Network security protection encryption method and device

Abstract

The invention relates to the technical field of digital information transmission, in particular to a network security protection encryption method and device, and the method comprises the steps: obtaining to-be-tested data and encryption algorithms, marking the to-be-tested data and encryption algorithms as target algorithms, collecting the test data of each target algorithm, and obtaining the performance evaluation index and security evaluation index of each target algorithm through processing; obtaining basic characteristic data of the to-be-encrypted data, and processing the basic characteristic data to obtain a data demand performance parameter and a data demand security parameter of the to-be-encrypted data; and performing comprehensive analysis to obtain a comprehensive energy efficiency evaluation index of each target algorithm, and performing encryption algorithm screening. According to the network security protection encryption method and device provided by the invention, the comprehensive energy efficiency evaluation index of each target algorithm is obtained through comprehensive analysis, and the algorithm which is more efficient in resource utilization can be selected, so that the waste of system resources is reduced, the overall efficiency and response speed are improved, and the user experience is improved. And the system fault risk caused by algorithm defects or insufficiency can be reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of digital information transmission, and in particular to a network security protection encryption method and device. Background Art

[0002] With the popularization of the Internet, the value of data has become increasingly prominent, and individuals and organizations are increasingly relying on the Internet for daily activities, making it essential to protect networks, data, and devices from unauthorized access and damage. Therefore, network security protection has become an important issue that cannot be ignored and requires continuous attention and updates to protect the confidentiality, integrity, and availability of information.

[0003] For example, the invention patent with announcement number: CN117294537B is a computer network security protection method and system using quantum encryption, which relates to the field of network security technology. In this method, a random and unpredictable security key is generated by a quantum key distribution protocol, and then the security key is transmitted to the communicating parties respectively by using a quantum channel, and the received security key is converted into a quantum bit, which is cut into a fixed period time line to form N1, N2, N3 to Nx groups of measurement screening information sets, and the calculation method is the same. Taking the N1 group of measurement screening information sets as an example, the first data set of spin state and the second data set of polarization state are counted, and calculation is performed to obtain the measurement index Clzs of the quantum bit, which is compared with the preset measurement threshold T and the measurement index Clzs, and a channel is established or abnormal feedback is given according to the comparison result, and the generated shared quantum key is used to perform quantum encryption on the communication content.

[0004] For example, the invention patent with announcement number: CN114389809B is an information-based network security protection method for encrypting https protocol, including the host-side server generating the https request to be transmitted; the host-side server sending the https request to the network security protection server; the network security protection server uses a detection program to perform intrusion detection on the https request; if it is found that the https request is invaded, it is destroyed and the message is transmitted back to the host-side server, otherwise proceed to the next step; the network security protection server uses an encryption program to encrypt the https request; the network security protection server sends the encrypted https request to the receiving client; the receiving client decrypts the https request and performs a local database query on the decrypted request; and returns the query result to the host-side server via the original path.

[0005] However, in the process of implementing the technical solution of the invention in the embodiments of the present application, it was found that the above-mentioned technology has at least the following technical problems: the current network security protection encryption methods include quantum encryption technology and asymmetric encryption methods. Although they have high security, they have high computational complexity, and the encryption and decryption processes are relatively slow, which may affect the real-time and efficiency of network communications. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a network security protection encryption method and device, which can effectively solve the problems involved in the above-mentioned background technology.

[0007] To achieve the above objectives, the present invention is implemented through the following technical solutions: The first aspect of the present invention provides a network security protection encryption method, including: obtaining data to be tested and encryption algorithms, marking them as target algorithms, and using each target algorithm to perform encryption and decryption operations on the data to be tested, collecting test data of each target algorithm, including performance data and security data, and obtaining a performance evaluation index and a security evaluation index of each target algorithm after processing.

[0008] The basic characteristic data of the data to be encrypted is obtained, and the data requirement performance parameters and data requirement security parameters of the data to be encrypted are obtained after processing.

[0009] According to the data requirement performance parameters and data requirement security parameters of the data to be encrypted and the performance evaluation index and security evaluation index of each target algorithm, a comprehensive analysis is performed to obtain the comprehensive energy efficiency evaluation index of each target algorithm. Encryption algorithms are screened according to the comprehensive energy efficiency evaluation index of each target algorithm, and the screening results are obtained and fed back.

[0010] As a further method, the test data of each target algorithm, including performance data and security data, is collected. The specific process is: deploying several time monitoring points to collect the test data of each target algorithm during the encryption and decryption operations on the test data, including performance data and security data.

[0011] The performance data includes the encryption speed at each time monitoring point within the encryption operation cycle, the resource consumption within the encryption operation cycle and the data throughput, wherein the resource consumption within the encryption operation cycle includes CPU usage, memory occupancy, disk occupancy and network IO occupancy.

[0012] The security data includes the number of brute force cracking attempts on each target algorithm and the time required for successful cracking, as well as the number of loopholes in the encryption operation cycle.

[0013] As a further method, the performance evaluation index and security evaluation index of each target algorithm are obtained through processing, specifically including: according to the encryption speed, each resource consumption and data throughput at each time monitoring point in the encryption operation cycle, the critical encryption speed, the critical consumption of each resource and the critical data throughput are extracted from the data encryption database, and the performance evaluation index of each target algorithm is obtained through comprehensive analysis. The performance evaluation index of each target algorithm is used to quantitatively evaluate the performance of each target algorithm, providing a basis for evaluating the comprehensive energy efficiency of each target algorithm.

[0014] As a further method, the performance evaluation index and security evaluation index of each target algorithm obtained through processing also include: extracting the critical number of brute force cracking times, the critical successful cracking time and the critical number of vulnerabilities from the data encryption database based on the number of brute force cracking attempts on each target algorithm and the time required for successful cracking and the number of vulnerabilities in the encryption operation cycle, and obtaining the security evaluation index of each target algorithm through comprehensive analysis. The security evaluation index of each target algorithm is used to quantitatively evaluate the security level of each target algorithm, providing a basis for evaluating the comprehensive energy efficiency of each target algorithm.

[0015] As a further method, the basic characteristic data of the data to be encrypted includes byte length and basic security requirement data.

[0016] The basic security requirement data specifically includes the number of systems that are allowed to access the data to be encrypted and the historical cumulative number of accesses.

[0017] As a further method, the data requirement performance parameters and data requirement security parameters of the data to be encrypted are obtained after processing. The specific process is: according to the byte length of the data to be encrypted, the data requirement performance parameters corresponding to the byte length interval are extracted from the data encryption database. The data requirement performance parameters of the data to be encrypted are used to quantitatively evaluate the performance requirements of the data to be encrypted for the encryption system, and provide a basis for evaluating the comprehensive energy efficiency evaluation indicators of each target algorithm.

[0018] According to the number of systems allowed to access the data to be encrypted and the historical cumulative number of accesses, the critical number of systems allowed to access the data and the critical historical cumulative number of accesses are extracted from the data encryption database, and the data requirement security parameters of the data to be encrypted are obtained through comprehensive analysis. The data requirement security parameters of the data to be encrypted are used to quantitatively evaluate the security of the data to be encrypted, and provide a basis for evaluating the comprehensive energy efficiency evaluation indicators of each target algorithm.

[0019] As a further method, the comprehensive analysis obtains the comprehensive energy efficiency evaluation index of each target algorithm. The specific analysis process is: based on the data requirement performance parameters and data requirement security parameters of the data to be encrypted and the performance evaluation index and security evaluation index of each target algorithm, the comprehensive energy efficiency evaluation index of each target algorithm is obtained through comprehensive analysis. The comprehensive energy efficiency evaluation index of each target algorithm is used to quantitatively evaluate the comprehensive energy efficiency of each target algorithm.

[0020] As a further method, encryption algorithm screening is performed according to the comprehensive energy efficiency evaluation indicators of each target algorithm, the screening results are obtained and feedback is provided, and the specific screening process is: the comprehensive energy efficiency evaluation indicators of each target algorithm are sorted in ascending order to obtain a comprehensive energy efficiency evaluation indicator sequence of each target algorithm, and the target algorithm with the largest comprehensive energy efficiency evaluation indicator among each target algorithm is extracted, and it is marked as the optimal algorithm of the test system.

[0021] As a further method, the comprehensive energy efficiency evaluation index of each target algorithm is specifically expressed as: ; In the formula, represents the comprehensive energy efficiency evaluation index of the rth target algorithm, represents the performance evaluation index of the rth target algorithm, represents the security evaluation index of the rth target algorithm, represents the data requirement performance parameter of the data to be encrypted, The data security parameter that represents the data to be encrypted.

[0022] The second aspect of the present invention provides a network security protection encryption device, characterized in that it includes: a processor and a memory and a network interface connected to the processor; the network interface is connected to a non-volatile memory in a server; when the processor is running, it calls a computer program from the non-volatile memory through the network interface, and runs the computer program through the memory to execute the above method.

[0023] Compared with the prior art, the embodiments of the present invention have at least the following advantages or beneficial effects: (1) The present invention provides a network security protection encryption method and device, which comprehensively considers the data demand performance and data demand security of the data to be encrypted and the performance and security of each target algorithm, and helps to select an algorithm that is more efficient in resource utilization, thereby reducing the waste of system resources, improving overall efficiency and response speed, and reducing the risk of system failures caused by algorithm defects or deficiencies, improving the stability and reliability of the system, and ensuring business continuity and data integrity.

[0024] (2) By comparing the performance of different algorithms, the present invention can intuitively see the advantages and disadvantages of each algorithm, so as to select the algorithm that best suits the current application scenario. At the same time, encryption algorithm screening based on performance evaluation index can also significantly improve the overall performance of data encryption and ensure the stability of data transmission.

[0025] (3) By quantitatively evaluating the security of the algorithm, the present invention can more accurately evaluate the security risks of various encryption algorithms in different application scenarios. This helps to avoid serious consequences such as data leakage and system control caused by insufficient algorithm security. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The present invention is further described using the accompanying drawings, but the embodiments in the accompanying drawings do not constitute any limitation to the present invention. A person skilled in the art can obtain other drawings based on the following drawings without creative work.

[0027] Figure 1 It is a schematic diagram of the method flow of the present invention.

[0028] Figure 2 It is a schematic diagram of the functional relationship between the historical cumulative number of accesses to the data to be encrypted and the data security requirement parameter of the data to be encrypted involved in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0030] Reference Figure 1 As shown, the first aspect of the present invention provides a network security protection encryption method, including: obtaining data to be tested and encryption algorithms, marking them as target algorithms, and using each target algorithm to perform encryption and decryption operations on the data to be tested, collecting test data of each target algorithm, including performance data and security data, and obtaining a performance evaluation index and a security evaluation index of each target algorithm after processing.

[0031] Specifically, the test data of each target algorithm, including performance data and security data, is collected in the following process: deploying a number of time monitoring points to collect the test data of each target algorithm during the encryption and decryption operations on the test data, including performance data and security data; The performance data includes the encryption speed at each time monitoring point in the encryption operation cycle, the resource consumption in the encryption operation cycle and the data throughput, wherein the resource consumption in the encryption operation cycle includes the CPU resource, memory resource, disk resource and network IO resource consumption; The security data includes the number of brute force cracking attempts on each target algorithm and the time required for successful cracking, as well as the number of loopholes in the encryption operation cycle.

[0032] Furthermore, the performance evaluation index and security evaluation index of each target algorithm are obtained through processing, specifically including: extracting the critical encryption speed, the critical consumption of each resource and the critical data throughput from the data encryption database according to the encryption speed, each resource consumption and the data throughput at each time monitoring point in the encryption operation cycle, and obtaining the performance evaluation index of each target algorithm through comprehensive analysis. The performance evaluation index of each target algorithm is used to quantitatively evaluate the performance of each target algorithm, providing a basis for evaluating the comprehensive energy efficiency of each target algorithm.

[0033] It should be explained that the encryption speed, resource consumption and data throughput at each time monitoring point in the encryption operation cycle in this embodiment respectively represent the encryption speed, resource consumption and data throughput from the previous time monitoring point to the current time monitoring point.

[0034] It should be explained that the critical encryption speed, the critical consumption of each resource and the critical data throughput respectively represent the minimum encryption speed, the maximum consumption of each resource and the minimum data throughput within the encryption operation cycle. Under this condition, the performance of the target algorithm on the encryption system is far lower than the expected value.

[0035] In a specific embodiment, the numerical expression of the performance evaluation index of each target algorithm is: ; In the formula, represents the performance evaluation index of the rth target algorithm, r represents the number of each target algorithm, , h represents the total number of target algorithms, represents the encryption speed of the rth target algorithm at the i-th time monitoring point, i represents the number of each time monitoring point, , t represents the total number of time monitoring points, represents the nth resource consumption of the rth target algorithm at the i-th time monitoring point, where n represents the number of each resource. ,, represents the data throughput of the rth target algorithm at the i-th time monitoring point, represents the critical encryption speed, represents the critical consumption of the nth resource, represents the critical data throughput, Indicates the algorithm performance impact factor corresponding to the preset encryption speed, Indicates the algorithm performance impact factor corresponding to the preset resource consumption, Indicates the algorithm performance impact factor corresponding to the preset data throughput.

[0036] It should be understood that, from the above formula, the greater the encryption speed and data throughput of the target algorithm and the smaller the resource consumption, the greater the corresponding performance evaluation index of the target algorithm, indicating that the target algorithm has better performance on the encryption system.

[0037] It should be explained that in this embodiment It is the algorithm performance impact factor corresponding to the preset encryption speed, which represents the degree of influence of the unit value of the encryption speed on the target algorithm in the system operation performance. When used, the algorithm performance impact factor corresponding to the encryption speed can be directly obtained from the data encryption database, and the corresponding relationship can be a preset mapping relationship. For example, the encryption speed of the target algorithm at the current time point and the algorithm performance impact factor corresponding to the encryption speed preset in the data encryption database form a mapping set, and the real-time encryption speed is input into the mapping set to obtain the algorithm performance impact factor corresponding to the encryption speed. The mapping relationship can be one-to-one or many-to-one.

[0038] It should be explained that in this embodiment It is the algorithm performance impact factor corresponding to the preset resource consumption, which represents the degree of influence of the unit value of resource consumption on the target algorithm in the system operation performance. When used, the algorithm performance impact factor corresponding to the resource consumption can be directly obtained from the data encryption database, and the corresponding relationship can be a preset mapping relationship. For example, the resource consumption of the target algorithm at the current time point and the algorithm performance impact factor corresponding to the resource consumption preset in the data encryption database form a mapping set, and the real-time resource consumption is input into the mapping set to obtain the algorithm performance impact factor corresponding to the resource consumption. The mapping relationship can be one-to-one or many-to-one.

[0039] It should be explained that in this embodiment It is the algorithm performance impact factor corresponding to the preset data throughput, which represents the degree of influence of the unit value of data throughput on the target algorithm in the system operation performance. When used, the algorithm performance impact factor corresponding to the data throughput can be directly obtained from the data encryption database, and the corresponding relationship can be a preset mapping relationship. For example, the data throughput of the target algorithm at the current time point and the algorithm performance impact factor corresponding to the data throughput preset in the data encryption database form a mapping set, and the real-time data throughput is input into the mapping set to obtain the algorithm performance impact factor corresponding to the data throughput. The mapping relationship can be one-to-one or many-to-one.

[0040] It should be explained that the above impact factors are all extracted from the data encryption database, and the value range is between 0 and 1.

[0041] It should be explained that during the data encryption process, the encryption speed can be directly measured through special performance testing tools or software. These tools can usually record the time required for the encryption operation from start to finish, and calculate the encryption speed based on this. System monitoring tools (such as Performance Monitor, Resource Manager, etc.) can be used to monitor the consumption of resources such as CPU, memory, disk, etc. during the data encryption process. These tools can display resource usage in real time and generate reports for subsequent analysis. You can also use professional performance analysis tools (such as Profiler) to deeply analyze the resource consumption during the data encryption process. These tools can provide more detailed and accurate resource consumption data. When data encryption involves network transmission, network performance testing tools (such as Wireshark, Netperf, etc.) can be used to measure data throughput. These tools can capture network data packets and calculate the data transmission rate.

[0042] It should be explained that encryption speed is one of the important indicators for measuring the performance of encryption algorithms. Encryption speed refers to the amount of data encrypted per second, and the amount of data is measured in megabits. The better the performance of an encryption algorithm or system, the faster its encryption speed is usually. This means that more data can be encrypted in the same amount of time, or the same amount of data can be encrypted in a shorter time. The improvement of encryption speed is particularly important for application scenarios that need to process large amounts of data or require fast responses. In many cases, encryption algorithms or systems with better performance can use resources more efficiently, thereby reducing unnecessary resource consumption. The better the performance of an encryption algorithm or system, the higher its data throughput is usually. Data throughput refers to the amount of data that a system can process per unit time, which directly reflects the speed and efficiency of the system in processing data. Therefore, when the performance of an encryption algorithm or system is improved, they can process more data faster, thereby increasing data throughput. Therefore, when evaluating the performance of an encryption system, it is necessary to comprehensively consider various factors to improve the accuracy and comprehensiveness of the evaluation.

[0043] It should be understood that the above embodiment can intuitively understand the processing efficiency of the algorithm at different stages by monitoring the encryption speed at different time points. Extracting the critical encryption speed helps to determine the fastest processing speed of the algorithm under specific conditions, and provides a quantitative basis for the performance optimization of the algorithm. Resource consumption includes CPU resources, memory resources, disk resources and network IO resource consumption. Monitoring and extracting the critical consumption of each resource can clearly reflect the occupation of system resources by the algorithm during operation, and help evaluate the resource efficiency of the algorithm. Data throughput is a key indicator for measuring the processing power of the system. By monitoring and extracting the critical data throughput, the ability of the algorithm to process data per unit time can be evaluated, providing a basis for the expansion and upgrade of the system. When comparing multiple target algorithms, the above evaluation indicators can be used as objective evaluation criteria. By comparing the critical encryption speed, critical resource consumption and critical data throughput of different algorithms, the advantages and disadvantages of each algorithm can be intuitively seen, so as to select the algorithm that best suits the current application scenario.

[0044] Furthermore, the performance evaluation index and security evaluation index of each target algorithm obtained through processing also include: extracting the critical number of brute force cracking times, critical successful cracking time and critical number of vulnerabilities from the data encryption database based on the number of brute force cracking attempts on each target algorithm and the time required for successful cracking and the number of vulnerabilities in the encryption operation cycle, and obtaining the security evaluation index of each target algorithm through comprehensive analysis. The security evaluation index of each target algorithm is used to quantitatively evaluate the security level of each target algorithm, providing a basis for evaluating the comprehensive energy efficiency of each target algorithm.

[0045] In a specific embodiment, the numerical expression of the security evaluation index of each target algorithm is: ; In the formula, represents the security evaluation index of the rth target algorithm, Indicates the number of brute force attacks on the rth target algorithm, represents the number of vulnerabilities of the rth target algorithm in the encryption operation cycle, It represents the time required to successfully crack the r-th target algorithm by brute force. Indicates the critical number of brute force cracking. Indicates the number of critical vulnerabilities, Indicates the critical successful cracking time, Indicates the algorithm security impact factor corresponding to the preset number of brute force cracking times, Indicates the algorithm security impact factor corresponding to the preset successful cracking time, Indicates the algorithm security impact factor corresponding to the preset number of vulnerabilities.

[0046] It should be understood that, from the above embodiments, the more times the target algorithm is brute-force cracked, the longer the time required for successful cracking, and the smaller the number of vulnerabilities of the target algorithm, the greater the corresponding security assessment index of the target algorithm, indicating that the encryption security performance of the target algorithm is better.

[0047] Table 1 Data example of the safety evaluation index of the target algorithm

[0048] In a specific embodiment, the critical number of brute force cracking attempts is set to 1,000,000 times, the critical successful cracking time is set to 60 seconds, the critical number of vulnerabilities is set to 5, the algorithm security impact factor corresponding to the number of brute force cracking attempts is set to 0.5, the algorithm security impact factor corresponding to the successful cracking time is set to 0.3, and the algorithm security impact factor corresponding to the number of vulnerabilities is set to 0.2.

[0049] It should be explained that in this embodiment It is the algorithm security impact factor corresponding to the preset number of brute force cracking times, which represents the numerical value of the degree of influence of the number of brute force cracking times on the security of the target algorithm. When used, the algorithm security impact factor corresponding to the number of brute force cracking times can be directly obtained from the data encryption database, and the corresponding relationship can be a preset mapping relationship. For example, the number of brute force cracking times of the target algorithm and the algorithm security impact factor corresponding to the preset number of brute force cracking times in the data encryption database form a mapping set, and the real-time brute force cracking times are input into the mapping set to obtain the algorithm security impact factor corresponding to the brute force cracking times. The mapping relationship can be one-to-one or many-to-one.

[0050] It should be explained that in this embodiment It is the algorithm security impact factor corresponding to the preset successful cracking time, which represents the numerical value of the impact degree of the successful cracking time on the security of the target algorithm. When used, the algorithm security impact factor corresponding to the successful cracking time can be directly obtained from the data encryption database, and the corresponding relationship can be a preset mapping relationship. For example, the successful cracking time of brute force cracking of the target algorithm and the algorithm security impact factor corresponding to the successful cracking time preset in the data encryption database form a mapping set, and the real-time successful cracking time is input into the mapping set to obtain the algorithm security impact factor corresponding to the successful cracking time. The mapping relationship can be one-to-one or many-to-one.

[0051] It should be explained that in this embodiment The algorithm security impact factor corresponding to the preset number of vulnerabilities is a numerical value indicating the degree of impact of the number of vulnerabilities on the security of the target algorithm. When used, the algorithm security impact factor corresponding to the number of vulnerabilities can be directly obtained from the data encryption database, and the corresponding relationship can be a preset mapping relationship. For example, the number of vulnerabilities of the target algorithm and the algorithm security impact factor corresponding to the preset number of vulnerabilities in the data encryption database form a mapping set, and the real-time number of vulnerabilities is input into the mapping set to obtain the algorithm security impact factor corresponding to the number of vulnerabilities. The mapping relationship can be one-to-one or many-to-one.

[0052] It should be explained that the above impact factors are all extracted from the data encryption database, and the value range is between 0 and 1.

[0053] It should be explained that the number of brute force cracking attempts refers to the number of times all possible password combinations are tried, which depends on the complexity and length of the password. In theory, any password can be found through brute force cracking, it is just a matter of time. The longer and more complex the password is, the more attempts are required for brute force cracking, and the higher the security is. The number of brute force cracking attempts is usually calculated based on the complexity of the password (including character type, length, etc.). For example, a 6-digit password consisting entirely of numbers may have 1 million combinations, which means 1 million attempts are required. The time required for successful cracking is directly related to the number of brute force cracking attempts, and is also affected by computing resources (such as CPU and GPU). As the complexity of the password increases, the cracking time increases exponentially. The time required for successful password cracking can be obtained through simulation experiments. For example, using a cluster for cracking, billions of attacks can be carried out per second, so as to calculate the approximate time required to crack a specific password. The number of vulnerabilities in the encryption operation cycle refers to the number of defects or weaknesses in the encryption algorithm itself that are discovered during the cycle. These vulnerabilities may be exploited by attackers to bypass encryption protection and directly obtain plaintext information. The number of vulnerabilities is usually obtained through security research, vulnerability disclosure platforms or professional security testing. Vulnerabilities should be minimized as much as possible during the design and implementation of encryption algorithms, and security audits and updates should be conducted regularly.

[0054] The basic characteristic data of the data to be encrypted is obtained, and the data requirement performance parameters and data requirement security parameters of the data to be encrypted are obtained after processing.

[0055] Specifically, the basic characteristic data of the data to be encrypted includes byte length and basic security requirement data.

[0056] The basic security requirement data specifically includes the number of systems that are allowed to access the data to be encrypted and the historical cumulative number of accesses.

[0057] It is important to explain that the size of the data directly affects the complexity and time required for encryption operations. Larger data sets generally require more computing resources to complete the encryption process. Large files or data streams may require the use of more efficient encryption algorithms or hardware acceleration technology to increase encryption speed.

[0058] It should be understood that the above embodiment can quantify the ability of the algorithm to resist brute force cracking by recording the number of brute force cracking and the time required for successful cracking. The critical number of brute force cracking and the critical successful cracking time provide the security performance boundary of the algorithm under extreme conditions, which helps to evaluate the performance of the algorithm when facing high-intensity attacks. At the same time, monitoring the number of vulnerabilities in the encryption operation cycle and extracting the critical number of vulnerabilities can reflect the security weaknesses that may exist in the algorithm during implementation and deployment. This helps to identify and repair potential security vulnerabilities in a timely manner and improve the overall security of the algorithm. Based on the security assessment index, targeted security reinforcement strategies can be formulated. For example, for algorithms that are easily cracked by brute force, measures such as increasing password complexity and limiting the number of login attempts can be taken to improve their security; for algorithms with more vulnerabilities, code review and vulnerability repair work are required. The above embodiment can more accurately evaluate the security risks of algorithms in different application scenarios through quantitative evaluation of algorithm security. This helps enterprises and organizations to fully consider security factors when making business decisions and avoid serious consequences such as data leakage and system control caused by insufficient algorithm security. In the process of algorithm design and optimization, it is often necessary to make a trade-off between performance and security.

[0059] Furthermore, the data requirement performance parameters and data requirement security parameters of the data to be encrypted are obtained after processing. The specific process is: according to the byte length of the data to be encrypted, the data requirement performance parameters corresponding to the byte length interval are extracted from the data encryption database. The data requirement performance parameters of the data to be encrypted are used to quantitatively evaluate the performance requirements of the data to be encrypted for the encryption system, and provide a basis for evaluating the comprehensive energy efficiency evaluation indicators of each target algorithm.

[0060] It should be understood that the larger the byte length of the data to be encrypted, the larger the corresponding data requirement performance parameter of the data to be encrypted.

[0061] According to the number of systems allowed to access the data to be encrypted and the historical cumulative number of accesses, the critical number of systems allowed to access the data and the critical historical cumulative number of accesses are extracted from the data encryption database, and the data requirement security parameters of the data to be encrypted are obtained through comprehensive analysis. The data requirement security parameters of the data to be encrypted are used to quantitatively evaluate the security of the data to be encrypted, and provide a basis for evaluating the comprehensive energy efficiency evaluation indicators of each target algorithm.

[0062] It should be explained that in this embodiment, the number of systems allowed to access the data to be encrypted refers to the number of systems or applications that are authorized to access the data to be encrypted. This number is usually set by the data owner or administrator according to business needs and security policies. The purpose is to limit the access scope of the data and ensure that only authorized systems or applications can access sensitive data, thereby improving the security and confidentiality of the data. This can be achieved through methods such as data access control policies, access control lists, or role-based access control. The historical cumulative number of accesses to the data to be encrypted refers to the total number of times the encrypted data has been accessed by different systems, applications, or users since the creation or setting of access rights. This indicator reflects the popularity, frequency of use, and potential security risks of the data. The purpose is to help the data owner or administrator understand the access to the data, evaluate the security status of the data, and adjust the access control policy or strengthen data protection measures accordingly. The historical cumulative number of accesses is usually counted through logging, monitoring tools, or data analysis platforms. These tools can record information such as the time, source, and operation type of each access, and generate corresponding reports or charts for analysis.

[0063] In a specific embodiment, the numerical expression of the data security requirement parameter of the data to be encrypted is: ; In the formula, represents the data security parameter required for the data to be encrypted, e represents a natural constant, Indicates the number of systems that are allowed to access the data to be encrypted. Indicates the historical cumulative number of accesses to the data to be encrypted. Indicates the critical number of allowed access systems. Indicates the critical history cumulative access times, Indicates the security impact factor of the encrypted data required corresponding to the preset number of allowed access systems, Indicates the security impact factor of the data to be encrypted corresponding to the preset historical cumulative number of accesses.

[0064] It should be understood that, the more systems are allowed to access the data to be encrypted and the fewer the historical cumulative access times of the data to be encrypted, the greater the corresponding data requirement security parameter of the data to be encrypted, indicating that the data security of the data to be encrypted is better.

[0065] In a specific embodiment, the critical number of systems allowed to access is set to 10, the critical historical cumulative number of accesses is set to 100 times, the security impact factor of the data to be encrypted corresponding to the number of systems allowed to access is set to 0.5, and the security impact factor of the data to be encrypted corresponding to the historical cumulative number of accesses is set to 0.5.

[0066] It should be understood that if Figure 2 As shown, curve a represents the relationship between the corresponding historical cumulative number of accesses to the data to be encrypted and the data requirement security parameter of the data to be encrypted when the number of systems allowed to access the data to be encrypted is 5, curve b represents the relationship between the corresponding historical cumulative number of accesses to the data to be encrypted and the data requirement security parameter of the data to be encrypted when the number of systems allowed to access the data to be encrypted is 15, and curve c represents the relationship between the corresponding historical cumulative number of accesses to the data to be encrypted and the data requirement security parameter of the data to be encrypted when the number of systems allowed to access the data to be encrypted is 25.

[0067] It should be explained that in this embodiment It is the security impact factor of the data to be encrypted corresponding to the preset number of allowed access systems, which represents the numerical value of the impact degree of the number of allowed access systems on the security of the data to be encrypted. When used, the security impact factor of the data to be encrypted corresponding to the number of allowed access systems can be directly obtained from the data encryption database, and the corresponding relationship can be a preset mapping relationship. For example, the number of allowed access systems for the data to be encrypted and the security impact factor of the data to be encrypted corresponding to the preset number of allowed access systems in the data encryption database form a mapping set, and the real-time number of allowed access systems is input into the mapping set to obtain the security impact factor of the data to be encrypted corresponding to the number of allowed access systems. The mapping relationship can be one-to-one or many-to-one.

[0068] It should be explained that in this embodiment It is the security impact factor of the data to be encrypted corresponding to the preset historical cumulative number of accesses, which represents the numerical value of the degree of influence of the historical cumulative number of accesses on the security of the data to be encrypted. When used, the security impact factor of the data to be encrypted corresponding to the historical cumulative number of accesses can be directly obtained from the data encryption database, and the corresponding relationship can be a preset mapping relationship. For example, the historical cumulative number of accesses to the data to be encrypted and the security impact factor of the data to be encrypted corresponding to the historical cumulative number of accesses preset in the data encryption database form a mapping set, and the real-time historical cumulative number of accesses is input into the mapping set to obtain the security impact factor of the data to be encrypted corresponding to the historical cumulative number of accesses. The mapping relationship can be one-to-one or many-to-one.

[0069] It should be explained that the above impact factors are all extracted from the data encryption database, and the value range is between 0 and 1.

[0070] It should be explained that in most data management systems, there is an access control list or similar mechanism to define which systems or users have access to specific data. By querying this list, you can get the number of systems that have access to the data to be encrypted. Similar to the query of the access control list, log files are also an important source for obtaining historical access records. By analyzing the log files, you can count the cumulative number of times the data to be encrypted has been accessed in the past period of time. There are many third-party website traffic and access analysis tools on the market (such as Google Analytics, StatCounter, etc.), which usually provide rich data analysis and reporting functions. If the access records of the data to be encrypted are captured by these tools, then these tools can be used to obtain the historical cumulative number of accesses.

[0071] According to the data requirement performance parameters and data requirement security parameters of the data to be encrypted and the performance evaluation index and security evaluation index of each target algorithm, a comprehensive analysis is performed to obtain the comprehensive energy efficiency evaluation index of each target algorithm. Encryption algorithms are screened according to the comprehensive energy efficiency evaluation index of each target algorithm, and the screening results are obtained and fed back.

[0072] Specifically, the comprehensive analysis obtains the comprehensive energy efficiency evaluation index of each target algorithm. The specific analysis process is: according to the data requirement performance parameters and data requirement security parameters of the data to be encrypted and the performance evaluation index and security evaluation index of each target algorithm, the comprehensive energy efficiency evaluation index of each target algorithm is obtained through comprehensive analysis. The comprehensive energy efficiency evaluation index of each target algorithm is used to quantitatively evaluate the comprehensive energy efficiency of each target algorithm.

[0073] In a specific embodiment, the numerical expression of the comprehensive energy efficiency evaluation index of each target algorithm is: ; In the formula, represents the comprehensive energy efficiency evaluation index of the rth target algorithm, represents the performance evaluation index of the rth target algorithm, represents the security evaluation index of the rth target algorithm, represents the data requirement performance parameter of the data to be encrypted, The data security parameter that represents the data to be encrypted.

[0074] It should be understood that in this embodiment, when the performance evaluation index of the target algorithm and the security evaluation index of the target algorithm are larger, the corresponding comprehensive energy efficiency evaluation index of the target algorithm is larger, indicating that the comprehensive energy efficiency of the target algorithm is better. The data requirement performance parameter and data requirement security parameter of the data to be encrypted respectively represent the degree of influence of the performance evaluation index and security evaluation index of the target algorithm on the comprehensive energy efficiency evaluation index of the target algorithm, which is equivalent to the role of the weight factor.

[0075] It should be explained that the above embodiments can ensure that the selected algorithm can meet the requirements of the actual application scenario in terms of performance by analyzing the data demand performance parameters such as processing speed and throughput of the data to be encrypted. This avoids system bottlenecks or delays caused by insufficient algorithm performance. Similarly, by analyzing the data demand security parameters, it can be ensured that the selected algorithm meets or exceeds the expected security standards in terms of security. This helps to protect sensitive data from unauthorized access and leakage risks. Taking into account the performance and security evaluation index of the algorithm, an algorithm that is more efficient in resource utilization can be selected. This helps to reduce the waste of system resources and improve overall efficiency and response speed. On the premise of meeting performance and security requirements, selecting an algorithm with a higher comprehensive energy efficiency evaluation index helps to reduce the cost of system construction and operation and maintenance. This includes hardware investment, energy consumption, labor costs and other aspects. By selecting the most suitable algorithm through comprehensive evaluation, the risk of system failure caused by algorithm defects or deficiencies can be reduced. This helps to improve the stability and reliability of the system and ensure business continuity and data integrity. Good system stability and reliability can improve user experience. The comprehensive energy efficiency evaluation index can be used as a reference for algorithm optimization and improvement. By continuously iterating and optimizing the algorithm, its comprehensive energy efficiency evaluation index can be improved to meet higher-level needs and challenges. The comprehensive energy efficiency evaluation index also provides an objective and comprehensive reference for decision makers. This helps decision makers to more accurately judge the pros and cons of each target algorithm and make more scientific and reasonable decisions.

[0076] Furthermore, the encryption algorithms are screened according to the comprehensive energy efficiency evaluation indicators of each target algorithm, the screening results are obtained and feedback is provided, and the specific screening process is: the comprehensive energy efficiency evaluation indicators of each target algorithm are sorted in ascending order to obtain a comprehensive energy efficiency evaluation indicator sequence of each target algorithm, the target algorithm with the largest comprehensive energy efficiency evaluation indicator among each target algorithm is extracted, and it is marked as the optimal algorithm of the test system.

[0077] The second aspect of the present invention provides a device for a network security protection encryption method, characterized in that it includes: a processor and a memory and a network interface connected to the processor; the network interface is connected to a non-volatile memory in a server; when the processor is running, it calls a computer program from the non-volatile memory through the network interface, and runs the computer program through the memory to execute the above method.

[0078] In a specific embodiment, the data encryption database is used to store relevant data in the data encryption process, including critical encryption speed, critical consumption of each resource and critical data throughput, algorithm security impact factor corresponding to the number of brute force cracking, algorithm security impact factor corresponding to the successful cracking time and algorithm security impact factor corresponding to the number of vulnerabilities, etc. The data extracted from the data encryption database in the above embodiment can be searched for encrypted data through searchable encryption technology, accessed through identity authentication and access control mechanisms, and plaintext data obtained through the decryption process. In addition, cloud database services and third-party encryption tools can also be used to simplify the storage, search and access process of encrypted data.

[0079] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A network security protection encryption method, characterized in that: include: Obtain the data to be tested and the encryption algorithm, mark them as target algorithms, and use the target algorithms to encrypt and decrypt the data to be tested, collect the test data of the target algorithms, including performance data and security data, and obtain the performance evaluation index and security evaluation index of the target algorithms after processing; Obtain basic characteristic data of the data to be encrypted, and obtain data requirement performance parameters and data requirement security parameters of the data to be encrypted after processing; According to the data requirement performance parameters and data requirement security parameters of the data to be encrypted and the performance evaluation index and security evaluation index of each target algorithm, a comprehensive analysis is performed to obtain the comprehensive energy efficiency evaluation index of each target algorithm. Encryption algorithms are screened according to the comprehensive energy efficiency evaluation index of each target algorithm, and the screening results are obtained and fed back.

2. According to claim 1, a network security protection encryption method is characterized by: The test data of each target algorithm is collected, including performance data and security data, and the specific process is as follows: Deploy several time monitoring points to collect test data during the period when each target algorithm performs encryption and decryption operations on the test data, including performance data and security data; The performance data includes the encryption speed at each time monitoring point in the encryption operation cycle, the resource consumption in the encryption operation cycle and the data throughput, wherein the resource consumption in the encryption operation cycle includes the CPU usage rate, memory occupancy rate, disk occupancy rate and network IO occupancy rate; The security data includes the number of brute force cracking attempts on each target algorithm and the time required for successful cracking, as well as the number of loopholes in the encryption operation cycle.

3. According to claim 2, a network security protection encryption method is characterized in that: The performance evaluation index and security evaluation index of each target algorithm obtained through processing specifically include: According to the encryption speed, resource consumption and data throughput at each time monitoring point in the encryption operation cycle, the critical encryption speed, the critical consumption of each resource and the critical data throughput are extracted from the data encryption database, and the performance evaluation index of each target algorithm is obtained by comprehensive analysis. The performance evaluation index of each target algorithm is used to quantitatively evaluate the performance of each target algorithm, providing a basis for evaluating the comprehensive energy efficiency of each target algorithm.

4. According to claim 2, a network security protection encryption method is characterized by: The performance evaluation index and the safety evaluation index of each target algorithm obtained through processing also include: According to the number of brute force cracking attempts on each target algorithm, the time required for successful cracking, and the number of vulnerabilities in the encryption operation cycle, the critical number of brute force cracking attempts, the critical successful cracking time, and the critical number of vulnerabilities are extracted from the data encryption database, and a comprehensive analysis is performed to obtain the security assessment index of each target algorithm. The security assessment index of each target algorithm is used to quantitatively evaluate the security level of each target algorithm, providing a basis for evaluating the comprehensive energy efficiency of each target algorithm.

5. According to claim 1, a network security protection encryption method is characterized by: The basic characteristic data of the data to be encrypted, including byte length and basic security requirement data; The basic security requirement data specifically includes the number of systems that are allowed to access the data to be encrypted and the historical cumulative number of accesses.

6. A network security protection encryption method according to claim 5, characterized in that: The data requirement performance parameters and data requirement security parameters of the data to be encrypted are obtained through processing, and the specific process is: According to the byte length of the data to be encrypted, the data requirement performance parameter corresponding to the byte length interval is extracted from the data encryption database. The data requirement performance parameter of the data to be encrypted is used to quantitatively evaluate the performance requirement of the encryption system for the data to be encrypted, and provide a basis for evaluating the comprehensive energy efficiency evaluation index of each target algorithm; According to the number of systems allowed to access the data to be encrypted and the historical cumulative number of accesses, the critical number of systems allowed to access the data and the critical historical cumulative number of accesses are extracted from the data encryption database, and the data requirement security parameters of the data to be encrypted are obtained through comprehensive analysis. The data requirement security parameters of the data to be encrypted are used to quantitatively evaluate the security of the data to be encrypted, and provide a basis for evaluating the comprehensive energy efficiency evaluation indicators of each target algorithm.

7. A network security protection encryption method according to claim 6, characterized in that: The comprehensive analysis obtains the comprehensive energy efficiency evaluation index of each target algorithm. The specific analysis process is as follows: According to the data requirement performance parameters and data requirement security parameters of the data to be encrypted and the performance evaluation index and security evaluation index of each target algorithm, a comprehensive analysis is performed to obtain the comprehensive energy efficiency evaluation index of each target algorithm, and the comprehensive energy efficiency evaluation index of each target algorithm is used to quantitatively evaluate the comprehensive energy efficiency of each target algorithm.

8. A network security protection encryption method according to claim 7, characterized in that: The encryption algorithm is screened according to the comprehensive energy efficiency evaluation index of each target algorithm, the screening result is obtained and feedback is given, and the specific screening process is as follows: The comprehensive energy efficiency evaluation indicators of each target algorithm are sorted in ascending order to obtain the comprehensive energy efficiency evaluation indicator sequence of each target algorithm, and the target algorithm with the largest comprehensive energy efficiency evaluation indicator among the target algorithms is extracted and marked as the optimal algorithm of the test system.

9. A network security protection encryption method according to claim 7, characterized in that: The comprehensive energy efficiency evaluation index of each target algorithm is expressed as follows: ； In the formula, represents the comprehensive energy efficiency evaluation index of the rth target algorithm, represents the performance evaluation index of the rth target algorithm, represents the security evaluation index of the rth target algorithm, represents the data requirement performance parameter of the data to be encrypted, The data security parameter that represents the data to be encrypted.

10. A device for applying a network security protection encryption method as described in any one of claims 1 to 9, characterized in that: include: Processor and memory and network interfaces connected to the processor; The network interface is connected to a non-volatile memory in the server; When running, the processor retrieves a computer program from the non-volatile memory through the network interface, and runs the computer program through the memory to execute the method described in any one of claims 1 to 9.

Images