A data security encryption method for communication network

Abstract

The present invention relates to the technical field of data security, and discloses a data security encryption method for a communication network; the method comprises the following steps: screening out available communication data from original communication data to be identified, collecting comprehensive security parameters, calculating data encryption coefficients, constructing an encryption profile with encryption nodes, generating initial encrypted data, extracting encryption features of the initial encrypted data, configuring trigger conditions matching the encryption features, and generating ciphertext data; compared with the prior art, the present invention can accurately calculate the encryption coefficients of the available communication data, and at the same time, combine the combined encryption method of the encryption profile and the encryption features to formulate encryption measures adapted to the available communication data, thereby ensuring that the available communication data can remain relatively complete in the data encryption operation, and at the same time, each encryption point after the data encryption remains relatively independent, thereby enhancing the security of data communication transmission in the communication network.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and more specifically, to a data security encryption method for a communication network. Background Art

[0002] In today's society, sharing data through network communication has gradually become an indispensable part of people's daily work and life. With the continuous popularization and development of communication networks, various risk factors that threaten the security of communication networks are also constantly changing and strengthening, resulting in the risk of data leakage and loss in communication networks. In order to improve the security of data in communication networks, data encryption is required.

[0003] The patent application with reference publication number CN112543189A discloses a data security transmission method and system, which is based on the fields of data encryption and satellite communication technology, comprehensively considers the cost of data transmission and the risk of data hijacking; realizes the transmission of ciphertext data and session keys separately through different paths, significantly reduces the risk of data hijacking and ciphertext leakage, and uses the identification key system to replace the public key system based on digital certificates in the transmission of session keys in a way that the ground communication network and the satellite communication network are transmitted separately, greatly reducing the high cost of relying solely on satellite network to transmit data;

[0004] The prior art has the following deficiencies:

[0005] When encrypting existing communication network data, the key obtained by a symmetric encryption algorithm or an asymmetric encryption algorithm is usually used as the standard to perform data encryption processing on the communication data in a specific mode to achieve a single encryption effect for the communication data. Since the data type and status contained in the communication data are not consistent, when communication data of different types and statuses are encrypted using a single encryption method, the data encryption point cannot be accurately matched with the characteristics of the actual communication data, making the encrypted communication data prone to confusion or loss, reducing the independence and security of the encrypted communication data, and is not conducive to the secure communication transmission of communication network data.

[0006] In view of this, the present invention proposes a data security encryption method for a communication network to solve the above problem. Summary of the invention

[0007] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: a data security encryption method for a communication network, applied to an encryption server, comprising:

[0008] S1: pre-processing the original communication data to obtain the communication data to be identified, and based on the data screening criteria, screening out the available communication data from the original communication data to be identified;

[0009] S2: Collect comprehensive security parameters of available communication data and calculate data encryption coefficient. Comprehensive security parameters include risky access ratio, risky duration ratio and public data ratio.

[0010] S3: Compare the data encryption coefficient with the preset data encryption threshold, and determine whether to enter the data encryption mode according to the comparison result; if entering the data encryption mode, execute S4-S5; if not entering the data encryption mode, repeat S2-S3;

[0011] S4: construct an encryption profile with encryption nodes, import available communication data into the encryption profile for data encryption, and generate initial encrypted data;

[0012] S5: Extract encryption features of the initial encrypted data, including node features and verification features, and configure trigger conditions that match the encryption features to generate ciphertext data.

[0013] Furthermore, the method for acquiring the communication data to be identified includes:

[0014] The time when the communication network first generates communication data is queried through the timestamp, and recorded as the starting time;

[0015] Record the period from the start time to the current time as the recording period, and query all communication data in the recording period through the communication database to obtain the original communication data;

[0016] Query the attribute types of the original communication data one by one, and record the original communication data whose attribute type is user data as the communication data to be verified;

[0017] Identify the key semantics of the communication data to be verified one by one through natural language processing technology;

[0018] Record identity information, address information, permission information, password information, business information, and computing information as available semantics;

[0019] Identify one by one whether the key semantics contain available semantics, and mark the communication data to be verified that contains any available semantics as communication data to be identified.

[0020] Furthermore, the data screening criteria are: only the duplicate data with the last ranking at the recording moment are retained;

[0021] Available communication data screening methods include:

[0022] According to the time sequence, the communication data to be identified is split into content characters and time characters one by one by using word segmentation technology;

[0023] Compare the content characters of the communication data to be identified with the standard content characters pre-stored in the communication database one by one for consistency;

[0024] Record the communication data to be identified whose content characters are consistent with the pre-stored standard content characters as valid communication data;

[0025] The communication database is used to query the sending address and receiving address of the valid communication data one by one, and the valid communication data with the same sending address, receiving address and content characters are recorded as duplicate data;

[0026] The recording times of duplicate data are queried one by one, the recording times are arranged in chronological order, and the duplicate data except the last one in the ranking is eliminated, and the remaining communication data to be identified is recorded as available communication data.

[0027] Furthermore, the method for obtaining the dangerous access ratio includes:

[0028] According to the preset access cycle, the recording period is divided into sub-periods, and in chronological order, The sub-periods are numbered in ascending order;

[0029] According to the number from large to small, query in order by accessing the system Access records of available communication data in each sub-period and count the number of access records;

[0030] The authorization status of access records is identified one by one through the access system, access records with the authorization status of unauthorized are recorded as dangerous accesses, and the number of dangerous accesses is counted;

[0031] Will The number of dangerous accesses in each sub-period is Compare the number of access records in each sub-period to obtain The percentage of children;

[0032] The expression of the sub-ratio is:

[0033] ;

[0034] In the formula, For the The proportion of sub-periods in each sub-period, For the The number of dangerous accesses in each sub-period, For the The number of access records in each sub-period;

[0035] Will The sub-ratios are compared with the preset risk ratio threshold in turn, and the sub-ratios greater than the preset risk ratio threshold are recorded as effective ratios. The effective percentage;

[0036] Will The effective proportions are accumulated and averaged to obtain the dangerous access proportion;

[0037] The expression of the dangerous access ratio is:

[0038] ;

[0039] In the formula, is the proportion of dangerous access, For the An effective percentage.

[0040] Furthermore, the method for obtaining the percentage of dangerous time includes:

[0041] Arrange and number dangerous visits in chronological order, and mark them with one number in between. a dangerous visit;

[0042] Identify them one by one by accessing the system The access address of the dangerous access is obtained by extracting the IP number in the access address. IP number;

[0043] The first detection The time when the IP number is obtained is recorded as the initial access time. Initial access time;

[0044] When no more detection is made within the preset access period When an IP number is detected, the last The time when the IP number is obtained is recorded as the end time of access. End of visit moment;

[0045] Will Initial access time to The duration between the end of the visit is recorded as the sub-visit duration, and the Length of visit;

[0046] Check the fixed access delay time of the communication network through the technical parameter table. Subtract each sub-access duration from the fixed access delay duration, and add them up to get the average to obtain the dangerous access duration value.

[0047] The expression of the dangerous access duration value is:

[0048] ;

[0049] In the formula, is the dangerous access duration value, For the The duration of the child's visit, Delay duration for fixed access;

[0050] Compare the dangerous access duration value with the duration corresponding to the recording period to obtain the dangerous duration ratio value;

[0051] The expression of the percentage of dangerous time is:

[0052] ;

[0053] In the formula, is the percentage of dangerous time, The duration corresponding to the recording period.

[0054] Furthermore, the method for obtaining the public data share includes:

[0055] Statistics one by one The number of available communication data in each sub-period is obtained The number of sub-values;

[0056] Will The sub-quantity values ​​are compared with the preset quantity threshold in turn, and the sub-quantity values ​​greater than the preset quantity threshold are recorded as valid quantity values, and the A valid number of values;

[0057] Query one by one The attribute status of the available communication data corresponding to the valid number value;

[0058] The available communication data whose attribute status is public is recorded as public data, and the number of public data is counted to obtain Public values;

[0059] Will The public values ​​are compared one by one Compare the effective quantity values ​​and obtain Individual occupancy rate;

[0060] The expression of sub-occupancy is:

[0061] ;

[0062] In the formula, For the The percentage of individual For the Public values, For the A valid number of values;

[0063] After removing the maximum and minimum values ​​of the child occupancy, the remaining The individual occupancy rates are accumulated and averaged to obtain the public data occupancy rate;

[0064] The expression of public data share is:

[0065] ;

[0066] In the formula, To disclose data share, For the The percentage of individual occupancy.

[0067] Furthermore, the expression of the data encryption coefficient is:

[0068] ;

[0069] In the formula, is the data encryption coefficient, , , is the weight factor, , , All are greater than 0;

[0070] The determination method of whether to enter the data encryption mode includes:

[0071] Encrypt the data factor With the preset data encryption threshold Compare;

[0072] when Greater than or equal to When , it is determined to enter the data encryption mode;

[0073] when Less than , it is determined not to enter the data encryption mode.

[0074] Furthermore, the method for constructing the encrypted contour includes:

[0075] Mark the key semantics of all available communication data one by one, and aggregate the available communication data with the same key semantics into a set to obtain x data sets;

[0076] Count the number of available communication data in x data sets one by one to obtain x quantity values;

[0077] Constructing x mutually independent data groups in the encryption server, and marking the data bits consistent with the x quantity values ​​in the x data groups respectively;

[0078] Create comment boxes at the end of each of the x data groups, and annotate the group semantics in the comment boxes;

[0079] Arrange x data groups in parallel, establish a connection channel between two adjacent data groups, and record the midpoint of the connection channel as an encrypted node to obtain x-1 encrypted nodes;

[0080] After numbering the x-1 encrypted nodes in sequence, a contour line is constructed outside the x data groups to obtain an encrypted contour.

[0081] Furthermore, the method for generating the initial encrypted data includes:

[0082] Mark the data groups and data sets that have the same group semantics as the key semantics as target groups, and obtain x target groups;

[0083] Import the available communication data in the xth data set in the x target groups into the data bits in the xth data group one by one, record the data group into which the available communication data is imported as a group to be encrypted, and obtain x groups to be encrypted;

[0084] The first character and the second character in the key semantics corresponding to the x groups to be encrypted are separated from the key semantics and combined to obtain x semantic groups, and the two semantic groups at both ends of the x-1 encryption nodes are connected end to end to obtain x-1 encryption features;

[0085] Based on x-1 encryption features, generate x-1 public keys and x-1 private keys through an asymmetric encryption algorithm;

[0086] Based on x-1 public keys, encrypt data of x-1 encryption nodes respectively to obtain the encryption profile to be verified;

[0087] Mark x-1 verification points on the contour line of the encrypted contour to be verified, and build x-1 decryption channels between the x-1 verification points and the x-1 encryption nodes to obtain the initial encrypted data.

[0088] Furthermore, the node feature and verification feature extraction method includes:

[0089] Arrange the x-1 encrypted features word by word to generate a feature arrangement group, split the first and third characters and combine them to obtain x-1 combined words;

[0090] The numbers of the encrypted nodes corresponding to the x-1 combinations are sequentially annotated at the front of the x-1 combinations to obtain x-1 node features;

[0091] Number the x-1 decryption channels connected to the x-1 verification points in sequence, and note the numbers of the decryption channels at the back end of the node features to obtain x-1 verification features;

[0092] The method for generating ciphertext data includes:

[0093] Record the locations of the verification points and encryption nodes of the x-1 decryption channels as external lock points and internal lock points respectively, and obtain x-1 external lock points and internal lock points;

[0094] Mark the external trigger position on the decryption channel and outside the internal lock point to obtain x-1 external trigger positions;

[0095] Mark the inner trigger position on the decryption channel and inside the outer lock point to obtain x-1 inner trigger positions;

[0096] After reversing the x-1 node features and x-1 verification features, x-1 internal trigger conditions and x-1 external trigger conditions are obtained;

[0097] The x-1 internal trigger conditions and the x-1 external trigger conditions are configured one by one on the x-1 internal trigger positions and the x-1 external trigger positions to obtain the ciphertext data.

[0098] The technical effects and advantages of a data security encryption method for a communication network of the present invention are as follows:

[0099] The present invention obtains communication data to be identified by pre-processing the original communication data, and based on the data screening criteria, screens out available communication data from the original communication data to be identified, collects comprehensive security parameters of the available communication data, calculates a data encryption coefficient, compares the data encryption coefficient with a preset data encryption threshold, determines whether to enter a data encryption mode according to the comparison result, constructs an encryption profile with encryption nodes, imports the available communication data into the encryption profile for data encryption, generates initial encrypted data, extracts encryption features of the initial encrypted data, configures trigger conditions that match the encryption features, and generates ciphertext data; compared with the prior art, the present invention can effectively screen out the original communication data The available communication data that meets the data encryption requirements can be obtained, and based on the comprehensive security parameters, the encryption coefficient of the available communication data can be accurately calculated, and it can be determined whether the available communication data in the communication network needs to be encrypted. At the same time, combined with the combined encryption method of the encryption profile and the encryption feature, encryption measures suitable for the available communication data can be formulated according to the different characteristics of the available communication data itself, ensuring that the available communication data can remain relatively complete in the data encryption operation and avoid the loss of data during encryption. At the same time, it can also ensure that each encryption point after the data encryption remains relatively independent, thereby improving the accuracy of the data encryption operation and thereby enhancing the security of data communication transmission in the communication network. BRIEF DESCRIPTION OF THE DRAWINGS

[0100] Figure 1 A schematic diagram of a flow chart of a data security encryption method for a communication network provided in Embodiment 1 of the present invention;

[0101] Figure 2 A schematic diagram of a data security encryption system for a communication network provided in Embodiment 2 of the present invention;

[0102] Figure 3 A schematic diagram of communication data transmission provided in Example 1 of the present invention. DETAILED DESCRIPTION

[0103] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0104] Example 1: Please refer to Figure 1 and Figure 3 As shown, the data security encryption method for a communication network described in this embodiment is applied to an encryption server, including:

[0105] S1: pre-processing the original communication data to obtain the communication data to be identified, and based on the data screening criteria, screening out the available communication data from the original communication data to be identified;

[0106] Original communication data refers to the unprocessed original data generated in the communication network, which can represent all the changed data in the communication network, so as to represent the communication network as a whole and comprehensively. Pre-processing refers to the preliminary processing of the type and content of the original communication data, which can screen out the original communication data without defects or abnormalities in type and content, so as to obtain the data to be identified and serve as the basis for subsequent data encryption.

[0107] The method for acquiring the communication data to be identified includes:

[0108] The time when the communication network first generates communication data is queried through the timestamp, and recorded as the starting time;

[0109] Record the period from the start time to the current time as the recording period, and query all communication data in the recording period through the communication database to obtain the original communication data;

[0110] Query the attribute types of the original communication data one by one, and record the original communication data whose attribute type is user data as the communication data to be verified; the attribute type refers to the type of the original communication data, including user data, system data, transmission data, network data, etc., which is used to accurately represent the type of the original communication data generated in the communication network, so as to preliminarily identify the original communication data;

[0111] The key semantics of the communication data to be verified are identified one by one through natural language processing technology; the key semantics is used to represent the true meaning of the communication data to be verified, which can be used to concisely and accurately represent the complex and ambiguous communication data to be verified;

[0112] Record identity information, address information, permission information, password information, business information, and computing information as available semantics;

[0113] Identify one by one whether the key semantics contain available semantics, and mark the communication data to be verified that contains any available semantics as communication data to be identified;

[0114] After the communication data to be identified is obtained, the scope of the communication data to be identified is large, and the forms of the communication data are also diverse. It is impossible to ensure that the communication data to be identified is in a standardized and neat state. In addition, due to the influence of the communication network hardware and the transmission environment, some of the communication data to be identified may have defects. Therefore, it is necessary to screen the communication data to be identified with defects, and record the communication data to be identified that remains after the screening as available communication data;

[0115] When screening available communication data, it is necessary to ensure the accuracy of screening available communication data under the constraints of data screening criteria;

[0116] The criteria for data screening are: only keep the duplicate data that ranks last at the time of recording;

[0117] Methods for filtering available communication data include:

[0118] According to the chronological order, the communication data to be identified is split into content characters and time characters one by one by using word segmentation technology; the content characters are used to represent the corresponding data content in the communication data to be identified, and the time characters are used to represent the corresponding recording time in the communication data to be identified, so that the communication data to be identified can be accurately split into two types of characters;

[0119] Compare the content characters of the communication data to be identified with the standard content characters pre-stored in the communication database one by one for consistency;

[0120] Record the communication data to be identified whose content characters are consistent with the pre-stored standard content characters as valid communication data;

[0121] The communication database is used to query the sending address and receiving address of the valid communication data one by one, and the valid communication data with the same sending address, receiving address and content characters are recorded as duplicate data;

[0122] Query the recording time of duplicate data one by one, arrange the recording time in chronological order, remove the duplicate data except the last one in the ranking, and record the remaining communication data to be identified as available communication data;

[0123] It should be noted that after obtaining available communication data, all communication data in the available communication data can be directly used for subsequent data encryption processing, and through analysis and calculation of the available communication data, the relevant data for data encryption can be obtained to achieve efficient and accurate execution of data encryption.

[0124] S2: Collect comprehensive security parameters of available communication data and calculate data encryption coefficient. Comprehensive security parameters include risky access ratio, risky duration ratio and public data ratio.

[0125] Comprehensive security parameters refer to parameters that affect the security of communication transmission of available communication data in the communication network, which can intuitively represent the transmission security of available communication data in the communication network and display the real-time situation of available communication data in the communication network from multiple angles, thereby improving the accuracy of subsequent calculations on the security of available communication data;

[0126] Comprehensive security parameters include the percentage of dangerous access, the percentage of dangerous duration, and the percentage of public data;

[0127] The proportion of dangerous access refers to the ratio of the number of unauthorized accesses to available communication data per unit time to the total number of accesses in the communication network. The larger the proportion of dangerous access, the larger the ratio of the number of unauthorized accesses to available communication data per unit time to the total number of accesses in the communication network. The larger the proportion of dangerous access, the larger the ratio of the number of unauthorized accesses to available communication data per unit time to the total number of accesses. The larger the amount of abnormal unauthorized access to available communication data, the more serious the external interference to available communication data, and the larger the data encryption coefficient.

[0128] Methods for obtaining the risky access ratio include:

[0129] According to the preset access cycle, the recording period is divided into sub-periods, and in chronological order, The sub-periods are numbered in ascending order; the preset access cycle is the time used to generate at least one update for different types of access records in the access system, so that a record period with a long time span can be divided into multiple periods with smaller time spans, which is convenient for fast and bounded query and statistics of access records;

[0130] According to the number from large to small, query in order by accessing the system Access records of available communication data in each sub-period and count the number of access records;

[0131] The authorization status of access records is identified one by one through the access system, and the access records with the authorization status of unauthorized are recorded as dangerous access, and the number of dangerous accesses is counted; the authorization status is used to indicate whether the access record has been authorized by the access system normally, so that the authorization of each access record can be identified and distinguished; the authorization status includes unauthorized and authorized;

[0132] Will The number of dangerous accesses in each sub-period is Compare the number of access records in each sub-period to obtain The percentage of children;

[0133] The expression of the sub-ratio is:

[0134] ;

[0135] In the formula, For the The proportion of sub-periods in each sub-period, For the The number of dangerous accesses in each sub-period, For the The number of access records in each sub-period;

[0136] Will The sub-ratios are compared with the preset risk ratio threshold in turn, and the sub-ratios greater than the preset risk ratio threshold are recorded as effective ratios. The preset dangerous proportion threshold refers to the minimum value of the sub-proportion corresponding to the effective proportion, which can distinguish the size of the sub-proportion, ensuring the accuracy of the identification of the effective proportion, and at the same time eliminating a large number of sub-proportions with small sub-proportions and no negative impact on the security of the communication network data, thereby reducing the data calculation burden;

[0137] Will The effective proportions are accumulated and averaged to obtain the dangerous access proportion;

[0138] The expression of the dangerous access ratio is:

[0139] ;

[0140] In the formula, is the proportion of dangerous access, For the The effective percentage;

[0141] The percentage of dangerous duration refers to the percentage of the access duration of the access records identified as dangerous access in the communication network when accessing the available communication data to the total access duration, which can be used to indicate the change in the continuous access time of the dangerous access to the available communication data. The larger the percentage of dangerous duration, the larger the percentage of the access duration of the access records identified as dangerous access in the communication network when accessing the available communication data to the total access duration, the longer the duration of the available communication data being subject to dangerous access, and the larger the data encryption coefficient;

[0142] Methods for obtaining the percentage of dangerous time include:

[0143] Arrange and number dangerous visits in chronological order, and mark them with one number in between. The interval marking method can ensure that the corresponding moments of each dangerous access in adjacent chains are not adjacent, thereby improving the temporal independence of each dangerous access;

[0144] Identify them one by one by accessing the system The access address of the dangerous access is obtained by extracting the IP number in the access address. IP number;

[0145] The first detection The time when the IP number is obtained is recorded as the initial access time. Initial access time;

[0146] When no more detection is made within the preset access period When an IP number is detected, the last The time when the IP number is obtained is recorded as the end time of access. The preset access period refers to the maximum time span between two adjacent IP numbers that can be detected, thereby limiting the detection time of the IP number; the preset access period is obtained by collecting a large number of historical maximum time spans between two adjacent IP numbers and calculating the average value;

[0147] Will Initial access time to The duration between the end of the visit is recorded as the sub-visit duration, and the Length of visit;

[0148] Check the fixed access delay time of the communication network through the technical parameter table. Subtract each sub-access duration from the fixed access delay duration, and add them up to get the average to obtain the dangerous access duration value.

[0149] The expression of the dangerous access duration value is:

[0150] ;

[0151] In the formula, is the dangerous access duration value, For the The duration of the child's visit, Delay duration for fixed access;

[0152] Compare the dangerous access duration value with the duration corresponding to the recording period to obtain the dangerous duration ratio value;

[0153] The expression of the percentage of dangerous time is:

[0154] ;

[0155] In the formula, is the percentage of dangerous time, The duration corresponding to the recording period;

[0156] The public data share refers to the ratio of the data that can be disclosed to the outside and does not need to be encrypted to the total amount of data in the available communication data, which can be used to represent the public data in the available communication data. The larger the public data share, the greater the ratio of the data that can be disclosed to the outside and does not need to be encrypted to the total amount of data in the available communication data, the less interference the available communication data is subject to from the external environment, and the smaller the data encryption coefficient.

[0157] Methods for obtaining public data share include:

[0158] Statistics one by one The number of available communication data in each sub-period is obtained The number of sub-values;

[0159] Will The sub-quantity values ​​are compared with the preset quantity threshold in turn, and the sub-quantity values ​​greater than the preset quantity threshold are recorded as valid quantity values, and the A valid number of values;

[0160] Query one by one The attribute status of the available communication data corresponding to the valid quantity value; the attribute status is used to indicate whether the content of the available communication data is public or not, and the attribute status includes a public status and a sensitive status. The available communication data in the public status can be fully disclosed, and the available communication data in the sensitive status cannot be fully disclosed;

[0161] The available communication data whose attribute status is public is recorded as public data, and the number of public data is counted to obtain Public values;

[0162] Will The public values ​​are compared one by one Compare the effective quantity values ​​and obtain Individual occupancy rate;

[0163] The expression of sub-occupancy is:

[0164] ;

[0165] In the formula, For the The percentage of individual For the Public values, For the A valid number of values;

[0166] After removing the maximum and minimum values ​​of the child occupancy, the remaining The individual occupancy rates are accumulated and averaged to obtain the public data occupancy rate;

[0167] The expression of public data share is:

[0168] ;

[0169] In the formula, To disclose data share, For the Individual occupancy rate;

[0170] After the comprehensive security parameters are obtained, the data encryption coefficient can be calculated according to the comprehensive security parameters, so that the data encryption coefficient can numerically represent the probability of whether the available communication data needs to be encrypted. When the data encryption coefficient is larger, the probability that the available communication data needs to be encrypted is greater, and vice versa;

[0171] The expression of data encryption coefficient is:

[0172] ;

[0173] In the formula, is the data encryption coefficient, , , is the weight factor, , , All are greater than 0;

[0174] in, , exemplary, is 0.39, is 0.26, is 0.35;

[0175] It should be noted that , , The purpose is to adjust the proportion of dangerous access, dangerous duration and public data in the data encryption coefficient, so that the influence of dangerous access proportion, dangerous duration and public data proportion on the size of the data encryption coefficient can maintain a relatively balanced degree, thereby ensuring the accuracy of the data encryption coefficient calculation.

[0176] S3: Compare the data encryption coefficient with a preset data encryption threshold, and determine whether to enter the data encryption mode according to the comparison result;

[0177] After the data encryption coefficient is calculated, it can be determined whether the available communication data needs to be encrypted according to the size of the data encryption coefficient, so as to serve as a basis for the subsequent communication network to determine the next step of communication transmission of the available communication data. When the data encryption coefficient is too large, it means that the communication network needs to perform the next step of encryption processing, and the communication network needs to be operated in the data encryption mode;

[0178] The determination method of whether to enter the data encryption mode includes:

[0179] Encrypt the data factor With the preset data encryption threshold Comparison; The preset data encryption threshold is a numerical representation of the minimum value of the data encryption coefficient corresponding to entering the data encryption mode, which can distinguish the size of the data encryption coefficient, so that data encryption coefficients of different sizes can enter or not enter the data encryption mode; The preset data encryption threshold is obtained by collecting a large number of historical minimum values ​​of the data encryption coefficient when entering the data encryption mode and calculating the average value;

[0180] when Greater than or equal to When , it indicates that the data encryption coefficient is greater than or equal to the preset data encryption threshold value. At this time, the available communication data needs to be affected by interference to a greater extent. At this time, the available communication data needs to be encrypted, and it is determined to enter the data encryption mode;

[0181] when Less than When , it means that the data encryption coefficient is less than the preset data encryption threshold. At this time, the available communication data needs to be less affected by the interference. At this time, the available communication data does not need to be encrypted, and it is determined not to enter the data encryption mode.

[0182] S4: construct an encryption profile with encryption nodes, import available communication data into the encryption profile for data encryption, and generate initial encrypted data;

[0183] The encryption profile refers to the blank data that currently occupies zero capacity and can accommodate a large amount of available communication data, and can be used as the object for subsequent data encryption operations, so that data encryption operations can be performed quickly and accurately, while the encryption node is the encryption position corresponding to the data encryption operation in the encryption profile;

[0184] The construction method of the encrypted contour includes:

[0185] Mark the key semantics of all available communication data one by one, and aggregate the available communication data with the same key semantics into a set to obtain x data sets; the key semantics is a word used to represent the real meaning corresponding to the available communication data, which is convenient for simplifying the reference to the available communication data;

[0186] Count the number of available communication data in x data sets one by one to obtain x quantity values;

[0187] Construct x mutually independent data groups in the encryption server, and mark the data bits that are consistent with the x quantity values ​​in the x data groups; the data group is the basic structure for constructing the encryption profile, and is also a structure that can provide data transfer for the available communication data in the data set, and the data bit is the smallest unit for constructing the data group, so as to ensure that the available communication data in the data set can be imported into the data group one by one and accurately without loss or confusion;

[0188] Create a comment box at the end of each of the x data groups, and annotate the group semantics in the comment box; the group semantics is used to represent the type corresponding to the data group and serves as the basis for subsequent comparison with the key semantics;

[0189] Arrange x data groups in parallel, establish a connection channel between two adjacent data groups, and record the midpoint of the connection channel as an encryption node to obtain x-1 encryption nodes; the connection channel is a channel used to connect two adjacent data groups to each other, so that the data in the two adjacent data groups can maintain interaction to a certain extent;

[0190] After numbering x-1 encrypted nodes in sequence, a contour line is constructed outside the x data groups to obtain an encrypted contour;

[0191] When x encrypted profiles are obtained, all available communication data can be imported into the encrypted profile, and the available communication data can be encrypted in the encrypted profile to obtain initial encrypted data, so that the available communication data can be transmitted securely and stably;

[0192] The method for generating the initial encrypted data includes:

[0193] Mark the data groups and data sets that have the same group semantics as the key semantics as target groups, and obtain x target groups;

[0194] Import the available communication data in the xth data set in the x target groups into the data bits in the xth data group one by one, record the data group into which the available communication data is imported as a group to be encrypted, and obtain x groups to be encrypted;

[0195] The first character and the second character in the key semantics corresponding to the x groups to be encrypted are separated from the key semantics and combined to obtain x semantic groups, and the two semantic groups at both ends of the x-1 encryption nodes are connected end to end to obtain x-1 encryption features;

[0196] Based on x-1 encryption features, x-1 public keys and x-1 private keys are generated through an asymmetric encryption algorithm. The asymmetric encryption algorithm is implemented using the RSA algorithm. The public key generated by the RSA algorithm needs to be sent to the sender in the communication network, and the private key generated by the RSA algorithm needs to be sent to the receiver in the communication network.

[0197] Based on x-1 public keys, encrypt data of x-1 encryption nodes respectively to obtain the encryption profile to be verified;

[0198] Mark x-1 verification points on the contour line of the encrypted contour to be verified, and build x-1 decryption channels between the x-1 verification points and the x-1 encryption nodes to obtain the initial encrypted data; the verification points are points used to mark the encrypted positions on the contour line. Relative to the encryption nodes, the verification points are located outside the encryption nodes and belong to the outer encryption structure;

[0199] It should be noted that the number of decryption channels set up needs to be consistent with the number of encryption nodes, and one decryption channel corresponds to one encryption node, so as to ensure that the corresponding encryption node can be quickly and accurately identified and found when the data is decrypted subsequently.

[0200] S5: extracting the encryption features of the initial encrypted data, and configuring trigger conditions matching the encryption features to generate ciphertext data;

[0201] Encryption features refer to features that can accurately represent the meaning of encryption nodes and verification points in the initial encrypted data, so that the encryption form and state of the initial encrypted data can be represented and used for subsequent decryption processing of encryption nodes and verification points, thus meeting the generation requirements of ciphertext data;

[0202] The encryption features include node features and verification features; the node features are used to represent the features of the encryption nodes, and the verification features are used to represent the features of the verification points;

[0203] The extraction methods of node features and verification features include:

[0204] Arrange x-1 encrypted features word by word to generate feature arrangement groups, split the first and third characters and combine them to obtain x-1 combination words; combination words are the basis of node features and verification features. By transforming and combining on the basis of combination words, node features or verification features can be obtained;

[0205] The numbers of the encrypted nodes corresponding to the x-1 combinations are sequentially annotated at the front of the x-1 combinations to obtain x-1 node features;

[0206] The x-1 decryption channels connected to the x-1 verification points are numbered in sequence, and the numbers of the decryption channels are annotated at the back end of the node features to obtain x-1 verification features; the front end of the combination word refers to the front of the first character, and the back end of the combination word refers to the back of the second character, so that the front and back order of the combination word can be calibrated;

[0207] After obtaining the node characteristics and verification characteristics, the trigger conditions corresponding to the node characteristics and verification characteristics can be configured on the initial encrypted data, so that the trigger conditions can be used as prompts for subsequent data decryption. After the trigger conditions are configured, the initial encrypted data is converted into ciphertext data, so that the ciphertext data can be used as a transmission carrier after data encryption for available communication data, thereby achieving a secure communication transmission effect of data in the communication network;

[0208] The trigger condition refers to the prerequisite for decrypting the initial encrypted data, so that the initial encrypted data can be decrypted under the premise of meeting the trigger condition, which can further encrypt and protect the initial encrypted data;

[0209] The method for generating ciphertext data includes:

[0210] Record the locations of the verification points and encryption nodes of the x-1 decryption channels as external lock points and internal lock points respectively, and obtain x-1 external lock points and internal lock points;

[0211] Mark the external trigger position on the decryption channel and outside the inner lock point to obtain x-1 external trigger positions; the external trigger position refers to the decryption trigger position located outside in data encryption, which can play an overall trigger restriction on the outside of the ciphertext data to achieve an overall decryption trigger effect;

[0212] Mark the inner trigger position on the decryption channel and located inside the outer lock point to obtain x-1 inner trigger positions; the inner trigger position refers to the decryption trigger position located inside the data encryption, which can play a local trigger restriction on the inside of the ciphertext data, thereby realizing a localized decryption trigger effect;

[0213] After reversing the x-1 node features and x-1 verification features, x-1 internal trigger conditions and x-1 external trigger conditions are obtained;

[0214] The x-1 internal trigger conditions and the x-1 external trigger conditions are configured one by one on the x-1 internal trigger positions and the x-1 external trigger positions to obtain the ciphertext data.

[0215] In this embodiment, the original communication data is pre-processed to obtain the communication data to be identified, and based on the data screening criteria, the available communication data is screened out from the original communication data to be identified, the comprehensive security parameters of the available communication data are collected, the data encryption coefficient is calculated, the data encryption coefficient is compared with the preset data encryption threshold, and according to the comparison result, it is determined whether to enter the data encryption mode, and an encryption profile with encryption nodes is constructed. The available communication data is imported into the encryption profile for data encryption, and initial encrypted data is generated. The encryption features of the initial encrypted data are extracted, and the trigger conditions matching the encryption features are configured to generate ciphertext data. Compared with the prior art, the original communication data can be effectively screened out. Available communication data that meets the data encryption requirements is selected, and based on the comprehensive security parameters, the encryption coefficient of the available communication data can be accurately calculated, and it is determined whether the available communication data in the communication network needs to be encrypted. At the same time, the combined encryption method of the encryption profile and the encryption feature can be combined to formulate encryption measures suitable for the available communication data according to the different characteristics of the available communication data itself, ensuring that the available communication data can remain relatively complete during the data encryption operation and avoid data loss during encryption. At the same time, it can also ensure that each encryption point after data encryption remains relatively independent, thereby improving the accuracy of data encryption operations and thereby enhancing the security of data communication transmission in the communication network.

[0216] Example 2: Please refer to Figure 2 As shown, the part not described in detail in this embodiment is described in the description of embodiment 1, and a data security encryption system for a communication network is provided, which is used to implement a data security encryption method for a communication network, including a data screening module, a coefficient calculation module, a mode determination module, an initial encryption module and a conditional encryption module, wherein each module is connected through a wired or wireless network;

[0217] A data screening module is used to perform pre-processing on the original communication data to obtain the communication data to be identified, and based on the data screening criteria, screen out the available communication data from the original communication data to be identified;

[0218] The coefficient calculation module is used to collect the comprehensive security parameters of available communication data and calculate the data encryption coefficient. The comprehensive security parameters include the proportion of dangerous access, the proportion of dangerous duration and the proportion of public data;

[0219] A mode determination module, used to compare the data encryption coefficient with a preset data encryption threshold, and determine whether to enter the data encryption mode according to the comparison result;

[0220] An initial encryption module is used to construct an encryption profile with encryption nodes, import available communication data into the encryption profile for data encryption, and generate initial encrypted data;

[0221] The conditional encryption module is used to extract the encryption features of the initial encrypted data, including node features and verification features, and configure trigger conditions that match the encryption features to generate ciphertext data.

[0222] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A data security encryption method for a communication network, applied to an encryption server, characterized in that: include: S1: pre-processing the original communication data to obtain the communication data to be identified, and based on the data screening criteria, screening out the available communication data from the original communication data to be identified; S2: Collect comprehensive security parameters of available communication data and calculate data encryption coefficient. Comprehensive security parameters include risky access ratio, risky duration ratio and public data ratio. S3: Compare the data encryption coefficient with the preset data encryption threshold, and determine whether to enter the data encryption mode according to the comparison result; if entering the data encryption mode, execute S4-S5; if not entering the data encryption mode, repeat S2-S3; S4: construct an encryption profile with encryption nodes, import available communication data into the encryption profile for data encryption, and generate initial encrypted data. The encryption profile is blank data with zero current occupied capacity and capable of accommodating a large amount of available communication data, and can be used as an object for subsequent data encryption operations. The encryption node is the encryption position corresponding to the data encryption operation in the encryption profile; The construction method of the encrypted contour includes: Mark the key semantics of all available communication data one by one, and aggregate the available communication data with the same key semantics into a set to obtain x data sets; Count the number of available communication data in x data sets one by one to obtain x quantity values; Constructing x mutually independent data groups in the encryption server, and marking the data bits consistent with the x quantity values ​​in the x data groups respectively; Create comment boxes at the end of each of the x data groups, and annotate the group semantics in the comment boxes; Arrange x data groups in parallel, establish a connection channel between two adjacent data groups, and record the midpoint of the connection channel as an encrypted node to obtain x-1 encrypted nodes; After numbering x-1 encrypted nodes in sequence, a contour line is constructed outside the x data groups to obtain an encrypted contour; S5: Extract encryption features of the initial encrypted data, including node features and verification features, and configure trigger conditions that match the encryption features to generate ciphertext data.

2. A data security encryption method for a communication network according to claim 1, characterized in that: The method for acquiring the communication data to be identified comprises: The time when the communication network first generates communication data is queried through the timestamp, and recorded as the starting time; Record the period from the start time to the current time as the recording period, and query all communication data in the recording period through the communication database to obtain the original communication data; Query the attribute types of the original communication data one by one, and record the original communication data whose attribute type is user data as the communication data to be verified; Identify the key semantics of the communication data to be verified one by one through natural language processing technology; Record identity information, address information, permission information, password information, business information, and computing information as available semantics; Identify one by one whether the key semantics contain available semantics, and mark the communication data to be verified that contains any available semantics as communication data to be identified.

3. A data security encryption method for a communication network according to claim 2, characterized in that: The data screening criteria are: only retain the duplicate data that ranks last at the recording time; Available communication data screening methods include: According to the time sequence, the communication data to be identified is split into content characters and time characters one by one by using word segmentation technology; Compare the content characters of the communication data to be identified with the standard content characters pre-stored in the communication database one by one for consistency; Record the communication data to be identified whose content characters are consistent with the pre-stored standard content characters as valid communication data; The communication database is used to query the sending address and receiving address of the valid communication data one by one, and the valid communication data with the same sending address, receiving address and content characters are recorded as duplicate data; The recording times of duplicate data are queried one by one, the recording times are arranged in chronological order, and the duplicate data except the last one in the ranking is eliminated, and the remaining communication data to be identified is recorded as available communication data.

4. A data security encryption method for a communication network according to claim 3, characterized in that: The method for obtaining the dangerous access ratio includes: According to the preset access cycle, the recording period is divided into sub-periods, and in chronological order, The sub-periods are numbered in ascending order; According to the number from large to small, query in order by accessing the system Access records of available communication data in each sub-period and count the number of access records; The authorization status of access records is identified one by one through the access system, access records with the authorization status of unauthorized are recorded as dangerous accesses, and the number of dangerous accesses is counted; Will The number of dangerous accesses in each sub-period is Compare the number of access records in each sub-period to obtain The percentage of children; The expression of the sub-ratio is: ； In the formula, For the The proportion of sub-periods in each sub-period, For the The number of dangerous accesses in each sub-period, For the The number of access records in each sub-period; Will The sub-ratios are compared with the preset risk ratio threshold in turn, and the sub-ratios greater than the preset risk ratio threshold are recorded as effective ratios. The effective percentage; Will The effective proportions are accumulated and averaged to obtain the dangerous access proportion; The expression of the dangerous access ratio is: ； In the formula, is the proportion of dangerous access, For the An effective percentage.

5. A data security encryption method for a communication network according to claim 4, characterized in that: The method for obtaining the risk duration ratio value includes: Arrange and number dangerous visits in chronological order, and mark them with one number in between. a dangerous visit; Identify them one by one by accessing the system The access address of the dangerous access is obtained by extracting the IP number in the access address. IP number; The first detection The time when the IP number is obtained is recorded as the initial access time. Initial access time; When no more detection is made within the preset access period When an IP number is detected, the last The time when the IP number is obtained is recorded as the end time of access. End of visit moment; Will Initial access time to The duration between the end of the visit is recorded as the sub-visit duration, and the Length of visit; Check the fixed access delay time of the communication network through the technical parameter table. Subtract each sub-access duration from the fixed access delay duration, and add them up to get the average to obtain the dangerous access duration value. The expression of the dangerous access duration value is: ； In the formula, is the dangerous access duration value, For the The duration of the child's visit, Delay duration for fixed access; Compare the dangerous access duration value with the duration corresponding to the recording period to obtain the dangerous duration ratio value; The expression of the percentage of dangerous time is: ； In the formula, is the percentage of dangerous time, The duration corresponding to the recording period.

6. A data security encryption method for a communication network according to claim 5, characterized in that: The method for obtaining the public data share includes: Statistics one by one The number of available communication data in each sub-period is obtained The number of sub-values; Will The sub-quantity values ​​are compared with the preset quantity threshold in turn, and the sub-quantity values ​​greater than the preset quantity threshold are recorded as valid quantity values, and the A valid number of values; Query one by one The attribute status of the available communication data corresponding to the valid number value; The available communication data whose attribute status is public is recorded as public data, and the number of public data is counted to obtain Public values; Will The public values ​​are compared one by one Compare the effective quantity values ​​and obtain Individual occupancy rate; The expression of sub-occupancy is: ； In the formula, For the The percentage of individual For the Public values, For the A valid number of values; After removing the maximum and minimum values ​​of the child occupancy rate, the remaining The individual occupancy rates are accumulated and averaged to obtain the public data occupancy rate; The expression of public data share is: ； In the formula, To disclose data share, For the The percentage of individual occupancy.

7. A data security encryption method for a communication network according to claim 6, characterized in that: The expression of the data encryption coefficient is: ； In the formula, is the data encryption coefficient, , , is the weight factor, , , All are greater than 0; The determination method of whether to enter the data encryption mode includes: Encrypt the data factor With the preset data encryption threshold Compare; when Greater than or equal to When , it is determined to enter the data encryption mode; when Less than , it is determined not to enter the data encryption mode.

8. A data security encryption method for a communication network according to claim 7, characterized in that: The method for generating the initial encrypted data comprises: Mark the data groups and data sets that have the same group semantics as the key semantics as target groups, and obtain x target groups; Import the available communication data in the xth data set in the x target groups into the data bits in the xth data group one by one, record the data group into which the available communication data is imported as a group to be encrypted, and obtain x groups to be encrypted; The first character and the second character in the key semantics corresponding to the x groups to be encrypted are separated from the key semantics and combined to obtain x semantic groups, and the two semantic groups at both ends of the x-1 encryption nodes are connected end to end to obtain x-1 encryption features; Based on x-1 encryption features, generate x-1 public keys and x-1 private keys through an asymmetric encryption algorithm; Based on x-1 public keys, encrypt data of x-1 encryption nodes respectively to obtain the encryption profile to be verified; Mark x-1 verification points on the contour line of the encrypted contour to be verified, and build x-1 decryption channels between the x-1 verification points and the x-1 encryption nodes to obtain the initial encrypted data.

9. A data security encryption method for a communication network according to claim 8, characterized in that: The method for extracting the node features and verification features includes: Arrange the x-1 encrypted features word by word to generate a feature arrangement group, split the first and third characters and combine them to obtain x-1 combined words; The numbers of the encrypted nodes corresponding to the x-1 combinations are sequentially annotated at the front of the x-1 combinations to obtain x-1 node features; Number the x-1 decryption channels connected to the x-1 verification points in sequence, and note the numbers of the decryption channels at the back end of the node features to obtain x-1 verification features; The method for generating ciphertext data includes: Record the locations of the verification points and encryption nodes of the x-1 decryption channels as external lock points and internal lock points respectively, and obtain x-1 external lock points and internal lock points; Mark the external trigger position on the decryption channel and outside the internal lock point to obtain x-1 external trigger positions; Mark the inner trigger position on the decryption channel and inside the outer lock point to obtain x-1 inner trigger positions; After reversing the x-1 node features and x-1 verification features, x-1 internal trigger conditions and x-1 external trigger conditions are obtained; The x-1 internal trigger conditions and the x-1 external trigger conditions are configured one by one on the x-1 internal trigger positions and the x-1 external trigger positions to obtain the ciphertext data.

Images