Side-hung non-intrusive data encryption tool and side-hung non-intrusive data encryption method

Abstract

The invention discloses a side-hung non-intrusive data encryption tool and method, and relates to the technical field of information technology processing. According to the method, an RSA encryption algorithm and a YXSL algorithm are adopted to carry out double-layer encryption processing on source data, and the method is realized through an SMNIDE encryption tool, and specifically comprises the following steps: carrying out initial replacement, and obtaining and outputting combined data; generating a sub-key, and carrying out iteration on the output combined data to obtain iteration data; combining the iterative data, and performing inverse permutation to obtain a layer of encrypted data; performing secondary encryption by using the public key through an RSA encryption algorithm to obtain double-layer encrypted data; and the data encryption processing module is used for improving the data concurrent processing efficiency. According to the method, an independent proxy process is not needed, and the data is encrypted or decrypted in real time by using a dual encryption algorithm, so that the security of the data in a network transmission process is ensured; data compression and decompression processing are carried out, the data transmission speed is increased, the capability and speed of data parallel streaming data processing are improved, and the overall analysis processing capability is improved.

Description

Technical Field

[0001] The present invention relates to the field of information technology processing technology, and in particular to a side-hung non-intrusive data encryption tool and method. Background Art

[0002] The existing proxy modes are divided into two types: proxy mode and intrusive mode, which are used for data processing between the visitor and the visitee. The proxy mode can decouple the target object from the proxy object so that they can be modified and extended independently. The proxy object can protect the target object, hide its real implementation details, and improve the security of the system. The proxy object can control the access to the target object and add additional logic before and after calling the target method, such as permission verification and logging. The proxy mode is an important way to implement aspect-oriented programming (AOP) and is widely used in transaction management and logging in the Spring framework; the intrusive mode allows users to better integrate with the framework and make it easier and more fully utilize the functions provided by the framework.

[0003] However, the proxy mode will increase the number of classes in the system design and increase the complexity of the code. Especially when using dynamic proxies, it is necessary to understand and process dynamically generated proxy classes. Adding a proxy object to the client and target object will slow down the request processing speed and increase the performance consumption of server resources. The intrusive method requires the modification of existing programs, which will affect the stability of the current system. These codes cannot be used outside the framework, which is not conducive to code reuse. Summary of the invention

[0004] The present invention aims to provide a non-intrusive data encryption tool and method to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides a side-hung non-intrusive data encryption tool, which uses the RSA encryption algorithm and the YXSL algorithm to perform double-layer encryption processing on the source data and is implemented through the SMNIDE encryption tool, specifically including:

[0006] The SMNIDE encryption tool uses the YXSL algorithm, uses the data module to recombine the source data, obtains and outputs the combined data for initial replacement;

[0007] The SMNIDE encryption tool uses a permutation table to reduce the key and selects parity bits to generate subkeys, iterates the output combined data, and obtains iterated data;

[0008] The obtained iterative data are merged and converted using an inverse permutation table to perform inverse permutation processing to obtain a layer of encrypted data;

[0009] The obtained encrypted data is encrypted twice using the public key through the RSA encryption algorithm to obtain double-layer encrypted data to improve the security of data during transmission;

[0010] The obtained double-layer encrypted data is compressed to improve the efficiency of concurrent data processing.

[0011] Furthermore, the source data recombining specifically includes:

[0012] The source data is labeled using the SMNIMK algorithm to obtain the label name and label value;

[0013] The obtained label names and label values ​​are classified and combined to obtain recombined data.

[0014] Furthermore, the double-layer encrypted data is compressed using the LZ77 algorithm and the Huffman coding algorithm, specifically including:

[0015] Use the LZ77 algorithm to find substrings in the double-encrypted data that match the content in the buffer and express them as "distance-length" pairs;

[0016] Compress the matching substring and output LZ77 compressed data. If there is no matching substring, output double-layer encrypted data characters.

[0017] According to the Huffman coding algorithm, scan and count the frequency of each character to build a Huffman tree;

[0018] By traversing the path of the Huffman tree, a corresponding Huffman code is generated for each character to generate a Huffman code table;

[0019] Each character in the output data is replaced with the corresponding Huffman code to achieve data compression and obtain compressed data.

[0020] Furthermore, the SMNIDE encryption tool also includes a data decryption processing module, specifically including:

[0021] The SMNIDE encryption tool decompresses the double-layer encrypted data to obtain the decompressed data;

[0022] The obtained decompressed data is decrypted using the RSA decryption algorithm and the decryption private key to obtain a layer of decrypted data;

[0023] The first layer of scrambled data is converted using the YXSL algorithm through an inverse permutation table, and the converted data is separated to obtain separated data;

[0024] The separated data is transferred to the left and right subkey positions for iterative operation, the key is expanded using the permutation table, and the parity bit is used for verification to obtain the iterative data;

[0025] The obtained iterative data are merged to obtain the second-layer decrypted data.

[0026] Furthermore, the double-layer encrypted data is decompressed using the LZ77 algorithm, the Huffman coding algorithm, and the SMNIMK algorithm, specifically including:

[0027] Use the Huffman coding algorithm to read the character code, restore the Huffman tree, perform decompression processing, and obtain the Huffman decompressed data;

[0028] The obtained Huffman decompressed data is restored to a substring using the LZ77 algorithm, and the decompressed data is output;

[0029] The decompressed data is obtained using the SMNIMK algorithm to perform classification operations through the labeling and classification combination information at the source end to obtain labeling and classification data to improve data processing capabilities.

[0030] The present invention also provides a non-intrusive data encryption method, which specifically includes:

[0031] The source data is labeled and classified using the SMNIMK algorithm to obtain labeled and classified data to improve data processing capabilities;

[0032] The obtained label classification data is double-encrypted using the RSA encryption algorithm and the YXSL algorithm to obtain double-encrypted data to improve the security of the data during transmission;

[0033] The obtained double-layer encrypted data is compressed using the LZ77 algorithm and the Huffman coding algorithm to obtain compressed data to improve the data concurrent processing capability;

[0034] The compressed data processed by the SMNIDE encryption tool is decompressed using the LZ77 algorithm, Huffman coding algorithm, and SMNIMK algorithm to obtain the decompressed labeling and classification data;

[0035] The decompressed label and classification data are decrypted using the RSA decryption algorithm and the YXSL algorithm to obtain the decrypted data and improve the security of the data during transmission.

[0036] Beneficial effects of the present invention: The side-hook non-intrusive data encryption tool (SMNIDE) is a tool between the proxy method and the code intrusion method, with low coupling and no need for a separate proxy process. By intercepting specific function calls, messages or events without modifying the original code, the tool avoids the use of the proxy method to increase the process, thereby increasing the large consumption of system resources and the occurrence of performance problems such as system load balancing, while avoiding the problems of high coupling of code embeddedness and affecting the performance of source applications.

[0037] The side-hung non-intrusive data encryption method uses the RSA algorithm and the YXSL algorithm to perform double-layer encryption processing on the source data, which improves the data security during network transmission. The data compression and decompression module provides the ability to merge and compress data, which can speed up the transmission speed of data on the disk and network, and improve the ability and speed of data parallel streaming processing, thereby improving the overall analysis and processing capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a data processing flow chart of the present invention.

[0039] Figure 2 It is a flow chart of the labeling implementation process of the present invention.

[0040] Figure 3 It is a flow chart of data compression and decompression processing of the present invention.

[0041] Figure 4 It is a flow chart of data encryption and decryption processing of the present invention.

[0042] Figure 5 It is a test effect diagram of the quantitative processing performance of the present invention.

[0043] Figure 6 This is a test effect diagram of the timing processing performance of the present invention. DETAILED DESCRIPTION

[0044] In the following description, a large number of specific details are provided to provide a more thorough understanding of the present invention. However, it is apparent to those skilled in the art that the present invention can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present invention, some technical features well known in the art are not described.

[0045] The present invention provides a non-intrusive data encryption tool for side-hanging, which is applied to enterprises such as telecommunications and finance with IT systems and high data security requirements. The tool avoids the use of proxy methods, increases processes, and thus increases the occurrence of performance problems such as large consumption of system resources and system load balancing. The tool is between the proxy method and the code intrusion method, has the characteristics of low coupling and does not require a separate proxy process. It not only avoids the performance problems such as independent processes affecting resource consumption and load balancing when deploying agents, but also avoids code embedded coupling and affects the performance of source applications. It is implemented by intercepting specific function calls, messages or events without modifying the original code, and inserting custom code before, during or after an application or system calls another API function, thereby realizing additional functions. When the original API is executed, in the scenario of non-intrusive data encryption, the data is encrypted, decrypted or compressed through the logic and compression algorithm of data encryption or decryption. For example, when the file read and write API is called, data can be encrypted before writing the file and decrypted before reading the file.

[0046] Reference Figure 1-4 , a non-intrusive data encryption tool that is low-coupled and non-intrusive, uses the SMNIDE encryption tool to perform double-layer encryption of data using the RSA algorithm and the YXSL algorithm. The RSA algorithm is an asymmetric encryption algorithm. Unlike the symmetric encryption algorithm, the RSA algorithm has two different keys, one is the public key and the other is the private key. The RSA public key cryptosystem is a cryptosystem that uses different encryption keys and decryption keys, and "it is computationally infeasible to derive the decryption key from the known encryption key." In the public key cryptosystem, the encryption key (i.e., public key) PK is public information, while the decryption key (i.e., secret key) SK needs to be kept secret. The encryption algorithm E and the decryption algorithm D are also public. Although the decryption key SK is determined by the public key PK, SK cannot be calculated based on PK.

[0047] The YXSL encryption algorithm performs an encryption before RSA encryption. The difference between this encryption algorithm and RSA is that the encryption and decryption keys are generated by the machine code of the source and target ends, and then encryption and decryption are performed using the keys. The YXSL encryption algorithm has a certain degree of security and can reduce the risk of the algorithm being attacked.

[0048] The data processing flow of the SMNIDE encryption tool is as follows:

[0049] The source data from HTTP, Kafka, MQ, MYSQL database, etc. are labeled using the SMNIMK algorithm to obtain label names and label values; the obtained label names and label values ​​are classified and combined to obtain recombined data, thereby improving data processing capabilities.

[0050] The source data is reassembled using a 64-bit data module, and two parts, L0 and R0, are output, each of which is 32 bits long. The source data is reassembled, and the combined data is obtained and output for initial permutation.

[0051] Use the YXSL algorithm and the permutation table to reduce the key K to 56-bit data K′. The 8th bit of each byte is used as the parity bit, and then 16 rounds of iterations are performed. In the subsequent iterations, a different sub-key is required to participate in the calculation in each round. The sub-key is generated by using machine code, timestamp and other information as the key K to generate 16 sub-keys.

[0052] The L16 and R16 obtained from the above 16 iterations are combined, and the obtained result is transformed using the inverse permutation table R to obtain a layer of encrypted data.

[0053] The obtained one-layer encrypted data is encrypted twice using the public key through the RSA encryption algorithm to obtain double-layer encrypted data to improve the security of data during transmission.

[0054] The obtained double-layer encrypted data is compressed using the LZ77 algorithm and the Huffman coding algorithm. The LZ77 algorithm starts from the beginning of the source data. The algorithm searches for the longest substring that matches the content in the search buffer in the sliding window. The matching process can be achieved through a simple linear search. After finding the matching substring, the algorithm represents it as a "distance-length" pair, where "distance" represents the distance of the matching substring in the search buffer, and "length" represents the length of the matching substring. For each matching substring, the algorithm represents it as a "distance-length" pair and outputs it in a compressed form. If no substring is matched, the original character is output. Then the input data is scanned, the frequency of each character is counted, and a character frequency table is constructed to construct a Huffman tree. By traversing the path of the Huffman tree, a corresponding Huffman code is generated for each character, and each character and its corresponding Huffman code are stored in a coding table. According to the generated Huffman coding table, each character in the original data is replaced with the corresponding Huffman code, thereby achieving data compression.

[0055] The decryption process is the reverse process of encryption. The Huffman coding algorithm is used to read the character code, restore the Huffman tree, perform decompression processing, and obtain the Huffman decompressed data; the obtained Huffman decompressed data is restored to a substring using the LZ77 algorithm, and the decompressed data is output; the obtained decompressed data is used with the SMNIMK algorithm, and the system automatically determines the information grouping and classification through the source end labels, classification combinations and other information. If the data belongs to the same system and the same group, which groups need to be combined and calculated, and which groups need to be calculated independently, the system automatically performs classification operations according to the rules based on the pre-attached labels, reducing big data retrieval, analysis and other operations, thereby improving the efficiency of data transmission, storage, and processing in a large amount of data concurrent environment.

[0056] The obtained decompressed data is decrypted using the RSA decryption algorithm and the decryption private key to obtain a layer of decrypted data;

[0057] The first layer of scrambled data uses the YXSL algorithm to transform through the inverse permutation table, and separates the data to obtain separated data;

[0058] The separated data is transferred to the left and right subkey positions for 16 rounds of iterative operations, the key is expanded using the permutation table, and the K password is used for verification to obtain the iterative data;

[0059] The obtained iterative data are merged to obtain the second-layer decrypted data.

[0060] The SMNIDE encryption tool uses the open source RSA encryption algorithm and the self-developed YXSL algorithm for double-layer encryption. YXSL decryption requires the use of an authorized key and the tool to decrypt and use, which provides data security and is not easy to be cracked. The main function of the YXSL algorithm is to encrypt or decrypt data. The data encrypted by this algorithm must be decrypted using the receiving end and the pre-generated key. The key is generated by the relevant data of the sending end and the receiving end. If the receiving end or the sending end device is changed, the key must be regenerated. The role of this function is to ensure the security of data during transmission. Even if it is intercepted, it cannot be easily cracked by the other party. Data compression improves the efficiency of concurrent processing and provides the ability to merge and compress data. It can speed up the transmission speed of data on disks and networks, improve the ability and speed of data parallel streaming processing, and thus improve the overall data analysis and processing capabilities.

[0061] Use the SMNIMK algorithm to perform data compression and conduct processing performance tests.

[0062] Six services were used to verify and compare the tool’s data processing efficiency. The configurations are shown in the following table.

[0063]

[0064] The six servers are divided into two groups with the same environment and the same application programs deployed at the same time. Then the device is deployed on the first group to verify the data processing efficiency in both quantitative and timing methods.

[0065] Quantitative performance test: 300 GB of business data was prepared in advance and processed simultaneously in two different environments. The data was divided into seven executions and the processing time of each execution was recorded.

[0066] Timing performance test: The same business data is processed every 10 minutes in two different environments. The execution is divided into seven times. After the time is up, the amount of data processed each time is counted.

[0067] Reference Figure 5 and Figure 6 After obtaining the data in both quantitative and timing ways, the minimum value is taken, and the concurrent processing speed of the SMNIMK algorithm for processing the same data in the same environment is increased by 35%.

[0068] The present invention also provides a non-intrusive data encryption method that configures the startup information of the SMNIDE tool in an existing application and starts it together with the application to achieve real-time encryption of data and solve the problem of data transmission security during transmission. SMNIDE is deployed on the application server in a non-intrusive manner, and the startup configuration generated by SMNIDE is applied to the startup script; SMNIDE and the application are re-enabled to match SMNIDE and the application; SMNIDE is used to encrypt the source data to ensure the security of the source data during network transmission or storage. If the decrypted data needs to be used directly, the data can be decrypted using the SMNIDE tool and the authorization key before use. Specifically:

[0069] The source data is labeled and classified using the SMNIMK algorithm to obtain labeled and classified data to improve data processing capabilities;

[0070] The obtained label classification data is double-encrypted using the RSA encryption algorithm and the YXSL algorithm to obtain double-encrypted data to improve the security of the data during transmission;

[0071] The obtained double-layer encrypted data is compressed using the LZ77 algorithm and the Huffman coding algorithm to obtain compressed data to improve the data concurrent processing capability;

[0072] The compressed data processed by SMNIDE is decompressed using the LZ77 algorithm, Huffman coding algorithm, and SMNIMK algorithm to obtain decompressed labeling and classification data;

[0073] The decompressed label and classification data are decrypted using the RSA decryption algorithm and the YXSL algorithm to obtain the decrypted data and improve the security of the data during transmission.

[0074] In the process of processing source data, this method can customize the corresponding labels or classifications according to the actual situation. When the data enters encryption and compression, the labels or classifications are performed at the same time. After being transmitted to the target end, the classification calculation and decryption process are performed according to the requirements. The overall data analysis and processing capabilities are improved, and the data security during network transmission is guaranteed.

[0075] As described above, although the present invention has been shown and described with reference to specific preferred embodiments, it should not be construed as limiting the present invention itself. Various changes may be made to it in form and detail without departing from the spirit and scope of the present invention as defined in the appended claims.

Claims

1. A non-intrusive data encryption tool, characterized in that: The RSA encryption algorithm and the YXSL algorithm are used to perform double-layer encryption on the source data, and the SMNIDE encryption tool is used to implement it, including: The SMNIDE encryption tool uses the YXSL algorithm, uses the data module to recombine the source data, obtains and outputs the combined data for initial replacement; The SMNIDE encryption tool uses a permutation table to reduce the key and selects parity bits to generate subkeys, iterates the output combined data, and obtains iterated data; The obtained iterative data are merged and converted using an inverse permutation table to perform inverse permutation processing to obtain a layer of encrypted data; The obtained encrypted data is encrypted twice using the public key through the RSA encryption algorithm to obtain double-layer encrypted data to improve the security of data during transmission; The obtained double-layer encrypted data is compressed to improve the efficiency of concurrent data processing.

2. The non-intrusive data encryption tool according to claim 1, characterized in that: The source data recombining specifically includes: The source data is labeled using the SMNIMK algorithm to obtain the label name and label value; The obtained label names and label values ​​are classified and combined to obtain recombined data.

3. The non-intrusive data encryption tool according to claim 1, characterized in that: The double-layer encrypted data is compressed using the LZ77 algorithm and the Huffman coding algorithm, specifically including: Use the LZ77 algorithm to search for substrings in the double-encrypted data that match the content in the buffer and express them as "distance-length" pairs; Compress the matching substring and output LZ77 compressed data. If there is no matching substring, output double-layer encrypted data characters. According to the Huffman coding algorithm, scan and count the frequency of each character to build a Huffman tree; By traversing the path of the Huffman tree, a corresponding Huffman code is generated for each character to generate a Huffman code table; Each character in the output data is replaced with the corresponding Huffman code to achieve data compression and obtain compressed data.

4. The non-intrusive data encryption tool according to claim 1, characterized in that: The SMNIDE encryption tool also includes a data decryption processing module, specifically including: The SMNIDE encryption tool decompresses the double-layer encrypted data to obtain the decompressed data; The obtained decompressed data is decrypted using the RSA decryption algorithm and the decryption private key to obtain a layer of decrypted data; The first layer of scrambled data is converted using the YXSL algorithm through an inverse permutation table, and the converted data is separated to obtain separated data; The separated data is transferred to the left and right subkey positions for iterative operation, the key is expanded using the permutation table, and the parity check bit is used for verification to obtain the iterative data; The obtained iterative data are merged to obtain the second-layer decrypted data.

5. The non-intrusive data encryption tool according to claim 4, characterized in that: The double-layer encrypted data is decompressed using the LZ77 algorithm, the Huffman coding algorithm, and the SMNIMK algorithm, specifically including: Use the Huffman coding algorithm to read the character code, restore the Huffman tree, perform decompression processing, and obtain the Huffman decompressed data; The obtained Huffman decompressed data is restored to a substring using the LZ77 algorithm, and the decompressed data is output; The decompressed data is obtained using the SMNIMK algorithm to perform classification operations through the labeling and classification combination information at the source end to obtain labeling and classification data to improve data processing capabilities.

6. A non-intrusive data encryption method, characterized in that: Specifically include: The source data is labeled and classified using the SMNIMK algorithm to obtain labeled and classified data to improve data processing capabilities; The obtained label classification data is double-encrypted using the RSA encryption algorithm and the YXSL algorithm to obtain double-encrypted data to improve the security of the data during transmission; The obtained double-layer encrypted data is compressed using the LZ77 algorithm and the Huffman coding algorithm to obtain compressed data to improve the data concurrent processing capability; The compressed data processed by the SMNIDE encryption tool is decompressed using the LZ77 algorithm, Huffman coding algorithm, and SMNIMK algorithm to obtain the decompressed labeling and classification data; The decompressed label and classification data are decrypted using the RSA decryption algorithm and the YXSL algorithm to obtain the decrypted data and improve the security of the data during transmission.

Images