Security control method and system for network information communication data elements

Abstract

The invention discloses a security control method and system for network information communication data elements, which comprises the steps of data feature extraction, feature processing, feature value calculation, feature value fusion, encryption key generation, data encryption, data transmission and data decryption, and relates to the technical field of security communication. According to the security control method for the network information communication data elements, multiple features of the network information communication data are extracted, preprocessed and subjected to feature value calculation, the multiple feature values are fused to generate the encryption key, and then the AES algorithm is used for carrying out encryption transmission on the data, so that the security of the data in the network transmission process is greatly improved, and the security of the data in the network transmission process is improved. The risk that the data is stolen, tampered or leaked is reduced; the data features are processed and calculated according to the preset algorithm formula, the encryption key with uniqueness and high security is generated, the encryption process is rigorous and scientific, and the reliability and stability of encryption are ensured.

Description

Technical Field

[0001] The present invention relates to the field of secure communication technology, and in particular to a method and system for securely controlling network information communication data elements. Background Art

[0002] With the rapid development of information technology and the widespread popularity of the Internet, network information communication plays a vital role in people's daily life, work and various industries. A large amount of sensitive information, such as personal privacy data, business secrets, financial transaction information, etc., is transmitted and interacted through the network.

[0003] However, the network environment is open and complex, which makes network information communication data face many security threats during transmission, such as data theft, tampering, forgery, etc. Traditional network information encryption methods have gradually exposed some limitations in the face of increasingly complex network attack methods and growing security needs.

[0004] On the one hand, many existing encryption technologies simply encrypt the data itself without fully considering the characteristic elements of the data, resulting in insufficient encryption targeting and security. On the other hand, when data is transmitted in the network, due to the lack of comprehensive consideration and security control of data sources, transmission paths, time and other characteristics, attackers have the opportunity to exploit these vulnerabilities to obtain data or crack encryption.

[0005] Therefore, in order to effectively ensure the secure transmission of network information communication data, a more comprehensive, efficient and targeted security control method and system is needed, which can fully explore the characteristic elements of network information communication data and apply them to the data encryption and decryption process, thereby improving the security and reliability of network information communication. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a method and system for security control of network information communication data elements, which solves the problems raised in the background technology.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: a method and system for security control of network information communication data elements, comprising the following steps:

[0008] Step 1: Data feature extraction

[0009] Extract data features from network information communication data that needs to be transmitted;

[0010] Step 2: Feature processing

[0011] Preprocess the extracted data features;

[0012] Step 3: Eigenvalue calculation

[0013] For each extracted data feature, its feature value is calculated respectively according to the corresponding data feature after preprocessing and in combination with the corresponding predetermined algorithm formula;

[0014] Step 4: Eigenvalue Fusion

[0015] The calculated data feature values ​​are fused through a predetermined fusion formula to obtain a comprehensive fusion feature value;

[0016] Step 5: Generate encryption key

[0017] The fused feature value is converted into a 256-bit encryption key K through the 256-bit version of the secure hash algorithm;

[0018] Step 6: Data encryption

[0019] Use the generated encryption key K in combination with the AES algorithm to encrypt network information communication data;

[0020] Step 7: Data Transfer

[0021] Transmit the encrypted network information communication data through the network;

[0022] Step 8: Data decryption

[0023] After receiving the encrypted data, the receiver calculates the encryption key K according to the method of steps 1 to 5 above, and then uses the encryption key K to decrypt the encrypted data using the AES algorithm to obtain the original network information communication data.

[0024] Preferably, the data characteristics include, but are not limited to, data length, data type, data sending time, data receiving time, data source IP address, and data destination IP address;

[0025] Data length refers to the size of the storage space occupied by the data, where bytes are used as the unit of measurement;

[0026] Data type is a way to classify network information communication data, where data types include but are not limited to: image type, audio type, video type, table type, text type;

[0027] Data sending timeData sending time refers to the specific moment when data starts to be transmitted from the sender;

[0028] The IP address of the data source refers to the unique identification address assigned to the device or network node that sends the data in the network;

[0029] The data destination IP address refers to the IP address of the device or network node that receives the data when it is transmitted in the network;

[0030] The IP address of the data source and the IP address of the data destination are both expressed in "dotted decimal" in the form of abcd, where a, b, c, d are all decimal integers between 0 and 255. abcd corresponds to an IP address represented by a 32-bit binary number, which is divided into 4 "8-bit binary numbers", that is, 4 bytes.

[0031] Preferably, the preprocessing method is as follows:

[0032] StepH1. Data length conversion

[0033] Obtain the bytes corresponding to the data length of the network information communication data, and convert the bytes into binary to obtain the binary bit data after the data length conversion;

[0034] StepH2: Data type encoding extraction

[0035] According to a predetermined data type coding table, obtain the coding value of the data type corresponding to the network information communication data;

[0036] StepH3, data sending time change

[0037] Obtaining time parameters corresponding to the date, hour, minute, and second from the data sending time, then transforming the time parameters corresponding to the date, hour, minute, and second in seconds using a predetermined transformation formula, and recording the result as the data sending time analysis value;

[0038] Step H4. Processing of data source IP address and data destination IP address

[0039] In the order of a, b, c, and d, the four bytes corresponding to the data source IP address are marked as f1, f2, f3, and f4, and the four bytes corresponding to the data destination IP address are marked as m1, m2, m3, and m4.

[0040] Preferably, in Step H2, the data type coding table includes a plurality of data types, and each data type is preset with a unique coding value;

[0041] Preferably, the specific method of Step H2 is: obtain the data type corresponding to the network information communication data, and use the data type to obtain the same data type from the data type coding table, then extract the preset coding value corresponding to the same data type, and use the coding value as the coding value of the data type corresponding to the network information communication data.

[0042] Preferably, in Step H3, the transformation formula is: s0 = sa ×24×60×60+s b ×60×60+s c ×60+s d , where s0 is the data sending time analysis value, s a 、s b 、s c 、s d Respectively expressed as the time parameters corresponding to day, hour, minute and second.

[0043] Preferably, in step three:

[0044] StepX1, the algorithm formula of data length characteristic value is as follows:

[0045] L = l × log2 (l)

[0046] Wherein, L is the characteristic value of the data length, l is the binary bit data after the data length of the network information communication data is converted;

[0047] StepX2, the algorithm formula for the characteristic value of the data type is as follows:

[0048] T=t 2 +t

[0049] Where T is the characteristic value of the data type, and t is the encoding value of the data type corresponding to the network information communication data;

[0050] StepX3, the algorithm formula of the data sending time characteristic value is as follows:

[0051] S=u-s0, where S is the characteristic value of the data transmission time, u is a predetermined fixed value, and u=2155116;

[0052] StepX4, the algorithm formula for the characteristic value of the data source IP address is as follows:

[0053] F=f1×f2+f3×f4

[0054] In the formula, F is the characteristic value of the IP address of the data source;

[0055] StepX5, the algorithm formula for the characteristic value of the data destination IP address is as follows:

[0056] M=m1×m2-m3×m4

[0057] Where M is the characteristic value of the IP address of the data source.

[0058] Preferably, the fusion formula is: Y=L+T+S+F+M, where F is the fusion feature value.

[0059] The present invention provides a method and system for security control of network information communication data elements. Compared with the prior art, it has the following beneficial effects:

[0060] Improved data security: By extracting, preprocessing and calculating the eigenvalues ​​of various features of network information communication data (such as data length, data type, data sending time, data receiving time, data source IP address and data destination IP address), and fusing multiple eigenvalues ​​to generate encryption keys, and then using the AES algorithm to encrypt and transmit data, the security of data during network transmission is greatly improved, and the risk of data theft, tampering or leakage is reduced.

[0061] Wide adaptability: The data features adopted by the present invention cover multiple aspects of network information communication data, so that the security control method can be applied to various types of data. Whether it is image, audio, video, table or text type data, it can be effectively protected under the security control system of the present invention, and has a wide range of application scenarios and adaptability.

[0062] The encryption process is scientific and reasonable: the present invention processes and calculates data features according to a predetermined algorithm formula to generate a unique and highly secure encryption key. The encryption process is rigorous and scientific, ensuring the reliability and stability of encryption.

[0063] High decryption accuracy: The receiver calculates the encryption key for decryption according to the same steps as the sender, which can accurately restore the original data, ensure the integrity and accuracy of data transmission, and effectively avoid data corruption or unrecognizable problems caused by inconsistencies in the encryption and decryption processes.

[0064] Strong system integration: The corresponding security control system integrates functional modules such as data extraction, preprocessing, analytical calculation, fusion calculation, key generation, data encryption, data transmission and decryption, realizing the full process automation of network information communication data security control, improving the efficiency and accuracy of security control, and reducing the errors and risks caused by manual operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 It is a schematic diagram of the method flow of the present invention;

[0066] Figure 2 It is a system block diagram of the present invention. DETAILED DESCRIPTION

[0067] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0068] As embodiment 1 of the present invention

[0069] See also Figure 1-Figure 2 The present invention provides a technical solution: a method and system for security control of network information communication data elements, comprising the following steps:

[0070] Step 1: Data feature extraction

[0071] Extract data features from network information communication data that needs to be transmitted;

[0072] The data characteristics include, but are not limited to, data length, data type, data sending time, data receiving time, data source IP address, and data destination IP address;

[0073] Data length refers to the size of the storage space occupied by the data, and in this embodiment, it is measured in bytes;

[0074] Data type is a way to classify network information communication data. In this embodiment, data types include but are not limited to: image type, audio type, video type, table type, text type;

[0075] Data sending time: Data sending time refers to the specific moment when data starts to be transmitted from the sender. In network communication and data exchange scenarios, when one party wants to transmit data to another party, the precise time when the data starts to leave the sender's device and enter the transmission channel is recorded. This time point is the data sending time.

[0076] The IP address of the data source refers to the unique identification address assigned to the device or network node that sends the data in the network; it can be understood as the network address of the "origin" of the data, which identifies which computer, server or network device the data was originally sent from;

[0077] The data destination IP address refers to the IP address of the device or network node that receives the data when the data is transmitted in the network. It can be regarded as the network address of the "destination" of the data, indicating which computer, server or network device the data is to be transmitted to for processing or reception.

[0078] The IP address of the data source and the IP address of the data destination are both expressed in "dot decimal" in the form of abcd, where a, b, c, d are all decimal integers between 0 and 255. abcd corresponds to an IP address represented as a 32-bit binary number, which is divided into four "8-bit binary numbers", that is, 4 bytes;

[0079] For example: the network information communication data is a piece of text data containing user personal information. The extracted data length is 512 bytes, the data type is text type, the data sending time is 10:30:00 on June 21, 2020, the data source IP address is 192.168.1.100, and the data destination IP address is 192.168.1.200;

[0080] Step 2: Feature processing

[0081] Preprocess the extracted data features;

[0082] StepH1. Data length conversion

[0083] Obtain the bytes corresponding to the data length of the network information communication data, and convert the bytes into binary to obtain the binary bit data after the data length conversion;

[0084] StepH2: Data type encoding extraction

[0085] According to a predetermined data type coding table, obtain the coding value of the data type corresponding to the network information communication data;

[0086] The specific method is: obtaining the data type corresponding to the network information communication data, and using the data type to obtain the same data type from the data type coding table, then extracting the preset coding value corresponding to the same data type, and using the coding value as the coding value of the data type corresponding to the network information communication data;

[0087] The data type coding table includes several data types, and each data type is preset with a unique coding value;

[0088] StepH3, data sending time change

[0089] Obtaining time parameters corresponding to the date, hour, minute, and second from the data sending time, then transforming the time parameters corresponding to the date, hour, minute, and second in seconds using a predetermined transformation formula, and recording the result as the data sending time analysis value;

[0090] The transformation formula is: s0 = s a ×24×60×60+s b ×60×60+s c ×60+sd , where s0 is the data sending time analysis value, s a 、s b 、s c 、s d Respectively expressed as time parameters corresponding to day, hour, minute and second;

[0091] For example: Taking the above extracted time of 10:30:00 on June 21, 2020 as an example, obtain the time parameters 21, 10, 30, and 0 corresponding to the day, hour, minute, and second respectively;

[0092] Substituting into the formula we get:

[0093] s0 = 20 × 24 × 60 × 60 + 10 × 60 × 60 + 30 × 60 + 0 = 1728000 + 36000 + 1800 = 1765800 seconds;

[0094] Step H4. Processing of data source IP address and data destination IP address

[0095] In the order of a, b, c, and d, mark the four bytes corresponding to the data source IP address as f1, f2, f3, and f4, and mark the four bytes corresponding to the data destination IP address as m1, m2, m3, and m4;

[0096] Step 3: Eigenvalue calculation

[0097] For each extracted data feature, its feature value is calculated respectively according to the corresponding data feature after preprocessing and in combination with the corresponding predetermined algorithm formula;

[0098] In this example:

[0099] StepX1, the algorithm formula of data length characteristic value is as follows:

[0100] L = l × log2 (l)

[0101] Wherein, L is the characteristic value of the data length, l is the binary bit data after the data length of the network information communication data is converted;

[0102] For example: Taking the 512-byte data length extracted above as an example, convert it into data with 4096 binary bits;

[0103] Substituting into the formula we get:

[0104] L=4096×log2(4096)=4096×12=49152;

[0105] StepX2, the algorithm formula for the characteristic value of the data type is as follows:

[0106] T=t2 +t

[0107] Where T is the characteristic value of the data type, and t is the encoding value of the data type corresponding to the network information communication data;

[0108] For example: Assume that the data type corresponding to the network information communication data is text type, and the encoding value corresponding to the text type is 10;

[0109] Substituting into the formula, we get: T = 10 2 +10=110;

[0110] StepX3, the algorithm formula of the data sending time characteristic value is as follows:

[0111] S=u-s0, where S is the characteristic value of the data transmission time, u is a predetermined fixed value, and u=2155116;

[0112] For example: Substituting the above-obtained s0 = 1765800 seconds into the formula yields:

[0113] S=2155116-1765800=389316;

[0114] StepX4, the algorithm formula for the characteristic value of the data source IP address is as follows:

[0115] F=f1×f2+f3×f4

[0116] In the formula, F is the characteristic value of the IP address of the data source;

[0117] For example: Take the IP address 192.168.1.100 of the above data source as an example;

[0118] f1=192、f2=168、f3=1、f4=100, substitute into the formula and we get:

[0119] F=192×168+1×100=32352+100=32452;

[0120] StepX5, the algorithm formula for the characteristic value of the data destination IP address is as follows:

[0121] M=m1×m2-m3×m4

[0122] Where M is the characteristic value of the IP address of the data source;

[0123] For example: Take the destination IP address 192.168.1.200 of the above data as an example

[0124] m1=192、m2=168、m3=1、m4=200, substitute into the formula and we get:

[0125] M=192×168-1×200=32256-200=32056;

[0126] Step 4: Eigenvalue Fusion

[0127] The calculated data feature values ​​are fused through a predetermined fusion formula to obtain a comprehensive fusion feature value;

[0128] The fusion formula is: Y = L + T + S + F + M, where F is the fusion feature value;

[0129] For example: Substituting the eigenvalues ​​obtained above into the equation, we get:

[0130] 49152+110+389316+32452+32056=503086;

[0131] Step 5: Generate encryption key

[0132] The fused feature value is converted into a 256-bit encryption key K through K=SHA-256(Y);

[0133] Among them, SHA-256 is the 256-bit version of the secure hash algorithm, which is a widely used cryptographic hash function. The algorithm is an existing technology, so it will not be described in detail here;

[0134] Step 6: Data encryption

[0135] Use the generated encryption key K in combination with the AES algorithm to encrypt network information communication data;

[0136] Step 7: Data Transfer

[0137] Transmit the encrypted network information communication data through the network;

[0138] During the transmission process, even if the data is stolen, the thief cannot directly obtain the real content of the data because it is in an encrypted state.

[0139] Step 8: Data decryption

[0140] After receiving the encrypted data, the receiver calculates the encryption key K according to the method of steps 1 to 5 above, and then uses the encryption key K to decrypt the encrypted data using the AES algorithm to obtain the original network information communication data, thereby achieving secure transmission and use of data.

[0141] Embodiment 2

[0142] As the second embodiment of the present invention, when the present application is implemented, compared with the first embodiment, the technical solution of the present embodiment is different from that of the first embodiment only in that:

[0143] This embodiment is also used to replace the predetermined algorithm formulas of each characteristic value with other predetermined algorithm formulas.

[0144] Embodiment 3

[0145] As the third embodiment of the present invention, when the present application is specifically implemented, compared with the first and second embodiments, the technical solution of this embodiment is to combine the solutions of the first and second embodiments mentioned above for implementation.

[0146] A security control system for network information communication data elements, the system is used to implement a security control method for network information communication data elements, the system comprising:

[0147] The data extraction module is used to extract data features from the network information communication data that needs to be transmitted.

[0148] The preprocessing module is used to preprocess the extracted data features.

[0149] The analysis and calculation module is used to calculate the characteristic values ​​of each extracted data feature according to the corresponding data features after preprocessing and in combination with the corresponding predetermined algorithm formula.

[0150] The fusion calculation module is used to fuse the calculated data feature values ​​through a predetermined fusion formula to obtain a comprehensive fusion feature value.

[0151] The key generation module is used to convert the fused feature value into a 256-bit encryption key through the 256-bit version of the secure hash algorithm.

[0152] The data encryption module is used to encrypt network information communication data using the generated encryption key in combination with the AES algorithm.

[0153] The data transmission module is used to transmit the encrypted network information communication data through the network.

[0154] The data decryption module is used for the receiver to receive the encrypted data and calculate the encryption key through the data extraction module, preprocessing module, analysis and calculation module, fusion calculation module and key generation module, and then use the encryption key to decrypt the encrypted data using the AES algorithm to obtain the original network information communication data.

[0155] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters and thresholds in the formula are set by technicians in this field according to actual conditions.

[0156] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0157] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A method for security control of network information communication data elements, characterized in that: The following steps are involved: Step 1: Extract data features from the network information communication data to be transmitted; Step 2: Preprocess the extracted data features; Step 3: For each extracted data feature, calculate its feature value according to the corresponding data feature after preprocessing and in combination with the corresponding predetermined algorithm formula; Step 4: The calculated data feature values ​​are fused through a predetermined fusion formula to obtain a comprehensive fusion feature value; Step 5: Use the 256-bit version of the secure hash algorithm to convert the fused feature value into a 256-bit encryption key K; Step 6: Use the generated encryption key K and the AES algorithm to encrypt the network information communication data; Step 7: Transmit the encrypted network information communication data through the network; Step 8: After receiving the encrypted data, the receiver calculates the encryption key K according to the method of steps 1 to 5 above, and then uses the encryption key K to decrypt the encrypted data using the AES algorithm to obtain the original network information communication data.

2. A method for security control of network information communication data elements according to claim 1, characterized in that: in, Data characteristics include but are not limited to data length, data type, data sending time, data receiving time, data source IP address and data destination IP address.

3. A method for security control of network information communication data elements according to claim 2, characterized in that: The preprocessing method is as follows: StepH1. Data length conversion Obtain the bytes corresponding to the data length of the network information communication data, and convert the bytes into binary to obtain the binary bit data after the data length conversion; StepH2: Data type encoding extraction According to a predetermined data type coding table, obtain the coding value of the data type corresponding to the network information communication data; StepH3, data sending time change Obtaining time parameters corresponding to the date, hour, minute, and second from the data sending time, then transforming the time parameters corresponding to the date, hour, minute, and second in seconds using a predetermined transformation formula, and recording the result as the data sending time analysis value; Step H4. Processing of data source IP address and data destination IP address In the order of a, b, c, and d, the four bytes corresponding to the data source IP address are marked as f1, f2, f3, and f4, and the four bytes corresponding to the data destination IP address are marked as m1, m2, m3, and m4.

4. A method for security control of network information communication data elements according to claim 3, characterized in that: In StepH2, the data type encoding table contains several data types, and each data type is preset with a unique encoding value.

5. A method for security control of network information communication data elements according to claim 3, characterized in that: The specific method of StepH2 is: obtain the data type corresponding to the network information communication data, and use the data type to obtain the same data type from the data type coding table, then extract the preset coding value corresponding to the same data type, and use the coding value as the coding value of the data type corresponding to the network information communication data.

6. A method for security control of network information communication data elements according to claim 3, characterized in that: In StepH3, the transformation formula is: s0=s a ×24×60×60+s b ×60×60+s c ×60+s d , where s0 is the data sending time analysis value, s d Respectively expressed as the time parameters corresponding to day, hour, minute and second.

7. A method for security control of network information communication data elements according to claim 3, characterized in that: In step three: StepX1, the algorithm formula of data length characteristic value is as follows: L = l × log2 (l) Wherein, L is the characteristic value of the data length, l is the binary bit data after the data length of the network information communication data is converted; StepX2, the algorithm formula for the characteristic value of the data type is as follows: T=t 2 +t Where T is the characteristic value of the data type, and t is the encoding value of the data type corresponding to the network information communication data; StepX3, the algorithm formula of the data sending time characteristic value is as follows: S=u-s0, where S is the characteristic value of the data transmission time, u is a predetermined fixed value, and u=2155116; StepX4, the algorithm formula for the characteristic value of the data source IP address is as follows: F=f1×f2+f3×f4 In the formula, F is the characteristic value of the IP address of the data source; StepX5, the algorithm formula for the characteristic value of the data destination IP address is as follows: M=m1×m2-m3×m4 Where M is the characteristic value of the IP address of the data source.

8. A method for security control of network information communication data elements according to claim 7, characterized in that: The fusion formula is: Y=L+T+S+F+M, where F is the fusion feature value.

9. A method for security control of network information communication data elements according to claim 2, characterized in that: Data length refers to the size of the storage space occupied by the data, where bytes are used as the unit of measurement; Data type is a way to classify network information communication data, where data types include but are not limited to: image type, audio type, video type, table type, text type; Data sending timeData sending time refers to the specific moment when data starts to be transmitted from the sender; The IP address of the data source refers to the unique identification address assigned to the device or network node that sends the data in the network; The data destination IP address refers to the IP address of the device or network node that receives the data when it is transmitted in the network; The IP address of the data source and the IP address of the data destination are both expressed in "dotted decimal" in the form of abcd, where a, b, c, d are all decimal integers between 0 and 255. abcd corresponds to an IP address represented by a 32-bit binary number, which is divided into 4 "8-bit binary numbers", that is, 4 bytes.

10. A security control system for network information communication data elements, the system being implemented by a security control method for network information communication data elements as claimed in any one of claims 1 to 9, characterized in that: The system includes: The data extraction module is used to extract data features from the network information communication data that needs to be transmitted. The preprocessing module is used to preprocess the extracted data features. The analysis and calculation module is used to calculate the characteristic values ​​of each extracted data feature according to the corresponding data features after preprocessing and in combination with the corresponding predetermined algorithm formula. The fusion calculation module is used to fuse the calculated data feature values ​​through a predetermined fusion formula to obtain a comprehensive fusion feature value. The key generation module is used to convert the fused feature value into a 256-bit encryption key through the 256-bit version of the secure hash algorithm. The data encryption module is used to encrypt network information communication data using the generated encryption key in combination with the AES algorithm. The data transmission module is used to transmit the encrypted network information communication data through the network. The data decryption module is used for the receiver to receive the encrypted data and calculate the encryption key through the data extraction module, preprocessing module, analysis and calculation module, fusion calculation module and key generation module, and then use the encryption key to decrypt the encrypted data using the AES algorithm to obtain the original network information communication data.

Images