Encryption system and method for data cross-network transmission

Abstract

The invention discloses an encryption system and method for data cross-network transmission, the encryption system comprises a basic information acquisition module and an encrypted information output module, the invention relates to the technical field of data cross-network transmission encryption, and solves the problems that the original encryption mode is too single, so that the risk of data theft exists in the data transmission process, and the data transmission efficiency is improved. In order to solve the technical problems in the prior art that the security value of a transmission network is analyzed, whether security risks exist during data transmission is analyzed by judging the security value, and repeated data of the transmission data are extracted and processed in the case of risks, so that the security of the transmission network is improved, and the security of the transmission network is improved. According to the method, encryption in different modes is carried out according to the parity of the repeated data capacity, the parity of the transmission data capacity is analyzed under the condition that no risk exists, and the transmission data is encrypted while different segmentation processing is carried out on the transmission data according to different capacity value properties; the security in the data transmission process can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data cross-network transmission encryption, and in particular to an encryption system and method for data cross-network transmission. Background Art

[0002] With the construction of informatization, when data is transmitted in batches between companies, departments, and systems, if it is transmitted in plain text, criminals may eavesdrop on the communication channel and steal the data. Encryption technology is a commonly used security and confidentiality method.

[0003] According to the patent application number CN202210430731.4, the patent includes: the first MD5 encryption of the primary key and AES encryption of other fields for the data of each institution in the institutional space and the exclusive model data of each institution in the data space; after encryption, they are fused and transmitted to the development space, and the primary key is encrypted again with MD5 after fusion; the fused data of each institution and the exclusive model data of each institution after fusion are matched according to their respective primary keys after the second MD5 encryption to obtain a matching result set; the matching result set is transmitted back to each institution in the institutional space according to the transmission channel of each institution in the institutional space; each institution restores the primary key by MD5 and decrypts the fields except the primary key by AES to obtain the exclusive model result of the institution. The present invention realizes that when multiple institutions jointly use the data in the government data space, the data is available but not visible, avoiding the risk of leakage of government data transmission.

[0004] Some existing data needs to be verified when transmitted across the network. However, when there are risks in verification, data transmission is still chosen. For such transmission, the data needs to be encrypted, but the original encryption method is too simple, resulting in the risk of data theft during the data transmission process, and its encryption security is not high. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides an encryption system and method for cross-network data transmission, which solves the problem that the original encryption method is too single, resulting in the risk of data theft during data transmission and the encryption security is not high.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: an encryption system for data transmission across networks, comprising:

[0007] A basic information acquisition unit is used to acquire basic information of a target object and transmit it to a network security judgment module, wherein the target object includes: current network, target network and transmission data, and the basic information includes: network loading speed, number of attacks, number of leaks and data capacity value;

[0008] The network security judgment module is used to obtain the basic information of the target object to be transmitted and judge the security of the current network and the target network based on the basic information and generate a judgment result, wherein the judgment result includes: a normal network signal and an abnormal network signal. At the same time, the normal network signal is transmitted to the normal network security encryption module, and the abnormal network signal is transmitted to the abnormal network security module. The specific way in which the network security judgment module generates the judgment result is as follows:

[0009] A1: The specific methods for judging network security are as follows:

[0010] S1: Get the number of attacks and leaks on the current network and record them as G and X respectively, then substitute them into the formula Calculate and obtain the protection value F of the current network;

[0011] S2: Then obtain the current maximum and minimum network loading speeds and record them as Smax and Smin respectively. At the same time, substitute the current network protection value F and the maximum and minimum loading speeds into the formula The security value Q1 of the current network is calculated, where a1 and a2 are both preset proportional coefficients, and a1+a2=1;

[0012] S3: Compare the calculated current network security value Q1 with the preset security value YS. When Q1 is YS, it means that the current network security value exceeds the preset security value and the current network is secure. On the contrary, when Q1 is less than YS, it means that the current network security value does not exceed the security value and the current network is insecure.

[0013] A2: Similarly, the current network security judgment method obtains the target network security judgment, and the data transmission security is judged by combining the current network security and the target network security. The specific judgment method is: if the current network and the target network are both safe, the system generates a normal network signal; if either the current network or the target network is unsafe, the system generates an abnormal network signal. Specifically, only when both network environments are safe does the data transmission environment mean that it is safe; when any network environment is unsafe, the system automatically determines that the data transmission environment is unsafe.

[0014] The network security anomaly encryption module is used to obtain the transmitted network anomaly signal and analyze it. By extracting and analyzing the repeated data in the transmitted data, it further encrypts the repeated data and generates corresponding encrypted information. At the same time, the encrypted information is transmitted to the encrypted information output module. The specific way in which the network security anomaly encryption module generates encrypted information is as follows:

[0015] P1: Acquire the transmission data and mark the duplicate data therein and record it as CF, extract the duplicate data CF at the same time, then perform binary conversion on the duplicate data to generate binary duplicate data CF1, then obtain the capacity value of the binary duplicate data CF1 and record it as Rc; it should be noted here that duplicate data refers to the same data in the transmission data, for example, the transmission data is digital data: 12423423 and 12353953, of which 1, 2 and 3 are duplicate data, and then mark and extract the duplicate data, waiting for subsequent processing and analysis.

[0016] P2: Then, different analysis and processing are performed according to the parity of the Rc value. The specific analysis and processing methods are as follows:

[0017] P21: When the Rc value is an odd number, the binary repeated data CF1 is obtained and processed in reverse order, and then the reverse-processed binary repeated data CF1 is converted from original data to generated processed data; it should be noted here that: if the capacity value of the transmitted data is an odd number, it is equivalent to judging the last digit of the capacity value, and the last digits of 1, 3, 5, 7 and 9 are represented as odd numbers, and then the repeated data is converted into binary numbers and processed in reverse order as a whole, and then the reverse-processed binary numbers are restored to the original data.

[0018] P22: When the value of Rc is an even number, the binary repeated data CF1 is obtained, and the binary is subjected to adjacent reduction processing to generate reduced data, and then the capacity value of the reduced data is obtained and recorded as R1, and the difference between the reduced data capacity value R1 and the binary repeated data capacity value Rc is obtained, and at the same time, the padding data of the same capacity value is generated in the order of binary 0101, and the padding data and the reduced data are recombined to generate the restored data. It should be noted here that if the capacity value of the transmitted data is an even number, it is equivalent to judging the mantissa of the capacity value, and the mantissa of 2, 4, 6, and 8 is represented as an even number, and then the same binary in the repeated data after conversion to binary is reduced.

[0019] P3: Obtain the non-duplicate data in the transmitted data and recombine it with the duplicate data to generate encrypted data. The specific method of generating the encrypted data is:

[0020] P31: Obtain duplicate data in the transmission data and label them in order and record them as j, where j=1, 2, ..., m, and then obtain all non-duplicate data in the transmission data;

[0021] P32: When the duplicate data capacity value Rc is an odd number, all non-duplicate data are processed in reverse order and recombined with the duplicate data to generate encrypted data, and the corresponding encrypted information is generated at the same time;

[0022] P33: When the duplicate data capacity value Rc is an even number, all non-duplicate data are obtained and processed in reverse order at the same time, and then the duplicate data is reorganized with the corresponding non-duplicate data in reverse order from large to small according to the label to generate encrypted data, and the corresponding encrypted information is generated at the same time. It should be noted here that the meaning of reorganizing in reverse order from large to small is that the labels of the duplicate data are numbered in ascending order according to the location at the beginning, and when reorganizing, the duplicate data is first processed in reverse order, and then filled in the original position from small to large according to the label from large to small to generate encrypted data.

[0023] The network security normal encryption module is used to obtain the transmitted network normal signal and analyze it, divide it in different ways according to the parity of the transmission data capacity value to generate corresponding segmented data, then encrypt the segmented data to generate corresponding encrypted information, and transmit the encrypted information to the encrypted information output module;

[0024] The encrypted information output module is used to obtain the transmitted encrypted information and store it.

[0025] Beneficial Effects

[0026] The present invention provides an encryption system and method for data transmission across networks. Compared with the prior art, it has the following beneficial effects:

[0027] The present invention analyzes the security value of the transmission network, judges the security value to analyze whether there is a security risk when the data is transmitted, extracts and processes the duplicate data of the transmission data in the case of risk, and encrypts it in different ways according to the parity of the duplicate data capacity; analyzes the parity of the transmission data capacity in the case of no risk, divides the transmission data differently according to the properties of different capacity values, and encrypts it at the same time. Different encryption methods can improve the security of the data transmission process. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 is a system block diagram of the present invention;

[0029] Figure 2 Figure 2 is a diagram of the method of the present invention. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] See also Figure 1 , this application provides an encryption system for data transmission across networks, including:

[0032] The basic information acquisition unit is used to acquire the basic information of the target object and transmit it to the network security judgment module, wherein the target object includes: current network, target network and transmission data, and the basic information includes: network loading speed, number of attacks, number of leaks and data capacity value.

[0033] The network security judgment module is used to obtain the basic information of the target object to be transmitted and judge the security of the current network and the target network based on the basic information and generate a judgment result, wherein the judgment result includes: a normal network signal and an abnormal network signal. At the same time, the normal network signal is transmitted to the normal network security encryption module, and the abnormal network signal is transmitted to the abnormal network security module. The specific method of generating the judgment result is as follows:

[0034] A1: The specific methods for judging network security are as follows:

[0035] S1: Get the number of attacks and leaks on the current network and record them as G and X respectively, then substitute them into the formula Calculate and obtain the protection value F of the current network;

[0036] S2: Then obtain the current maximum and minimum network loading speeds and record them as Smax and Smin respectively. At the same time, substitute the current network protection value F and the maximum and minimum loading speeds into the formula The security value Q1 of the current network is calculated, where a1 and a2 are both preset proportional coefficients, and a1+a2=1;

[0037] S3: Compare the calculated current network security value Q1 with the preset security value YS. When Q1 is equal to or less than YS, it means that the current network security value exceeds the preset security value and the current network is secure. On the contrary, when Q1 is less than YS, it means that the current network security value does not exceed the security value and the current network is not secure. Specifically, the preset security value YS is set by the operator, and the network environment is judged to be safe by comparing the security value with it.

[0038] A2: Similarly, the current network security judgment method obtains the target network security judgment, and the data transmission security is judged by combining the current network security and the target network security. The specific judgment method is: if the current network and the target network are both safe, the system generates a normal network signal; if either the current network or the target network is unsafe, the system generates an abnormal network signal. Specifically, only when both network environments are safe does the data transmission environment mean that it is safe; when any network environment is unsafe, the system automatically determines that the data transmission environment is unsafe.

[0039] The network security anomaly encryption module is used to obtain the transmitted network anomaly signal and analyze it. By extracting and analyzing the repeated data in the transmitted data, it further encrypts the repeated data and generates corresponding encrypted information. At the same time, the encrypted information is transmitted to the encrypted information output module. The specific method of generating the encrypted information is as follows:

[0040] P1: Acquire the transmission data and mark the duplicate data therein and record it as CF, extract the duplicate data CF at the same time, then perform binary conversion on the duplicate data to generate binary duplicate data CF1, then obtain the capacity value of the binary duplicate data CF1 and record it as Rc; it should be noted here that duplicate data refers to the same data in the transmission data, for example, the transmission data is digital data: 12423423 and 12353953, of which 1, 2 and 3 are duplicate data, and then mark and extract the duplicate data, waiting for subsequent processing and analysis.

[0041] P2: Then, different analysis and processing are performed according to the parity of the Rc value. The specific analysis and processing methods are as follows:

[0042] P21: When the Rc value is an odd number, the binary repeated data CF1 is obtained and processed in reverse order, and then the reverse-processed binary repeated data CF1 is converted from original data to generated processed data; it should be noted here that: if the capacity value of the transmitted data is an odd number, it is equivalent to judging the last digit of the capacity value, and the last digits of 1, 3, 5, 7 and 9 are represented as odd numbers, and then the repeated data is converted into binary numbers and processed in reverse order as a whole, and then the reverse-processed binary numbers are restored to the original data.

[0043] P22: When the value of Rc is an even number, the binary repeated data CF1 is obtained, and the binary is subjected to adjacent reduction processing to generate reduced data, and then the capacity value of the reduced data is obtained and recorded as R1, and the difference between the reduced data capacity value R1 and the binary repeated data capacity value Rc is obtained, and at the same time, padding data of equal capacity value is generated in the order of binary 0101, and the padding data and the reduced data are reorganized to generate restored data. It should be noted here that: if the capacity value of the transmitted data is an even number, it is equivalent to judging the mantissa of the capacity value, and the mantissa of 2, 4, 6, and 8 represents an even number, and then the same binary in the repeated data after conversion to binary is reduced, and 011101000 can be reduced to reduced data in the form of 0110100, and then the padding data is generated according to the capacity difference, and the generation method of the padding data is generated in the form of 0101.

[0044] P3: Obtain the non-duplicate data in the transmitted data and recombine it with the duplicate data to generate encrypted data. The specific method of generating the encrypted data is:

[0045] P31: Obtain duplicate data in the transmission data and label them in order and record them as j, where j=1, 2, ..., m, and then obtain all non-duplicate data in the transmission data;

[0046] P32: When the duplicate data capacity value Rc is an odd number, all non-duplicate data are processed in reverse order and recombined with the duplicate data to generate encrypted data, and the corresponding encrypted information is generated at the same time;

[0047] P33: When the duplicate data capacity value Rc is an even number, all non-duplicate data are obtained and processed in reverse order at the same time, and then the duplicate data is reorganized with the corresponding non-duplicate data in reverse order from large to small according to the label to generate encrypted data, and the corresponding encrypted information is generated at the same time. It should be noted here that the meaning of reorganizing in reverse order from large to small is that the labels of the duplicate data are numbered in ascending order according to the location at the beginning, and when reorganizing, the duplicate data is first processed in reverse order, and then filled in the original position from small to large according to the label from large to small to generate encrypted data.

[0048] The encrypted information output module is used to obtain the transmitted encrypted information and store it.

[0049] Embodiment 2, as Embodiment 2 of the present invention, differs from Embodiment 1 in that the network security normal encryption module obtains the network normal signal and analyzes it.

[0050] The network security normal encryption module is used to obtain the transmitted network normal signal and analyze it, and divide it in different ways according to the parity of the transmission data capacity value to generate corresponding segmented data, and then encrypt the segmented data to generate corresponding encrypted information, and transmit the encrypted information to the encrypted information output module. The specific method of generating encrypted information is as follows:

[0051] T1: Get the capacity value of the transmitted data and record it as RL. When the capacity value of the transmitted data RL is an odd number, the specific method of generating the encrypted information is as follows:

[0052] B1: Get the capacity value RL of the transmitted data and divide it into nine equal parts according to the capacity RL. At the same time, label the nine parts of the data and record them as k, where k=1, 2, ..., 9. Then, perform different encryption according to the integrity of the data:

[0053] B11: When the segmented data is complete, the number of duplicate data in a single segmented data is obtained, and the segmented data with the same number are reorganized to generate reorganized data;

[0054] B12: When the segmented data is not complete, a single segmented data is obtained and corresponding virtual data is generated, and then the virtual data and the single segmented data are recombined to generate recombined data; it should be noted here that: the virtual data is generated based on the data before segmentation, if part of the data in the first segmented data exists in the second segmented data, then virtual data corresponding to the incomplete data in the second data that originally belonged to the first segmented data is generated, and the virtual data is recombined with the first segmented data.

[0055] T2: When the transmission data capacity value RL is an even number, the specific steps of generating the encrypted information are as follows:

[0056] B2: Get the capacity value RL of the transmitted data and divide it into eight equal parts according to the capacity RL. At the same time, label the eight parts and record them as o, where o=1, 2, ..., 8. Then, perform different encryption according to the parity of the capacity of a single part of the data:

[0057] B21: When the segmented data is an odd number, two groups of single segmented data whose labels add up to 9 are obtained, and the two groups are recombined to generate corresponding recombined data;

[0058] B22: When the number of split data is an even number, two adjacent pieces of data of a single piece of split data are recombined to generate corresponding recombined data.

[0059] The encrypted information output module is used to obtain the transmitted encrypted information and store it.

[0060] Embodiment 3, as the embodiment 3 of the present invention, focuses on combining the implementation processes of embodiment 1 and embodiment 2 for implementation.

[0061] The encryption method for data transmission across a network comprises the following steps:

[0062] Step 1: Determine whether the data transmission environment is dangerous based on the security values ​​of the current network and the target network, and classify the transmission environment into normal network and abnormal network;

[0063] Step 2: Encrypt the transmission data when the network is abnormal, extract and process the repeated data of the transmission data, and encrypt it in different ways according to the parity of the repeated data capacity to obtain encrypted information;

[0064] Step 3: Encrypt the transmission data when the network is normal, analyze the parity of the transmission data capacity, and perform different segmentation processing on the transmission data according to different capacity value properties, and encrypt it to obtain encrypted information;

[0065] Step 4: Store the obtained encrypted information.

[0066] Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0067] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. An encryption system for data transmission across a network, characterized in that: include: A basic information acquisition unit is used to acquire basic information of a target object and transmit it to a network security judgment module, wherein the target object includes: current network, target network and transmission data, and the basic information includes: network loading speed, number of attacks, number of leaks and data capacity value; The network security judgment module is used to obtain the basic information of the target object to be transmitted and judge the security of the current network and the target network according to the basic information and generate a judgment result, wherein the judgment result includes: a normal network signal and an abnormal network signal. At the same time, the normal network signal is transmitted to the normal network security encryption module, and the abnormal network signal is transmitted to the abnormal network security module; The network security anomaly encryption module is used to obtain the transmitted network anomaly signal and analyze it, extract and analyze the repeated data in the transmitted data, further encrypt the repeated data and generate corresponding encrypted information, and transmit the encrypted information to the encrypted information output module; The network security normal encryption module is used to obtain the transmitted network normal signal and analyze it, divide it in different ways according to the parity of the transmission data capacity value to generate corresponding segmented data, then encrypt the segmented data to generate corresponding encrypted information, and transmit the encrypted information to the encrypted information output module; The encrypted information output module is used to obtain the transmitted encrypted information and store it.

2. The encryption system for data transmission across networks according to claim 1, characterized in that: The specific method for the network security judgment module to generate the judgment result is as follows: A1: The specific methods for judging network security are as follows: S1: Get the number of attacks and leaks on the current network and record them as G and X respectively, then substitute them into the formula Calculate and obtain the protection value F of the current network; S2: Then obtain the current maximum and minimum network loading speeds and record them as Smax and Smin respectively. At the same time, substitute the current network protection value F and the maximum and minimum loading speeds into the formula The security value Q1 of the current network is calculated, where a1 and a2 are both preset proportional coefficients, and a1+a2=1; S3: Compare the calculated current network security value Q1 with the preset security value YS. When Q1 is YS, it means that the current network security value exceeds the preset security value and the current network is secure. On the contrary, when Q1 is less than YS, it means that the current network security value does not exceed the security value and the current network is insecure. A2: Similarly, the current network security judgment method is used to obtain the target network security judgment, and the data transmission security is judged based on the current network security and the target network security. The specific judgment method is: if the current network and the target network are both secure, the system generates a normal network signal; if either the current network or the target network is unsafe, the system generates an abnormal network signal.

3. The encryption system for data transmission across networks according to claim 1, characterized in that: The specific method for the network security anomaly encryption module to generate encrypted information is as follows: P1: Get the transmitted data and mark the duplicate data therein as CF, extract the duplicate data CF, then perform binary conversion on the duplicate data to generate binary duplicate data CF1, then get the capacity value of the binary duplicate data CF1 and record it as Rc; P2: Then, different analysis and processing are performed according to the parity of the Rc value. The specific analysis and processing methods are as follows: P21: When the value of Rc is an odd number, the binary repetitive data CF1 is obtained and reverse processed, and then the reverse processed binary repetitive data CF1 is converted into original data to generate processed data; P22: When the value of Rc is an even number, the binary repeated data CF1 is obtained, and the binary is subjected to adjacent reduction processing to generate reduced data. Then, the capacity value of the reduced data is obtained and recorded as R1. The difference between the reduced data capacity value R1 and the binary repeated data capacity value Rc is obtained. At the same time, padding data of equal capacity value is generated in the order of binary 0101, and the padding data and the reduced data are recombined to generate restored data. P3: Obtain the non-duplicate data in the transmitted data and recombine it with the duplicate data to generate encrypted data. The specific method of generating the encrypted data is: P31: Obtain duplicate data in the transmission data and label them in order and record them as j, where j=1, 2, ..., m, and then obtain all non-duplicate data in the transmission data; P32: When the duplicate data capacity value Rc is an odd number, all non-duplicate data are processed in reverse order and recombined with the duplicate data to generate encrypted data, and the corresponding encrypted information is generated at the same time; P33: When the duplicate data capacity value Rc is an even number, all non-duplicate data are obtained and processed in reverse order. Then, the duplicate data are reassembled with the corresponding non-duplicate data in reverse order from large to small to generate encrypted data, and the corresponding encrypted information is generated at the same time.

4. The encryption system for data transmission across networks according to claim 1, characterized in that: The specific method for the network security normal encryption module to generate encrypted information is as follows: T1: Get the capacity value of the transmitted data and record it as RL. When the transmission data capacity value RL is an odd number, the specific method of generating the encrypted information is as follows: B1: Get the capacity value RL of the transmitted data and divide it into nine equal parts according to the capacity RL. At the same time, label the nine parts of the data and record them as k, where k=1, 2, ..., 9. Then, perform different encryption according to the integrity of the data: B11: When the segmented data is complete, the number of duplicate data in a single segmented data is obtained, and the segmented data with the same number are reorganized to generate reorganized data; B12: When the segmented data is not complete, a single segmented data is obtained and corresponding virtual data is generated, and then the virtual data and the single segmented data are recombined to generate recombined data; T2: When the transmission data capacity value RL is an even number, the specific steps of generating the encrypted information are as follows: B2: Get the capacity value RL of the transmitted data and divide it into eight equal parts according to the capacity RL. At the same time, label the eight parts and record them as o, where o=1, 2, ..., 8. Then, perform different encryption according to the parity of the capacity of a single part of the data: B21: When the segmented data is an odd number, two groups of single segmented data whose labels add up to 9 are obtained, and the two groups are recombined to generate corresponding recombined data; B22: When the number of split data is an even number, two adjacent pieces of data of a single piece of split data are recombined to generate corresponding recombined data.

5. The encryption method for cross-network data transmission according to any one of claims 1 to 4 is characterized in that: The method specifically comprises the following steps: Step 1: Determine whether the data transmission environment is dangerous based on the security values ​​of the current network and the target network, and classify the transmission environment into normal network and abnormal network; Step 2: Encrypt the transmission data when the network is abnormal, extract and process the repeated data of the transmission data, and encrypt it in different ways according to the parity of the repeated data capacity to obtain encrypted information; Step 3: Encrypt the transmission data when the network is normal, analyze the parity of the transmission data capacity, and perform different segmentation processing on the transmission data according to different capacity value properties, and encrypt it to obtain encrypted information; Step 4: Store the obtained encrypted information.

Images