Internet-based data transmission encryption security protection system

Abstract

The invention relates to the technical field of data security protection, in particular to an encryption security protection system based on Internet data transmission. Comprising a data acquisition module, a server, a data encryption module, an identity verification module, a data verification module and a security protection module, by combining the authority level and the access frequency, the system can dynamically adjust the verification standard, so that the risk of the access request is more accurately judged, and the risk of unauthorized access is reduced; the method comprises the following steps: analyzing historical access behaviors of a visiting user, dynamically calculating a security value in combination with factors such as verification pass and failure times, access duration and risk access times so as to assess potential risks of user access, deciding whether to allow to continue to transmit data according to the security value, and sending out an early warning when the risk is relatively large; and the access is limited or an administrator is notified to carry out further processing, so that effective user behavior monitoring and risk management are realized, and the security of data transmission is improved.

Description

Technical Field

[0001] The present invention relates to the field of data security protection, and in particular to an encryption security protection system based on Internet data transmission. Background Art

[0002] In industries such as finance, healthcare, and government, the data transmitted often involves highly sensitive information, such as personal identity information, financial data, and health records. Encryption is a key technology to ensure that this data is not stolen or leaked during transmission. As enterprises’ digital transformation deepens, more and more business activities and data need to be transmitted over the Internet. Encryption technology can ensure the security of data when it is transmitted between different platforms. Data leakage may lead to huge economic losses, including direct financial losses or customer loss due to a crisis of trust. Data transmission encryption can significantly reduce these risks, thereby protecting the financial health of the enterprise. Therefore, the security protection of data transmission encryption is very important.

[0003] The security protection of data transmission encryption is not only an effective means to protect data from theft and tampering during transmission, but also a key technology to ensure the security of corporate and personal information, comply with regulatory requirements, protect reputation, and support modern digital business. It is an indispensable part of today's information security system. Summary of the invention

[0004] To this end, the present invention provides an Internet-based data transmission encryption security protection system to overcome the problems mentioned in the above background technology.

[0005] To achieve the above-mentioned purpose, the present invention provides a data transmission encryption security protection system based on the Internet, comprising: a data acquisition module, a server, a data encryption module, an identity authentication module, a data verification module and a security protection module;

[0006] The data collection module is responsible for collecting user data and data information to be transmitted from the data source and sending them to the server for storage;

[0007] The data encryption module obtains the collected data from the database, converts and encrypts it, and calculates the security value of user data transmission; the specific steps are as follows:

[0008] A character matching text is set, wherein the character matching text is composed of characters and numerical values, and each character corresponds to a unique numerical value; when the transmitted data is text, the transmitted data is matched with all the set characters respectively to obtain the corresponding numerical values, and the numerical values ​​are sorted in order according to their corresponding data timestamps to obtain the text numerical sequence to be converted; when the transmitted data is a video, the video is divided into several frames for extraction, and then a separate image file is generated, and then matched by a picture conversion method to obtain the numerical sequence to be converted; when the transmitted data is a picture, the picture is divided into several areas and the byte stream obtained by converting the pixel block area is merged in the order from left to right and from top to bottom to obtain the picture numerical sequence to be converted;

[0009] Identify the position of zero in the text numerical sequence to be converted and the picture numerical sequence to be converted, randomly select a number from 1 to 9 as the conversion value, and replace the zero in the text numerical sequence to be converted and the picture numerical sequence to be converted with the conversion value, thereby obtaining the text numerical sequence to be converted and the picture numerical sequence to be converted after zero removal; respectively count the number of bytes of the text numerical sequence to be converted and the picture numerical sequence to be converted, and evenly divide them into 5 groups according to the same number of bytes; if the number of values ​​is not divisible by 5, randomly add a number from 1 to 9 to the end of the last byte of the text numerical sequence to be converted and the picture numerical sequence to be converted until the numerical sequence to be converted can be divided by 5, thereby obtaining the text numerical sequence to be converted and the picture numerical sequence to be converted after 5 groups; The first three value groups of the text value group to be converted and the image value group to be converted are used as the length, width and height to construct a cuboid, and the two diagonal points of the top surface of the cuboid are connected to obtain the midpoint of the top surface of the cuboid; with the midpoint of the top surface of the cuboid as the center, the fourth value of the text value group to be converted and the image value group to be converted is used as the radius to draw a circle, and the fifth value of the text value group to be converted and the image value group to be converted is used as the height to draw a cone; thus, each text value group to be converted and the image value group to be converted corresponds to a cuboid and a cone respectively; the volume of each cuboid and cone is calculated respectively, the volumes of the obtained cuboid and cone are added and then matched in the character matching text according to the corresponding values ​​to obtain the encrypted ciphertext of the converted text and the encrypted ciphertext of the converted image, and send them to the server for storage;

[0010] The authentication module is used to verify the user's identity, authenticate the user according to the user's permission level and access frequency, and manage user operations;

[0011] The data verification module ensures the integrity and authenticity of data during transmission by means of digital signatures, confirming that the data comes from a trusted source;

[0012] The security protection module protects data security by identifying and evaluating risks in user data transmission.

[0013] As a preferred embodiment of the present invention, the user data in the data acquisition module includes the number of user visits, the number of verifications, the access duration and the access device; the data information to be transmitted includes the source of the transmitted data, the timestamp and the transmission log.

[0014] As a preferred embodiment of the present invention, the steps of converting a picture into a sequence of picture values ​​to be converted are:

[0015] When the transmitted data is a picture, the picture is divided into several pixel blocks, and the image processing library is used to open the pixel blocks and load them as operable objects to obtain the pixel data of the area, including the height, width and color channel of the image; pixel data is obtained from the pixel block area, the cropped pixel block area is converted into a pixel array, and the NumPy library is used to represent the pixels of the image in matrix form, where each pixel point is represented as an RGB value or RGBA value, depending on the color mode of the image; the pixel block area matrix is ​​expanded into a continuous byte stream, each element in the byte stream represents the color value of a pixel (red, green, blue), and the generated byte data is arranged in the order of pixels; the byte stream obtained by converting the above pixel block area is merged in the order from left to right and from top to bottom to obtain the numerical sequence of the image to be converted.

[0016] As a preferred implementation of the present invention, identity authentication is performed and user operations are managed according to the user's authority level and access frequency. The specific steps are as follows:

[0017] When a user requests access, identify the permission level of the visiting user and grant the corresponding access rights. Each user has different permission values ​​according to his or her permission level. Set the permission value as Qi. Where i = 1, 2, 3...I, I is a positive integer. I represents the total number of users, and i represents the number of any visiting user. The higher the permission level, the larger the permission value Qi and the wider the access range. Record the number of times each user visits more than once on the same day and record it as Ci. Substitute the values ​​of the permission value Qi and the excess value Ci into the formula Calculate and obtain the verification value Yi;

[0018] Set a verification threshold T. When the verification value Yi is greater than or equal to the set verification threshold T, it means that the user has passed the identity authentication and can access normally, and the verification log is sent to the server storage; when the verification value Yi is less than the set verification threshold T, it means that there may be risks, the user's access request will be rejected, and the administrator will be notified for authorization or further verification, and the verification log will be sent to the server storage.

[0019] As a preferred embodiment of the present invention, data verification is performed through digital signature, and the specific steps are as follows:

[0020] Before data transmission, a hash value of fixed length is generated for the data to be transmitted using a hash algorithm (SHA-256) and recorded as a data summary; the sender encrypts the generated data summary using its own private key to obtain a digital signature. This digital signature is bound to the data summary and can only be decrypted with the sender's public key; the generated digital signature is attached to the data packet and sent; after receiving the data packet, the receiver separates the original data and the digital signature generated by the sender from the data packet. The extracted data packet may contain other metadata, such as timestamp, sender identification, etc., to help with verification and subsequent processing; the receiver runs the same hash function (SHA-256) as the sender on the received original data again to calculate the local data summary; the receiver uses the sender's public key to decrypt the received digital signature to obtain the original data summary generated by the sender. If the decryption fails, it means that the digital signature is invalid; the receiver compares the decrypted data summary with the locally generated summary. When the data summary and the local summary are exactly the same, it means that the data has not been tampered with and the signature source is credible, and the receiver continues to process the data; when the data summary and the local summary are inconsistent, it means that the data has been tampered with or damaged during transmission and the verification fails. The receiver will reject the data packet, initiate a retransmission request, and issue an alarm to notify the administrator to perform a security check; after the verification is completed, the detailed information of each data verification is recorded and sent to the server for storage.

[0021] As a preferred implementation of the present invention, the specific steps of identifying and evaluating the risks in user data transmission are as follows:

[0022] Get the historical access records of the visiting user, where the historical access records include the number of times the identity authentication is passed and the corresponding access time, and the number of times the identity authentication is not passed; count the total number of times the identity authentication is passed and the number of times the identity authentication is not passed, and record it as K1; count the number of times the identity authentication is not passed, and record it as K2; set a safe access time, get the historical access time of each visiting user, and compare it with the safe access time. When the access time is longer than the standard access time, the access record is recorded as a risky access; when the access time is less than or equal to the standard access time, the access record is recorded as a normal access; count the total number of risky access times and the number of normal access times and record it as Z1; count the number of risky accesses and record it as Z2; substitute the values ​​of the total number of visiting user authentications K1, the number of authentication failures K2, the total number of accesses Z1, the number of risky accesses Z2, and the verification value Yi into the formula The security value Fi of the visiting user is calculated, where b1, b2 and b3 are the set weight factors;

[0023] Set a security value threshold G. When the security value Fi is greater than the set verification threshold G, it means that there is no potential security risk in the user's visit, and the security data is sent to the server storage; when the security value Fi is less than or equal to the set verification threshold G, it means that there is a potential security risk in the user's visit, and the user's access to data transmission or reception is restricted, and an access log is generated, an early warning is issued and sent to the server storage and the administrator respectively; after receiving the early warning signal, the administrator rejects or further verifies the data transmission request.

[0024] Beneficial effects of the present invention:

[0025] 1. By combining the permission level and access frequency, the system can dynamically adjust the verification standards to more accurately judge the risk of access requests and reduce the risk of unauthorized access; monitoring of access exceeding the number of times combined with verification thresholds can help to promptly detect and prevent potential abnormal activities and avoid data leakage or attacks; the mechanism that requires additional verification for new devices can effectively prevent access from unfamiliar devices and protect user account security; the operation time management mechanism prevents users who have been inactive for a long time from retaining active operations, reducing the risk of operation hijacking, and automatically extending the session when the user is active, maintaining security while also improving the user experience.

[0026] 2. By analyzing the historical access behavior of visiting users, combined with factors such as the number of verification passes and failures, access duration and the number of risky visits, the security value is dynamically calculated to evaluate the potential risks of user access. Based on the security value, it is decided whether to allow continued data transmission, and when the risk is high, an early warning is issued, access is restricted or the administrator is notified for further processing, thereby achieving effective user behavior monitoring and risk management and improving the security of data transmission; the system can automatically record the security event log of each visit, and the administrator can conduct in-depth analysis based on this data to further optimize the system's security strategy; by identifying and restricting risky access, the system can effectively prevent abuse by malicious users and protect the data security of legitimate users. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic diagram of system module connection of the present invention. DETAILED DESCRIPTION

[0028] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0029] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0030] It should be noted that, in the description of the present invention, terms such as "up", "down", "left", "right", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is merely for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0031] In addition, it should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0032] See also Figure 1 As shown, the present invention is an Internet-based data transmission encryption security protection system, including: a data acquisition module, a server, a data encryption module, an identity authentication module, a data verification module and a security protection module;

[0033] The data collection module is responsible for collecting user data and data information to be transmitted from the data source and sending them to the server for storage; user data includes the number of user visits, verification times, access duration and access device; the data information to be transmitted includes the source of the transmitted data, timestamp and transmission log;

[0034] The data encryption module obtains the collected data from the database, converts and encrypts it, and calculates the security value of user data transmission; the specific steps are as follows:

[0035] Set a character matching text, where the character matching text consists of characters and values, and each character corresponds to a unique value; when the transmitted data is text, match the transmitted data with all the set characters to obtain the corresponding values, and sort the values ​​according to their corresponding data timestamps to obtain the text value sequence to be converted; when the transmitted data is a video, divide the video into several frames for extraction, and then generate a separate image file, and then match it through the image conversion method to obtain the value sequence to be converted; when the transmitted data is a picture, divide the picture into several areas (such as each area is a 50*50 pixel block, and different pixel block sizes are flexibly selected according to the complexity of the picture), and use the image processing library to open the pixel block and load it as an operable object, and obtain the pixel data of the area, including the height, width and color channel of the image; obtain pixel data from the pixel block area, convert the cropped pixel block area into a pixel array, and use the NumPy library to represent the pixels of the image in matrix form, where each pixel point will be represented as an RGB value or RGBA value, depending on the color of the image Color mode; it should be noted that in RGB mode, each pixel is represented by 3 integer values, representing red, green and blue channels respectively, and in RGBA mode, each pixel is represented by 4 integer values, representing red, green, blue and transparency channels respectively; the pixel block area matrix is ​​expanded into a continuous byte stream, each element in the byte stream represents the color value (red, green, blue) of a pixel, and the generated byte data is arranged in the order of pixels. For example, the bytes of the RGB value of the first pixel will be stored in the first three positions of the byte stream in sequence, where the length of the byte data is: when a 10*10 pixel block area is extracted and the image is in RGB mode, the length of the generated byte data is 50*50*3=7500 bytes, where 3 represents the three channels of RGB. If the image is in RGBA mode, each pixel occupies 4 bytes, and the corresponding length of the generated byte data is 50*50*4=10000 bytes; the byte stream obtained by converting the above pixel block area is merged in the order from left to right and from top to bottom to obtain the numerical sequence of the image to be converted;

[0036] Identify the position of zero in the text numerical sequence to be converted and the picture numerical sequence to be converted, randomly select a number from 1 to 9 as the conversion value, and replace the zero in the text numerical sequence to be converted and the picture numerical sequence to be converted with the conversion value, thereby obtaining the text numerical sequence to be converted and the picture numerical sequence to be converted after de-zeroing; count the number of bytes of the text numerical sequence to be converted and the picture numerical sequence to be converted respectively, and evenly divide them into 5 groups according to the same number of bytes; if the number of values ​​is not divisible by 5, randomly add a number from 1 to 9 to the end of the last byte of the text numerical sequence to be converted and the picture numerical sequence to be converted until the numerical sequence to be converted is divisible by 5, thereby obtaining the text numerical group to be converted and the picture numerical group to be converted after 5 groups; it should be noted that if the byte length is 7901 bytes and the length byte is not divisible by 5, then keep adding 1 to 9 until the last byte of the text numerical sequence to be converted and the picture numerical sequence to be converted is divisible by 5. Add numbers to 7905 bytes, with each group of bytes being 181; construct a cuboid using the first three value groups of the text value group to be converted and the image value group to be converted as the length, width and height, and connect the two diagonal points of the top surface of the cuboid to obtain the midpoint of the top surface of the cuboid; use the midpoint of the top surface of the cuboid as the center, take the fourth value of the text value group to be converted and the image value group to be converted as the radius to draw a circle, and use the fifth value of the text value group to be converted and the image value group to be converted as the height to draw a cone; thus, each text value group to be converted and the image value group to be converted corresponds to a cuboid and a cone respectively; calculate the volume of each cuboid and cone respectively, add the volumes of the obtained cuboid and cone, and then match them in the character matching text according to the corresponding values ​​to obtain the converted text encrypted ciphertext and the converted image encrypted ciphertext, and send them to the server for storage;

[0037] The encryption method of character matching and numerical conversion increases the complexity and unpredictability of data transmission. Combined with the encryption process of the geometric model, the encrypted data is difficult to decode or tamper with. Different processing methods are used according to the data type (text, video, picture), and the most appropriate encryption method is applied to different types of data to optimize the data processing process. The data is evenly divided into 5 groups and different superimposed geometric models are drawn for encryption processing, which can improve the security of the data and avoid the security vulnerabilities that may be caused by a single encryption method.

[0038] The authentication module is used to verify the user's identity, authenticate the user according to the user's permission level and access frequency, and manage user operations; the specific steps are as follows:

[0039] When a user requests access, identify the permission level of the visiting user and grant the corresponding access rights. Each user has different permission values ​​according to his or her permission level. Set the permission value as Qi; where i = 1, 2, 3...I, I is a positive integer, I represents the total number of users, and i represents the number of any visiting user. The higher the permission level, the larger the permission value Qi and the wider the access range. Record the number of times each user visits more than once a day and record it as Ci. The number of times each user visits more than once a day is used to measure the user's access frequency. Too high a number of visits may indicate abnormal activities or high-risk operations. Substitute the values ​​of the permission value Qi and the excess value Ci into the set formula The verification value Yi is calculated, where a1 and a2 are the set weight factors; from the formula, the larger the permission value Qi is, the higher the permission level is, the higher the access security is, and the larger the verification value Yi is; the larger the overtime value Ci is, the more frequent the access is, and there may be risks, and the verification value Yi will be reduced accordingly; a verification threshold T is set, when the verification value Yi is greater than or equal to the set verification threshold T, it means that the user has passed the identity authentication and can access normally, and the verification log is sent to the server for storage; when the verification value Yi is less than the set verification threshold T, it means that there may be risks, the user's access request will be rejected, and the administrator will be notified to authorize or further verify, and the verification log will be sent to the server for storage;

[0040] Identify whether the device used by the visiting user is a trusted device. For devices accessed for the first time, the user is required to perform additional verification via SMS or email verification code to ensure that the user is operating on a trusted device; if the device is a registered trusted device, the system will skip the additional device verification step and directly authorize access; once the visiting user passes all verifications, the system will manage the user's operation time according to his or her permission level and security policy; if the user does not perform any operation within a set period of time (for example, 30 minutes), the system will automatically lock the operation and require re-verification; whenever the user has a valid operation, the system will extend the operation time and refresh the operation lock timer to avoid unnecessary operation interruptions;

[0041] By combining the permission level and access frequency, the system can dynamically adjust the verification standard to more accurately determine the risk of access requests and reduce the risk of unauthorized access; monitoring of access exceeding the number of times combined with verification thresholds can help to promptly detect and prevent potential abnormal activities and avoid data leakage or attack behaviors; the mechanism that requires additional verification for new devices can effectively prevent access from unfamiliar devices and protect user account security; the operation time management mechanism prevents users who have been inactive for a long time from retaining active operations, reducing the risk of operation hijacking, and automatically extending the session when the user is active, maintaining security while also improving the user experience;

[0042] The data verification module ensures the integrity and authenticity of data during transmission by means of digital signatures, and confirms that the data comes from a trusted source; the specific steps are as follows:

[0043] Before data transmission, a hash algorithm (SHA-256) is used to generate a fixed-length hash value for the data to be transmitted, and it is recorded as the data summary; the sender uses its own private key to encrypt the generated data summary to obtain a digital signature. This digital signature is bound to the data summary and can only be decrypted with the sender's public key; the generated digital signature is attached to the data packet and sent; after receiving the data packet, the receiver separates the original data and the digital signature generated by the sender from the data packet. The extracted data packet may contain other metadata, such as timestamps, sender identification, etc., to help with verification and subsequent processing; the receiver runs the same hash function (SHA-256) as the sender on the received original data again to calculate the local data summary; the receiver uses the sender's public key to decrypt the received digital signature to obtain the original data summary generated by the sender. If the decryption fails, it means The digital signature is invalid; the receiver compares the decrypted data summary with the locally generated summary. When the data summary and the local summary are completely consistent, it means that the data has not been tampered with and the signature source is credible, and the receiver continues to process the data; when the data summary and the local summary are inconsistent, it means that the data has been tampered with or damaged during transmission and the verification fails. The receiver will reject the data packet, initiate a retransmission request, and issue an alarm to notify the administrator to conduct a security check; after the verification is completed, the detailed information of each data verification is recorded and sent to the server for storage, where the detailed information of the data verification includes the verification result, timestamp, sender identity, abnormal conditions during the digital signature verification process, etc.

[0044] By binding the digital signature to the data summary, any tampering will change the data summary. By comparing the decrypted data summary with the locally generated summary, it is possible to effectively detect whether the data has been tampered with during transmission and ensure the integrity of the data; the digital signature ensures that the data cannot be modified during transmission. Even if there is an attacker in the middle of the transmission process, the data cannot be changed without being detected, which significantly improves the security of data transmission; the detailed information of each data verification will be recorded in the log and stored on the server, which is convenient for the system administrator's subsequent security audit and problem tracking, providing a high-level security protection mechanism that can effectively protect the integrity, authenticity and credibility of the data;

[0045] The security protection module protects data security by identifying and evaluating risks in user data transmission; the specific steps are as follows:

[0046] Obtain the historical access records of the visiting user, where the historical access records include the number of times the identity authentication is passed and the corresponding access time, and the number of times the identity authentication is not passed; count the total number of times the identity authentication is passed and the number of times the identity authentication is not passed, and record it as K1; count the number of times the identity authentication is not passed, and record it as K2; set a safe access time, the specific time is set by the professional and technical personnel in this field; obtain the historical access time of each visiting user, and compare it with the safe access time. When the access time is longer than the standard access time, the access record is recorded as a risky access, and when the access time is less than or equal to the standard access time, the access record is recorded as a normal access; count the total number of risky access times and the number of normal access times and record it as Z1, count the number of risky accesses, and record it as Z2; substitute the values ​​of the total number of visiting user verifications K1, the number of verification failures K2, the total number of accesses Z1, the number of risky accesses Z2, and the verification value Yi into the set formula

[0047] The security value Fi of the visiting user is calculated, where b1, b2 and b3 are the set weight factors. From the formula, it can be obtained that when the number of identity authentication failures is smaller and the number of identity authentication passes is larger, the security value is larger; when the number of risky visits is smaller and the number of normal visits is larger, the security value is larger; when the verification value is larger, the security value is larger;

[0048] Set a security value threshold G. When the security value Fi is greater than the set verification threshold G, it means that there is no potential security risk for the user's visit, and the security data is sent to the server storage; when the security value Fi is less than or equal to the set verification threshold G, it means that there is a potential security risk for the user's visit, and the user's access to data transmission or reception is restricted, and an access log is generated, and an early warning is issued and sent to the server storage and administrator respectively; after receiving the early warning signal, the administrator rejects or further verifies the data transmission request; establish a security incident response process to ensure that when a security threat is detected, it can respond and deal with it quickly and effectively;

[0049] By analyzing the historical access behavior of visiting users, combining factors such as the number of verification passes and failures, access duration and the number of risky visits, the security value is dynamically calculated to evaluate the potential risk of user access. Based on the security value, it is decided whether to allow continued data transmission, and when the risk is high, an early warning is issued, access is restricted or the administrator is notified for further processing, thereby achieving effective user behavior monitoring and risk management and improving the security of data transmission. The system can automatically record the security event log of each visit, and the administrator can conduct in-depth analysis based on this data to further optimize the system's security strategy. By identifying and restricting risky access, the system can effectively prevent abuse by malicious users and protect the data security of legitimate users.

[0050] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0051] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A security protection system based on Internet data transmission encryption. It is characterized in that It includes a data encryption module and a security protection module; the characteristic is that the data encryption module obtains the collected data from the database, converts and encrypts it, and calculates the security value of user data transmission; the specific steps are as follows: The transmitted data is processed to obtain a text numerical sequence to be converted and a picture numerical sequence to be converted, the position of zero in the text numerical sequence to be converted and the picture numerical sequence to be converted is identified, a number is randomly selected from 1 to 9 as a conversion value, and the conversion value is used to replace the zero in the text numerical sequence to be converted and the picture numerical sequence to be converted, so as to obtain the text numerical sequence to be converted and the picture numerical sequence to be converted after de-zeroing; the number of bytes of the text numerical sequence to be converted and the picture numerical sequence to be converted are respectively counted, and they are evenly divided into 5 groups according to the same number of bytes. If the number of values ​​is not divisible by 5, a number from 1 to 9 is randomly added to the end of the last byte of the text numerical sequence to be converted and the picture numerical sequence to be converted until the numerical sequence to be converted can be divided by 5, thereby obtaining the text numerical sequence to be converted after 5 groups. group and the image value group to be converted; use the first three value groups of the text value group to be converted and the image value group to be converted as the length, width and height to construct a cuboid, connect the two diagonal points of the top surface of the cuboid to obtain the midpoint of the top surface of the cuboid; use the midpoint of the top surface of the cuboid as the center, take the fourth value of the text value group to be converted and the image value group to be converted as the radius to draw a circle, and use the fifth value of the text value group to be converted and the image value group to be converted as the height to draw a cone; thus, each text value group to be converted and the image value group to be converted corresponds to a cuboid and a cone respectively; calculate the volume of each cuboid and cone respectively, add the volumes of the obtained cuboid and cone, and then match them in the character matching text according to the corresponding values ​​to obtain the converted text encrypted ciphertext and the converted image encrypted ciphertext; The security protection module protects data security by identifying and evaluating risks in user data transmission.

2. According to claim 1, a data transmission encryption security protection system based on the Internet, It is characterized in that It also includes a data collection module and a server. The data collection module is responsible for collecting user data and data information to be transmitted from the data source and sending them to the server for storage; user data includes user access times, verification times, access duration and access device; The information of the data to be transmitted includes the source, timestamp and transmission log of the transmitted data.

3. According to claim 1, a data transmission encryption security protection system based on the Internet, It is characterized in that The steps to convert an image into a numerical sequence of images to be converted are: When the transmitted data is an image, the image is divided into several pixel blocks, and the image processing library is used to open the pixel blocks and load them as operable objects, and the pixel data of the area is obtained, including the height, width, and color channels of the image; the pixel data is obtained from the pixel block area, and the cropped pixel block area is converted into a pixel array, and the NumPy library is used to represent the pixels of the image in matrix form, where each pixel point is represented as an RGB value or an RGBA value, depending on the color mode of the image; Expand the pixel block area matrix into a continuous byte stream. Each element in the byte stream represents the color value of a pixel, including red, green and blue. Arrange the generated byte data in the order of pixels. Convert the above pixel block area to obtain the byte stream, and merge the byte streams in the order from left to right and from top to bottom to obtain the numerical sequence of the image to be converted.

4. According to claim 1, a data transmission encryption security protection system based on the Internet, It is characterized in that It also includes an identity authentication module, which is used to verify the identity of the user, authenticate the user according to the user's permission level and access frequency, and manage user operations; the specific steps are: When a user requests access, the permission level of the visiting user is identified and the corresponding access rights are granted. Each user has a different permission value according to his or her permission level. The number of times each user visits more than once on the same day is recorded. The permission value and the value of the excess number are normalized to obtain the verification value. Set a verification threshold. When the verification value is greater than or equal to the set verification threshold, it means that the user has passed the identity authentication and can access normally, and the verification log is sent to the server storage; when the verification value is less than the set verification threshold, it means that there may be risks, the user's access request will be rejected, and the administrator will be notified for authorization or further verification, and the verification log will be sent to the server storage.

5. According to claim 1, a security protection system for Internet data transmission encryption, It is characterized in that It also includes a data verification module, which uses digital signatures to ensure the integrity and authenticity of data during transmission. The specific process of data verification through digital signatures is as follows: Before data transmission, a hash value of a fixed length is generated for the data to be transmitted using a hash algorithm and recorded as a data summary; the sender uses its own private key to encrypt the generated data summary to obtain a digital signature, which is bound to the data summary and can only be decrypted using the sender's public key. The generated digital signature is then attached to the data packet and sent; after receiving the data packet, the receiver separates the original data and the digital signature generated by the sender from the data packet. The extracted data packet contains other metadata to help with verification and subsequent processing; the receiver runs the same hash function as the sender on the received original data again to calculate the local data summary; the receiver The recipient uses the sender's public key to decrypt the received digital signature and obtains the original data summary generated by the sender. If the decryption fails, it means that the digital signature is invalid. The recipient compares the decrypted data summary with the locally generated summary. When the data summary and the local summary are exactly the same, it means that the data has not been tampered with and the signature source is credible, and the recipient continues to process the data. When the data summary and the local summary are inconsistent, it means that the data has been tampered with or damaged during transmission and the verification fails. The recipient will reject the data packet, initiate a retransmission request, and issue an alarm to notify the administrator to perform a security check. After the verification is completed, the detailed information of each data verification is recorded and sent to the server for storage.

6. According to claim 1, a security protection system for Internet data transmission encryption, It is characterized in that Identify and assess risks in user data transmission. The specific steps are: Obtain the historical access records of visiting users, where the historical access records include the number of times identity authentication is passed and the corresponding access duration, and the number of times identity authentication is not passed; count the total number of times identity authentication is passed and the number of times identity authentication is not passed; count the number of times identity authentication is not passed; set a safe access duration; obtain the historical access duration of each visiting user, and compare it with the safe access duration. When the access duration is longer than the standard access duration, the access record is recorded as a risky access. When the access duration is less than or equal to the standard access duration, the access record is recorded as a normal access. The number of risky visits is counted together with the sum of the number of normal visits to count the number of risky visits; The total number of verifications for visiting users, the number of verification failures, the total number of visits, the number of risky visits, and the verification value are normalized to obtain the security value of the visiting user; Set a security value threshold. When the security value is greater than the set verification threshold, it means that the user's access has no potential security risks, and the security data will be sent to the server storage. When the security value is less than or equal to the set verification threshold, it means that the user's access has potential security risks, and the user's access to data transmission or reception is restricted, and an access log is generated, an early warning is issued and sent to the server storage and administrator respectively. After receiving the early warning signal, the administrator will reject or further verify the data transmission request.

Images