558 results about "Master key" patented technology

The invention relates to the technical field of data access security, and discloses a container mirror image security management method and system, and the method comprises the steps: constructing a container mirror image, generating a differential encryption key through a strategy center, carrying out the encryption strategy of a kernel dependence layer, a runtime environment layer, an application code layer and a sensitive configuration layer, and forming a hierarchical protection basis. If an access request is triggered, firstly collecting equipment fingerprints and geofence information and evaluating an environmental risk score, verifying access authority and an access scene matching degree through attribute-based encryption, analyzing operation track characteristics in real time, identifying an abnormal mode, and if the three-layer verification is passed, generating a temporary access token; according to the method, access request authority is verified, a temporary access token is matched, key fragments are synthesized, a master key is only temporarily generated in a memory and encrypted and stored, and through combination of a double-layer encryption channel and inner-layer and outer-layer defense, the anti-attack ability of container mirror image transmission is improved, and man-in-the-middle attack and data tampering are effectively coped with.

The invention discloses a multi-party collaborative signature management method and system based on a key segmentation technology, and relates to the technical field of fragmentation encryption, and the method comprises the steps: initializing data in an encryption system, collecting behavior data when a key anomaly occurs in history, deploying an AI anomaly detection model, generating a master key through a distributed key generation protocol, and generating a multi-party collaborative signature in the encryption system; deriving time by using a hierarchical deterministic algorithm, segmenting a master key to form key fragments, and distributing each fragment to different nodes; formulating a periodic rotation triggering mechanism; calculating an abnormal score of each node, judging whether each node has an abnormal risk or not, and marking the abnormal risk; for the marked nodes with the abnormal risk, fragments are redistributed for alternation; dynamically adjusting the threshold according to the abnormal score; a client initiates a signature request, abnormal nodes are eliminated, fragment node aggregation is screened, and collaborative signature is carried out.

A system includes a plurality of nodes. Each of the plurality of nodes includes memory; a network interface; and a hardware processor coupled with the memory and the network interface. The system further includes a computing device. The computing device includes memory storing a master key, security keys encrypted using the master key, and associations between the security keys and the nodes. The computing device further includes a network interface and a hardware processor coupled with the memory and the network interface. The processor is configured to receive, from a node of the one or more nodes, a request for a security key of the one or more security keys, identify an association between the node and the security key within the associations, decrypt the security key using the master key to generate a decrypted security key, and communicate the decrypted security key to the node.

The invention relates to a health data encryption storage method and device, equipment and a storage medium, and the method comprises the steps: obtaining to-be-processed health data, carrying out the sensitivity analysis and grade division of the health data, and obtaining health data sub-blocks; performing encryption preprocessing on the health data sub-blocks, and performing group data protection according to a preset differential privacy algorithm to obtain encrypted data blocks; generating an initial master key through a hardware security module, and performing derived hierarchical encryption on the encrypted data block to obtain a data encryption key; performing fragmentation processing and regular distributed storage on the data encryption key to obtain a dynamic security key; and performing metadata separation storage on the encrypted data according to the dynamic security key, and performing data permission determination according to a preset role-based access control mechanism to obtain an encrypted isolation database. According to the invention, efficient security protection can be maintained under different application scenes and access permissions, and the risk of data leakage is reduced.

The invention discloses a revocable attribute-based encryption method with strategy hiding, which is based on ciphertext strategy attribute encryption, solves the problem that user privacy is leaked due to disclosure of an access strategy, realizes revocation of fine-grained user attribute access authority, and is proved to be completely safe. In a system establishment stage, system parameters are disclosed, a public key and a master key are generated, an authoritative authority authorizes a data user, distributes a private key and generates an AGK tree and an attribute group key, a data owner generates a ciphertext according to the public key, an access structure set by the data owner and a selected secret value, and the ciphertext is transmitted to the data owner. And then hiding the mapping function by using a cuckoo filter, positioning the attribute by a data user through the cuckoo filter, updating a private key by using an attribute group key, and finally decrypting the ciphertext to obtain the wanted information.

The invention discloses a data security authentication method and system for smart medical treatment, and relates to the field of data security, and the method comprises the steps: obtaining the identity authentication information of a user, and generating an anti-quantum root key; obtaining operation data and an operation log; according to the operation type, dynamically deriving a temporary sub-key based on the master key, and decomposing the temporary sub-key to obtain m temporary sub-key fragments and n temporary sub-key fragments; transmitting the m temporary sub-key fragments to the client terminal; generating a second signature fragment based on the n temporary sub-key fragments, receiving the first signature fragment, and combining the first signature fragment and the second signature fragment to obtain an operation signature; calculating a hash value of the operation data, and embedding the hash value into the operation signature; and encrypting the operation log based on the embedded operation signature to generate a tamper-resistant log, and marking the temporary sub-key as a failure state. The security of the medical data can be effectively improved.

A system and method for providing credentials device unique credentials to a chip is disclosed. In one embodiment, the method comprises receiving the credentials in credential provisioning server (CPS), the credentials having information encrypted according to a secure server key (SSK) securely stored in a hardware security module (HSM) communicatively coupled to the CPS, the hardware security module also securely storing a master key; receiving a credential request in the CPS, the credential request comprising a chip identifier that identifies the chip; securely decrypting the encrypted information in the HSM according to the SSK; securely computing a chip-unique key in the HSM, according to the chip identifier and the master key; re-encrypting the decrypted information according to the computed chip-unique key; and providing the credentials having the re-encrypted information to the device.

A method including transmitting, by a device to a storage server, a request to receive encrypted content and one or more encrypted keys stored in association with the encrypted content; receiving, by the device from the storage server, the encrypted content and the one or more encrypted keys; receiving, by the device, a master string of alphanumeric characters; determining, by the device, a master key based at least in part on the master string; decrypting, by the device based at least in part on utilizing the master key, an encrypted assigned private key associated with the device to determine an assigned private key, the encrypted assigned private key being included in the one or more encrypted keys; and decrypting, by the device, the encrypted content based at least in part on utilizing the assigned private key is disclosed. Various other aspects are contemplated.

The invention discloses a dynamic NFT-based attribute-based encrypted medical data sharing method, which comprises the following steps that: firstly, a user submits identity authentication information to a trusted digital identity platform, and applies for an attribute certificate from an institution to which the user belongs; secondly, the key management system completes system initialization and generates a master key and a public key, the medical data owner generates an attribute-based encrypted ciphertext according to the access strategy and casts a dynamic NFT according to the smart contract, and when the medical data demander conforms to the access strategy, the medical data owner issues a sub-NFT of the dynamic NFT to the medical data demander through the smart contract; and then the medical data demander applies for a master key from the key management system and decrypts the ciphertext. And finally, the medical data owner changes the access strategy and re-judges whether the medical data demander conforms to the access strategy. According to the invention, the data access control does not depend on a fixed strategy any more, and the controllability and security of the data access control are enhanced.

The invention discloses a stable transmission method for server data encryption and rapid authentication, and belongs to the technical field of data security. The method comprises the following steps: dividing data into three levels of core sensitive data, important data and common data by utilizing a semantic analysis model; performing encryption protection on different levels of data by adopting a hierarchical encryption strategy; a master key is generated based on a chaotic system, a session key is generated in combination with a timestamp and a device fingerprint and is regularly alternated, and secure distribution is performed through a trusted execution environment and a block chain; multi-modal features are fused, the identity is verified through zero-knowledge proof, and the authentication strength is adjusted through dynamic risk assessment. The method is suitable for cloud computing, the Internet of Things and a distributed storage system, through deep fusion of a multi-level hybrid encryption algorithm, a dynamic key management mechanism and a self-adaptive authentication strategy, data security encryption, rapid authentication and stable transmission are achieved, and security, efficiency and adaptability are improved.

The invention relates to an alliance chain identity privacy protection method and system based on multi-level group signature and distributed key management, and belongs to the field of block chain technology, network and information security. According to the method, a multi-level group signature structure is adopted, anonymous identity verification is achieved in the transaction process, privacy protection is further enhanced through zero-knowledge proof, anonymous identity verification is achieved in the transaction process, it is ensured that privacy of participants is not leaked, a homomorphic encryption algorithm is used in the signature and verification process of transaction data, and the transaction data are subjected to identity authentication. And privacy leakage is prevented. And meanwhile, the Shamir secret sharing algorithm divides the master key and stores the master key in a plurality of sub-group members in a distributed manner, so that the anti-attack capability and the key security are enhanced. According to the method, a dynamic group member management and double signature verification mechanism is further introduced, so that the flexibility and the overall security are improved. The method has significant advantages in the aspects of identity anonymity, data integrity and efficiency, and is suitable for alliance chain application scenarios with high privacy and security requirements.

The invention discloses a multi-level access control and authority synchronization method for secure mobile storage, and belongs to the field of mobile storage security. Aiming at the problems of data leakage, poor authority management and the like of the mobile storage device, a multi-level access control framework, a decentralized authority synchronization mechanism and a dynamic token and zero-knowledge proof system are constructed. Generating a plurality of layers of sub-keys from a master key by using a PBKDF2 algorithm through hierarchical key generation, and associating different encryption areas and authority strategies; incremental synchronization is carried out based on a Merkle tree, and data consistency is guaranteed through a consistency verification protocol; a temporary token is generated by using a Schnorr protocol, and the permission is verified in combination with zero-knowledge proof, so that the privacy security is ensured. In scene application of a power grid and the like, a master key is activated through biological recognition, permission is loaded according to a strategy, and permission change is efficiently synchronized. According to the method, the mobile storage security and the management efficiency are improved, and accurate authority control and reliable synchronization are realized.

The invention discloses a method for applying an anti-quantum certificate to a TLS1.2 handshake process, which realizes the application of an MLDSA anti-quantum signature algorithm and an MLKEM anti-quantum key encapsulation mechanism in the handshake process by expanding a cipher suite and a signature algorithm field of a TLS1.2 protocol. The method specifically comprises the following steps: defining a cipher suite supporting MLKEM and an MLDSA signature algorithm enumeration value; the client declares algorithm support in ClientHello, and the server responds and returns a certificate chain containing the double-antibody quantum certificate; after the client verifies the certificate, the pre-master key is encapsulated by using MLKEM, and the server de-encapsulates the derived session key; and the two parties send Finished messages to each other to complete handshake. According to the scheme, on the premise that a TLS1.2 basic framework is not changed, the communication security is enhanced through double-resistance quantum algorithm integration, international and national cryptographic algorithms are supported, quantum computing attacks can be resisted, meanwhile, adaptation of the international and national cryptographic algorithms is supported, compatibility with an existing system is ensured, the security risk of a traditional cryptographic algorithm in a quantum environment is solved, and the security risk of the traditional cryptographic algorithm in the quantum environment is reduced. And a standardized solution is provided for anti-quantum upgrade of the TLS1.2 protocol.

The invention relates to the technical field of network security, in particular to a distributed key management and encryption communication method oriented to a big data environment. The method comprises the following steps: establishing a system architecture and configuring safety parameters; generating a master key and a session key through the random number; segmenting the master key into a plurality of segments and storing the segments to different nodes; encrypting the session key by using the public key of the receiver, distributing the session key through the secure channel, and decrypting the session key by the receiver to obtain the session key; constructing a Merkle tree through an AES-GCM function, and introducing a network adaptation factor into an encryption process by considering that security requirements and network conditions of data encryption in different environments are different; and regularly updating a secret key, implementing an access control strategy, and recording a log to perform system audit so as to guarantee long-term security. According to the invention, the efficient AES-GCM encryption algorithm is used, so that the speed and security of data encryption are improved. By implementing the access control strategy, only the authorized user can access and operate the key, and the security of the system is improved.

The invention relates to the technical field of information security, in particular to a forward security policy hidden attribute-based keyword search method, which is used for access control and search of sensitive information and comprises the following steps: acquiring a public parameter and a master key; attribute processing is performed on an attribute set submitted by a data user, a user private key is constructed, and a puncture key is output; the method comprises the following steps: randomly selecting a symmetric key, performing symmetric encryption on a plaintext through the symmetric key to obtain an initial ciphertext, sequentially performing strategy hidden encryption, keyword encryption and label binding on the plaintext to obtain a corresponding output representation, and integrating the initial ciphertext and the output representation to obtain a complete ciphertext; when the constraint condition is met, the puncture key is updated; establishing a keyword set according to the data user demand content, generating a trap door, and initiating a search request; matching the trap door with the complete ciphertext according to the search request to obtain a matching result, and decrypting the initial ciphertext by integrating the updated puncture key and the user private key to obtain a corresponding plaintext; and the forward safety is effectively improved.

The invention relates to a dynamic double-layer hidden watermark and encryption binding file protection method and system based on deep learning, and belongs to the technical field of digital content security. The problems of attack resistance, traceability obstruction and key-watermark unhooking in document cross-platform circulation are solved. According to the scheme, the method comprises the following steps of: extracting semantic fingerprints by using a sentence vector model Sentence-BERT; the fuzzy extractor generates a master key and derives a time key chain; the authentication encryption algorithm AEAD encrypts and binds the source and the timestamp load; container layer structure rearrangement and document layer zero-width character double embedding are carried out; the generative adversarial network or diffusion model adversarial training improves the optical character recognition and transcoding resistance; version binding and tracing are achieved through the watermark hash chain. The technical effects cover anti-counterfeiting migration, cross-layer fault-tolerant guarantee recoverability, rearrangement attack resistance, full-period accurate traceability and post-quantum security enhancement.

The invention provides a low-altitude unmanned aerial vehicle operation data security sharing method and system, and the method comprises the steps: initializing a low-altitude unmanned aerial vehicle operation data security sharing system through a low-altitude traffic management platform, and generating a public parameter, a master key and an identity private key of a user; wherein the master key comprises a master public key and a master private key; the unmanned aerial vehicle encrypts the operation data of the unmanned aerial vehicle based on the identity information of the agent side to obtain an initial ciphertext, and uploads the initial ciphertext to the cloud platform; the agent side decrypts the initial ciphertext based on an identity private key of the agent side to obtain operation data of the unmanned aerial vehicle, generates a re-encryption key and uploads the re-encryption key to the cloud platform; the cloud platform re-encrypts the initial ciphertext based on the re-encryption key to generate a re-encrypted ciphertext; and the multi-body sharer end decrypts the re-encrypted ciphertext based on the identity private key of the multi-body sharer end to obtain the operation data of the unmanned aerial vehicle. According to the invention, the sharing security of the operation data of the unmanned aerial vehicle in a dynamic open network environment can be efficiently guaranteed.

The invention relates to the field of computer security, and discloses a data storage security protection method and system based on a solid-state hard disk, which comprises the following steps: identifying the inherent physical difference of a flash memory chip in the solid-state hard disk so as to calculate the read-write time sequence micro-deviation of the solid-state hard disk; performing hash operation on the device root key and the unique identifier of the controller corresponding to the solid state disk to obtain a bound master control key; generating a temporary encryption key of the write-in operation to encrypt plaintext data of the host system to obtain ciphertext data; writing the ciphertext data into a flash memory physical page corresponding to the physical page address to obtain a ciphertext physical page address; when the access mode is a hostile attack mode, secretly updating the ciphertext physical page address into a new physical page address, and deleting the ciphertext physical page address; and when the access mode is a secure access mode and the verification key is consistent with the bound master control key, normal loading and data access requests of the solid state disk are allowed. According to the invention, the security and integrity of data storage can be improved.

Features for providing a secure method of symmetric encryption for private smart contacts among multiple parties in a private peer-to-peer network. The features include a master key representing a unique blockchain ledger. The master key may be shared among multiple participants in a private peer-to-peer network. Sharing of the master key may include communicating the master key in an encrypted message (e.g., email) using public key infrastructure (PKI). In some implementations, more complex distribution features may be includes such as quantum entanglement. The features support instantiation of a smart contract using a specific master key. The request may be submitted as an entry to the ledger with appropriate metadata and / or payload information for identifying and processing the request.

The invention discloses a city inspection data sharing method and device based on an unmanned aerial vehicle, and the method comprises the steps: firstly determining an inspection time period when the inspection data needs to be shared, and collecting the position, speed, signal and meteorological data set of the unmanned aerial vehicle in the time period according to a preset sampling frequency; after all the data sets are aligned through timestamps, features are extracted respectively to form multi-dimensional feature vectors; converting the multi-dimensional feature vector into a one-dimensional array, and generating a hash feature value through a hash algorithm in combination with a timestamp and a random number; extracting a master key and an authentication key from the hash feature value, generating an initialization vector based on the master key, binding the master key, the authentication key and a timestamp, and then distributing the three to a receiver; inspection data is divided into blocks, a number and a timestamp are added to each block, encryption is performed by using a master key and an initialization vector, an authentication tag is generated in combination with an authentication key, and a data packet is packaged and then transmitted. According to the invention, the problem of low security during routing inspection data sharing of the unmanned aerial vehicle in the prior art is solved.

The invention discloses a rail transit-oriented soft information codeword reconstruction security key extraction method and system, and relates to the field of digital information transmission, in the method, a sending end and a legal receiving end alternately send pilot frequencies to each other through a preset channel, and calculate a channel feature sequence of the preset channel; the sending end generates a master key from a preset random source, and encodes the master key to obtain a code word sequence; the sending end generates an information interaction sequence according to the first feature sequence and the code word sequence, and sends the information interaction sequence to a legal receiving end; after the legal receiving end receives the information interaction sequence, the legal receiving end reconstructs the second feature sequence according to the information interaction sequence to obtain a code word structure sequence; and the legal receiving end decodes the code word structure sequence to obtain a final key. The method and the device are used for improving the consistency rate of the secret keys among the legal users, so that the secret key generation and extraction efficiency is improved, and the safety of a rail transit system is improved.

The invention relates to an anti-quantum password migration method and system, electronic equipment and a storage medium, and belongs to the technical field of anti-quantum data transmission. The method comprises the following steps: carrying out adaptive expansion on a transport layer security protocol; the encryption end and the decryption end perform secure transmission of the application data based on the expanded transport layer security protocol, and the secure transmission process of the application data comprises the following steps: generating a master key, a multi-level sub-key and a path key chain according to a chain type post-quantum key generation mechanism based on the expanded cipher suite; the encryption end generates an encryption key through a part of the sub-keys, encrypts application data in a symmetric encryption mode to generate a ciphertext, and sends the ciphertext and a path node key at the tail end of the path key chain to a decryption end; and the decryption end verifies the path node key, generates a decryption key by using part of the sub-keys after the verification of the path node key is passed, and decrypts the ciphertext. According to the invention, the security and high efficiency of data transmission in the anti-quantum cryptography migration process are realized.

The invention discloses a multi-layer encryption system for an electronic bidding document, particularly relates to the technical field of bidding document encryption, and is used for solving the problems that advanced decryption of an encrypted bidding document is difficult to detect, and a leakage path is difficult to efficiently trace to the source. Comprising a secret key segmentation module, a false quotation generation and binding module, an advanced decryption verification module, a leakage traceability module and a sequential decryption module, a real electronic bidding document is encrypted to generate an encrypted bidding document, a main secret key is segmented by adopting a threshold encryption scheme, a Hash function and random disturbance are combined, a surface bidding document is generated according to the real electronic bidding document, and the surface bidding document is encrypted. The method comprises the following steps: calculating a false quotation of a surface bidding document according to different sub-key combinations used for advanced decryption, generating a sub-key combination-false quotation mapping, carrying out matching evaluation on whether the false quotation of the surface bidding document is decrypted in advance by combining abnormal quotation detection and quotation mode robustness, determining a suspicious key combination used for advanced decryption, and judging whether the false quotation of the surface bidding document is decrypted in advance. And the encrypted bidding document is decrypted in a time window allowed by bid opening.

The invention provides an anti-quantum identification signature method based on an on-lattice SIS problem. The method comprises the following steps: selecting system safety parameters and other related system parameters; generating a system public parameter and a master key by using the system security parameter and other related system parameters; generating a corresponding public and private key pair by using the user identity ID; the user generates a signature of the message by using the private key; and the verifier verifies the validity of the signature by using the system parameters and the user public key. According to the method, a lattice-based digital signature scheme is constructed by utilizing an SIS difficulty problem on a middle lattice, and quantum attack resistance security is provided for an information system for deploying the algorithm scheme; personal identity information of the user is used for registering and generating public and private keys, the key escrow problem participated by a third party is relieved, and the privacy security of the user is improved.

The invention discloses an anti-quantum computing communication implementation method and system and computer equipment. The method comprises the steps that a PQC channel is established with a front-end server, the PQC channel outputs a first master key through a post-quantum algorithm, the first master key derives a second master key, and the second master key is sent to a target server; sending the first key negotiation information to a front-end server; receiving second key negotiation information sent from the front-end server, decrypting the second key negotiation information by using a second master key, and calculating to obtain a session key; and the client realizes encrypted communication with the target server by using the session key. Compared with the prior art, the method has the advantages that the PQC channel protected by the post-quantum algorithm is firstly established between the client and the front-end server, and then the security channel is used for protecting a plurality of classical security channels established between the client and different target servers, so that the attack of a quantum computer can be effectively resisted.

The invention discloses an optical network mutual backup video data encryption method and system based on a distributed system, and belongs to the field of data encryption. The method comprises the following steps: generating a node trust evaluation value by acquiring optical network topology data including link state parameters and edge node dynamic load parameters; and adopting a distributed consensus protocol to screen edge nodes meeting the dynamic load fluctuation range and the trust evaluation value threshold as encrypted cooperative nodes. And generating a master key segmentation factor based on the node trust value, splitting the master key into sub-key fragments, partitioning optical network mutual backup video data, and binding and encrypting the partitioned optical network mutual backup video data with the sub-keys to form mutual backup encrypted data blocks, thereby realizing redundant storage of heterogeneous nodes across physical locations. According to the method, the initial encryption path is constructed according to the link state parameters, the transmission priority is dynamically disturbed by using the chaotic mapping sequence, the target encryption path adaptive to the storage requirement is generated, and finally the encrypted data blocks are distributed to the heterogeneous nodes through the path, so that the encryption efficiency and the data redundancy storage reliability can be improved.

The invention relates to a traceable security communication method, device and equipment based on a privacy number, and belongs to the technical field of communication processing, and the method realizes credible storage of communication data by obtaining a communication record and generating a distributed unique identifier, adopting an SM2 algorithm for signature and writing evidence data into a block chain. Meanwhile, the preset master key is subjected to fragmentation processing, a plurality of sub-key fragments are generated, the storage position is determined, and the session key is generated by adopting an SM4 algorithm to perform end-to-end encryption on the communication content, so that the communication security is guaranteed. Besides, a zero-knowledge proof protocol is introduced for identity verification, dynamic risk assessment and an authority fusing mechanism are combined, high-risk communication is effectively prevented, multiple cryptography technologies and safety mechanisms are comprehensively applied, and safety, credibility and auditing performance of the communication process are comprehensively improved.

A rekeyable lock cylinder with a cylinder body, an inner sleeve, and a plug assembly is provided. The plug assembly includes a plurality of key followers and a corresponding plurality of first racks and second racks disposed in carriers. The first racks correspond to operation of a user key and the second racks correspond to operation of a master key. As such, the lock cylinder is usable in a user / master key system. Disengaging either of the first or second racks from the key followers allows rekeying of the lock cylinder for the user key or the master key.

The invention discloses an Internet of Things puncturable attribute-based encryption method based on a block chain and a Bloom filter, and is used for solving the problems of low dynamic permission revocation efficiency and difficult operation auditing in an Internet of Things environment. The method realizes a core function through the following steps: an authorization mechanism initializes system parameters and segments a master key; a data owner defines an access strategy and initializes the Bloom filter during encryption; when the permission is revoked, a puncture tuple containing a label binding component, a strategy binding component and a cross validation component is generated, and the ciphertext is updated after verification of a block chain smart contract; and during decryption, the cloud server firstly screens the validity of the user tag through a Bloom filter, and then decrypts the data in combination with an attribute strategy. The method has the advantages that the complexity of puncture verification is reduced by the Bloom filter, and the resource consumption is remarkably reduced; two-factor binding and cross validation ensure that puncture operation cannot be forged; and the block chain completely records key generation, puncture and decryption operations, so that operation transparency and auditing performance are realized.

The invention discloses an identity authentication method and system based on a national secret algorithm, and the method comprises the steps: building a hierarchical key management system based on a national secret IBE framework, generating a system master key pair through employing an SM2 algorithm, and achieving a decentralized key distribution mechanism; constructing a domain perception differential privacy protection module, defining a privacy budget allocation strategy according to the security level, and adding calibrated Laplace noise to the user identity feature vector; designing a distributed batch matrix multiplication protocol, and decomposing the distributed batch matrix multiplication protocol to a plurality of computing nodes for parallel processing through a secret sharing technology; a zero-knowledge proof verification mechanism is implemented, and identity verification is completed through a commitment scheme based on an SM3 hash algorithm; deploying a self-adaptive key updating strategy, and analyzing threat level change through a threat situation evaluation function; and establishing a secure communication channel based on SM4 symmetric encryption, and performing encryption processing by using the temporary session key. The security and expandability of the system are improved, the privacy of the user is effectively protected, and the system adapts to a dynamically changing network threat environment.