Enterprise information security system and method

Abstract

The invention discloses an enterprise information security system and method, and relates to the technical field of information security, and the system comprises a login terminal and an information security management center. The information security management center comprises an information storage database, a key analysis unit, a personnel information database, an information extraction confirmation unit, a key encryption unit and an encryption terminal; registration information of login personnel is stored in the personnel information database, and the registration information comprises personnel basic information of the login personnel; the secret key encryption unit is used for encrypting a login secret key prepared by a specified person in advance according to registration information in the person information database and deleting the login secret key in the person information database; when an external person invades the system, the external person can only see the coordinates and cannot find the original login key and the logic relationship, so that the safety protection effect of enterprise information is improved, and the enterprise information is prevented from being stolen by the external person.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an enterprise information security system and method. Background Art

[0002] Enterprise information is a general term for various intelligence, information, data, and messages that are generated within the enterprise or applied to enterprise departments and have been processed. In the process of generation, transmission, and communication, it affects the economic activities of the enterprise, supports the scientific decision-making of managers, and serves to maximize the interests of the enterprise.

[0003] The invention with patent publication number CN116127524B discloses an enterprise information security management system, including a login terminal and an information security management center, the information security management center includes an information storage database, a key analysis unit, a personnel information database, an information extraction confirmation unit, a key encryption unit and an encryption terminal; it solves the technical problem that the corresponding enterprise information is not encrypted, which easily leads to hackers breaking through the firewall and stealing the enterprise information; it improves the security protection effect of enterprise information and prevents enterprise information from being stolen by external personnel; but the above scheme still has the following problems: 1. The key encryption method used (simple mathematical operations based on personnel coding parameters and login keys) is not safe enough and can be easily reverse engineered or cracked by brute force; 2. The login key is limited to four groups of numbers, which limits the complexity and diversity of the key and is vulnerable to brute force attacks. Summary of the invention

[0004] The embodiments of the present application provide an enterprise information security system and method to solve the problems in the prior art, that the key encryption method used is not secure enough and is easily reverse engineered or cracked by brute force, and that the login key is limited to four groups of numbers, which limits the complexity and diversity of the key and is easily vulnerable to brute force attacks. The system and method can improve the security protection of enterprise information and prevent enterprise information from being stolen by outsiders.

[0005] The embodiment of the present application provides an enterprise information security system, including: a login terminal and an information security management center; A two-way connection between the login terminal and the information security management center; The information security management center includes an information storage database, a key analysis unit, a personnel information database, an information extraction and confirmation unit, a key encryption unit and an encryption terminal; The information storage database is bidirectionally connected to the encryption terminal, the information storage database and the key analysis unit are both electrically connected to the input end of the information extraction confirmation unit, the key analysis unit is bidirectionally connected to the personnel information database, and the personnel information database is bidirectionally connected to the key encryption unit; The encryption terminal includes an information diversion unit, an explicit and implicit flow segmentation unit, and a grid encryption unit, wherein the information diversion unit is electrically connected to an input end of the explicit and implicit flow segmentation unit, and the explicit and implicit flow segmentation unit is electrically connected to an input end of the grid encryption unit; The information storage database has a plurality of different storage spaces disposed therein, and each different storage space stores the enterprise information of different enterprises; The encryption terminal is used to encrypt the enterprise information stored in the information storage database, and divide the enterprise information of different enterprises into nine groups of information data streams in advance through the information distribution unit, obtain the overall value capacity of the entire enterprise information, and then divide it equally to obtain nine groups of information data streams; Then, the nine groups of information data streams are segmented by the explicit and implicit stream segmentation unit, and different information data streams are divided into explicit data streams and implicit data streams, and the segmented explicit data streams and implicit data streams are transmitted to the grid encryption unit; The grid encryption unit performs grid encryption on the divided different clear data streams and hidden data streams, fills the different clear data streams into the designated positions of the grid template of the clear data stream, fills the different hidden data into the designated positions of the grid template of the hidden data stream, and transmits the two groups of grid templates after filling to the original storage position of the enterprise information to replace the original enterprise information; The personnel information database stores the registration information of the logged-in personnel, wherein the registration information includes the basic information of the logged-in personnel; The key encryption unit encrypts the login key prepared in advance by the designated person according to the registration information in the personnel information database, and deletes the login key in the personnel information database to prevent the login key from being stolen by an outsider, causing the stored information to be stolen. The specific method of encrypting the login key is: S101, obtaining the personnel code parameter of the login personnel from the basic information of the personnel, the personnel code parameter consists of eight digits, and obtaining the login key prepared by the login personnel during the first registration process, wherein the login key consists of four groups of digits; By splicing the personnel code parameter and the login key, a first personnel code consisting of twelve digits, with the personnel parameter code in the front and the login key in the back, is formed; The first eight digits of the first personnel code are personnel code parameters, and the last four digits are login keys; S102, randomly dividing the twelve digits in the first personnel code in order to obtain a plurality of groups, each group cannot be empty, and marking the coordinates of the digits in each group after the grouping to obtain a first coordinate marking result; The first coordinate marking result includes group information and coordinate information of the first personnel code; For example, the first person code is 123456784321. The first person code is randomly grouped, and the grouping results are 1, 2345, 678, 43, and 21. The coordinates of each group of numbers are marked. The coordinate marking results of the first group are (1, 1), and the coordinate marking results of the second group are (2, 1), (2, 2), (2, 3), and (2, 4). The marking results of the third group are (3, 1), (3, 2), and (3, 3). The marking results of the fourth group are (4, 1) and (4, 2), and the marking results of the fifth group are (5, 1) and (5, 2).

[0006] S103, setting a random scattering rule to scramble the twelve digits in the first personnel code, randomly storing the scrambled first personnel code, and deleting the login key in the original first personnel code.

[0007] The login terminal is used for external enterprise personnel to log in, input the designated basic information of the personnel and the corresponding login key and transmit it to the information security management center; The key analysis unit receives basic information of the personnel and matches it from the personnel information database to obtain the personnel coding parameters of the corresponding personnel. According to the personnel parameter coding and the first coordinate marking result, the login key stored when the corresponding personnel registered is converted, and the login key is compared. If the match is successful, the corresponding access rights are provided. If the match is unsuccessful, the system rejects the login request and records the attempted login information.

[0008] In one or more embodiments of the present application, in step S101, a random disturbance number is added to the login key to increase the number of digits of the login key, wherein the specific method of adding the random disturbance number is: S201, adding a disturbance number to the login key of the first person code, by inserting the disturbance number into a random position of the original login key, after inserting the disturbance number, the original four-digit login key is expanded into a new login key containing multiple digits, which is recorded as the first login key; The disturbance digit in the first login key may be one or more, and may be inserted into a random position of the login key alone or in combination. The random position refers to the position before or after any digit in the login key. For example, the original login key is 1234, and the newly added disturbance number is 5, which is inserted between 1 and 2. The expanded first login key is 15234.

[0009] S202, setting coordinates for each disturbed digit, for recording the position and number of the disturbed digits inserted, the coordinates of the disturbed digits following the coordinates of the previous digit to determine the coordinate value; The coordinate values ​​of the disturbance numbers are recorded as (x, y, z), where z is the grouping mark code; For example, the original login key is 6543, and a new perturbation number 7 is added and inserted between 6 and 5. The expanded first login key is 67543. The coordinates of 6 are (1, 1), and the coordinates of 5 are (1, 2). Then the coordinates of the perturbation number are (1, 1, group mark code); Before coordinate marking, a random grouping rule table is preset, and the random grouping rule table includes a variety of numbers and number combinations, and each combination corresponds to a unique grouping mark code; The grouping mark code may not be a single number, but may be a set or a decimal, etc. For example, the coordinates of the inserted disturbance number are (1, 1, 2.2).

[0010] In one or more embodiments of the present application, in step S201, the number and insertion position of the disturbance digits in the first login key are dynamically adjusted, and different insertion combinations and insertion numbers are set to keep the length of the digits in all first login keys consistent, specifically including the following steps: S301, setting a reference length L1, wherein the reference length is a digital length longer than the original login key, and all login keys should reach the reference length after adding the disturbance digits; The reference length should not be set too short. Since the original login key is four digits long, the reference length is set to ten digits. S302, setting the length of the original login key to L2, and calculating the difference between the original login key length and the reference length ΔL=L1-L2; Since the base length is ten digits and the original login key is four digits, the difference between the original login key and the base length is six digits; S303, selecting the number of disturbed digits from the random grouping rule table according to the difference ΔL, and inserting the disturbed digits into n positions randomly selected in the original key to obtain a second login key; After inserting the perturbation digit, ensure that the length of the second login key is consistent with the base length.

[0011] The disturbance numbers in the random grouping rule table include a variety of numbers and number combinations, such as 1, 12, 123, 1234, etc.; The number of disturbed numbers is selected from the random grouping rule table and inserted into the original login key, specifically: According to the difference between the original login key and the reference length, it is determined that six perturbation digits need to be added; According to the number of disturbance numbers to be added, six digits are drawn from the random grouping rule table. These six digits can be composed of one or more groups of digits. In the original login key, a position is randomly selected and one or more groups of six-digit numbers are inserted into the original key. The selected position can be before any number of the original login key or after any number of the original login key.

[0012] In one or more embodiments of the present application, in step S301, the standard for setting the benchmark length is adjusted after the system has been in operation for a period of time, and the number of digits of the set benchmark length is changed; for example, the standard for the benchmark length is changed every three months, and the standard for the benchmark length of ten digits is adjusted to fifteen digits.

[0013] In order to better demonstrate a monitoring process of an enterprise information security system, the present invention provides an enterprise information security method, which comprises the following steps: S401, the login terminal receives a login request from an external enterprise personnel, including basic information of the designated personnel and a corresponding login key; S402, transmitting the basic information of the personnel and the login key to the information security management center, and the key analysis unit in the information security management center receives the information and performs preliminary verification on the basic information of the personnel; S403, the key analysis unit retrieves a personnel record matching the input personnel basic information from the personnel information database, and if a matching record is found, obtains the personnel coding parameter of the personnel; S404, according to the obtained personnel code parameters and the known random scattering rule, reverse operation is performed to restore the first personnel code, and the first coordinate marking result is used to reorder the scrambled first personnel code to restore the original login key; S405, restore the original login key and compare it with the login key provided in the login request. If they match, the verification is successful, and the key analysis unit sends a confirmation signal to the system, allowing login and granting corresponding access rights; if they do not match, the verification fails, the system rejects the login request, and records the attempted login information.

[0014] One or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: By encrypting the login key and deleting the original login key, the risk of outsiders directly stealing the login key is reduced. The coordinate mark provides precise location information for each group of numbers, so that the original position and order of each group of numbers can be accurately identified in the encrypted data, which facilitates the subsequent decryption and recovery of the original data. At the same time, the coordinate mark does not rely on a specific encryption algorithm or encryption method. The coordinate mark is part of the encryption process and is used to increase the complexity of encryption.

[0015] When outsiders break into the system, they can only see the coordinates but cannot find the original login key and logical relationship, which improves the security protection of corporate information and prevents corporate information from being stolen by outsiders. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of the enterprise information security system S101-S103 of the present invention; Figure 2 This is an effect diagram of the first coordinate marking result corresponding to a circle in the enterprise information security system of the present invention. DETAILED DESCRIPTION

[0017] To facilitate the understanding of the present invention, the present application will be described more comprehensively below with reference to the relevant drawings; the drawings show preferred embodiments of the present invention, but the present invention can be implemented in many different forms and is not limited to the embodiments described herein; on the contrary, the purpose of providing these embodiments is to enable a more thorough and comprehensive understanding of the disclosed content of the present invention.

[0018] It should be noted that the terms “vertical”, “horizontal”, “up”, “down”, “left”, “right” and similar expressions used in this document are only for illustrative purposes and do not represent the only implementation method.

[0019] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by technicians in the technical field to which the present invention belongs; the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention; the term "and / or" used herein includes any and all combinations of one or more related listed items.

[0020] Embodiment 1: Figure 1 As shown, the present application provides an enterprise information security system, including: a login terminal and an information security management center; A two-way connection between the login terminal and the information security management center; The information security management center includes an information storage database, a key analysis unit, a personnel information database, an information extraction and confirmation unit, a key encryption unit and an encryption terminal; The information storage database is bidirectionally connected to the encryption terminal, the information storage database and the key analysis unit are both electrically connected to the input end of the information extraction confirmation unit, the key analysis unit is bidirectionally connected to the personnel information database, and the personnel information database is bidirectionally connected to the key encryption unit; The encryption terminal includes an information diversion unit, an explicit and implicit flow segmentation unit, and a grid encryption unit, wherein the information diversion unit is electrically connected to an input end of the explicit and implicit flow segmentation unit, and the explicit and implicit flow segmentation unit is electrically connected to an input end of the grid encryption unit; The information storage database has a plurality of different storage spaces disposed therein, and each different storage space stores the enterprise information of different enterprises; The encryption terminal is used to encrypt the enterprise information stored in the information storage database, and divide the enterprise information of different enterprises into nine groups of information data streams in advance through the information distribution unit, obtain the overall value capacity of the entire enterprise information, and then divide it equally to obtain nine groups of information data streams; Then, the nine groups of information data streams are segmented by the explicit and implicit stream segmentation unit, and different information data streams are divided into explicit data streams and implicit data streams, and the segmented explicit data streams and implicit data streams are transmitted to the grid encryption unit; The grid encryption unit performs grid encryption on the divided different clear data streams and hidden data streams, fills the different clear data streams into the designated positions of the grid template of the clear data stream, fills the different hidden data into the designated positions of the grid template of the hidden data stream, and transmits the two groups of grid templates after filling to the original storage position of the enterprise information to replace the original enterprise information; The personnel information database stores the registration information of the logged-in personnel, wherein the registration information includes the basic information of the logged-in personnel; The key encryption unit encrypts the login key prepared in advance by the designated person according to the registration information in the personnel information database, and deletes the login key in the personnel information database to prevent the login key from being stolen by an outsider, causing the stored information to be stolen. The specific method of encrypting the login key is: S101, obtaining the personnel code parameter of the login personnel from the basic information of the personnel, the personnel code parameter consists of eight digits, and obtaining the login key prepared by the login personnel during the first registration process, wherein the login key consists of four groups of digits; By splicing the personnel code parameter and the login key, a first personnel code consisting of twelve digits, with the personnel parameter code in the front and the login key in the back, is formed; The first eight digits of the first personnel code are personnel code parameters, and the last four digits are login keys; S102, randomly dividing the twelve digits in the first personnel code in order to obtain a plurality of groups, each group cannot be empty, and marking the coordinates of the digits in each group after the grouping to obtain a first coordinate marking result; The first coordinate marking result includes group information and coordinate information of the first personnel code; For example, the first person code is 123456784321. The first person code is randomly grouped, and the grouping results are 1, 2345, 678, 43, and 21. The coordinates of each group of numbers are marked. The coordinate marking results of the first group are (1, 1), and the coordinate marking results of the second group are (2, 1), (2, 2), (2, 3), and (2, 4). The marking results of the third group are (3, 1), (3, 2), and (3, 3). The marking results of the fourth group are (4, 1) and (4, 2), and the marking results of the fifth group are (5, 1) and (5, 2).

[0021] S103, setting a random scattering rule to scramble the twelve digits in the first personnel code, randomly storing the scrambled first personnel code, and deleting the login key in the original first personnel code.

[0022] The login terminal is used for external enterprise personnel to log in, input the designated basic information of the personnel and the corresponding login key and transmit it to the information security management center; The key analysis unit receives basic information of the personnel and matches it from the personnel information database to obtain the personnel coding parameters of the corresponding personnel. According to the personnel parameter coding and the first coordinate marking result, the login key stored when the corresponding personnel registered is converted, and the login key is compared. If the match is successful, the corresponding access rights are provided. If the match is unsuccessful, the system rejects the login request and records the attempted login information.

[0023] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages: By encrypting the login key and deleting the original login key, the risk of outsiders directly stealing the login key is reduced. The coordinate mark provides precise location information for each group of numbers, so that the original position and order of each group of numbers can be accurately identified in the encrypted data, which facilitates the subsequent decryption and recovery of the original data. At the same time, the coordinate mark does not rely on a specific encryption algorithm or encryption method. The coordinate mark is part of the encryption process and is used to increase the complexity of encryption.

[0024] When outsiders break into the system, they can only see the coordinates but cannot find the original login key and logical relationship, which improves the security protection of corporate information and prevents corporate information from being stolen by outsiders.

[0025] Embodiment 2: In embodiment 1, the login key consists of four digits with a fixed number of digits. When attacked by an outsider or brute force, the login key is easily cracked by an outsider because of its fixed number of digits, which limits its complexity and diversity.

[0026] Therefore, the embodiments of the present application are optimized based on the above embodiments.

[0027] In one or more embodiments of the present application, in step S101, a random disturbance number is added to the login key to increase the number of digits of the login key, wherein the specific method of adding the random disturbance number is: S201, adding a disturbance number to the login key of the first person code, by inserting the disturbance number into a random position of the original login key, after inserting the disturbance number, the original four-digit login key is expanded into a new login key containing multiple digits, which is recorded as the first login key; The disturbance digit in the first login key may be one or more, and may be inserted into a random position of the login key alone or in combination. The random position refers to the position before or after any digit in the login key. For example, the original login key is 1234, and the newly added disturbance number is 5, which is inserted between 1 and 2. The expanded first login key is 15234.

[0028] S202, setting coordinates for each disturbed digit, for recording the position and number of the disturbed digits inserted, the coordinates of the disturbed digits following the coordinates of the previous digit to determine the coordinate value; The coordinate values ​​of the disturbance numbers are recorded as (x, y, z), where z is the grouping mark code; For example, the original login key is 6543, and a new perturbation number 7 is added and inserted between 6 and 5. The expanded first login key is 67543. The coordinates of 6 are (1, 1), and the coordinates of 5 are (1, 2). Then the coordinates of the perturbation number are (1, 1, group mark code); Before coordinate marking, a random grouping rule table is preset, and the random grouping rule table includes a variety of numbers and number combinations, and each combination corresponds to a unique grouping mark code; The grouping mark code may not be a single number, but may be a set or a decimal, etc. For example, the coordinates of the inserted disturbance number are (1, 1, 2.2).

[0029] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages: By inserting random perturbation numbers into the login key, the number of digits and complexity of the key are increased, making it challenging for outsiders or brute force attack methods to crack the login key. The possibility of guessing or exhaustive attempts increases, which directly improves the security of the system. The location of the perturbation number insertion is flexible, making each generated login key unique and difficult to predict, further enhancing security.

[0030] As the number of bits of the login key increases, the system can effectively distinguish and verify the increased disturbance digits, thereby improving the security and robustness of the system.

[0031] Embodiment 3: In embodiment 2, in step S201, the disturbance numbers inserted in the first login key, although increasing the complexity and security of the login key by adding random disturbance numbers, the number of newly added disturbance numbers in each login key is different, resulting in difficulty in storing and searching the login key, making each login key unique, which still has a certain degree of predictability when being attacked by outsiders.

[0032] Therefore, the embodiments of the present application are optimized based on the above embodiments.

[0033] In one or more embodiments of the present application, in step S201, the number and insertion position of the disturbance digits in the first login key are dynamically adjusted, and different insertion combinations and insertion numbers are set to keep the length of the digits in all first login keys consistent, specifically including the following steps: S301, setting a reference length L1, wherein the reference length is a digital length longer than the original login key, and all login keys should reach the reference length after adding the disturbance digits; The reference length should not be set too short. Since the original login key is four digits long, the reference length is set to ten digits. S302, setting the length of the original login key to L2, and calculating the difference between the original login key length and the reference length ΔL=L1-L2; Since the base length is ten digits and the original login key is four digits, the difference between the original login key and the base length is six digits; S303, selecting the number of disturbed digits from the random grouping rule table according to the difference ΔL, and inserting the disturbed digits into n positions randomly selected in the original key to obtain a second login key; After inserting the perturbation digit, ensure that the length of the second login key is consistent with the base length.

[0034] The disturbance numbers in the random grouping rule table include a variety of numbers and number combinations, such as 1, 12, 123, 1234, etc.; The number of disturbed numbers is selected from the random grouping rule table and inserted into the original login key, specifically: According to the difference between the original login key and the reference length, it is determined that six perturbation digits need to be added; According to the number of disturbance numbers to be added, six digits are drawn from the random grouping rule table. These six digits can be composed of one or more groups of digits. In the original login key, a position is randomly selected and one or more groups of six-digit numbers are inserted into the original key. The selected position can be before any number of the original login key or after any number of the original login key.

[0035] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages: By dynamically adjusting the number and insertion position of the perturbation digits in the first login key, the complexity and randomness of the login key are increased. Although each login key has the same length, the internal perturbation digit combination and position are random, making it difficult for attackers to crack the key through statistical or predictive means.

[0036] By setting a baseline length, all login keys are kept consistent in length after adding the perturbation digit, which simplifies the key storage and search process and avoids the additional processing complexity caused by different key lengths.

[0037] Embodiment 4: In embodiment 3, the digital length of the second login key remains consistent for a long time, which may easily cause a decrease in system security.

[0038] Therefore, the embodiments of the present application are optimized based on the above embodiments.

[0039] In one or more embodiments of the present application, in step S301, the standard for setting the benchmark length is adjusted after the system has been in operation for a period of time, and the number of digits of the set benchmark length is changed; for example, the standard for the benchmark length is changed every three months, and the standard for the benchmark length of ten digits is adjusted to fifteen digits.

[0040] In one or more embodiments of the present application, the coordinates in the first coordinate marking result may be a part of a closed figure, and the specific method of dividing the figure is: A point is randomly selected inside the closed figure, defined as the reference point, and a fixed angle is selected to divide the closed figure so that all coordinates can divide the entire closed figure; After the division is completed, all parts of the closed figure correspond to all coordinates of the first coordinate marking result one by one and all parts of the closed figure are different; The closed figure may specifically be a figure with a closed curve, such as a square, a rectangle, or a circle.

[0041] For example, Figure 2 As shown, taking a circle as an example, a point is randomly selected inside the circle as the reference point, and the first coordinate marking results are (1, 1), (2, 1), (2, 2) and (3, 1); the figure is divided clockwise into four parts, and the figures of the four parts are different.

[0042] In order to better demonstrate a monitoring process of an enterprise information security system, the present invention provides an enterprise information security method, which comprises the following steps: S401, the login terminal receives a login request from an external enterprise personnel, including basic information of the designated personnel and a corresponding login key; S402, transmitting the basic information of the personnel and the login key to the information security management center, and the key analysis unit in the information security management center receives the information and performs preliminary verification on the basic information of the personnel; S403, the key analysis unit retrieves a personnel record matching the input personnel basic information from the personnel information database, and if a matching record is found, obtains the personnel coding parameter of the personnel; S404, according to the obtained personnel code parameters and the known random scattering rule, reverse operation is performed to restore the first personnel code, and the first coordinate marking result is used to reorder the scrambled first personnel code to restore the original login key; S405, restore the original login key and compare it with the login key provided in the login request. If they match, the verification is successful, and the key analysis unit sends a confirmation signal to the system, allowing login and granting corresponding access rights; if they do not match, the verification fails, the system rejects the login request, and records the attempted login information.

[0043] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages: By regularly adjusting the benchmark length standard, potential attackers can be effectively prevented from using fixed key lengths to guess or crack. Dynamic adjustment strategies increase the difficulty of attacks and improve the overall security of the system.

[0044] As network technology continues to develop, new security threats continue to emerge. By regularly changing the baseline length standard, the system can respond to these new threats more flexibly and ensure the complexity and unpredictability of the key.

[0045] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. An enterprise information security system, characterized in that: include: Login terminal and information security management center; The information security management center includes an information storage database, a key analysis unit, a personnel information database, an information extraction confirmation unit, a key encryption unit, an encryption terminal and a login terminal; The personnel information database stores the registration information of the logged-in personnel, wherein the registration information includes the basic information of the logged-in personnel; The key encryption unit encrypts the login key prepared in advance by the designated person according to the registration information in the personnel information database, and deletes the login key in the personnel information database, wherein the specific method of encrypting the login key is: S101, obtaining the personnel code parameter of the login personnel from the basic information of the personnel, the personnel code parameter consists of eight digits, and obtaining the login key prepared by the login personnel during the first registration process, wherein the login key consists of four groups of digits; By splicing the personnel code parameter and the login key, a first personnel code consisting of twelve digits, with the personnel parameter code in the front and the login key in the back, is formed; S102, randomly dividing the twelve digits in the first personnel code in order to obtain a plurality of groups, each group cannot be empty, and marking the coordinates of the digits in each group after the grouping to obtain a first coordinate marking result; S103, setting a random scattering rule to scramble the twelve digits in the first personnel code, randomly storing the scrambled first personnel code, and deleting the login key in the original first personnel code.

2. An enterprise information security system as claimed in claim 1, characterized in that: The first coordinate marking result includes the grouping information and coordinate information of the first personnel code.

3. An enterprise information security system as claimed in claim 1, characterized in that: The login terminal is used for external enterprise personnel to log in, input designated basic information of personnel and corresponding login key and transmit it to the information security management center.

4. An enterprise information security system as claimed in claim 1, characterized in that: The key analysis unit receives basic information of the personnel and matches it from the personnel information database to obtain the personnel coding parameters of the corresponding personnel. According to the personnel parameter coding and the first coordinate marking result, the login key stored when the corresponding personnel registered is converted, and the login key is compared. If the match is successful, the corresponding access rights are provided. If the match is unsuccessful, the system rejects the login request and records the attempted login information.

5. An enterprise information security system as claimed in claim 1, characterized in that: The random disturbance number is added to the login key to increase the number of digits of the login key, wherein the specific method of adding the random disturbance number is: S201, adding a disturbance number to the login key of the first person code, by inserting the disturbance number into a random position of the original login key, after inserting the disturbance number, the original four-digit login key is expanded into a new login key containing multiple digits, which is recorded as the first login key; S202, setting coordinates for each disturbed digit, for recording the position and number of the disturbed digit inserted, the coordinates of the disturbed digit follow the coordinates of the previous digit to determine the coordinate value.

6. An enterprise information security system as claimed in claim 5, characterized in that: The coordinate values ​​of the disturbance numbers are recorded as (x, y, z), where z is the grouping mark code.

7. An enterprise information security system as claimed in claim 5, characterized in that: Before the coordinates are marked, the original login key presets a random grouping rule table, which contains a variety of numbers and number combinations, and each combination corresponds to a unique grouping mark code.

8. An enterprise information security system as claimed in claim 5, characterized in that: The number and insertion position of the disturbance digits in the first login key are dynamically adjusted, and different insertion combinations and insertion numbers are set to make the length of the digits in all first login keys consistent, which specifically includes the following steps: S301, setting a reference length L1, wherein the reference length is a digital length longer than the original login key, and all login keys should reach the reference length after adding the disturbance digits; The reference length should not be set too short. Since the original login key is four digits long, the reference length is set to ten digits. S302, setting the length of the original login key to L2, and calculating the difference between the original login key length and the reference length ΔL=L1-L2; Since the base length is ten digits and the original login key is four digits, the difference between the original login key and the base length is six digits; S303, selecting the number of disturbed digits from the random grouping rule table according to the difference ΔL, and inserting the disturbed digits into n positions randomly selected in the original key to obtain a second login key.

9. An enterprise information security system as claimed in claim 8, characterized in that: The standard of the reference length is adjusted after the system is put into operation, and the number of digits of the set reference length is changed.

10. An enterprise information security method, using an enterprise information security system as claimed in claim 1, characterized in that: include: S401, the login terminal receives a login request from an external enterprise personnel, including basic information of the designated personnel and a corresponding login key; S402, transmitting the basic information of the personnel and the login key to the information security management center, and the key analysis unit in the information security management center receives the information and performs preliminary verification on the basic information of the personnel; S403, the key analysis unit retrieves a personnel record matching the input personnel basic information from the personnel information database, and if a matching record is found, obtains the personnel coding parameter of the personnel; S404, according to the obtained personnel code parameters and the known random scattering rule, reverse operation is performed to restore the first personnel code, and the first coordinate marking result is used to reorder the scrambled first personnel code to restore the original login key; S405, restore the original login key and compare it with the login key provided in the login request. If they match, the verification is successful, and the key analysis unit sends a confirmation signal to the system, allowing login and granting corresponding access rights; if they do not match, the verification fails, the system rejects the login request, and records the attempted login information.

Images