypted by the network layer working key.

[0119] The process involves retrieving the session mapping table and path forwarding table from the on-chip BRAM using identifiers. Based on load balancing and link failures, the path identifier lookup and table filling are performed at the hardware layer to obtain the dynamic transmission field. After field filling, a checksum is calculated, and a transport layer private header is constructed based on the dynamic transmission field. Next, the outermost dedicated encryption working key is invoked, and the network layer key is used to perform streaming overall encryption and hash verification on the transport layer private header and application layer ciphertext. This completely converts topology mapping sensitive information such as link sessions and transmission paths into ciphertext, resulting in the transport layer ciphertext.

[0120] Step S5044: Obtain terminal identity information, generate network layer basic fields and custom extended fields based on terminal identity information, fill the network layer basic fields and custom extended fields into the transport layer ciphertext to obtain the standard IP header, and perform link layer normalization processing on the standard IP header to obtain an Ethernet frame; the link layer normalization processing includes: uniform message length, frame alignment, encapsulation of Ethernet frame header and generation of frame check sequence.

[0121] Specifically, terminal identity information refers to the unique identifier of the terminal device receiving the downlink message. Network layer basic fields refer to the standard IPv4 or IPv6 header's required source and destination IP addresses, TTL (Time To Live), and protocol type, among other specified fields. The standard IP header refers to the assembled, standardized network layer header that is directly compatible with and can be routed by existing network switches or routers. Link layer normalization refers to the overall message standardization process integrating bus byte alignment, short frame padding, CRC generation, and frame header normalization. Message length unification refers to the short frame padding operation where the total length of the Ethernet header and IP message is calculated and automatically padded with zeros at the end when it is less than 60 bytes to ensure the minimum frame length. Frame alignment refers to the operation of uniformly shifting and aligning the bus message to standard byte boundaries to avoid bit misalignment errors. Encapsulating the Ethernet frame header refers to the operation of filling in the preset source MAC address, destination MAC address, and Ethernet type fields, and inserting VLAN tags as needed.

[0122] After all three layers of private protocol ciphertext are constructed, the communication identifier of the destination terminal is extracted to obtain the terminal's identity information. The standard protocol header infrastructure is assembled, generating basic network layer fields and custom extended fields for writing identity data in the reserved segment based on the terminal's identity information. Subsequently, the basic network layer fields and custom extended fields are filled into the transport layer ciphertext to obtain the standard IP header. Finally, the outermost Ethernet frame encapsulation and standardization reassembly are performed, and the standard IP header undergoes link-layer normalization processing, specifically performing message length unification, frame alignment, Ethernet frame header encapsulation, and frame check sequence generation. After normalization and reassembly, a complete, sequential, and protocol-compliant physical transmission unit is output. This unit is then transmitted via a high-speed DMA (Direct Memory Access) channel and backpressure is eliminated through traffic shaping buffering, ultimately resulting in an Ethernet frame for line-speed output.

[0123] This embodiment provides a layered key private security protocol processing method, which designs a top-down, hierarchical encryption encapsulation and normalization mechanism for the downlink direction. By sequentially constructing an encrypted application layer private header and an encrypted transport layer private header, and finally filling the transport layer ciphertext with network layer basic fields and custom extended fields to obtain a standard IP header, and performing strict link layer normalization processing, it not only ensures the end-to-end confidentiality of core business data and session states at each layer, but also makes the final output Ethernet frame fully compatible with existing standard network routing and switching equipment, achieving seamless network access.

[0124] Figure 6 This is a schematic diagram of the module design provided in an embodiment of the present invention. Specifically, the module design refers to a layered hardware and software collaborative optimization architecture that is embedded within a reconfigurable chip for typical business scenarios involving millions of terminals with long-term connections and high-concurrency access in power private networks.

[0125] The global shared module refers to a full-process shared support module that provides a unified security foundation and anomaly protection capabilities for uplink and downlink bidirectional service pipelines. It internally comprises two core units: a layered independent key management module and an anomaly logging and hardware interception module. The uplink packet parsing and verification module consists of six sub-modules: Ethernet packet input, link layer, network layer, transport layer, and application layer. It is a pure hardware pipeline specifically designed to handle terminal-uploaded data. The downlink packet encryption and encapsulation module consists of six sub-modules: service payload encryption, application layer header encryption and proprietary encapsulation, transport layer header encryption and proprietary encapsulation, network layer standard protocol encapsulation, link layer frame warping and timing reassembly, and Ethernet packet output. It is a pure hardware pipeline used to achieve secure closed-loop hardware output of trusted packets.

[0126] like Figure 6 As shown, taking the data interaction scenario between the electricity information collection master station and the power terminal as an example, the hierarchical independent key management module in the global shared module generates a key set by obtaining the root key and the session master key. For hundreds of thousands of concurrent access terminals, it adopts a mechanism of temporarily caching the active terminal keys in BRAM, providing a hierarchical and independent security foundation for bidirectional message processing across the entire network.

[0127] In the uplink direction, the uplink packet parsing and verification module acquires the uplink packet and performs step-by-step parsing and verification. For example, at the link layer, it verifies the broadcast frame count of the window; at the network layer, it verifies the terminal fingerprint Hamming distance. After each layer of verification is successful, the uplink packet is decrypted layer by layer using the corresponding key in the key set, and finally plaintext collection data is output to obtain the original service payload. If a broadcast storm attack or spoofed terminal access occurs during the above process, causing any level of verification to fail, the anomaly log and hardware interception module in the global shared module will directly remove the uplink packet at the bottom layer and block subsequent step-by-step parsing and verification of the uplink packet. At the same time, it will record the anomaly characteristics and generate a lightweight event log report. In the downlink direction, the downlink message encryption and encapsulation module obtains the downlink plaintext service payload and uses the key set to encrypt and encapsulate the downlink plaintext service payload step by step. It sequentially performs processes such as encrypting the service payload, looking up and updating the dynamic transmission field and encapsulating the private header, and writing the custom extension field from the inside out. Finally, after frame normalization and timing reassembly, the Ethernet frame is obtained, and the encrypted Ethernet frame is output to the outside at a multi-10 Gigabit line speed through the high-speed DMA channel.

[0128] As a specific application embodiment of the present invention, combined with a layered key private security protocol processing system, taking the specific business scenario of a power massive terminal access gateway as an example, namely, accessing distribution terminals, IoT terminals or smart meters with millions of long connections, a complete secure interaction closed loop is constructed through collaborative terminals, reconfigurable chips and business terminals; wherein, the terminal performs identity authentication and message sending and receiving, the business terminal processes the reception and distribution of the original business payload, the reconfigurable chip performs key set derivation, uplink message hierarchical parsing verification and decryption, and downlink message hierarchical encryption encapsulation and regularization, and by deploying a mandatory dependency-type hardware pipeline at the bottom layer, malicious traffic is intercepted and discarded in real time, ensuring end-to-end data confidentiality while avoiding the ineffective consumption of computing power of the upper layer system.

[0129] First, the electrical initialization and root key and session master key acquisition stages are performed. The reconfigurable chip board powers on, reads the permanently stored root key, and locks the external read path of the built-in security encryption kernel. Then, the unique identifiers and baseline fingerprints of a massive number of terminals are batch-distributed to the Double Data Rate Synchronous Dynamic Random Access Memory (DMR) for pre-storage. When a terminal first joins the network, asymmetric algorithms are used to perform two-way authentication, generating a session master key. Next, a key set is generated based on the root key and session master key. Through the high-speed peripheral component interconnect channel, the hierarchical keys and session binding relationships of online active terminals are distributed to the reconfigurable chip. During this process, to address the limited hardware cache capacity of the reconfigurable chip, a large-scale terminal dynamic scheduling mechanism based on an adaptive strategy is adopted. This mechanism defaults to the Least Recently Used (LRU) eviction policy and introduces the maximum key context lifetime as a fallback constraint. It automatically identifies long-term silent terminals and proactively clears their idle block random access memory (BRAM) or DMR key caches, prioritizing the retention of key resources for high-frequency active terminals. This achieves adaptive and efficient scheduling of massive terminal keys under limited hardware resources.

[0130] Secondly, during the uplink service interaction phase, electricity consumption information collection and reporting was selected as the implementation sample. Uplink messages were acquired and parsed and verified level by level. Parallel link-layer verifications, such as frame length detection, cyclic redundancy check, and window broadcast counting, were performed. Then, custom extended fields were parsed to extract the terminal identifier, the baseline fingerprint was retrieved from a table, and the Hamming distance was calculated for network-layer verification. After each level of verification passed, the uplink messages were decrypted layer by layer using a key set. The network-layer key was retrieved to decrypt the encrypted transport-layer private header, the transport-layer key was retrieved to decrypt the encrypted application-layer private header, and finally, the application-layer key was retrieved to decrypt the encrypted service payload, outputting plaintext collected data to obtain the original service payload, which was then sent to the backend service terminal for processing.

[0131] Next, in the downlink service interaction phase, taking the plaintext command issued by the electricity information collection master station as an example, the downlink plaintext service payload is obtained and encrypted and encapsulated step by step using a key set. This involves sequentially executing actions such as retrieving the application layer key to encrypt the downlink plaintext service payload and attaching a verification tag, assembling the application layer private header and encrypting it using the transport layer key, looking up and updating the dynamic transmission field to construct the transport layer private header and encrypting it entirely using the network layer key. Subsequently, a custom extended field containing terminal identity information is written, and after link layer normalization processing such as frame normalization and short frame padding, an Ethernet frame is finally obtained. The compliant Ethernet frame is output through traffic shaping, enabling multi-gigabit line-speed transmission to the terminal.

[0132] Finally, in the end-to-end security protection and anomaly interception phase, pipeline-level real-time blocking is implemented for different attack behaviors. During the aforementioned uplink parsing process, if any level of verification fails, the uplink packet is discarded, and the layer-by-layer parsing and verification of the upper-layer packet is blocked. The anomaly characteristics that trigger the verification failure are recorded, and a lightweight event log is generated. Specific interception scenarios cover the following four: Scenario 1: To deal with broadcast storm attack packets, during link layer detection, when the window broadcast frame count exceeds a preset threshold, the hardware directly discards the packet and reports the anomaly log without consuming central processing unit computing power. Scenario 2: To deal with spoofed terminal packets, during network layer verification, when the Hamming distance is greater than a preset trusted threshold, the hardware discards the packet on-site and reports the spoofed terminal alarm log to prompt the push of operation and maintenance alarms. Scenario 3: To deal with malicious packet tampering, if the hash integrity check does not match during the decryption process, the hardware directly discards the packet and records the anomaly characteristics such as the protocol layer at which the tampering occurred, the abnormal terminal identifier, and the timestamp. Scenario 4 addresses the issue of persistent brute-force attacks. When a terminal fails to decrypt or perform hash verification multiple times consecutively, the hardware proactively clears all three layers of key caches corresponding to that terminal and issues a shutdown command to force the terminal to re-initiate authentication. Through the coordinated efforts of the hardware and software throughout this entire process, reliable and secure access for a massive number of power terminals with high concurrency is perfectly supported.

[0133] This embodiment also provides a hierarchical key private security protocol processing device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0134] This embodiment provides a layered key private security protocol processing device, such as... Figure 7 As shown, it includes: Module 701 is used to obtain the root key and session master key; The generation module 702 is used to generate a key set based on the root key and the session master key; The decryption module 703 is used to obtain the uplink message, perform step-by-step parsing and verification of the uplink message, and after the verification is passed, use the key set to decrypt the uplink message layer by layer to obtain the original service payload. If any level of verification fails, the uplink message is removed and the step-by-step parsing and verification of the upper layer message is blocked. The encryption module 704 is used to obtain the downlink plaintext service payload and use the key set to encrypt and encapsulate the downlink plaintext service payload step by step to obtain the Ethernet frame.

[0135] In some alternative implementations, the acquisition module 701 includes: The terminal authentication unit is used to perform two-way terminal authentication using an asymmetric algorithm to obtain session key materials. The key material decryption unit is used to decrypt and restore the session key material using the local private key after the terminal's two-way authentication is successful, in order to obtain the session master key.

[0136] In some alternative implementations, the generation module 702 includes: The key calculation unit is used to calculate the root key and session master key using a key derivation algorithm to obtain a key set containing network layer keys, transport layer keys, and application layer keys.

[0137] In some alternative implementations, the decryption module 703 includes: The complete Ethernet frame obtaining unit is used to perform integrity verification on the uplink message through the link layer to obtain a complete Ethernet frame. The complete Ethernet frame includes an Ethernet frame header, custom extended fields, encrypted transport layer private header, encrypted application layer private header, and encrypted service payload. The terminal identity legitimacy verification unit is used to verify the legitimacy of the terminal identity on the complete Ethernet frame through the network layer. After the verification is successful, the network layer key is used to decrypt the private header of the encrypted transport layer to obtain the transport layer plaintext. The transport layer plaintext legitimacy verification unit is used to verify the link legitimacy of the transport layer plaintext through the transport layer. After the verification is passed, the transport layer key is used to decrypt the encrypted application layer private header to obtain the application layer plaintext. The application layer plaintext header integrity verification unit is used to perform header integrity verification on the application layer plaintext through the application layer. After the verification is passed, the encrypted business payload is decrypted using the application layer key to obtain the original business payload. The abnormal feature recording unit is used to record the abnormal features of the failed verification. The abnormal features include the abnormal terminal ID, the abnormal occurrence protocol level, and the abnormal type. The lightweight event log generation unit is used to generate lightweight event logs based on anomaly characteristics.

[0138] In some optional implementations, the terminal identity verification unit includes: A custom extended field parsing unit is used to parse custom extended fields to obtain the terminal ID; The terminal baseline fingerprint determination unit is used to determine the terminal baseline fingerprint by using the terminal ID as an index, and to calculate the Hamming distance between the real-time fingerprint of the complete Ethernet frame and the terminal baseline fingerprint. The encrypted transmission header decryption unit is used to determine that the terminal identity verification is successful when the Hamming distance is less than or equal to a preset trust threshold, and to decrypt the encrypted transmission layer private header using the network layer key to obtain the transmission layer plaintext.

[0139] In some optional implementations, the transport layer plaintext validity verification unit includes: The transport layer plaintext extraction unit is used to extract the link binding ID, transmission path identifier, and session state field from the transport layer plaintext. The on-chip session mapping table retrieval unit is used to retrieve the session mapping table and obtain triple data. The link validity verification unit is used to perform a full-byte equal-value comparison of the link binding ID, transmission path identifier, session state field, and triple data. If they match completely, the link validity verification passes.

[0140] In some alternative implementations, the encryption module 704 includes: The business ciphertext encryption unit is used to encrypt the downlink plaintext business payload using the application layer key and attach a verification tag to obtain the business ciphertext. The application layer private header construction unit is used to obtain the service transmission status of the current session, generate application layer session fields and service verification codes based on the service transmission status, construct application layer private headers based on application layer session fields and service verification codes, and encrypt application layer private headers and service ciphertexts using transport layer keys to obtain application layer ciphertexts. The transport layer private header construction unit is used to obtain dynamic transmission fields, construct transport layer private headers based on dynamic transmission fields, and encrypt the transport layer private headers and application layer ciphertexts using network layer keys to obtain transport layer ciphertexts. The standard IP header acquisition unit is used to obtain terminal identity information. Based on the terminal identity information, network layer basic fields and custom extended fields are generated. The network layer basic fields and custom extended fields are filled into the transport layer ciphertext to obtain the standard IP header. The standard IP header is then subjected to link layer normalization processing to obtain the Ethernet frame. The link layer normalization processing includes: message length unification, frame alignment, encapsulation of Ethernet frame header, and generation of frame check sequence.

[0141] The hierarchical key private security protocol processing apparatus provided in this embodiment of the invention can execute a hierarchical key private security protocol processing method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method. Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0142] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0143] The following is a detailed reference. Figure 8 This diagram illustrates a suitable structural schematic for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 801, which can perform various appropriate actions and processes based on a program stored in read-only memory (ROM) 802 or a program loaded from memory 808 into random access memory (RAM) 803. The RAM 803 also stores various programs and data required for the operation of the electronic device. The processor 801, ROM 802, and RAM 803 are interconnected via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0144] Typically, the following devices can be connected to I / O interface 805: input devices 806 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 807 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 808 including, for example, magnetic tapes, hard disks, etc.; and communication devices 809. Communication device 809 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 8 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0145] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 809, or installed from a memory 808, or installed from a ROM 802. When the computer program is executed by a processor 801, it performs the functions defined in a hierarchical key private security protocol processing method according to embodiments of the present invention.

[0146] Figure 8 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of the present invention.

[0147] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as recordable on a storage medium, or implemented as computer code downloaded over a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, it implements the hierarchical key private security protocol processing method shown in the above embodiments.

[0148] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0149] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for processing a hierarchical key private security protocol, characterized in that, The method includes: Obtain the root key and session master key; Generate a key set based on the root key and the session master key; The uplink message is acquired, and the uplink message is parsed and verified level by level. After the verification is passed, the uplink message is decrypted layer by layer using the key set to obtain the original service payload. If any level of verification fails, the uplink message is removed and the layer-by-layer parsing and verification of the upper layer message is blocked. The downlink plaintext service payload is obtained, and the downlink plaintext service payload is encrypted and encapsulated step by step using the key set to obtain an Ethernet frame.

2. The method according to claim 1, characterized in that, The session master key is obtained through the following methods: Asymmetric algorithms are used to perform two-way authentication of the terminal to obtain session key materials; After successful two-way authentication on the terminal, the session key material is decrypted and restored using the local private key to obtain the session master key.

3. The method according to claim 1, characterized in that, The step of generating a key set based on the root key and the session master key includes: Using a key derivation algorithm, the root key and the session master key are calculated to obtain a key set containing network layer keys, transport layer keys, and application layer keys.

4. The method according to claim 3, characterized in that, The protocol stack of the uplink message includes, from bottom to top, the link layer, network layer, transport layer, and application layer; The uplink message is parsed and verified level by level. After successful verification, the uplink message is decrypted layer by layer using the key set to obtain the original service payload, including: The link layer performs integrity verification on the uplink message to obtain a complete Ethernet frame. The complete Ethernet frame includes an Ethernet frame header, a custom extended field, an encrypted transport layer private header, an encrypted application layer private header, and an encrypted service payload. The network layer verifies the legitimacy of the terminal identity in the complete Ethernet frame. After the verification is successful, the network layer key is used to decrypt the encrypted transport layer private header to obtain the transport layer plaintext. The transport layer performs link legitimacy verification on the transport layer plaintext. After the verification is successful, the transport layer key is used to decrypt the encrypted application layer private header to obtain the application layer plaintext. The application layer performs header integrity verification on the plaintext of the application layer. After the verification is successful, the encrypted service payload is decrypted using the application layer key to obtain the original service payload.

5. The method according to claim 4, characterized in that, The process involves verifying the terminal's identity legitimacy within the complete Ethernet frame via the network layer. Upon successful verification, the network layer key is used to decrypt the encrypted transport layer private header to obtain the transport layer plaintext, including: The custom extended field is parsed to obtain the terminal ID; Using the terminal ID as an index, determine the terminal baseline fingerprint, and calculate the Hamming distance between the real-time fingerprint of the complete Ethernet frame and the terminal baseline fingerprint; When the Hamming distance is less than or equal to a preset trust threshold, the terminal identity verification is confirmed to be successful, and the network layer key is used to decrypt the encrypted transport layer private header to obtain the transport layer plaintext.

6. The method according to claim 4, characterized in that, The link validity verification of the transport layer plaintext through the transport layer includes: Extract the link binding ID, transmission path identifier, and session state field from the transport layer plaintext; Retrieve the session mapping table to obtain triplet data; The link binding ID, the transmission path identifier, the session state field, and the triplet data are compared byte-by-byte. If they match completely, the link validity verification passes.

7. The method according to claim 1, characterized in that, After the layer-by-layer parsing and verification of the blocked upper-layer packets, the method further includes: Record the abnormal characteristics that trigger the verification failure, including the abnormal terminal ID, the abnormal occurrence protocol level, and the abnormal type; A lightweight event log is generated based on the aforementioned anomaly characteristics.

8. The method according to claim 3, characterized in that, The step of using the key set to perform step-by-step encryption and encapsulation of the downlink plaintext service payload to obtain an Ethernet frame includes: The downlink plaintext service payload is encrypted using the application layer key and a verification tag is attached to obtain the service ciphertext. Obtain the service transmission status of the current session, generate an application layer session field and a service verification code based on the service transmission status, construct an application layer private header based on the application layer session field and the service verification code, and encrypt the application layer private header and the service ciphertext using the transport layer key to obtain the application layer ciphertext. Obtain the dynamic transmission field, construct the transport layer private header based on the dynamic transmission field, and encrypt the transport layer private header and the application layer ciphertext using the network layer key to obtain the transport layer ciphertext. The terminal identity information is obtained, and network layer basic fields and custom extended fields are generated based on the terminal identity information. The network layer basic fields and custom extended fields are filled into the transport layer ciphertext to obtain a standard IP header. The standard IP header is then subjected to link layer normalization processing to obtain an Ethernet frame. The link layer normalization processing includes: uniform message length, frame alignment, encapsulation of Ethernet frame header, and generation of frame check sequence.

9. A hierarchical key private security protocol processing system, characterized in that, The system includes: Terminal, reconfigurable chip, and business terminal; The terminal is used to send uplink messages to the reconfigurable chip and to receive Ethernet frames from the reconfigurable chip. The reconfigurable chip is used to obtain the root key and the session master key; generate a key set based on the root key and the session master key; receive uplink messages sent by the terminal, perform step-by-step parsing and verification of the uplink messages, and after successful verification, use the key set to decrypt the uplink messages layer by layer to obtain the original service payload and output it to the service terminal. If any level of verification fails, the uplink message is discarded, and the step-by-step parsing and verification of the upper layer messages is blocked. The service terminal is used to receive the original service payload and send downlink plaintext service payload to the reconfigurable chip. The reconfigurable chip is also used to receive downlink plaintext service payloads, perform step-by-step encryption and encapsulation using the key set, obtain Ethernet frames, and output them to the terminal.

10. A layered key private security protocol processing device, characterized in that, The device includes: The acquisition module is used to obtain the root key and session master key; The generation module is used to generate a key set based on the root key and the session master key; The decryption module is used to acquire uplink messages, perform step-by-step parsing and verification of the uplink messages, and after the verification is successful, use the key set to decrypt the uplink messages layer by layer to obtain the original service payload. If any level of verification fails, the uplink message is discarded and the step-by-step parsing and verification of the upper layer messages is blocked. An encryption module is used to acquire the downlink plaintext service payload and encapsulate the downlink plaintext service payload through step-by-step encryption using the key set to obtain an Ethernet frame.

11. The apparatus according to claim 10, characterized in that, The acquisition module includes: The terminal authentication unit is used to perform two-way terminal authentication using an asymmetric algorithm to obtain session key materials. The key material decryption unit is used to decrypt and restore the session key material using the local private key after the terminal's two-way identity authentication is successful, so as to obtain the session master key.

12. The apparatus according to claim 10, characterized in that, The generation module includes: The key calculation unit is used to calculate the root key and the session master key using a key derivation algorithm to obtain a key set including the network layer key, the transport layer key and the application layer key.

13. The apparatus according to claim 12, characterized in that, The decryption module includes: The complete Ethernet frame obtaining unit is used to perform integrity verification on the uplink message through the link layer to obtain a complete Ethernet frame. The complete Ethernet frame includes an Ethernet frame header, a custom extended field, an encrypted transport layer private header, an encrypted application layer private header, and an encrypted service payload. The terminal identity legitimacy verification unit is used to verify the terminal identity legitimacy of the complete Ethernet frame through the network layer. After the verification is successful, the network layer key is used to decrypt the encrypted transport layer private header to obtain the transport layer plaintext. The transport layer plaintext legitimacy verification unit is used to perform link legitimacy verification on the transport layer plaintext through the transport layer. After the verification is passed, the transport layer key is used to decrypt the encrypted application layer private header to obtain the application layer plaintext. The application layer plaintext header integrity verification unit is used to perform header integrity verification on the application layer plaintext through the application layer, and after the verification is passed, use the application layer key to decrypt the encrypted service payload to obtain the original service payload. An abnormal feature recording unit is used to record the abnormal features that trigger the verification failure. The abnormal features include the abnormal terminal ID, the abnormal occurrence protocol level, and the abnormal type. A lightweight event log generation unit is used to generate lightweight event logs based on the aforementioned anomaly characteristics.

14. The apparatus according to claim 13, characterized in that, The terminal identity verification unit includes: A custom extended field parsing unit is used to parse the custom extended field to obtain the terminal ID; The terminal baseline fingerprint determination unit is used to determine the terminal baseline fingerprint by using the terminal ID as an index, and to calculate the Hamming distance between the real-time fingerprint of the complete Ethernet frame and the terminal baseline fingerprint. The encrypted transmission header decryption unit is used to determine that the terminal identity legitimacy verification is passed when the Hamming distance is less than or equal to a preset trust threshold, and to decrypt the encrypted transmission layer private header using the network layer key to obtain the transmission layer plaintext.

15. The apparatus according to claim 13, characterized in that, The transport layer plaintext validity verification unit includes: The transport layer plaintext extraction unit is used to extract the link binding ID, transmission path identifier and session state field from the transport layer plaintext. The on-chip session mapping table retrieval unit is used to retrieve the session mapping table and obtain triple data. The link validity verification unit is used to perform a full-byte equal-value comparison of the link binding ID, the transmission path identifier, the session state field, and the triplet data. If they match completely, the link validity verification passes.

16. The apparatus according to claim 12, characterized in that, The encryption module includes: The business ciphertext encryption unit is used to encrypt the downlink plaintext business payload using the application layer key and attach a verification tag to obtain the business ciphertext. The application layer private header construction unit is used to obtain the service transmission status of the current session, generate an application layer session field and a service verification code based on the service transmission status, construct an application layer private header based on the application layer session field and the service verification code, and encrypt the application layer private header and the service ciphertext using the transport layer key to obtain the application layer ciphertext. The transport layer private header construction unit is used to obtain dynamic transmission fields, construct a transport layer private header based on the dynamic transmission fields, and encrypt the transport layer private header and the application layer ciphertext using the network layer key to obtain transport layer ciphertext. The standard IP header acquisition unit is used to obtain terminal identity information, generate network layer basic fields and custom extended fields based on the terminal identity information, fill the network layer basic fields and custom extended fields into the transport layer ciphertext to obtain the standard IP header, and perform link layer normalization processing on the standard IP header to obtain an Ethernet frame; the link layer normalization processing includes: uniform message length, frame alignment, encapsulation of Ethernet frame header, and generation of frame check sequence.

17. An electronic device, characterized in that, include: A memory and a processor are interconnected, the memory stores computer instructions, and the processor executes the computer instructions to perform a hierarchical key private security protocol processing method according to any one of claims 1 to 8.

18. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute a layered key private security protocol processing method according to any one of claims 1 to 8.

19. A computer program product, characterized in that, Includes computer instructions for causing a computer to execute a layered key private security protocol processing method according to any one of claims 1 to 8.

Images