A network data encryption system

Abstract

The application relates to the technical field of data encryption systems, and particularly discloses a network data encryption system, which comprises a local file management module, a cloud file management module, a file information interaction module and a data encryption and decryption module; the local file management module is based on the local disk loading of the client software and encrypts the local data automatically stored by the automatic client data; the cloud file management module is based on the backup of the data interaction between the client and the background; the file information interaction module is based on the data interaction of the client, the background and the cloud storage; and the data encryption and decryption module is used for performing encryption on the data obtained through the interaction by using a cover code and an encryption algorithm. The network data encryption system provided by the application encrypts the local buffer data and the network cloud disk data in the interaction process by using a secondary encryption mode, so that the virus implantation can be avoided to directly obtain the data being input.

Description

Technical Field

[0001] This invention relates to the field of data encryption system technology, and specifically to a network data encryption system. Background Technology

[0002] Network data refers to private data interactions based on application software, such as chat logs, software browsing data, or stored data. With the development and widespread adoption of information technology, company and personal data are vulnerable to theft.

[0003] Publication (Announcement) No.: CN112583579A, Publication (Announcement) Date: 2021-03-30, discloses a network data encryption transmission system, including a sending end for transmitting network data; a segmentation module communicatively connected to the sending end; an encryption module communicatively connected to the segmentation module; an intermediate management node communicatively connected to the encryption module; a decryption module communicatively connected to the intermediate management node; and a fusion module communicatively connected to the decryption module. The fusion module is used to fuse multiple segments of data decrypted by the decryption module to obtain the network data transmitted by the sending end. A receiving end is communicatively connected to the fusion module and is used to receive the network data transmitted by the sending end obtained by the fusion module. This invention uses a segmentation followed by encryption to transmit network data, ensuring data security during communication without affecting data real-time performance.

[0004] In existing technologies, including the aforementioned patents, data encryption methods involve encrypting data at data interaction nodes and encrypting the data at communication nodes multiple times to ensure data security. However, data theft often involves acquiring data generated by pre-implanted viruses that has not yet been uploaded, thus failing to prevent data security breaches. Summary of the Invention

[0005] The purpose of this invention is to provide a network data encryption system to solve the above-mentioned problems.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a network data encryption system, comprising:

[0007] The local file management module is based on the location of the local disk where the client software is installed, and encrypts the local data that is automatically collected from the client data.

[0008] The cloud-based file management module enables backup based on data interaction between the client and the backend.

[0009] The file information interaction module is based on the interaction and acquisition of data between the client, the backend, and cloud storage.

[0010] The data encryption / decryption module is used to encrypt the data obtained through the interaction using a masking code and an encryption algorithm.

[0011] Preferably, the data encryption / decryption module includes:

[0012] The encryption unit parses data received from the client that includes one or more encrypted portions, wherein the one or more encrypted portions are encrypted using a first key;

[0013] The encryption masking unit identifies one or more symbols contained in the data, whereby the one or more symbols represent one or more encrypted portions of the data, and assigns the one or more symbols to a second key and uses the second key to decrypt the one or more encrypted portions of the data.

[0014] Preferably, the data encryption / decryption module further includes a decryption unit, which performs code parsing based on the encryption unit and the encryption masking unit, executes the encryption masking unit, and obtains the acquisition parameters of the corresponding first key code by decrypting the encryption masking unit, so as to calculate the first key by using the DS algorithm.

[0015] Preferably, the DS algorithm is based on a 64-bit data block, which is recombined bit by bit. The output is divided into two parts, L0 and R0, each 32 bits long. The obtained parameter is swapped to the first bit, the 50th bit to the second bit, and so on, with the last bit being the original 7th bit. L0 and R0 are the two parts of the output after the swap, with L0 being the left 32 bits and R0 being the right 32 bits. The input value is D1D2D3......D64. After the initial permutation, the result is: L0 = D58D50...D8; R0 = D57D49...D7. After 16 iterations, L16 and R16 are obtained. These are used as input for the inverse permutation to obtain the ciphertext.

[0016] Preferably, the encryption masking unit performs masking code parsing on the one or more encrypted portions of data, customizes a database based on the masking data, determines whether at least one character corresponds to the at least one field, wherein the database contains one or more fields and one or more corresponding masking data characters, and based on the determination that at least one masking data character corresponds to the at least one field, replaces the one or more encrypted portions with the at least one masking data character.

[0017] A method for encrypting network data, applied to the network data encryption system described in the solution, comprises the following steps:

[0018] S001: Obtain user-inputted data, encrypt its filename, generate a unique index, and synchronously store it in the cloud media library and local disk;

[0019] S002, after the filename is encrypted, the file content data is sent to the encryption / decryption machine so that the encryption / decryption machine can encrypt the received file content to form a double encryption behavior;

[0020] S003: Obtain the encrypted file data after encryption by the encryption / decryption machine, write the encrypted file data to the distributed cloud drive, and return the unique index of the file;

[0021] S004. After encrypting the unique index of the file, it is stored in the database along with the unique index of the file name in step S001 to manage the files uploaded to the server in a unified manner, and the index of the database record is encrypted.

[0022] Preferably, in step 2, the information is parsed based on interaction and one or more encrypted parts are encrypted using the first key; then, a masking code is automatically derived from the database based on the information encrypted using the first key, and the masking code with the first key is encrypted again based on the DS algorithm and through one iterative operation.

[0023] Preferably, in step 4, if non-file data uploaded by the user is obtained, the encryption / decryption method is directly called to encrypt the non-file data using the user's identity identifier and return the encrypted content.

[0024] In the above technical solution, the network data encryption system provided by the present invention has the following beneficial effects: it uses a two-stage encryption method to encrypt both local buffer data and network cloud disk data during interaction, thereby preventing virus implantation from directly obtaining the data being input. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0026] Figure 1 This is a schematic diagram of the module provided in an embodiment of the present invention;

[0027] Figure 2 This is a schematic diagram of the process structure provided in an embodiment of the present invention. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] Example 1

[0030] like Figure 1 As shown, a network data encryption system includes:

[0031] The local file management module is based on the location of the local disk where the client software is installed, and encrypts the local data that is automatically collected from the client data.

[0032] The cloud-based file management module enables backup based on data interaction between the client and the backend.

[0033] The file information interaction module is based on the interaction and acquisition of data between the client, the backend, and cloud storage.

[0034] The data encryption / decryption module is used to encrypt the data obtained through interaction by applying a masking code and encryption algorithm.

[0035] In the above embodiments, the data encryption / decryption module includes:

[0036] The encryption unit parses data received from the client containing one or more encrypted portions, wherein the one or more encrypted portions are encrypted using a first key;

[0037] An encryption masking unit identifies one or more symbols contained in the data, wherein the one or more symbols represent one or more encrypted portions of the data, and the one or more symbols correspond to a second key and the one or more encrypted portions of the data are decrypted using the second key.

[0038] Furthermore, the data encryption / decryption module also includes a decryption unit, which performs code parsing based on the encryption unit and the encryption masking unit, executes the encryption masking unit, and obtains the acquisition parameters of the corresponding first key code by decrypting the encryption masking unit, so as to obtain the first key by calculating the parameters through the DS algorithm.

[0039] Furthermore, the DS algorithm reassembles 64-bit data blocks bit by bit and divides the output into two parts, L0 and R0, each 32 bits long. The acquired parameters are swapped to the first bit, the 50th bit to the second bit, and so on, with the last bit being the original 7th bit. L0 and R0 are the two parts of the output after the swapping; L0 is the left 32 bits of the output, and R0 is the right 32 bits. The input values ​​are D1D2D3......D64. After the initial permutation, the results are: L0 = D58D50...D8; R0 = D57D49...D7. After 16 iterations, L16 and R16 are obtained, which are used as input for the inverse permutation to obtain the ciphertext.

[0040] Furthermore, the encryption masking unit performs masking code parsing on one or more encrypted portions of data, customizes a database based on the masking data, determines whether at least one character corresponds to at least one field, wherein the database contains one or more fields and one or more corresponding masking data characters, and based on the determination that at least one masking data character corresponds to at least one field, replaces one or more encrypted portions with at least one masking data character.

[0041] Example 2

[0042] A method for encrypting network data, applied to the network data encryption system provided in Embodiment 1 above, comprises the following steps:

[0043] S001: Obtain user-inputted data, encrypt its filename, generate a unique index, and synchronously store it in the cloud media library and local disk;

[0044] S002, after the filename is encrypted, the file content data is sent to the encryption / decryption machine so that the encryption / decryption machine can encrypt the received file content to form a double encryption behavior;

[0045] S003: Obtain the encrypted file data after encryption by the encryption / decryption machine, write the encrypted file data to the distributed cloud drive, and return the unique index of the file;

[0046] S004. After encrypting the unique index of the file, store it together with the unique index of the file name in step S001 in the database to manage the files uploaded to the server in a unified manner, and encrypt the index of the database record.

[0047] In step 2, the information is parsed based on the interaction and one or more encrypted parts are encrypted using the first key; then, a masking code is automatically derived from the database based on the information encrypted using the first key, and the masking code with the first key is encrypted again based on the DS algorithm and through one iterative operation.

[0048] Furthermore, if non-file data uploaded by the user is obtained in step 4, the encryption / decryption method is directly called to encrypt the non-file data using the user's identity identifier and return the encrypted content.

[0049] In summary, by using double encryption to encrypt both local buffered data and network cloud disk data during interaction, we can prevent viruses from directly accessing the data being entered.

[0050] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program fields. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program field implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0051] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program fields according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0052] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0053] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0054] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

[0055] The embodiments of this application also provide a specific implementation of an electronic device capable of implementing all the steps in the methods described above, wherein the electronic device specifically includes the following:

[0056] Processor, memory, communications interface, and bus;

[0057] The processor, memory, and communication interface communicate with each other through the bus.

[0058] The processor is used to invoke a computer program in the memory, and when the processor executes the computer program, it implements all the steps in the method described in the above embodiments.

[0059] Embodiments of this application also provide a computer-readable storage medium capable of implementing all the steps of the methods in the above embodiments, wherein the computer-readable storage medium stores a computer program that, when executed by a processor, implements all the steps of the methods in the above embodiments.

[0060] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on its differences from other embodiments. In particular, for hardware + program embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. Although the embodiments in this specification provide the method operation steps as shown in the embodiments or flowcharts, more or fewer operation steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible execution order among many steps and does not represent the only execution order. In actual device or terminal execution, the methods can be executed in the order shown in the embodiments or drawings or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, field, or device that includes a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, field, or device. Without further limitations, the presence of other identical or equivalent elements in the process, method, field, or device that includes said elements is not excluded. For ease of description, the above devices are described in terms of function, divided into various modules. Of course, in implementing the embodiments of this specification, the functions of each module can be implemented in one or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the shown or discussed mutual couplings or direct couplings or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms. This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program fields according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which are executable by the processor of the computer or other programmable data processing device, produce instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0061] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program fields. Therefore, the embodiments of this specification can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of computer program fields implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The various embodiments in this specification are described in a progressive manner, with reference to each other for similar or identical parts. Each embodiment focuses on describing the differences from other embodiments. In particular, for system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, and relevant parts can be referred to in the description of the method embodiments. In the description of this specification, references to terms such as "an embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example that are included in at least one embodiment or example of the embodiments of this specification.

[0062] In this specification, the illustrative expressions of the terms used do not necessarily refer to the same embodiments or examples. Furthermore, those skilled in the art can combine and integrate different embodiments or examples described in this specification, as well as features of different embodiments or examples, without contradiction. The above descriptions are merely embodiments of this specification and are not intended to limit the embodiments of this specification. Various modifications and variations can be made to the embodiments of this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the embodiments of this specification should be included within the scope of the claims of the embodiments of this specification.

Claims

1. A network data encryption system, characterized in that, include: The local file management module is based on the location of the local disk where the client software is installed, and encrypts the local data that is automatically collected from the client data. The cloud-based file management module enables backup based on data interaction between the client and the backend. The file information interaction module is based on the interaction and acquisition of data between the client, the backend, and cloud storage. The data encryption / decryption module is used to encrypt the data obtained through the interaction by applying a masking code and an encryption algorithm. The data encryption / decryption module includes: An encryption unit parses data received from a client that includes one or more encrypted portions, wherein the one or more encrypted portions are encrypted using a first key; An encryption masking unit identifies one or more symbols contained in the data, where the one or more symbols represent one or more encrypted portions of the data, and assigns the one or more symbols to a second key and uses the second key to decrypt the one or more encrypted portions of the data; wherein, for the one or more encrypted portions of the data, a masking code is parsed, a custom database is defined based on the masking data, and it is determined whether at least one character corresponds to at least one field, wherein the database contains one or more fields and one or more characters corresponding to the masking data, and based on the determination that at least one character of the masking data corresponds to the at least one field, the one or more encrypted portions are replaced with the at least one character of the masking data; The decryption unit performs code parsing based on the encryption unit and the encryption masking unit, executes the encryption masking unit, and obtains the acquisition parameters of the corresponding first key code by decrypting the encryption masking unit, so as to calculate the first key by using the DS algorithm; The DS algorithm is based on a 64-bit data block, which is recombined bit by bit. The output is divided into two parts, L0 and R0, each 32 bits long. The obtained parameter is swapped to the first bit, the 50th bit to the second bit, and so on, with the last bit being the original 7th bit. L0 and R0 are the two parts of the output after the swapping. L0 is the left 32 bits of the output, and R0 is the right 32 bits. The input value is D1D2D3......D64. After the initial permutation, the result is: L0=D58D50...D8; R0=D57D49...D7. After 16 iterations, L16 and R16 are obtained. These are used as input for the inverse permutation to obtain the ciphertext.

2. A method for encrypting network data, characterized in that, The steps applied to the network data encryption system described in claim 1 are as follows: S001: Obtain user-inputted data, encrypt its filename, generate a unique index, and synchronously store it in the cloud media library and local disk; S002, after the filename is encrypted, the file content data is sent to the encryption / decryption machine so that the encryption / decryption machine can encrypt the received file content to form a double encryption behavior; S003: Obtain the encrypted file data after encryption by the encryption / decryption machine, write the encrypted file data to the distributed cloud drive, and return the unique index of the file; S004. After encrypting the unique index of the file, it is stored in the database along with the unique index of the file name in step S001 to manage the files uploaded to the server in a unified manner, and the index of the database record is encrypted.

3. The method for encrypting network data according to claim 2, characterized in that, In step S002, based on interactive information parsing, one or more encrypted portions are encrypted using the first key; then, based on the information encrypted using the first key, a masking code is automatically derived from the database, and based on the DS algorithm, the masking code with the first key is encrypted a second time through one iterative operation.

4. The method for encrypting network data according to claim 2, characterized in that, If non-file data uploaded by the user is obtained in step S004, the encryption / decryption method is directly called to encrypt the non-file data using the user's identity identifier and return the encrypted content.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the network data encryption method according to any one of claims 2 to 4.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the network data encryption method according to any one of claims 2 to 4.

Images